| ▲ | weinzierl 3 hours ago | |
"exactly the same software supply chain problem" While the crates ecosystem is certainly not immune to supply chain attacks this over generalization is not justified. There are several features that make crates.io more robust than npm. One of them is that vulnerable versions can be yanked without human intervention. Desperate comments from maintainers like this one[1] from just a few days ago would not happen with crates.io. There are also features not provided by crates.io that make the situation better. For example you could very easily clone the repo and run | ||