carnet VS bad_actor_poc

These kinds of problems affect all software in all programming languages. At the end of the day, you have to have your build process and testing sandboxed if you can't afford to review every dependency update. Companies who have strict policies about this can host their own internal Crates.io mirror so internal projects can only rely on audited crates. For Rust, Carnet is a wrapper for Cargo which sandboxes builds with bubblewrap on Linux.

(Shameless plug) I wrote carnet exactly for this reason. It's a small bash script that isolates cargo using namespaces/cgroups. It can't normalize system time (yet?) but I always use it when I work with Rust.

I'm not suggesting people in this thread are wrong, but working for a security company gives a slightly different perspective. For example, there's really nothing stopping a rogue crate from exporting your private keys, just by using VS code. I wasn't thinking about this when I helped write that proposal, though.

Having less tools that can do things like https://github.com/lucky/bad_actor_poc is a relief.

Code execution that may not be so obvious could be the preLaunchTask that runs before starting the app and can run a build that has an extra task executing arbitrary code unrelated to the build. What about the npm module that steals your crypto wallet private keys? Make a simple edit and a malicious linter is loaded from the node_modules folder, instead of the one that is installed globally. Even reading the code can be deceptive, attackers can use Unicode hacks to hide malicious code in plain sight. Heck, you don't even have to open any source code to be owned.

https://github.com/lucky/bad_actor_poc is one example

It turns out that because Rust can execute code at compile time, simply opening a Rust source file in an editor with code completion support can cause a virus to be installed on my computer. Apparently I can't trust anything but basic text editors anymore...