Supply chain attacks spreading from npm to Rust

A malicious Rust crate called Arrayref was found executing a build-time payload, and the HN thread's first reaction was blunt: npm ecosystem attack techniques are now migrating to Cargo. This matters because Rust has a reputation as a safer, more rigorous ecosystem, and that reputation has driven a lot of adoption in security-sensitive contexts.

The pattern here is consistent. Attackers are not targeting runtime users anymore. They are targeting build machines, CI environments, and developer workstations. The question someone raised in the thread is worth sitting with: why don't these attacks embed runtime payloads? The answer is probably that compromising a build machine gives you access to secrets, signing keys, and internal infrastructure that is worth more than any single downstream binary.

Cargo currently lacks the controls that pnpm added to allowlist install scripts. That gap is now being actively exploited. The npm ecosystem had years of this before tooling caught up. Rust is now at the beginning of that same curve.