crates.io phishing attempt

Thanks to my sponsors: Max Bruckner, Mark Tomlin, Raphaël Thériault, Makoto Nakashima, Philipp Angerer, genny, Nereuxofficial, Alex Rudy, Timothée Gerber, Alan O'Donnell, Laine Taffin Altman, Nyefan, Kamran Khan, Hadrien G., Sung Jeon, traxys, Anna M, knutwalker, Olly Swanson, Vladimir and 239 more Max Bruckner, Mark Tomlin, Raphaël Thériault, Makoto Nakashima, Philipp Angerer, genny, Nereuxofficial, Alex Rudy, Timothée Gerber, Alan O'Donnell, Laine Taffin Altman, Nyefan, Kamran Khan, Hadrien G., Sung Jeon, traxys, Anna M, knutwalker, Olly Swanson, Vladimir, compwhizii, Mike English, Antoine PESTEL-ROPARS, xd009642, SeniorMars, David Barsky, Richard Stephens, Reto Trappitsch, Matthias Zepper, Vinay Mehta, playest, Philipp Hatt, Alexandra Østermark, prairiewolf, Johnathan Pagnutti, Chris Thackrey, callym, Zeeger Lubsen, Geoff Cant, avborhanian, Matt Campbell, Ripta Pasay, Marcin Kołodziej, Taneli Kaivola, zoey, Neil Blakey-Milner, Guilherme Neubaner, Romain Ruetschi, Simon Menke, Mark Old, Samit Basu, Jimmy Hartzell, Dirkjan Ochtman, René Ribaud, Raine Godmaire, Miguel Raz Guzmán Macedo, Benjamin Röjder Delnavaz, Marco Carmosino, Marc-Andre Giroux, Lawrence Bethlenfalvy, hgranthorner, Guillaume E, Jim, Ryan, Andrew Henshaw, std__mpa, Brandon Piña, Daniel Silverstone, you got maiL, Luis, Steven Pham, Aleksandre Khokhiashvili, kuerbsikakteen, Eugene Bulkin, ShikChen, Tom Forbes, Lach, Michał Bartoszkiewicz, Julien Roncaglia, Mario Fleischhacker, Horváth-Lázár Péter, Niels Abildgaard, Olivia Crain, Chris, Romet Tagobert, Jesse Luehrs, Sawyer Knoblich, Marie Janssen, ofrighil, Mathew Haji, Marty Penner, Jake Demarest-Mays, Diego Roig, Jörn Huxhorn, Zalán Bálint Lévai, Enrico Zschemisch, Mark, Victor Song, Björn Marschollek, Lyssieth, Carson Page, notryanb, Pete LeVasseur, Chris Emery, Geoffroy Couprie, Corey Alexander, villem, Marcus Griep, Em Sharnoff, me, David White, Mattia Valzelli, Ross Williams, Thehbadger, Torben Clasen, clement, Santiago Lema, Geoffrey Thomas, Xavier Groleau, Bob Ippolito, Anson VanDoren, Dominik Wagner, Sean Bryant, Kyle Lacy, Kevin Murphy, James Rhodes, Mateusz Wykurz, Jeff Crocker, Malik Bougacha, Christian Bourjau, Ian McLinden, The0x539, Stephan Buys, Wyatt Herkamp, Jean-David Gadina, Gioele Pannetto, Egor Ternovoi, Justin Ossevoort, Astrid, Tabitha, Paige Ruten, Christopher Valerio, Gorazd Brumen, Zachary Thomas, pinkhatbeard, Yves, Senyo Simpson, Twan Walpot, Daniel Wagner-Hall, Isak Sunde Singh, Toon Willems, Andy F, L0r3m1p5um, James Brown, Dave Minter, Dimitri Merejkowsky, Luke Konopka, Tiziano Santoro, anichno, Tobias Bahls, Yufan Lou, Sam Leonard, Hamilton Chapman, Blake Johnson, budrick, Julian Schmid, Yuriy Taraday, Josh Triplett, old.woman.josiah, Andy Gocke, Marcus Griep, AdrianEddy, Angelo, Lena Schönburg, Chris Sims, C J Silverio, Ben Mitchell, jatescher, Menno Finlay-Smits, Matt Heise, Zaki, Richard Pringle, Lucille Blumire, Borys Minaiev, Vincent Mutolo, Radu Matei, Dom, Joshua Roesslein, Nicolas Riebesel, Romain Kelifa, Peter Shih, rektide, Pete Bevin, jalciné, Jonathan Adams, Xirvik Servers, Antoine Rouaze, Adam Gutglick, Chris Walker, Édomaur odéon, Guy Waldman, Lyrenhex, FELIX, belzael, Michal Hošna, Luke Yue, eliferrous, Boris Dolgov, Adam Lassek, Brian L. Troutwine, Brooke, Michael, Dylan Anthony, Aiden Scandella, James Leitch, Beat Scherrer, Kai Kaufman, Jan-Stefan Janetzky, Colin VanDervoort, Integer 32, LLC, Tyler Bloom, Valentin Mariette, Scott Sanderson, Justin Smith, David Smith, Yann Schwartz, Henrik Tudborg, Ronen Cohen, Ben Wishovich, Tanner Muro, Olivier Peyrusse, Zac Harrold, qrpth, Braidon Whatley, David Cornu, Hazel Duvall, Mathias Brossard, Matt Jadczak, ZacJW, Justy, Ives van Hoorne, Jelle Besseling, Matt Jackson, milan, Matej Volf, Tomáš Šedovič, frankwang, Daniel Strittmatter, xales, Max von Forell, WeblWabl, asaaki, Nicolas Coulange, John VanEnk, Zoran Zaric, RedstoneWizard08, psentee, Mikkel Rasmussen, Mason Ginter

Earlier this week, an npm supply chain attack.

It’s turn for crates.io, the main public repository for Rust crates (packages).

The phishing e-mail looks like this:

And it leads to a GitHub login page that looks like this:

Several maintainers received it — the issue is being discussed on GitHub.

The crates.io team has acknowledged the attack and said they’d see if they can do something about it.

No compromised packages have been identified as of yet (Sep 12, 14:10 UTC).

Important links:

• Rust Security Response WG blog post.
• GitHub discussion about the attack

Did you know I also make videos? Check them out on YouTube!

Here's another article just for you:

A terminal case of Linux

Sep 24, 2021

29 min #rust · #linux

Has this ever happened to you?

You want to look at a JSON file in your terminal, so you pipe it into jq so you can look at it with colors and stuff.

Cool Bear's hot tip

That’s a useless use of cat.

…oh hey cool bear. No warm-up today huh.

Sure, fine, okay, I’ll read the darn man page for jq… okay it takes a “filter” and then some files. And the filter we want is.. . which, just like files, means “the current thing”:

Read more