crates.io phishing attempt
Thanks to my sponsors: Joshua Roesslein, Victor Song, you got maiL, Angelo, Tomáš Šedovič, Corey Alexander, Marc-Andre Giroux, John VanEnk, Matt Campbell, Dirkjan Ochtman, Mario Fleischhacker, L0r3m1p5um, Julien Roncaglia, Makoto Nakashima, Björn Marschollek, Hamilton Chapman, WeblWabl, Lach, Daniel Strittmatter, Ross Williams and 239 more
Earlier this week, an npm supply chain attack.
It’s turn for crates.io, the main public repository for Rust crates (packages).
The phishing e-mail looks like this:
And it leads to a GitHub login page that looks like this:
Several maintainers received it — the issue is being discussed on GitHub.
The crates.io team has acknowledged the attack and said they’d see if they can do something about it.
No compromised packages have been identified as of yet (Sep 12, 14:10 UTC).
Important links:
Did you know I also make videos? Check them out on YouTube!
Here's another article just for you:
Some mistakes Rust doesn't catch
I still get excited about programming languages. But these days, it’s not so much because of what they let me do, but rather what they don’t let me do.
Ultimately, what you can with a programming language is seldom limited by the language itself: there’s nothing you can do in C++ that you can’t do in C, given infinite time.
As long as a language is turing-complete and compiles down to assembly, no matter the interface, it’s the same machine you’re talking to. You’re limited by… what your hardware can do, how much memory it has (and how fast it is), what kind of peripherals are plugged into it, and so on.