Last Updated: 2026-09-18T12:35:00Z
What’s Happening
According to the Rust language security response working group, maintainers of rust-lang (the repo comprising the Rust language itself) and popular packages (crates) are being targeted by social engineering attacks intended to compromise the repository.
Per the post:
A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that’s used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).
The attackers are going as far as creating “legends” on social media to provide a plausible backstory for the fake organization they claim to represent.
This is not a new technique, even against Rust maintainers. This is what got the arrayref crate. And a prior report shows the same approach.
Actions
Don’t accept repos from strangers, kids. And if you do, definitely don’t run it outside an isolated environment. Real isolation, not OpenAI style.
We have a tool to check your exposure to infostealers, by the way.
If you’re a Rust maintainer, you’re at the mercy of the fact that GitHub authentication is a requirement for using crates.io. So your best move is to employ all the hardening techniques against that account possible. That includes strong MFA, scoped tokens, signed commits, branch protections, and trusted publishing.
