Rust's crates.io team warns of an ongoing campaign against rust-lang members and popular-crate owners — a fake job, project or contract pitch leads to a video call where the target is asked to install a 'missing audio codec' or run a clipboard command; a June attempt on a crates.io maintainer delivered a RAT hidden in a take-home TypeScript 'test' repo, and the August arrayref compromise fits the same shape

View raw markdownEdit on GitHub ↗

TL;DR

On 2026-09-17 the Rust project's crates.io team and Security Response Working Group published "Be alert: targeted attacks on prominent Rustaceans": an ongoing campaign is targeting "rust-lang members and owners of popular crates." The pattern: an approach "for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity" from a "new but legitimate seeming" company with a plausible LinkedIn presence, then a video call used "to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command" placed on the clipboard. The post ties two prior events to the pattern: a June 2026 attempt on crates.io maintainer Matt Mastracci — a fake Singapore VC, a video call, then a "Ticket Harbor" TypeScript repo to build as a test, carrying a multi-stage loader for a RAT — and the August arrayref compromise (~245M lifetime downloads, malicious versions live under two hours). The style "is known to be used by the DPRK"; the Rust team says it does not know whether every incident is one campaign. The goal is a maintainer's machine or account, so that malware ships from a name nobody has reason to distrust. Recommendations: treat unsolicited approaches with suspicion however credible they look, hold calls on a platform you set up, enable MFA, check login history, and report to help@crates.io / security@rust-lang.org.

What happened

The warning (2026-09-17). Adam Harvey, writing for the crates.io team and the security response working group, describes the lure and the two payload paths — a fake codec install, or a command the target is talked into pasting from the clipboard — and the infrastructure: freshly created company identities with LinkedIn profiles built to survive a quick check. The post links the June attempt and the August arrayref incident as examples, and points to existing documentation of the DPRK "Contagious Interview" tradecraft. It does not name a group.

The June attempt, in the target's own words. Matt Mastracci (a crates.io maintainer) published "Anatomy of a Failed (Nation-State?) Attack" on 2026-06-25. A persona claiming to represent Lua Ventures — a Singapore venture firm that turned out to be defunct — emailed about advisory work, name-dropped two portfolio companies, held an unremarkable video call, and then sent the "test": a TypeScript ferry-ticketing repository called Ticket Harbor, with instructions to run "typecheck, test suite, and relevant desktop/server build commands before submitting." Inside: patch files that injected code into the TypeScript compilation tooling, a self-executing stub obfuscated with Base64 and XOR, a payload hidden in operators/3.png, and a WASM stub that spawned a detached Node process carrying a 1.68 MB obfuscated second stage — a RAT Mastracci calls PinpinRAT, with system fingerprinting, file exfiltration, arbitrary command execution and DNS tunnelling. He caught it because he had Claude analyse the repository before running anything, and the patch files stood out; nothing executed. He reported it to Canadian authorities the week of 2026-06-25.

The August compromise. The arrayref / proc-macro1 incident (2026-08-20) — a compromised owner account publishing malicious versions of three crates that pulled a typosquatted build-time dropper — is, per the Rust blog, an example of what this campaign is for. The Register notes "evidence suggested compromised maintainer credentials."

Context from the press (2026-09-21). SecurityWeek: the techniques "matched previous North Korean attack patterns"; the Rust team "did not know whether all of these incidents are part of the same campaign." The Register: the tactics resemble the fake-recruiter campaigns described in an international advisory from Australia, Germany, Japan and the US; Help Net Security summarises that advisory as counting 30,000+ infected devices in 100+ countries and 7,000+ cryptocurrency wallets between December 2025 and July 2026, with infrastructure shared with the DPRK IT-worker operation.

Why this file exists when the corpus already has Contagious Interview. The PolinRider, Joyfill and WeaselBiscuit files document the same actor class hitting npm and Packagist. This is the first time a registry's own security team has warned that its maintainers are being worked as a class, and the first with a maintainer's first-person account of the take-home-repo variant. For this audience the take-home repo is the part that matters: a repository you are asked to build is a payload delivery format, whether you build it by hand or hand it to a coding agent — the same trust boundary as GitSpawn (a repo's .git/config runs commands when an agent opens it) and the Codex/Cursor git-hook bugs.

Am I affected?

You are a target if you own a crate, an npm package, a PyPI project or a GitHub Action with meaningful downloads, or hold a role on a language or registry team. The signals are on the human side, not in a lockfile:

  • An unsolicited job, advisory, "project" or contract approach from a company you cannot find independent history for (recent LinkedIn page, no press, no product).
  • A video call that ends with a request to install something (an "audio codec," a "meeting plugin") or to run a command from the clipboard.
  • A "test" or "take-home" repository you are asked to build or run locally — especially one with patch files, postinstall/prepare scripts, binaries or images in unexpected places, or a WASM blob in a web app.
# Before building any repository someone sent you: look before you run.
git -C the-repo log --oneline | head            # one or two commits from a fresh account is a tell
find the-repo -name "*.patch" -o -name "patches" -o -name "*.wasm" -o -name "*.node" | head
grep -rn "postinstall\|preinstall\|prepare" the-repo/package.json
# Signals from the June sample (Mastracci): a process named PinpinWrappedJs, a hidden
# ~/.cache-<randomhex> directory, and outbound traffic to 89.124.107.161:80 from a dev box
pgrep -fl PinpinWrappedJs; ls -d ~/.cache-* 2>/dev/null
# crates.io / npm / GitHub: unrecognised sessions, tokens or publishes
# crates.io → Account Settings → API Tokens; GitHub → Settings → Sessions and → Applications

If you are affected

If you ran a "test" repository or installed something on a recruiter's call and the machine holds publishing credentials: assume the machine and every token on it are gone. Follow if-your-local-ai-agent-was-exploited.md for the host (it is the same job: an untrusted repo executed as you), then if-your-github-pat-leaked.md and rotating-cloud-credentials.md from a different machine. Revoke and re-issue crates.io and npm tokens, check what was published under your name in the window, and tell the registry (help@crates.io, security@rust-lang.org) — the Rust team asked to hear about attempts, not only successes.

Prevention

  • Build unknown repositories only in a throwaway sandbox — a container or microVM with no credentials mounted (prevention/agent-sandboxing.md). This applies doubly when a coding agent does the building: it will run the same postinstall, hook or patch step you would.
  • Read the repo before you run it. Mastracci's save was a review pass (with an LLM) before executing anything; prevention/package-vetting-checklist.md is the checklist.
  • Hold calls on your own platform, never install "codecs" or paste commands mid-call, and treat a recruiter's insistence on their meeting link as the signal.
  • Hardware-key MFA on registry and GitHub accounts, scoped short-lived publish tokens, and Trusted Publishing where the registry offers it (prevention/credential-hygiene.md). A compromised laptop still publishes, but it publishes once and visibly rather than quietly for months.
  • Downstream: pin and audit dependencies, and watch registry security posts — the arrayref window was under two hours because someone reported it.

Sources