Notifications
Clear all
Topic starter
02/08/2026 11:28 am
TL;DR: A compromised update to the Rust crate onering used a build.rs script to harvest Git metadata and the latest commit diff from downstream projects, then exfiltrate it through a disguised Sentry envelope, according to Aikido. Build-time execution turns a dependency into an attack path for source code theft, not just credential harvesting.
NHIMG editorial — based on content published by Aikido: Compromised Rust crate onering performs code exfiltration
Questions worth separating out
Q: What breaks when a dependency can run code during build time?
A: Build-time execution breaks the assumption that dependencies are passive.
Q: Why do build systems increase supply chain risk in software teams?
A: Build systems increase supply chain risk because they convert package trust into execution trust.
Q: What do security teams get wrong about package integrity checks?
A: They often treat package signing, version pinning, and hash verification as complete controls.
Practitioner guidance
- Inspect build scripts before promotion Block or quarantine dependencies that ship build.rs, install hooks, or other build-time executables until they are reviewed for file access, process spawning, and network calls.
- Restrict build environment egress Allow CI and developer build runners to reach only explicitly approved endpoints, and separate observability destinations from general internet access with content-aware inspection.
- Constrain repository visibility in CI Run builds with the minimum repository scope needed, and prevent build jobs from reading unrelated Git history, patches, or adjacent project data.
What's in the full article
Aikido's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact malicious build.rs logic that locates the consuming project and extracts git data.
- The full Sentry envelope structure used to disguise exfiltration as telemetry traffic.
- Indicators of compromise for version 1.4.1, including the specific endpoint and DSN artefacts.
- Aikido's detection workflow, including how the issue surfaced in its malware feed and rescanning process.
👉 Read Aikido's analysis of the compromised Rust crate onering and code exfiltration →
Rust build-time code exfiltration: what should teams change now?
Explore further
02/08/2026 12:44 pm
Build-time execution is a supply chain trust gap, not just a malware delivery method. The core failure here is the assumption that dependency installation is separate from code execution. In practice, build scripts create a privileged pathway from package trust into local repository access and outbound network egress. That means software teams need to govern dependency behavior, not merely dependency versions. Practitioners should treat build-time code as part of the security perimeter.
A question worth separating out:
Q: Who is accountable when a build dependency steals source code?
A: Accountability usually spans engineering, platform security, and supply chain governance. Engineering owns dependency selection, platform teams own build isolation and egress controls, and security owns detection and policy enforcement. For regulated environments, the question becomes whether the organisation can prove it had reasonable controls over code provenance and execution.
👉 Read our full editorial: Compromised Rust crate onering shows code exfiltration risks
