Supply-Chain Security Beyond the Package Registry

The article challenges the narrative that crates.io and similar package registries bear sole responsibility for preventing supply-chain attacks. The author argues that real supply-chain security requires addressing multiple attack vectors—from typo-squatting to procedural macros with unrestricted system access—and that simple solutions like URL verification create a false sense of security. Ultimately, comprehensive security demands system-level isolation measures that go far beyond what any single registry or package manager can provide.