Rust teams advise maintainers to watch for fake video-call invitations aimed at crate owners
The crates.io and security response teams describe an ongoing campaign that targets Rust members and owners of popular crates.
The Rust crates.io team and security response working group have published a notice about an ongoing campaign aimed at Rust project members and owners of popular crates. The goal of the attackers is to compromise devices and accounts so they can publish malware.
The pattern described is a video call arranged for something that sounds positive, such as a job, a project or a contract. During the call the target is steered into installing something, for example a supposedly missing audio codec, or into running a command copied to the clipboard. The attackers use new but plausible company profiles to pass a quick check.
The post says a similar attack hit prominent Rust developers in June, and that the arrayref crate was briefly compromised through similar methods last month. The teams say they do not yet know whether these are all part of one campaign.
Maintainers are asked to be careful with cold outreach, to prefer calls on platforms they already trust, and ideally to set up the call themselves. They should also check that their accounts look normal, with MFA enabled and no unexpected logins. Concerns can go to help@crates.io for crates.io accounts or security@rust-lang.org for anything else.
Sources
Verified Oct 25, 2026 (official source). rustsecuritycrates.io