There is some server side verification, mostly around checking that the dependencies all exist, the file isn't too large, etc. But 99% of the testing happens on the client.
Eg:
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
https://github.com/rust-lang/crates.io/blob/58e505f2abdabd6a...
In “You meant to install ripgrep”rust-lang
crates.io
Rust2014–2026
rust-lang / crates.io
crates.io
The Rust package registry
30Distinct people
39Mentions
1Explicit recommenders
3.8KGitHub stars
What to know before exploring
What it is
The Rust package registry
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
PS: I love that Mozilla uses Rust for the media-parser to boost security. But in the context of wider system engineering, there's a danger that crates.io will become another…
DyslexicAtheist used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 11:19:25 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year39 dated mentions
Observed mentions: 2014-11-20 20:55:27 UTC to 2026-10-26 08:22:53 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 8 | 2 | 6 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Homepage
| Usage Policy
| Security
| Status
| Contact
| Contributing
🦀 Overview
Welcome to the GitHub repository for crates.io, the official package registry for the Rust programming language.
crates.io serves as a central registry for sharing "crates", which are packages or libraries written in Rust that you can use to enhance your projects. This repository contains the source code and infrastructure for the crates.io website, including both frontend and backend components.
This service is maintained for you by the crates.io team, with support from the Rust Foundation. File hosting is donated by Amazon Web Services, with CDN services donated by Fastly.
🛠️ Contributing
We welcome contributions from the community! Whether you're fixing a bug, implementing a new feature, or improving documentation, your contributions help make crates.io better for everyone.
crates.io is built with Rust for the backend services. More specifically, the axum web framework and diesel for database access, with a custom-built background worker system. The frontend is a SvelteKit application written in TypeScript.
Please review our contribution guidelines before submitting your pull request. The same document also contains instructions on how to set up a local development environment, with additional structured documentation available in AGENTS.md.
🪲 Issue Tracker
If you encounter any bugs or have technical issues with crates.io, please feel free to open an issue in our issue tracker. Our team will review and address these as fast as we can.
For feature suggestions, enhancements, or general discussions about crates.io, we encourage you to utilize GitHub Discussions instead. Visit the Discussions tab to engage with the community, share your ideas, and participate in ongoing conversations. Your input is valuable in shaping the future of crates.io, and we look forward to hearing your thoughts!
☎️ Contact
For any questions or inquiries about crates.io, feel free to reach out to us via:
Zulip: #t-crates-io
Email: help@crates.io
GitHub Discussions: rust-lang/crates.io
We're here to help and eager to hear from you!
🤗 Code of Conduct
Respect and inclusivity are core values of the Rust community. Our Code of Conduct outlines the standards of behavior expected from all participants. By adhering to these guidelines, we aim to create a welcoming space where individuals from diverse backgrounds can collaborate and learn from one another. We appreciate your commitment to upholding these principles and fostering a positive community atmosphere.
If you have a Code of Conduct concern, please contact the moderators using the links in the Code of Conduct.
⚖️ License
Licensed under either of these:
Apache License, Version 2.0, (LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0)
MIT license (LICENSE-MIT or https://opensource.org/licenses/MIT)
Read the full README on GitHubWhat Hacker News says
4 sources> Never mind that this is a blatant opportunity to make supply-chain attacks. I don't know why these are treated as distinct names in crate names, and if there are any conflicting crates out there in the wild right now they should probably all be forced to rename.
crates.io already disallows crates differing only in underscore/hyphen choice. I can't easily find documentation to this effect, but users have reported it returning an error (e.g., [0]).
[0] https://github.com/rust-lang/crates.io/issues/166
In A personal list of Rust grievancesI think this guy has the right idea but may be confused about how `git` works: every repo you `git clone` is an entire copy of the repo and all of its history, completely stand alone.
You can never lose your work as long as you retain a copy of the repo. You can never lose other people's work as long as you retain a copy of their repo. `cargo` does not require crates.io, can use other registries when they come into being, and can refer to modules by file path or by `http` uri.
However, he is trying the tact of talking about how crates.io uses GH's oauth; this is a clever thing to do since it ties explicit ownership of the repo to the user. There is nothing stopping crates.io to also use other ouaths the same way, as all of the major GH alternatives also support oauth and can be used for this purpose.
Crates.io most likely doesn't want to
Read the rest
handle internal auth, as this becomes a maintenace nightmare for a 3? person team. Since the team is also small, adding other oauth->proof of repo onwership backends is presumably on their todo list but something they can't commit to.
Good news, though: https://github.com/rust-lang/crates.io (and they accept PRs)
A couple of things addressing points from different part in this thread:
- Archiving the complete history of all crates in crates.io is perfectly feasible today for an individual. Over time that might change.
- Setting up a mirror is straightforward, should you want to do so: https://github.com/rust-lang/crates.io/blob/master/docs/MIRR...
- crates.io is financed by the Rust Foundation and is at no risk of disappearing, it is a very well funded effort.
- Using cargo with an alternative repo is not difficult, requires some one-time configuration.
- Vendoring your dependencies is supported.
- cargo hits the network to look for semver compatible updated versions of your dependencies on specific moments if you don't have a Cargo.lock file.
- Not updating your dependencies stops you from getting the rug pulled from under you if an unwanted chan
Read the rest
ge happens, but it also stops you from getting any desired changes including security vulnerability fixes.
- Even if you vendor all of your dependencies, you still have to audit them the first time and every time you update them. Are you? Most aren't. Code you haven't written yourself can't be assured not to be malicious, and code you've written yourself can still have exploitable mistakes.