cargo-witness tool detects mismatches between Rust crates and their published source code

A new open-source tool called cargo-witness has been released to address a supply chain security gap in the Rust ecosystem, where published crate artifacts on crates.io are not guaranteed to match their corresponding GitHub source code. The gap was exploited in the 'onering' attack in June 2026, in which a malicious build script was injected into a published artifact without appearing in the crate's public git history. cargo-witness works by downloading the exact crate artifact, extracting it, and comparing it against the verified source commit using the strongest available anchor, such as a Trusted Publishing-attested commit or an embedded VCS info file. The tool flags specific anomalies including injected or modified build scripts, files absent from git, precompiled binaries, and checksum mismatches. It can be run as a one-time project scan, in CI mode, as a nightly daemon, or as a GitHub Action, and requires no API keys or paid services to function.