Rust Crate Owners Face Recruiter-Style Account Theft
The Rust project warned that attackers are actively targeting Rust team members and popular crate owners with fake job-offer video calls, aiming to compromise developer accounts and push malicious packages. The warning connects the current activity to similar targeting in June and the arrayref crate compromise in August.
The lure is simple: a convincing company profile and interview setup, then a prompt to install software for a missing codec or paste code from the clipboard. If the maintainer runs it, the attacker can steal credentials or execute code on that account, and once the publisher account is theirs, they can ship crates that look legitimate to downstream users.
That puts the risk at the publisher trust chain, not just the endpoint. For any team that signs or publishes packages, the durable exposure is the human identity that can release software; technical controls on the build side do not stop a hijacked maintainer account from poisoning the package feed.