Phishing Campaign Targets crates.io Maintainers
Just days after a similar attack hit the npm ecosystem, a phishing campaign is now targeting maintainers on crates.io, the primary public package registry for Rust. The campaign, which surfaced this week, tricks recipients into visiting a fraudulent GitHub login page designed to harvest credentials.
The phishing email itself has been reproduced by community members who received it. The message directs targets to a login page that closely mirrors GitHub's authentication flow, presumably in an attempt to capture passwords or session tokens. The attack is being actively discussed in a GitHub discussion opened by affected maintainers.
The crates.io team has acknowledged the incident and indicated it will investigate potential countermeasures. At the time of this writing (Sep 12, 14:10 UTC), no compromised packages have been identified.
Guidance and Resources
Maintainers who believe they may have been targeted should review the official response from the Rust Security Response WG, which outlines current status and recommended actions. The ongoing GitHub discussion also contains first-hand reports and analysis from the community.
This attack follows a similar supply chain incident earlier this week involving the color npm package, underscoring that package registries remain a persistent vector for credential phishing. Users should exercise caution with unsolicited messages claiming to originate from registry services or version control platforms.
