Cargo

Rust package manager abuse techniques

4 techniques

Cargo automatically compiles and executes a build.rs file before building any crate that includes one. The build script runs as a native …

Malicious crates published to crates.io can exploit vulnerabilities in Cargo's archive extraction process. These attacks include symlink …

The `cargo install --git` command clones a git repository and builds its contents locally, including executing any build.rs scripts and …

Rust procedural macros (proc-macros) are compiled and executed during the compilation of any crate that depends on them. Unlike declarative …