crates.io
Ranked 4 of 9 package repositories by recommenders
The main Rust package registry, free for developers and praised for its no-overwrite policy and easy access to crates. Critics warn of GitHub login dependence and supply-chain security risks.
The main Rust package registry, free for developers and praised for its no-overwrite policy and easy access to crates. Critics warn of GitHub login dependence and supply-chain security risks.
35 people gave an opinion
- recommend it
- 17
- criticize it
- 18
- approval share
- 49%
Recommended in 9 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 17 people recommend itNeeds 10 or more, met.
- 0.9 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Easy to find and import crates
“I need a map of key ranges to values with intelligent range merging, it is right there on crates.io to import”
Comment from 4 Dec 2025 in “Programming peaked” “crates.io provides solutions for many common problems already”
Comment from 28 Dec 2025 in “Benefits of Fullstack Rust” “crates.io makes it easy to use complex data structures”
Comment from 14 Jan 2026 in “Is Rust faster than C?” - Comment from 17 Nov 2025 in “Open-source Zig book”
Team cares about security
“The good news is the people behind crates.io and the Rust ecosystem care about security.”
Comment from 12 Apr 2026 in “No one owes you supply-chain security” “They're definitely not unprepared for an incident like this.”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” Free service that benefits developers
“a small team of mostly volunteers offering a free service”
Comment from 12 Apr 2026 in “No one owes you supply-chain security” “Crate and npm are a boon for many developers.”
Comment from 10 May 2026 in “Incident CVE-2024-Yikes”
What people warn about
Each mark is one comment
Requires GitHub account to publish
“crates.io, the main crate registry, uses GitHub as its only authentication method”
Comment from 27 Dec 2025 in “Package managers keep using Git as a database, it never works out” “A Github account is required to publish crates to crates.io (this sucks if you don't want to be locked in to another Microsoft system).”
Comment from 15 Jun 2026 in “Memory safety CVEs differ between Rust and C/C++” “I hate how crates.io requires a GitHub account to publish anything.”
Comment from 24 Mar 2026 in “An Incoherent Rust” - Comment from 26 Mar 2026 in “Moving from GitHub to Codeberg, for lazy people”
Typosquatting and malicious packages
“Crates.io is an unmoderated wasteland of infinite transitive dependency chaos”
Comment from 7 Nov 2025 in “Why I love OCaml (2023)” “crates.io is completely ripe for typosquatting and package overtakes”
Comment from 19 May 2026 in “Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised” “crates.io is a glaring security risk and a looming catastrophe”
Comment from 17 Jun 2026 in “Why stdx is not on crates.io” Slow to fix known issues
“This isn't a particularly difficult problem, and other package ecosystems have solved it many times in the past.”
Comment from 25 Jun 2026 in “GitHub shouldn't be a dependency for publishing Rust on crates.io” “It was frustrating how long it took the Crates.io team (Rust manager) to address name squatting”
Comment from 1 Jun 2026 in “NPM packages from RedHat have been compromised” “They have known about the issue for a 10+ years and haven't fixed it yet”
Comment from 15 Jun 2026 in “Memory safety CVEs differ between Rust and C/C++” Weak moderation of published crates
“Crates.io is an unmoderated wasteland of infinite transitive dependency chaos”
Comment from 7 Nov 2025 in “Why I love OCaml (2023)” “I’m disappointed crates.io doesn’t have a stricter bar for serving a crate”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload”
Other package repositories people recommend
The four most recommended other package repositories, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Nixpkgs | 38 | 22 | 63% | 11 | — | — |
| Arch User Repository | 34 | 74 | 31% | 5 | — | — |
| Arch User Repository | 20 | 23 | 47% | 10 | — | — |
| crates.ioThis page | 17 | 18 | 49% | 9 | — | — |
| PyPI | 16 | 28 | 36% | 10 | — | — |
What people said
39 of the 43 comments that mention it, newest first. Each links to the original comment.
“Crater is one of the biggest benefits of crates.io being the biggest Rust package registry.”
“This is unacceptable for a mature package management system.”
“Previously published versions shouldn't just disappear from the list.”
“They're definitely not unprepared for an incident like this.”
“I’m disappointed crates.io doesn’t have a stricter bar for serving a crate”
“crates.io is arguably worse.”
“Arguably crates.io is worse.”
“You STILL need a github account to publish to crates.io.”
“They changed the policy a few years ago to disallow squatting and you can report a package as not doing anything”
“This isn't a particularly difficult problem, and other package ecosystems have solved it many times in the past.”
“the self-hosted git no longer exists. GitHub repos sit stale for decades.”
“crates.io is a glaring security risk and a looming catastrophe”
“read your organization and team membership and private Projects”
“They tied themselves to Microsoft it seems.”
“They have known about the issue for a 10+ years and haven't fixed it yet”
“A Github account is required to publish crates to crates.io (this sucks if you don't want to be locked in to another Microsoft system).”
“I can just make an account and push whatever I want.”
“It was frustrating how long it took the Crates.io team (Rust manager) to address name squatting”
“crates.io is completely ripe for typosquatting and package overtakes”
“got into the habit of yelling at people who complained about it”
“I can't get over the lack of namespacing”
“Crate and npm are a boon for many developers.”
“a small team of mostly volunteers offering a free service”
“The good news is the people behind crates.io and the Rust ecosystem care about security.”
“That crates.io is only meant to contain source code already helps, and them only allowing uploading new packages and yanking but not overwriting them also helps.”
“a number of other projects assume that you have a GitHub account”
“I hate how crates.io requires a GitHub account to publish anything.”
“crates.io makes it easy to use complex data structures”
“Until it isn't and you're swimming in a fishing net full of code you didn't write and dependencies you do not want.”
“crates.io provides solutions for many common problems already”
“they've avoided tying themselves to Github in other ways”
“crates.io, the main crate registry, uses GitHub as its only authentication method”
“Crates.io should not know about or care about my project's Git usage or lack thereof.”
“I need a map of key ranges to values with intelligent range merging, it is right there on crates.io to import”
“Centralized package managers only add a layer of obfuscation that attackers can use to their advantage.”
“when you get it easily at crates.io”
“it is really really annoying because you pretty much have to break large projects down into multiple crates”
“Crates.io is an unmoderated wasteland of infinite transitive dependency chaos”
“this is more about crates.io than Cargo, and is the biggest weakness of the language community”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.