Rust's security team just told maintainers the next attack starts with a job interview. the…
rust's security team just told maintainers the next attack starts with a job interview. the warning, out september 17, describes fake offers and video calls aimed at prominent rustaceans to reach crates.io accounts.
the supply chain now recruits its victims.
Context
The Rust Blog post Be alert: targeted attacks on prominent Rustaceans, dated September 17, 2026 and written by Adam Harvey for the crates.io team and security response working group, says they believe there is an ongoing campaign targeting rust-lang members and owners of popular crates to compromise devices and accounts in order to publish malware. A video call is set up for a job, a project or a contract opportunity and used to get the target to install something or run a command, with plausible company profiles. The post says a June attack targeted prominent Rust developers and that the arrayref crate was briefly compromised through similar attacks the month before. Its guidance is to be suspicious of cold outreach, set up calls on trusted platforms, re-check accounts including MFA and unexpected logins, and contact help@crates.io or security@rust-lang.org.
The post says we believe and that it does not know whether these are all part of the same campaign, so no wider threat conclusion is supported. It says the style is known to be used by the DPRK, which is the post's own wording and not an attribution of this campaign. The next attack starts with a job interview and the supply chain now recruits its victims are the author's framing.
Watch next
- A follow-up post or advisory from the Rust security team.
Sources
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 22 September 2026 at 21:03 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →