--- title: Rust developers targeted by social engineering attacks... description: The Rust Security Response Working Group has warned of an active social engineering campaign targeting rust-lang members and maintainers of popular crates.... canonical: https://daily.dev/posts/rust-developers-targeted-by-social-engineering-attacks-aimed-at-compromising-crates-djyhqer7x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rust developers targeted by social engineering attacks aimed at compromising crates | daily.dev og:description: The Rust Security Response Working Group has warned of an active social engineering campaign targeting rust-lang members and maintainers of popular crates.... og:url: https://daily.dev/posts/rust-developers-targeted-by-social-engineering-attacks-aimed-at-compromising-crates-djyhqer7x og:image: https://api.daily.dev/og/posts/djYhqEr7X.png og:image:alt: Rust developers targeted by social engineering attacks aimed at compromising crates og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rust developers targeted by social engineering attacks aimed at compromising crates **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary The Rust Security Response Working Group has warned of an active social engineering campaign targeting rust-lang members and maintainers of popular crates. Attackers create fake company profiles on LinkedIn, offer jobs or contracts, then use video calls to trick targets into installing malware disguised as an audio codec or running malicious clipboard commands. The goal is to compromise developer accounts and devices in order to publish malware through the Rust ecosystem, a potential supply chain attack. Recommended defenses include being suspicious of unsolicited outreach, using trusted video call platforms, enabling MFA, monitoring account activity, and reporting suspicious contact to crates.io or rust-lang security teams. ## Content The Rust Security Response Working Group has issued a warning about an ongoing campaign targeting rust-lang team members and maintainers of popular crates. The attacks follow a familiar pattern. Someone reaches out cold, usually on LinkedIn, with a job offer, project proposal, or contract opportunity. The outreach looks credible - attackers build out convincing fake company profiles with enough detail to pass a quick check. If the target engages, they're invited to a video call. That's where things go wrong. During the call, victims are either prompted to install what appears to be a missing audio codec (malware) or tricked into running malicious commands copied to their clipboard. The goal is device and account compromise - specifically to get into accounts with publish access to crates.io and push malware downstream into the Rust ecosystem. The Security Response Working Group's recommendations: - Be suspicious of unsolicited outreach, especially involving video calls - Use established, trusted platforms for calls rather than unfamiliar software - Enable multi-factor authentication on all relevant accounts - Check your accounts for unexpected logins or sessions - If something feels off, contact the crates.io team or the rust-lang security team This fits a broader pattern of supply chain attacks targeting open source maintainers - the same basic playbook has been used against npm and PyPI maintainers in recent years. The fake codec trick in particular has shown up in several campaigns. Maintainers of widely-used crates are high-value targets precisely because a single compromised publish can affect thousands of downstream projects. If you've received suspicious outreach or think you may have been targeted, the rust-lang security team wants to hear about it. ## Questions this post answers ### How are attackers trying to compromise Rust crate maintainers right now? Attackers set up fake company profiles on LinkedIn and approach rust-lang members and popular crate maintainers with job, project, or contract offers. After establishing contact, they schedule video calls and use them to get targets to install malware disguised as a missing audio codec, or to run malicious commands copied from the clipboard, aiming to compromise accounts and publish malware through the Rust ecosystem. _Maintainers wary of supply chain risk can follow security incident coverage like this on daily.dev._ ### What should Rust crate maintainers do if a stranger on LinkedIn offers them a job or contract? Treat unsolicited offers, especially ones that seem too convenient, as a red flag, according to the Rust Security Response Working Group. Recommended steps include sticking to trusted video call platforms, enabling multi-factor authentication on relevant accounts, checking for unexpected login activity, and contacting the crates.io or rust-lang security teams if something feels off. _Developers guarding their accounts against social engineering can track advisories like this via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 11 comments across lobsters, hackernews (as of 2026-09-21). **TL;DR:** The discussion pivots from the immediate phishing/malware warning into a broader worry about Rust's dependency ecosystem and supply-chain risk, with some pushback that this attack pattern isn't unique to Rust. **Sentiment:** 0% positive · 25% mixed · 75% skeptical **The pushback** - The huge number of transitive dependencies and powerful build.rs scripts create a large, hard-to-audit attack surface. - Build scripts can silently run arbitrary code (including accessing SSH keys or browser cookies) at compile time, even just from opening an editor with an LSP attached. - This kind of targeted social-engineering attack isn't unique to Rust; similar campaigns have reportedly hit Ruby and Node ecosystems too. **By community** - lobsters (skeptical): Commenters use the warning as a springboard to criticize Rust's dependency sprawl and the risks of build.rs, suggesting dependency cooldowns as a mitigation. - hackernews (mixed): Some push back that this attack style isn't Rust-specific and has hit other ecosystems, while others clarify the post's intent to warn at-risk community members. **Hottest debate:** Whether the supply-chain risk highlighted is a Rust-specific problem or just a broader issue affecting all package ecosystems. **Open questions** - Is there a better architectural approach than build.rs to limit the blast radius of compromised dependencies? - How effective would dependency cooldowns actually be at catching supply-chain attacks before they spread? **Highlights** > recently, systemd-the-organisation looked at introducing rust as a part of systemd-the-init. luca boccassi, one of the senior maintainers[1] of systemd-the-both, [raised some good points about it](https://github.com/systemd/systemd/pull/43551#issuecomment-5445121831). i've stripped what i'll describe as somewhat _extreme_ exaggerations around cargo and crates.io: > [...] you have thousands upon thousands of recursive dependencies, and one getting typo-squatted or taken over is all that is needed for massive supply chain attacks [...] and all of those thousands of recursive dependencies not only brings in runtime code, but even arbitrary build time code (build.rs) that stealthly runs as your user on your machine during compilation, and thus can access your browser cookies and your ssh keys and whatever else. This not only puts final users at risk, but all developers too. i'd recommend largely ignoring the rest of the thread because it devolves into the usual byte-wasting seething from both sides ("it's a toy language for toy people", "how very dare you", "your mother was a hamster", and so forth). i've been thinking a bit lately about (further) securing one's development environment. every now and then i'm reminded of the [build.rs file](https://doc.rust-lang.org/cargo/reference/build-scripts.html)[2] and how normalised it is, even to me, and it makes me shiver a bit. all the way down there, some sub-sub-sub dependency [can be compromised](https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/) and the knock-on effect can be utterly enormous. this process can be (and is by default in every case i'm aware of) launched by simply opening your text editor with a lsp server attached, because the second thing it does is run `cargo check`. the library situation in rust is both an incredible strength (you can easily lean on the shoulders of a billion giants) and an incredible vulnerability (any one of those giants can, through intention, negligence, or simply unfortunate circumstances, cause ridiculous damage). likewise, "build scripts as a function built into the language implementation" is extremely powerful both for good and for bad. docs.rs, which provides a hosting platform for rust's `//!` doc comments, [approaches this by running the build inside a heavily restricted container](https://blog.rust-lang.org/2019/09/18/upcoming-docsrs-changes/#what-will-change). rubydoc.info recently suffered a mass attack from openai bots [exploiting this same sort of thing](https://simonwillison.net/2026/Sep/12/openai-agents-rubygems/)[3] (post courtesy of our own ~simonw). yes, makefiles and such can execute arbitrary code too, but whataboutism pointing to things invented before most people on this website were born isn't a shining argument that the current way is "just fine". i think the problem has been exacerbated by the general proliferation of the idea that you just `$toolchain add $dependency`, occasionally run `$toolchain update $dependency` if your github bot ci isn't doing that automatically for you (it _really_ shouldn't, but sadly usually does), and otherwise never again think about it in any capacity until oops, another one. let's do some quick maths on one of my own "sandbox projects", a very small web application that backs onto a postgres db: ```sh # first five lines in this particular file are # package metadata. $ tail -n +6 Cargo.toml | wc -l 25 $ cargo tree --prefix none | cut -d ' ' -f1 | sort -u | wc -l 239 ``` yum. 239 unique transient dependencies, excluding any that are the same dependency but are semver-incompatible, as cargo [collapses semver-compatible dependencies into one if their version ranges overlap](https://www.lurklurk.org/effective-rust/dep-graph.html). i'm not good enough at programming programming languages to properly identify a better path, but this isn't really ideal. some people might point to `go generate` as an example of something with a smaller blast radius[4], but `build.r > — [arcayr on lobsters · 4 points, 1 comments](https://lobste.rs/s/uz30ed/be_alert_targeted_attacks_on_prominent#c_i9tzji) > This is legitimately scary. Any piece of software that depends on open source (which is almost *every* piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software. I guess our best defense right now is [dependency cooldowns](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) - giving new package releases a few days before upgrading to them, in the hope that supply chain risks will be spotted by someone else. > — [simonw on lobsters · 1 points](https://lobste.rs/s/uz30ed/be_alert_targeted_attacks_on_prominent#c_wxjwvt) > Bit of a strange article. This is neither targeted nor limited to Rust, we've seen reports here of this happening over at Ruby and Node lately just as well, and I'm sure other ecosystems are also being attacked, just without as much noise. > — [andOlga on hackernews · 1 comments](https://news.ycombinator.com/item?id=49745076) **Source threads** - [lobsters](https://lobste.rs/s/uz30ed/be_alert_targeted_attacks_on_prominent) · 58 points · 5 comments - [hackernews](https://news.ycombinator.com/item?id=49744514) · 13 points · 6 comments ## Similar posts on daily.dev - [Be alert: targeted attacks on prominent Rustaceans](https://daily.dev/posts/be-alert-targeted-attacks-on-prominent-rustaceans-ug8iw73la) · Tech Lead Digest · 0 upvotes · 0 comments - [Supply chain nightmare: How Rust will be attacked and what we can do to mitigate the inevitable](https://daily.dev/posts/supply-chain-nightmare-how-rust-will-be-attacked-and-what-we-can-do-to-mitigate-the-inevitable-xdchrtlnw) · Hacker News · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/rust-developers-targeted-by-social-engineering-attacks-aimed-at-compromising-crates-djyhqer7x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rust developers targeted by social engineering attacks aimed at compromising crates","url":"https://daily.dev/posts/rust-developers-targeted-by-social-engineering-attacks-aimed-at-compromising-crates-djyhqer7x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rust-developers-targeted-by-social-engineering-attacks-aimed-at-compromising-crates-djyhqer7x"},"datePublished":"2026-09-17T20:06:12.269Z","dateModified":"2026-09-21T10:34:36.375Z","description":"The Rust Security Response Working Group has warned of an active social engineering campaign targeting rust-lang members and maintainers of popular crates....","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rust-developers-targeted-by-social-engineering-attacks-aimed-at-compromising-crates-djyhqer7x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,rust,malware","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Rust developers targeted by social engineering attacks aimed at compromising crates"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rust-developers-targeted-by-social-engineering-attacks-aimed-at-compromising-crates-djyhqer7x#faq","mainEntity":[{"@type":"Question","name":"How are attackers trying to compromise Rust crate maintainers right now?","acceptedAnswer":{"@type":"Answer","text":"Attackers set up fake company profiles on LinkedIn and approach rust-lang members and popular crate maintainers with job, project, or contract offers. After establishing contact, they schedule video calls and use them to get targets to install malware disguised as a missing audio codec, or to run malicious commands copied from the clipboard, aiming to compromise accounts and publish malware through the Rust ecosystem. Maintainers wary of supply chain risk can follow security incident coverage like this on daily.dev."}},{"@type":"Question","name":"What should Rust crate maintainers do if a stranger on LinkedIn offers them a job or contract?","acceptedAnswer":{"@type":"Answer","text":"Treat unsolicited offers, especially ones that seem too convenient, as a red flag, according to the Rust Security Response Working Group. Recommended steps include sticking to trusted video call platforms, enabling multi-factor authentication on relevant accounts, checking for unexpected login activity, and contacting the crates.io or rust-lang security teams if something feels off. Developers guarding their accounts against social engineering can track advisories like this via daily.dev."}}]} ```