The Rust project's security team and crates.io warned September 17 of an ongoing campaign targeting prominent Rust maintainers and owners of popular crates, using fake job offers, projects or contracts to set up a video call that becomes the attack vector, according to the official Rust blog.
Attackers build convincing fake company profiles and LinkedIn presences before the call, then get the target to install malicious software disguised as an audio codec or to run a command placed on their clipboard, the Rust team said. The blog post attributed the attack style to a pattern known to be used by North Korea and noted it has hit targets outside the Rust community too.
The team linked the current campaign to a similar attack in June and to last month's compromise of the arrayref crate, which used comparable tactics, and asked anyone approached this way to report it to help@crates.io or security@rust-lang.org.
Simon Willison, who flagged the warning, recommended dependency cooldowns, waiting several days before pulling in a new package release, as a practical defense: a compromised crate usually gets caught by someone else in the community before your build ever touches it.
A supply chain attack that starts with a video call instead of a phishing email is a reminder that the weakest link in open source security is very often not the code review process, it's a maintainer being social-engineered before any code gets written.