{
  "id": 8130329,
  "title": "Be alert: targeted attacks on prominent Rustaceans",
  "url": "https://urgent.news/2026/09/17/be-alert-targeted-attacks-on-prominent-rustaceans-8130329",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-17T23:59:19.000Z",
  "source": {
    "name": "Simon Willison",
    "slug": "simon-willison",
    "url": "https://simonwillison.net/2026/Sep/17/targeted-attacks-on-rustaceans/"
  },
  "original_language": "en",
  "account": "The security team of the Rust programming language, known as crates security, has issued an urgent warning about a possible campaign targeting prominent Rust developers, or \"Rustaceans.\" These attackers aim to compromise devices and accounts of these individuals to spread malware. Security experts believe that such attacks are likely using seemingly innocuous video calls as a gateway to install malicious software or run commands on the target's computer.\n\nIn a recent supply chain attack, this method was used to compromise the array ref crate and other open source software. The attack typically involves a conversation that appears to be for a job, a collaboration, or a contract. Once trust is established, the attacker uses this connection to distribute malware, often through a purportedly missing audio codec or by placing commands in the clipboard.\n\nThe source of these potential attack vectors can be any individual involved in the open source software supply chain, including those with publishing rights for packages in the dependency network. Due to the pervasive nature of open source software, it is crucial to exercise caution when adopting new package releases. To mitigate the risk of such attacks, implementing dependency cooldowns is recommended. This practice involves waiting several days before upgrading to new package releases, allowing for potential detection and prevention of supply chain attacks.",
  "summary": "Be alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware. A video call is set up for something positive — maybe for a job, maybe for a project,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}