Supply chain attacks targeting Rust developers continue

Summary

The crates security team and Adam Harvey are warning about an ongoing social engineering campaign targeting prominent Rust developers. Attackers are using fake video call pretexts (such as job offers or contracts) to install malware or execute commands. It was reported that a successful supply chain breach occurred last month in the 'array ref' package.

Why it matters

Almost every software stack relies indirectly on open-source packages. Consequently, a single compromised maintainer can inject malware into millions of downstream builds. The attack exploits the human layer—specifically the publishing permissions held by individuals—rather than a code vulnerability, making detection difficult for automated tools alone.

Highlights

• Attack vector: Fake video calls (job, contract, project) are used to convince targets to install a 'missing audio codec' or execute a command copied to the clipboard.
• Last month, a successful supply chain attack was carried out using this method against the 'array ref' package (and others).
• Mitigation proposed by Simon Willison: 'dependency cooling periods'—delaying upgrades to new package versions by a few days to allow time for anomaly detection.

Critical take

While Simon Willison's 'dependency cooling periods' framework appears to be a reasonable interim solution, it leaves a passive impression. This approach places the burden on all downstream users, relying on the hope that someone else will notice the issue. It fails to address the root cause: the lack of multi-party or hardware-backed signing in package publishing. Furthermore, as a link share without independent analysis, it merely repeats the warning and offers a single mitigation idea without going further.