# supply-chain 22

Published articles for supply-chain 22.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Be alert: targeted attacks on prominent Rustaceans

DevFeed: [Be alert: targeted attacks on prominent Rustaceans](<https://devfeed.tech/articles/be-alert-targeted-attacks-on-prominent-rustaceans-42174.md>)

Original publisher: [Read original article](<https://simonwillison.net/2026/Sep/17/targeted-attacks-on-rustaceans/>)

Author: Simon Willison

Published: 2026-09-17T23:59:19Z

Content type: opinion

Language: en

Sources: [Simon Willison's Weblog](<https://devfeed.tech/sources/simon-willison-s-weblog.md>)

Topics: [Rust](<https://devfeed.tech/topics/rust.md>), [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [Security](<https://devfeed.tech/topics/security.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Malware](<https://devfeed.tech/topics/malware.md>)

Tags: [dependency-cooldowns](<https://devfeed.tech/tags/dependency-cooldowns.md>), [dependency-cooldowns-5](<https://devfeed.tech/tags/dependency-cooldowns-5.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-321](<https://devfeed.tech/tags/open-source-321.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [rust](<https://devfeed.tech/tags/rust.md>), [rust-114](<https://devfeed.tech/tags/rust-114.md>), [security](<https://devfeed.tech/tags/security.md>), [security-637](<https://devfeed.tech/tags/security-637.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-22](<https://devfeed.tech/tags/supply-chain-22.md>)

### AI overview

The article warns of an ongoing campaign targeting Rust-lang members and maintainers of popular crates. Attackers reportedly use video calls and social engineering to trick targets into installing malicious software or executing commands, with the goal of publishing malware through compromised accounts. It recommends delaying dependency upgrades to help detect supply-chain attacks.

### Source excerpt

Be alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware. A video call is set up for something positive -- maybe for a job, maybe for a project, maybe for a contract opportunity -- and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard). Last month this trick was used in a successful supply chain attack against the array ref crate, among others. Any piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software. I guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else. Tags: open-source, security, rust, supply-chain, dependency-cooldowns