The Rust project says maintainers are being lured into video calls that plant malware

The registry is not being attacked. The people who can publish to it are. Adam Harvey, writing for the crates.io team and the Rust security response working group, published the warning on September 17, 2026. The project believes a campaign is under way against project members and owners of popular crates, and that its goal is to take over devices and accounts and publish malware from them.

The call is the exploit

A video call is arranged around something welcome — a job, a project, a contract. During the call the target is asked to install something, in one described case a supposedly missing audio codec, or to run a command that the attacker has placed on the clipboard for them to paste. Nothing about that sequence requires a bug in any piece of software.

The setup is built to survive a quick check. The attackers register new companies that look legitimate, with plausible LinkedIn presences behind them, so a candidate who spends five minutes verifying the employer finds what they expect to find. The project notes that this attack style is known to be used by the DPRK and has been seen outside the Rust community as well.

What has already happened

This is not a hypothetical. A previous attack of the same shape targeted many prominent Rust developers in June 2026, and in August the arrayref crate was briefly compromised through similar attacks. The project states plainly that it does not currently know whether all of these are part of the same campaign.

It also does not say how many people were approached or how many accounts were actually taken. That absence is worth reading as it is written: a warning issued while an investigation is open, not a post-mortem with a count at the end of it.

• The target is a person with publish rights, not a vulnerability in the toolchain.
• Compromising one maintainer puts malicious code into every project that depends on their package.
• A briefly compromised package can be pulled, but builds that ran during the window already consumed it.
• Nothing in this depends on Rust; the same approach works against any registry with human maintainers.

What the project asks people to do

The advice is short. Treat cold outreach with suspicion. Where a call has to happen with someone new, be the one who schedules it, on a platform you already use, so the meeting does not arrive as a link with an installer behind it. Re-check the accounts that can publish: multi-factor authentication enabled, and no unexpected logins on platforms that record them. The post gives two addresses for anyone with a concern, one for registry accounts and one for everything else.

Simon Willison wrote about the warning the same day. He adds the defense that works on the consuming side rather than the maintaining side. A dependency cooldown means waiting several days before adopting a newly published release, in the hope that a supply chain attack is spotted by someone else first. It costs latency on updates and buys the only thing that helps here, which is other people's attention.