crates.io phishing attempt
Thanks to my sponsors: Raphaël Thériault, Peter Shih, Geoffrey Thomas, Stephan Buys, Astrid, Berkus Decker, Sam Leonard, Lyssieth, Jonathan Adams, Hadrien G., Marty Penner, Marcus Griep, Ben Mitchell, Daniel Strittmatter, David White, anichno, xales, Alex Krantz, Menno Finlay-Smits, Jimmy Hartzell and 253 more
Earlier this week, an npm supply chain attack.
It’s turn for crates.io, the main public repository for Rust crates (packages).
The phishing e-mail looks like this:
And it leads to a GitHub login page that looks like this:
Several maintainers received it — the issue is being discussed on GitHub.
The crates.io team has acknowledged the attack and said they’d see if they can do something about it.
No compromised packages have been identified as of yet (Sep 12, 14:10 UTC).
Important links:
Did you know I also make videos? Check them out on PeerTube and also YouTube!
Here's another article just for you:
The case for sans-io
The most popular option to decompress ZIP files from the Rust programming language is a crate simply named zip — At the time of this writing, it has 48 million downloads. It’s fully-featured, supporting various compression methods, encryption, and even supports writing zip files.
However, that’s not the crate everyone uses to read ZIP files. Some applications benefit from using asynchronous I/O, especially if they decompress archives that they download from the network.