cargo-crev

Rust has a culture where people don't use `unsafe` unless absolutely necessary. That is generally good enough in my experience. If you want to go further, you can disable unsafe in a crate by adding #[forbid(unsafe)]. And if you need more control than that, there's probably tooling out there that will help depending on what exactly you need. https://github.com/rustsec/rustsec/tree/main/cargo-audit https://github.com/rust-secure-code/cargo-geiger https://github.com/crev-dev/cargo-crev

Well, Deno by itself won't solve the supply chain attack problem. Crowd review might[0]. It's cute that npm/yarn/github/dependabot/renovate all warn if there's a security issue, but at that point it's a bit too late. (Better than nothing, definitely, a step in the right direction, but not a solution.) Clean reboots are always hard, usually don't work out. Just look at the Py2-Py3 transition. Also there's a Perl6 story somewhere here. (Relevant xckd[1], relevant c2 entry[2] ) [0] https://github.com/crev-dev/cargo-crev [1] https://xkcd.com/224/ [2] https://wiki.c2.com/?SecondSystemEffect

'cargo crev' makes this kind of workflow possible: https://github.com/crev-dev/cargo-crev

You don't need to read the code yourself, but ideally it should be vetted or reviewed by sources you trust. Maybe that's Debian / Ubuntu / Red Hat, or maybe it's through a review system like Rust's cargo-crev: https://github.com/crev-dev/cargo-crev Minimizing the number of dependencies helps a lot too. But don't blindly npm or pip install something unless you trust the developers. npx/pipx are even worse. All it takes is a one typo-squatter to steal your ssh keys and maybe even saved browser passwords or cookies.

A blockchain isn't needed for that. Authentication needs "crypto"graphy, but not "crypto"currency. This wouldn't be a complete thread without someone mentioning Rust, so I'll do it. cargo-crev is a nice web-of-trust type code review system for Rust crates. https://github.com/crev-dev/cargo-crev

dependabot (GitHub's free? notifier) is probably the biggest risk factor in npm supply-chain attacks. Because who audits the actual diffs? "npm-crev" can't come soon enough... https://web.crev.dev/rust-reviews/ https://github.com/crev-dev/cargo-crev