crates.io phishing attempt
Thanks to my sponsors: Scott Sanderson, Max Heaton, ShikChen, budrick, Jimmy Hartzell, Mario Fleischhacker, Mason Ginter, Mateusz Wykurz, Max Bruckner, old.woman.josiah, Chris, Lena Schönburg, Sean Bryant, prairiewolf, Alan O'Donnell, you got maiL, James Leitch, Mathias Brossard, Radu Matei, Julien Roncaglia and 246 more
Earlier this week, an npm supply chain attack.
It’s turn for crates.io, the main public repository for Rust crates (packages).
The phishing e-mail looks like this:
And it leads to a GitHub login page that looks like this:
Several maintainers received it — the issue is being discussed on GitHub.
The crates.io team has acknowledged the attack and said they’d see if they can do something about it.
No compromised packages have been identified as of yet (Sep 12, 14:10 UTC).
Important links:
Did you know I also make videos? Check them out on PeerTube and also YouTube!
Here's another article just for you:
My ideal Rust workflow
Writing Rust is pretty neat. But you know what’s even neater? Continuously testing Rust, releasing Rust, and eventually, shipping Rust to production. And for that, we want more than plug-in for a code editor.
We want… a workflow.
Why I specifically care about this
This gets pretty long, so if all you want is the advice, feel free to jump to it directly.