You must log in or # to comment.
Guess it was just a matter of time.
Reminder to have minimum ages for update releases to help avoid these exact kinds of attacks. I do like 3 days which is probably overkill.
How do you set that up?
I’m not a rust user but it looks like the feature is in their unstable branch https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-ag. Also looks like someone made a crate to do that called cargo-cooldown. These supply chain attacks have been more frequent only recently so a lot of ecosystems are still working on implementing this kind of feature.
Configure your updater and use exact or semi-exact versions.
