The Compiler Is Now Part of the Attack Surface

Installing a dependency feels administrative; running an application feels consequential. Modern build systems have erased that distinction. When packages can execute programs during compilation, fetching and building unfamiliar code becomes a privileged event—one that may occur before defenders ever inspect the finished binary. Compilation is execution A recent [SafeDep report](https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/) describes a malicious Rust crate using the build process to run a payload. The episode is notable not because Rust is uniquely vulnerable, but because it exposes a category error shared across software ecosystems: developers often think of builds as transformations of source code, even when those transformations include arbitrary executable logic. Rust supports build scripts and procedural macros for legitimate reasons. They can discover system libraries, generate bindings, embed assets, or transform syntax. Comparable mechanisms exist elsewhere: lifecycle scripts in JavaScript, setup hooks in Python, plugins in Java and .NET, and custom rules in general-purpose build tools. These features make ecosystems productive. They also mean a pac