crates.io phishing attempt

Sep 12, 2025 1 min #rust · #security

Thanks to my sponsors: Zoran Zaric, Mathias Brossard, notryanb, WeblWabl, Olly Swanson, Marco Carmosino, Valentin Mariette, zed, Berkus Decker, ShikChen, Michael, Chris Emery, Hadrien G., Miguel Raz Guzmán Macedo, Ryan, Olivia Crain, Gioele Pannetto, Seth, Geoff Cant, Michael Alyn Miller and 262 more

Earlier this week, an npm supply chain attack.

It’s turn for crates.io, the main public repository for Rust crates (packages).

The phishing e-mail looks like this:

A phishing e-mail: Important: Breach notification regarding crates.io Hi, BurntSushi! We recently discovered that an unauthorized actor had compromised the crates.io infrastructure and accessed a limited amount of user information. The attacker's access was revoked, and we are currently reviewing our security posture. We are currently drafting a blog post to outline the timeline and the steps we took to mitigate this. In the meantime, we strongly suggest you to rotate your login info by signing in here to our internal SSO, which is a temporary fix to ensure that the attacker cannot modify any packages published by you. — Andrew Gallant on BlueSky

And it leads to a GitHub login page that looks like this:

A fake GitHub sign-in page. — Barre on GitHub

Several maintainers received it — the issue is being discussed on GitHub.

The crates.io team has acknowledged the attack and said they’d see if they can do something about it.

No compromised packages have been identified as of yet (Sep 12, 14:10 UTC).

Important links:

(JavaScript is required to see this. Or maybe my stuff broke)

Did you know I also make videos? Check them out on PeerTube and also YouTube!

Here's another article just for you:

Getting in and out of trouble with Rust futures

Jul 07, 2020

14 min #rust · #async

I started experimenting with asynchronous Rust code back when futures 0.1 was all we had - before async/await. I was a Rust baby then (I’m at least a toddler now), so I quickly drowned in a sea of .and_then, .map_err and Either<A, B>.

But that’s all in the past! I guess!

Now everything is fine, and things go smoothly. For the most part. But even with async/await, there are still some cases where the compiler diagnostics are, just, so much.