Framework
Cargo is Rust's official build system and package manager, handling dependency resolution, compilation, and publishing of crates.
Rust's nightly of 22 September 2026 stops Miri copying environment variables into the target/ directories CI jobs cache. Caches saved earlier still hold any secret a Miri step saw, so teams have to delete them and rotate those credentials.
Reality
Malicious arrayref 0.3.10 was downloaded 2,285 times from crates.io in the 86 minutes before Rust's security response team deleted it on August 20. Lockfiles still pinned to 0.3.9 kept most builds away from its unsandboxed build-script payload.
Reality
Malicious versions of three Rust crates ran code at compile time on August 20. Wiz says the infrastructure overlaps with DPRK operations, so the campaign should be treated as live.
Perspective Coverage
6 publishersReality
The Rust Security Response Team deleted proc-macro1 and arrayref 0.3.10 on August 20 after a build script fetched and launched a binary. The lure was a yank warning.
Perspective Coverage
7 publishersReality
Version 2.11 reads Cargo, uv and go.work workspaces so a Python test can be ordered behind a Rust build in one task graph. The support ships as experimental, switched on by future flags that can still change.
Reality
A developer checked npm, PyPI and crates.io for machine-readable funding data using nothing but their public APIs. npm has a declared field whose value arrives in three shapes, PyPI has hand-typed labels, and the sparse index has neither.
Reality
Since uv 0.12.0 landed on July 28, 2026, uv init has written a src layout and a uv_build build-system table by default. The old --package tip is now backwards, and --no-package is the way back to a flat main.py.
Reality
Attestation proves a package came out of the pipeline it names. When the pipeline is the thing that was owned, the seal still verifies, and a gate that only checks origin passes all 84 versions pushed on May 11.
Reality
A Rust author pins his proxy's socket exhaustion on getrandom, arriving via ring via trust-dns, and later on a single into_inner() call in his own connection pool. Only one of the two comes with a mechanism.
Reality
A blocking MCP tool call asks the client's idle timer to stay patient for four minutes. The fix that survived eleven releases is to return a readable resource as soon as the command proves it is slow.
Reality
Counting JSONTestSuite fixtures before writing any parser code turned up 19 must-reject number literals that Rust's stdlib conversions accept. That is 40% of the number cases, and the same gap opens wherever a stdlib conversion is looser than the wire format.
Reality
Wiz says the crates.io compromise executed at build time, so reviewing the library source would have caught nothing. Cargo did the rest.
Reality
Compiling any project that resolved the poisoned crate on August 20 was enough to run a credential stealer. Wiz links the infrastructure to DPRK-attributed campaigns.
Reality