{ "@context": "https://schema.org", "@id": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-09-17-be-alert-targeted-attacks-on-prominent-rustaceans/#webpage", "@type": [ "WebPage", "ArchiveComponent" ], "articleBody": "**[Be alert: targeted attacks on prominent Rustaceans](https://blog.rust-lang.org/2026/09/17/targeted-attacks/)**. Important warning from Adam Harvey and the crates security team:\n\n> We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.\n>\n> A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).\n\nLast month this trick was used in a successful [supply chain attack against the array ref crate](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/), among others.\n\nAny piece of software that depends on open source (which is almost *every* piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.\n\nI guess our best defense right now is [dependency cooldowns](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.\n", "authors": [], "captured_at": "2026-09-18T01:14:43.309993603+00:00", "category": "programming", "content_html": "

Be alert: targeted attacks on prominent Rustaceans. Important warning from Adam Harvey and the crates security team:

\n
\n

We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.

\n

A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).

\n
\n

Last month this trick was used in a successful supply chain attack against the array ref crate, among others.

\n

Any piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.

\n

I guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.

\n", "content_markdown": "**[Be alert: targeted attacks on prominent Rustaceans](https://blog.rust-lang.org/2026/09/17/targeted-attacks/)**. Important warning from Adam Harvey and the crates security team:\n\n> We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.\n>\n> A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).\n\nLast month this trick was used in a successful [supply chain attack against the array ref crate](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/), among others.\n\nAny piece of software that depends on open source (which is almost *every* piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.\n\nI guess our best defense right now is [dependency cooldowns](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.\n", "dateCreated": "2026-09-18T01:14:43.309993603+00:00", "date_created": "2026-09-17T23:59:19+00:00", "date_modified": "2026-09-17T23:59:19+00:00", "date_published": "2026-09-17T23:59:19+00:00", "description": "Be alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to…", "external_url": "https://simonwillison.net/2026/Sep/17/targeted-attacks-on-rustaceans/", "git": { "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e", "path": "items/simonwillison-net/2026/09/2026-09-17-be-alert-targeted-attacks-on-prominent-rustaceans.md", "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/simonwillison-net/2026/09/2026-09-17-be-alert-targeted-attacks-on-prominent-rustaceans.md" }, "id": "urn:aggr:item:05ba713b82a68ea646d8de40f4f7f8a0034de5f5", "isBasedOn": { "@id": "https://simonwillison.net/2026/Sep/17/targeted-attacks-on-rustaceans/" }, "mainEntity": { "@id": "https://simonwillison.net/2026/Sep/17/targeted-attacks-on-rustaceans/", "@type": "CreativeWork", "archivedAt": { "@id": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-09-17-be-alert-targeted-attacks-on-prominent-rustaceans/#webpage" }, "dateModified": "2026-09-17T23:59:19+00:00", "datePublished": "2026-09-17T23:59:19+00:00", "headline": "Be alert: targeted attacks on prominent Rustaceans", "timeRequired": "PT1M", "url": "https://simonwillison.net/2026/Sep/17/targeted-attacks-on-rustaceans/", "wordCount": 208 }, "name": "Archived snapshot: Be alert: targeted attacks on prominent Rustaceans", "preview": null, "reading_minutes": 1, "replicated_at": null, "source": "simonwillison-net", "source_name": "Simon Willison's Weblog", "summary": "Be alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware. A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard). Last month this trick was used in a successful supply chain attack against the array ref crate, among others. Any piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software. I guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else. Tags: open-source, security, rust, supply-chain, dependency-cooldowns", "tags": [ "dependency-cooldowns", "open-source", "rust", "security", "supply-chain" ], "temporalCoverage": "2026-09-18T01:14:43.309993603+00:00", "title": "Be alert: targeted attacks on prominent Rustaceans", "url": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-09-17-be-alert-targeted-attacks-on-prominent-rustaceans/", "word_count": 208 }