Rust maintainers warn of targeted developer-account attacks

The Rust security and crates.io teams warn that attackers are targeting developers and crate owners with convincing job or project invitations. Attackers arrange video meetings, then use them to persuade developers to install software, such as a supposedly missing audio component, or run a command. A compromised device or account could let attackers publish malicious packages.

Rust Project · Sep 17, 2026

Why it matters

Software supply-chain defenses need to protect maintainer accounts and laptops as well as dependency manifests.

More context

The advisory recommends using familiar meeting platforms, preferably arranging the call yourself, and checking MFA and unexpected account logins. It links earlier attacks, including the arrayref compromise, while explicitly leaving their relationship uncertain. Maintainers can contact the Rust security or crates.io teams for assistance.

Keep in mind

This is an active campaign warning, not evidence that every Rust package is affected. The team has not established that all referenced incidents belong to one campaign.

Original read