Be alert: targeted attacks on prominent Rustaceans

Blog · Watch/Read · (gathered 2026-09-23)

• An ongoing, targeted campaign is attempting to compromise prominent Rustaceans (Rust-lang members and popular crate owners) to publish malware via their accounts.
• Attackers use social engineering during video calls (e.g., for job or project opportunities) to trick targets into installing malicious software (like a fake audio codec) or executing commands, a method successfully used in a supply chain attack against the array ref crate.
• The suggested best defense against such supply chain attacks is implementing “dependency cooldowns,” allowing new package releases a few days before upgrading to them, hoping that compromises will be spotted.