Rustaceans Under Fire: When Fake Job Offers Deliver Malware

The Rust security team has issued a warning about an ongoing campaign targeting maintainers of popular crates. Attackers approach developers with job offers or collaboration opportunities, often through video calls, attempting to trick them into running malware under the guise of a technical test. The goal is to compromise their devices and gain control of their accounts.

The campaign targets maintainers, not code

This campaign differs from common supply-chain attacks that rely on typosquatting or compromised CI/CD pipelines. Attackers are going directly after the people with publishing rights. They use personalized offers and build trust before striking. This indicates that the ecosystem has matured to the point where deceiving a person is cheaper than breaching infrastructure.

Social engineering bypasses technical barriers

Even the best technical security fails when an attacker is on a call with a person holding access who willingly runs “test code” on their work machine. This type of attack (familiar from the crypto community) exploits the fact that open-source developers rarely have isolated devices for commercial and volunteer work.

Work isolation is not enough for full protection

Even strict separation of work and private computers does not solve the core problem if a developer tests malicious code on the machine from which they publish packages. Attackers target the exact moment when the victim believes they are in control.

Hardware token keys as the only solution

Adoption outside the vendor's narrative will decide if malware detection is enough, or if hardware keys (like YubiKey) must be enforced for publishing to main repositories. As long as a compromised laptop can automatically publish a crate, social engineering will work.

Lilith's verdict

Open-source security is shifting from finding bugs in code to phishing interviews, because human vanity has fewer patches than any server.