The Rust Security Response Working Group and the crates.io team warned on September 17, 2026 that attackers are targeting the people who publish Rust code. The lure is a friendly video call about a job, a project, or a contract. The goal is the maintainer's machine, and through it the accounts that push packages to every project downstream.
A crate is a Rust package. crates.io is the public registry that serves those packages to anyone running cargo build. One stolen publishing account can therefore put attacker code into thousands of builds at once, without touching any of those projects directly.
How the fake offers work
The approach is patient and pleasant. "A video call is set up for something positive," the Rust advisory says. The problem starts once the call is running.
At that point the caller asks the target to fix something small. One version of the trick asks the target to install a missing audio codec. Another puts a command on the clipboard and asks the target to paste and run it. Both end the same way, with attacker-supplied code running on a maintainer's computer.
The companies behind the calls look real enough to survive a quick check. The Rust teams say the attackers register new business identities and give them plausible LinkedIn pages. Phoronix reported the same pattern on September 17, 2026, noting the warning came jointly from the security working group and the crates.io team.
Rust's post says the tactic is documented as a North Korean method, and that other developer communities have already seen it.
The thread back to arrayref
The working group suspects this campaign is not new. It links the current calls to an incident in June 2026 that also went after developers, and to the August 2026 compromise of the arrayref crate. In that case, malicious releases of arrayref, internment, and append-only-vec ran a remote payload during the build itself. Tech AI Wire covered the arrayref supply chain attack when crates.io pulled the versions.
The pattern is consistent. The registry itself is hard to attack. The humans who hold publishing rights are easier, and a job offer is a normal thing for a well-known engineer to receive.
What the Rust teams ask maintainers to do
| Action | Why it matters |
|---|---|
| Turn on multi-factor authentication | A stolen password alone then cannot publish a crate |
| Prefer call platforms you already trust | Removes the "install this to join" step the attack depends on |
| Review recent account logins | Catches a session that started somewhere you have never been |
| Report suspicious contact to the Rust or crates.io security teams | Lets the working group connect one approach to a campaign |
What this means for developers
If you maintain anything with real download numbers, treat inbound recruiting as an attack surface. Verify the company through a channel the caller did not give you, such as a website you found yourself. Never paste a command you did not write, and never install a codec, driver, or "meeting helper" to make a call work. A real employer will use a platform that already runs in your browser.
Separate the keys from the daily machine. Keep your crates.io token off the laptop you take calls on, and rotate it if that laptop ever runs something you did not expect. Hardware-backed multi-factor authentication is worth the ten minutes it takes to set up, because it survives a stolen browser session.
Consumers of crates get one practical lesson from the arrayref case: commit your Cargo.lock, and read the diff when a long-stable dependency suddenly pulls in something new. Build scripts run arbitrary code on your machine and in your CI. Pinning is the control you already have, and it costs nothing.
This article was first published on Tech AI Wire.
Also available in
Deutsch · 日本語 · Français · Español · Português
Top comments (0)