The core packages (things like rand and regex) are pretty closely audited in pra... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

nicoburns 37 days ago | parent | context | favorite | on: Malicious Rust crate Arrayref runs a build-time pa...

The core packages (things like rand and regex) are pretty closely audited in practice (albeit it might not catch a credential compromise).

This crate isn't one of them.

lyu07282 37 days ago [–]

> This crate isn't one of them.

still caught in hours though, so just as a general rule: never install anything newer than 7 days old packages

cargo feature for this is still unstable infuriatingly:

https://github.com/rust-lang/cargo/issues/17009

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact