Rust 1.100 Introduces Cargo Security Cooldowns to Prevent Malicious Dependency Attacks

Rust 1.100 will introduce optional security cooldowns in Cargo, giving developers a way to delay newly published dependencies before they enter projects.

Scheduled for November 12, 2026, the release aims to give security teams and package maintainers time to spot malicious updates before automated builds pull them in.

The feature is available in beta but has not reached stable Rust. Its default waiting period remains zero, so upgrading alone will not enable protection. Teams must set a minimum package age to reduce exposure during the risky hours after a release appears.

Researchers from Socket.dev documented the malicious proc-macro1 crate behind an August compromise involving arrayref, internment, and append-only-vec.

Its build script downloaded a payload, showing how a trusted dependency can bring malware into developer systems without obvious changes to application code.

Rust 1.100 Introduces Cargo Security Cooldowns

The three compromised releases remained on crates.io for 86, 90, and 107 minutes, respectively, before removal, according to Rust security responders cited by Socket.

All disappeared within two hours, but automated updates could still reach developer machines and continuous integration systems before defenders finished checking them.

During the incident, attackers added a harmful dependency to trusted packages. Reporting on compromised Rust package releases explains how Cargo ran the malicious build script during compilation, allowing code execution before developers used the affected library.

That makes dependency selection a security decision, not simply routine maintenance. Work on the cooldown began before that attack. The tracking issue opened on May 18, and nightly Cargo gained support on June 21.

The stabilization change merged on August 28, with the feature listed for Rust 1.100 in draft release notes.

How the Waiting Period Works

Developers can enable a seven-day cooldown in .cargo/config.toml by setting global-min-publish-age = "7 days" under [registry].

Cargo accepts periods expressed in seconds, minutes, hours, days, weeks, or months. Its incompatible-publish-age rule defaults to "deny", so teams normally need no separate resolver setting.

When Cargo selects dependencies, it excludes releases younger than the chosen limit. It can select an older version that meets the project’s requirements. If none qualifies, dependency resolution fails rather than accepting a fresh release simply to complete the build.

This strict behavior addresses a specific risk: attackers could publish malware and withdraw safe versions, pushing a weaker policy toward the malicious update.

Attackers withdrew legitimate arrayref versions during the August incident. Cargo also reports skipped releases and their ages, helping developers understand blocked updates.

The approach shares a goal with GitHub’s Dependabot cooldown protection, which delays routine version updates. Cargo places the age check within dependency selection itself, rather than relying only on an update bot to hold back new releases.

Cargo preserves versions already recorded in Cargo.lock, even when they fall below the age threshold. Enabling cooldowns therefore will not remove a malicious release already locked into a project. The feature also excludes cargo install, Git dependencies, local paths, and registries without publication timestamps.

For urgent fixes, developers can run CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p some-crate --precise 1.2.3, replacing the example package and version.

This bypass applies to that command, including indirect dependencies it resolves. Once recorded in the lockfile, those versions remain usable under normal settings.

A cooldown buys time; it does not scan code or prove safety. Earlier malicious Rust logging crates stole wallet keys while keeping normal logging functions, showing why familiar behavior cannot establish trust. Malware that escapes detection can simply outlast the waiting period.

Socket also noted a September warning about attackers targeting Rust project members and crate owners through fake job and project offers. Attackers arranged video calls, then tried to persuade targets to install software or run commands.

That campaign highlights the account security problem behind poisoned releases: delaying updates does not stop criminals from stealing the access used to publish malicious code.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Rust 1.100 Introduces Cargo Security Cooldowns to Prevent Malicious Dependency Attacks appeared first on Cyber Security News.