Malicious Rust crate Arrayref runs a build-time payload(safedep.io)
532 points by abhisek | 468 comments
SafeDep blog post analyzing a malicious version of the Rust crate arrayref that executes a payload at build time via a supply-chain attack.
#crates-io on Hacker News
5 stories tagged crates-io, newest first.
Zerostack – A Unix-inspired coding agent written in pure Rust(crates.io)
535 points by gidellav | 295 comments
crates.io page for zerostack v1.0.0, a minimal Rust coding agent CLI supporting multiple LLM providers like OpenRouter, OpenAI, Anthropic, Gemini and Ollama.
Servo is now available on crates.io(servo.org)
442 points by ffin | 140 comments
Servo project blog post announcing the v0.1.0 release of the servo crate, its first crates.io release, along with an LTS version.
Package managers keep using Git as a database, it never works out(nesbitt.io)
742 points by birdculture | 426 comments
Andrew Nesbitt's blog post arguing that package managers like Cargo repeatedly use git repositories as registry databases and run into scaling problems.
Rust’s dependencies are starting to worry me(vincents.dev)
378 points by chaosprint | 494 comments
Blog post by a Rust enthusiast expressing concern about the number and trustworthiness of dependencies pulled in from crates.io in Rust projects.