crates.io
AssessPlatforms
The official package registry for Rust crates.
Why it's here
Placed in Assess: 2 article(s) of evidence from 2 source(s), led by security coverage, with 1 in the last 30 days. Confidence 40%.
Evidence (2)
- 8Simon Willison·9/17/2026securityTargeted attacks hit prominent Rust developers
Security researchers and the crates team warn of an active campaign targeting Rust project members and maintainers of popular crates. The attackers use deceptive video calls and social engineering to get victims to install malware or run commands, apparently to steal accounts and publish malicious packages.
- 9Hacker News·8/20/2026securityMalicious Rust crate arrayref ran code at build time
A compromised release of the Rust crate arrayref was published to crates.io with a typosquatted dependency that executed a payload during compilation. The malicious versions were later removed, but the crate’s wide transitive use and yanking of older safe releases increased the likelihood that builds would encounter the bad release.