Targeted social-engineering campaign aims to compromise Rust crate maintainers

A coordinated campaign is targeting members of the Rust language community and owners of popular crates, according to a warning from Adam Harvey and the crates security team. The attackers are using social-engineering tactics—such as setting up video calls under the guise of job opportunities, projects, or contracts—to gain access to devices or accounts.

The attackers then attempt to trick targets into installing software, such as a purportedly missing audio codec, or executing commands, including via clipboard manipulation. Once compromised, these accounts or devices can be used to publish malware through legitimate package channels, enabling supply-chain attacks.

The campaign has already resulted in at least one successful attack: a supply-chain compromise of the array ref crate and others was reported last month. The incident demonstrates how attackers exploit the trust placed in maintainers and the dependency networks of widely used software.

To mitigate such risks, experts have proposed 'dependency cooldowns'—a practice of delaying upgrades to new package releases for a few days to allow time for community scrutiny and detection of malicious changes. This approach aims to reduce the window of opportunity for attackers to exploit compromised accounts or devices.