- Published on
Targeted attacks on prominent Rustaceans
- Authors
- Name
- DeepHorus
On 17 September 2026, Adam Harvey and the crates security team issued an urgent alert about targeted attacks on prominent Rustaceans and owners of popular Rust crates. The campaign is attempting to compromise devices and accounts so attackers can use them to publish malware. The warning names rust-lang members and maintainers of widely used crates as primary targets. It describes an ongoing operation rather than an isolated incident.
According to the security team, the attackers set up video calls framed as positive opportunities, such as job interviews, project collaborations, or contract offers. During these calls, they try to convince targets to install software, including a purportedly missing audio codec. In other cases, they ask the target to execute a command, for example by placing the command on the clipboard. The goal is to gain a foothold on a maintainer's machine or take over an account.
Last month, this trick was used in a successful supply chain attack against the arrayref crate, among others. That breach demonstrated that the method can produce real compromised releases in the Rust ecosystem. Rather than relying only on technical exploits, the attackers exploit human trust and the privileges attached to package publishing. The incident has raised concerns about how quickly a single compromised maintainer can affect many downstream users.
The security team emphasized that any piece of software depending on open source, which is almost every piece of software, has a network of human beings who are potential attack vectors. Everyone with publishing rights to any package in a dependency network can become an entry point for malware. This interconnectivity means that a targeted attack on one prominent Rustacean may have consequences far beyond a single project. It also highlights the difficulty of securing widely distributed open-source supply chains.
As a defense, the crates security team currently recommends dependency cooldowns. This approach gives new package releases a few days before developers upgrade to them, in the hope that supply chain attacks will be spotted by someone else first. Adam Harvey and the security team urged Rust community members to be alert to unexpected video call invitations and suspicious installation requests. They also advised maintainers to verify identities and avoid executing unknown commands.
The campaign remains ongoing, and the security team believes further attempts are likely. Rustaceans are encouraged to report suspicious contacts and to treat unsolicited opportunities with caution. Because open-source dependencies underpin nearly all modern software, the warning has implications for the broader technology industry. Stronger protections around publishing rights and human verification may be needed to reduce similar risks in the future.
