Rust's crates security team warns of an active campaign social-engineering maintainers over fake video calls
Adam Harvey and the crates security team published a warning on 17 September describing an ongoing campaign targeting rust-lang members and owners of popular crates. Attackers set up video calls under pretexts of job offers, projects or contracts, then push targets to install malicious software such as a fake audio codec, or to run commands via clipboard manipulation, with the goal of publishing malware through compromised accounts. The same technique took the arrayref crate and others in August 2026. The team's headline mitigation is dependency cooldowns, waiting several days before upgrading to new releases so the community has a window to catch supply-chain attacks. That is a concrete, adoptable policy for any lockfile-driven build.
↳ Follow the thread