Loading story…
The Rust project has warned that attackers are actively targeting prominent community members and maintainers of popular crates.io packages in an apparent effort to compromise accounts and publish malware through trusted Rust crates. The attackers use credible-looking fictitious company websites and LinkedIn profiles to approach targets with seemingly legitimate job, project, or contract opportunities and arrange video calls.
During the calls, the operators pressure targets to install a supposed missing audio codec or run commands, including commands copied through the clipboard, to gain access to devices or maintainer accounts. Rust advised maintainers to treat unsolicited outreach with skepticism, use trusted conferencing platforms, and review MFA and account-login activity; reporting has linked the tactic to prior DPRK-associated activity, including the brief compromise of the arrayref crate, though attribution for the current campaign is unconfirmed.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The crates.io team and Rust security working group issued an alert about an ongoing social-engineering campaign targeting rust-lang members and maintainers of popular crates. Attackers used credible company and LinkedIn profiles to arrange fraudulent calls, then tried to induce targets to install a purported audio codec or execute clipboard-delivered commands to compromise accounts and publish malware through crates.
The arrayref crate was briefly compromised in the month preceding the September alert through attacks described as similar to the current social-engineering activity. Rust stated it could not determine whether the incidents were part of the same campaign.
Similar attacks reportedly targeted numerous Rust developers in June, using an attack style later associated with the current activity. The source does not specify the year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign is targeting crates.io users with emails impersonating the Rust Foundation, urging recipients to log in to protect their packages. The emails originate from rustfoundation.dev, a domain not controlled by the Rust Foundation, and aim to steal GitHub credentials. There is no evidence of a compromise of crates.io infrastructure, and the Rust team is working to take down the phishing domain and monitor for suspicious activity.
Jun 29, 2026
Two malicious Rust packages, named 'faster_log' and 'async_println', were discovered on the official Crates.io repository, where they were designed to steal private keys from cryptocurrency wallets, specifically targeting Solana and Ethereum users. These packages were downloaded nearly 8,500 times before their removal, with 'faster_log' accounting for 7,200 downloads and 'async_println' for 1,200. The malicious crates impersonated the legitimate 'fast_log' crate by copying its README file, repository metadata, and maintaining the original logging functionality to avoid suspicion among developers. The attackers embedded a payload within the crates that, upon execution, scanned the victim's environment and project source files for sensitive information, including hex strings resembling Ethereum private keys, Base58 strings similar to Solana keys or addresses, and bracketed byte arrays that could contain keys or seeds. When such data was found, it was bundled with the file path and line number and exfiltrated to a hardcoded Cloudflare Worker URL, which was confirmed to be live and accepting POST requests during the investigation. The malicious activity was discovered by researchers at the code security company Socket, who promptly reported it to Crates.io. In response, Crates.io removed both packages and suspended the publishing accounts, 'rustguruman' and 'dumbnbased', on September 24th. The incident highlights the risks associated with open-source software supply chains, where attackers can leverage trusted repositories to distribute malware to unsuspecting developers. The malicious crates did not have any dependent downstream crates, which may have limited the spread of the compromise. The attack demonstrates the sophistication of threat actors in mimicking legitimate projects to evade detection and the importance of vigilant monitoring of package repositories. The use of a legitimate logging functionality within the malicious crates further reduced suspicion, allowing the packages to remain undetected for several months. The exfiltration endpoint used by the attackers was not an official Solana RPC endpoint, indicating a deliberate attempt to disguise the data theft operation. This supply chain attack underscores the need for developers to verify the authenticity of third-party packages and for repository maintainers to implement robust security controls. The incident also serves as a warning to the broader cryptocurrency and developer communities about the ongoing threat of targeted attacks seeking to compromise digital assets through software dependencies. Security researchers continue to monitor for similar threats and advise immediate removal of the affected packages from any projects.
Jun 29, 2026
A malicious Rust package named `evm-units` was discovered on Crates.io, posing as a legitimate Ethereum utility but secretly delivering cross-platform payloads to compromise developers' systems. The package, authored by 'ablerust' and downloaded over 7,000 times, was designed to appear as a genuine Uniswap helper library, returning plausible Ethereum version numbers while executing hidden malicious code. Upon invocation of the `get_evm_version()` function, the package would download and execute a payload tailored to the victim's operating system, with additional logic to evade detection by checking for the presence of Qihoo360 antivirus, a product popular in Asian markets. The malicious activity was active for approximately eight months before being swiftly removed from Crates.io following its discovery and reporting by the Socket Threat Research Team. The package's behavior suggests a focus on cryptocurrency theft, leveraging stealthy execution and targeting developers in regions where Qihoo360 is prevalent. The incident highlights the ongoing risks of supply chain attacks in open-source ecosystems, particularly for developers in the cryptocurrency sector who may be targeted for their access to digital assets and sensitive codebases.
Jun 29, 2026