crates.io phishing attempt

Thanks to my sponsors: Elnath , Ian McLinden Elnath , Ian McLinden

Earlier this week, an npm supply chain attack.

It’s turn for crates.io, the main public repository for Rust crates (packages).

The phishing e-mail looks like this:

And it leads to a GitHub login page that looks like this:

Several maintainers received it — the issue is being discussed on GitHub.

The crates.io team has acknowledged the attack and said they’d see if they can do something about it.

No compromised packages have been identified as of yet (Sep 12, 14:10 UTC).

Important links:

• Rust Security Response WG blog post.
• GitHub discussion about the attack