Cackle blocks Rust supply-chain attacks with per-crate API whitelisting

250 indirect dependencies per project, and any one of them can turn your binary into a data siphon. David Lattimore's Cackle (cargo-acl) doesn't just audit your lockfile - it checks which crates actually use network, filesystem, or process APIs and flags those that shouldn't.

How a Rust crate turns into a backdoor Lattimore walks through a fictional but painfully realistic attack: Alex maintains a Rust tool with ~20 direct and ~250 indirect dependencies. One transitive dep, foobar, gets a new maintainer named Bob who ships an update that calls std::net::TcpStream::connect and exfiltrates a client user database. By the time Alex pins the old version, reputational damage is done. This isn't hypothetical. Python and Node.js ecosystems see supply-chain attacks regularly. Rust's crate registry is still relatively safe, but the attack surface grows with adoption.

Cackle's approach: whitelist APIs, not just versions Cackle works by defining API classes in a cackle.toml alongside Cargo.toml. You declare which crates are allowed to use "net", "fs", "process", or unsafe. Run cargo acl and it inspects the actual code references in your entire dependency tree. An example API definition:

include = exclude =
Then whitelist a specific package:

When a crate suddenly starts using std::net where it never did before, Cackle flags it as a problem. You see the change immediately, not after a breach.

Installing and bootstrapping Cackle currently supports Linux only. Install with cargo install --locked cargo-acl. It ships with a terminal UI that helps you generate an initial config by walking through your crate tree and marking which API calls are expected. The tool complements existing practices like cargo-vet, cargo-crev, and manual code review. It doesn't replace them - it catches the class of attack where a trusted crate turns malicious after passing initial review. For a project with hundreds of transitive dependencies, Cackle turns an implicit trust relationship into an explicit, auditable one. Apply it before cargo update becomes a liability.

Source: Making Rust supply chain attacks harder with Cackle (2023)
Domain: davidlattimore.github.io