On: Malicious Rust crate Arrayref runs a build-time payload

[kelnos]

It's interesting that you include Java in there, as I've worked on some pretty bog-standard Java code bases where the dependency tree didn't look all that different from a cargo project's.

[pjmlp → kelnos]

It starts by those that reach out for Log4J, when java.util.logging.Logger already does the job.

Guava for whatever cool reason, and so on.