Interestingly, developers in ecosystems like Go, Rust, and those utilizing native Web APIs—where robust standard libraries drastically reduce reliance on third-party code and strict cryptographic verification is built into the core toolchain—reported zero instances of a college dropout’s weekend project wiping out global logistics infrastructure today.
As someone who’s built a career in Rust, it is 100% susceptible to an attack like this. The community is just generally paranoid enough to avoid depending on super niche packages.
Even so, Cargo still doesn’t have code signing and crates.io doesn’t have 2FA. They just barely rolled out email alerts for new crates being published with your API key.
And there’s dozens of single-author crates that are depended upon by millions of lines of code, any one of which could easily be a vector in a supply chain attack. In fact there have been attempted supply chain attacks against crates.io, but to my knowledge they’ve all relied on typo-squatting.
We’re definitely overdue for a major attack.
I guess one benefit is rust development often doesn’t use bleeding edge version for everything, where you pull the entirety of crates.io through your machine when you open your IDE. From what I’ve seen most projects use == versions and lock files.
I don’t know enough about rust though. Could an attacker change historical crate versions to a payload and then cargo pulls them because they changed? Or will cargo only pull an update if you change to a different version on your machine?
You can’t overwrite previously published versions.
Application projects are recommended to check-in the
Cargo.lockwhich pins dependency versions but you can always just runcargo updateat any time which automatically upgrades all dependencies to the newest version allowed by theCargo.toml.Some projects get around this by pinning the dependency in the
Cargo.toml(using=) or by vendoring all their dependencies, which is a huge pain in the ass.Cargo does not respect lockfiles by default, AFAIK. You need to explicitly pass the --locked flag.
When you
cargo installa binary, it ignores lockfiles. If you clone a project and build it, it respects theCargo.lockthat was checked in.
I can tell without clicking that it’s Snaps
I was wrong
You’re wrong again. It’s also snaps.
Too lazy to check, but did they parody the entire Onion article or just the headline? Lol
i was also too lazy to check, so I asked claude, it said:
The parody covers the full article structure — headline, location, opening quote, quoted speaker, closing “at press time” paragraph, and a final spokesperson quote — not just the headline
AI image in header. Didn’t read.
deleted by creator
Pebcak.
I write this as someone who fully hates npm and javascript, but it’s not even a package manager issue. The issue is that someone gets hacked and their credentials get stolen. This could happen to any ecosystem, it’s just more likely to be beneficial if you target JS because of ubiquity.
People would need to develop entirely new credential management protocols to circumvent this and they’d probably be risky to automate to the same degree of convenience that we have now so, unless you’re looking to spin up containers for each and every step of development or, god forbid, write/vendor your dependencies it’s actually not easy at all to prevent this sort of thing.
