crates.io phishing attempt

Thanks to my sponsors: Ryan, Guy Waldman, Gorazd Brumen, teor, Jonas Platte, Alex Rudy, prairiewolf, Zaki, Nyefan, Philipp Gniewosz, Jack Duvall, Ivo Murrell, Mason Ginter, Anna M, Romain Kelifa, Scott Sanderson, Matěj Volf, Beth Rennie, Stephan Buys, Jan-Stefan Janetzky and 279 more Ryan, Guy Waldman, Gorazd Brumen, teor, Jonas Platte, Alex Rudy, prairiewolf, Zaki, Nyefan, Philipp Gniewosz, Jack Duvall, Ivo Murrell, Mason Ginter, Anna M, Romain Kelifa, Scott Sanderson, Matěj Volf, Beth Rennie, Stephan Buys, Jan-Stefan Janetzky, Nicholas Orta, Dirkjan Ochtman, Angelo, Michael, messense, Walther, Lawrence Bethlenfalvy, Antoine Boegli, Antoine Rouaze, John VanEnk, compwhizii, Makoto Nakashima, alethiophile, Brandon Piña, AdrianEddy, Lyssieth, Guillaume E, pinkhatbeard, Max Heaton, Olivia Crain, you got maiL, genny, Beat Scherrer, Josiah Bull, Tabitha, Andy Gocke, Steven Pham, Andrew Henshaw, Sam Leonard, Chris Thackrey, Daniel Silverstone, Ben Wishovich, Justin Smith, Integer 32, LLC, Zoran Zaric, Matt Heise, Seth, L0r3m1p5um, Daniel Wagner-Hall, Jonathan Adams, Johnathan Pagnutti, budrick, Matt Jackson, Christoph Grabo, Olly Swanson, Daniel Papp, Òscar Pérez, zed, Mark Old, Adam Gutglick, Jörn Huxhorn, Kevin Nguyen, Mathias Brossard, Romet Tagobert, Luuk, Xirvik Servers, Mark, WeblWabl, Michał Zalewski, Chris Walker, Carson Page, Dave Minter, Brooke Tilley, Olivier Peyrusse, Reto Trappitsch, Matt Jadczak, Yuriy Taraday, Lucille Blumire, Wojciech Smołka, Morgan Rosenkranz, James Rhodes, Astrid, Marco Carmosino, Sawyer Knoblich, Isak Sunde Singh, Vladimir, Hamilton Chapman, David White, Boris Dolgov, Christian Bourjau, John Horowitz, old.woman.josiah, Mateusz Wykurz, Justin Ossevoort, Pete LeVasseur, Hadrien G., René Ribaud, Chris Sims, Tomas Sedovic, dataphract, Guilherme Neubaner, Arjen Laarhoven, Antoine PESTEL-ROPARS, Luke Yue, Neil Blakey-Milner, Jean-David Gadina, Radu Matei, Dylan Anthony, Tanner Muro, Manuel Hutter, Andy F, Egor Ternovoi, Benjamin Röjder Delnavaz, Malik Bougacha, Kyle Lacy, Luke Konopka, Björn Marschollek, Marcus Griep, Ian McLinden, Marie Janssen, Sindre Johansen, Jim, Twan Walpot, Brian L. Troutwine, Yufan Lou, Tom Forbes, Jelle Besseling, Zac Harrold, Aaron Gorodetzky, Samit Basu, Zachary Myers, Garret Kelly, Sylvie Nightshade, Dom, Ronen Ulanovsky, Aleksandre Khokhiashvili, Herman J. Radtke III, Geoffrey Thomas, Marcus Griep, Duane Sibilly, Marty Penner, Alexandra Østermark, Paul Horn, Noel, Menno Finlay-Smits, avborhanian, milan, Tiziano Santoro, clement, Urs Metz, Matthias Zepper, Richard Stephens, Chris, Tobias Bahls, Timothée Gerber, hgranthorner, traxys, Tyler Bloom, std__mpa, Scott Steele, Eugene Bulkin, ShikChen, Philipp Angerer, Thehbadger, Michal Hošna, Berkus Decker, villem, Paige Ruten, Andrew Neth, Matthew T, Alan O'Donnell, xales, Kevin Anderson, Victor Song, bbutkovic, Kai Kaufman, Cole Kurkowski, SeniorMars, DaVince, Bob Ippolito, Cole Tobin, Aiden Scandella, Yves, Enrico Zschemisch, Michał Bartoszkiewicz, Geoff Cant, ofrighil, Marc-Andre Giroux, Santiago Lema, Raine Godmaire, Taneli Kaivola, Adam Lassek, Sean Bryant, Elendol, Mike English, Marky Mark, Henrik Tudborg, Guillaume Demonet, Ross Williams, Dimitri Merejkowsky, Elnath, Ripta Pasay, James Leitch, Justy, Ronen Cohen, Em Sharnoff, Torben Clasen, qrpth, James Brown, Wyatt Herkamp, Josh Triplett, Toon Willems, Sarah Berrettini, Matt Campbell, Marcin Kołodziej, Ives van Hoorne, Max von Forell, Braidon Whatley, Valentin Mariette, ZacJW, e9zaktw1, Paul Marques Mota, Nicolas Riebesel, Jimmy Hartzell, anichno, Zalán Bálint Lévai, Ben Mitchell, Sung Jeon, Chris Emery, playest, Pete Bevin, Jesse Luehrs, Geoffroy Couprie, me, Felix Weis, Daniel Strittmatter, Corey Alexander, Laine Taffin Altman, Niels Abildgaard, Nicholas, Mikkel Rasmussen, Jake Demarest-Mays, Colin VanDervoort, Michael Alyn Miller, Blake Johnson, Thor Kamphefner, David E Disch, Christopher Valerio, Raphaël Thériault, belzael, Ahmad Alhashemi, 0lach, Xavier Groleau, Vincent Mutolo, Zachary Thomas, Senyo Simpson, Jon Gjengset, Borys Minaiev, Lena Schönburg, Mario Fleischhacker, psentee, David Barsky, Ula, Julian Schmid, Kamran Khan, Max Bruckner, Philipp Hatt, Gioele Pannetto, Romain Ruetschi, Diego Roig, notryanb, Peter Shih, Dominik Wagner, Richard Pringle, C J Silverio, Joshua Roesslein, Evan Relf, Horváth-Lázár Péter, Mattia Valzelli, Simon Menke, Aalekh Patel, jatescher, Alex Krantz, David Cornu, callym, Chris Biscardi, Yann Schwartz, Mark Tomlin, Andronik

Earlier this week, an npm supply chain attack.

It’s turn for crates.io, the main public repository for Rust crates (packages).

The phishing e-mail looks like this:

And it leads to a GitHub login page that looks like this:

Several maintainers received it — the issue is being discussed on GitHub.

The crates.io team has acknowledged the attack and said they’d see if they can do something about it.

No compromised packages have been identified as of yet (Sep 12, 14:10 UTC).

Important links:

• Rust Security Response WG blog post.
• GitHub discussion about the attack