crates-io

Socket researchers discovered TrapDoor, a supply chain attack spanning 34 packages and 384+ versions across three registries, with a novel technique that embeds hidden instructions in AI coding assistant config files to trigger credential exfiltration.

The Servo project publishes its first crates.io release, making the Rust-native browser engine available as an embeddable library with a WebView API and a six-month LTS cycle.

An audit of the world's largest open source package registries finds they spend 12 percent of their budgets fighting malware and just 2 percent on new features, with no path to sustainable security funding.