3 ms·
We do in fact see them a lot. Typically they target Python or Node because those ecosystems are much more popular than Rust. But build.rs provides exactly the s
by isityettime 5mo ago
We do in fact see them a lot. Typically they target Python or Node because those ecosystems are much more popular than Rust. But build.rs provides exactly the same opportunities to attackers for Rust.
- b40d-48b2-979e 5mo agoNo, we don't. We see build system attacks, such as injecting malicious scripts into their CI and getting malicious code into the artifact for use at runtime. You don't see someone doing a drive-by PR to a `setup.py`.
- isityettime 5mo agoNot a drive-by PR, but once a package is compromised it often does spread to its reverse-dependencies via mechanisms like setup.py at build time. There was case like this with setup.py less than two months ago: https://www.stepsecurity.io/blog/forcememo-hundreds-of-github-python-repos-compromised-via-account-takeover-and-force-push https://www.stepsecurity.io/blog/forcememo-hundreds-of-githu... Lots of npm supply chain attacks propagate at build time via post-install hooks, too.
- isityettime 5mo agoOh look, today furnished us with a new example: https://github.com/TanStack/router/issues/7383 https://github.com/TanStack/router/issues/7383