Topic starter
02/08/2026 11:28 am
TL;DR: A compromised update to the Rust crate onering used a build.rs script to harvest Git metadata and the latest commit diff from downstream projects, then exfiltrate it through a disguised Sentry envelope, according to Aikido. Build-time execution turns a dependency into an attack path for source code theft, not just credential harvesting.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “Compromised Rust crate onering performs code exfiltration”.
Key questions
Q: What breaks when a dependency can run code during build time?
A: Build-time execution breaks the assumption that dependencies are passive.
Q: Why does build-time exfiltration matter if no secrets are stolen?
A: Because source code and commit diffs are often the most valuable assets in a development pipeline.
Q: What do security teams get wrong about package ecosystem trust?
A: They often assume trusted registries and familiar maintainers are enough to validate safety.
Practitioner guidance
- Restrict build-script execution in CI Run untrusted or newly changed dependencies in isolated build environments and block build scripts from reaching repositories unless they are explicitly required.
- Review dependencies that execute during build Flag crates with build.rs files for deeper inspection, especially when the script touches git, network, or filesystem APIs.
- Monitor outbound traffic from build jobs Watch for POSTs from compilation steps to telemetry, logging, or paste-style endpoints, including legitimate services that may be abused as exfiltration channels.
Bottom line: The incident shows that a malicious dependency can turn compilation into a source-code exfiltration channel without any application call ever occurring.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:44 pm
Build-time execution is now a supply-chain exfiltration control point: the attack surface is no longer limited to application runtime. If a dependency can run code during build, it can inspect repository context before any security monitoring around the finished application begins. The practical conclusion is that build isolation, script review, and provenance checks must be part of package trust decisions.
A question worth separating out:
Q: Should teams block all build scripts to reduce supply-chain risk?
A: Not always, but they should treat build scripts as high-risk and allow them only where the dependency truly needs them. The safer pattern is to isolate builds, inspect script behaviour, and deny unnecessary network or repository access. Blanket blocking is blunt, but unreviewed execution is worse.
👉 Read our full editorial: Compromised Rust crate onering shows code exfiltration risks