The Rust project’s crates.io security response working group warned maintainers this month that prominent Rust developers are being targeted by a recruiter-lure attack it says is “known to be used by the DPRK.” Writing on the official Rust blog, engineer Adam Harvey described the pattern: “a video call is set up for something positive, maybe for a job, maybe for a project, maybe for a contract opportunity,” and that call becomes the vector for getting a target to install a fake missing audio codec or run another command. The attackers, the post says, build “new but legitimate seeming company profiles,” LinkedIn presence included, so a quick background check comes back clean. Several prominent Rustaceans were targeted in June, and last month the widely used arrayref crate, with 245 million lifetime downloads, was briefly compromised through a related attack before being pulled roughly 86 minutes after publication.
Why it matters: crates.io is Rust’s package registry, and a maintainer account compromise there is a supply chain event, not an individual one, every project that depends on a poisoned crate inherits whatever gets published under that maintainer’s name. The same recruiter-call tradecraft has already run against npm and PyPI developers, and this month’s advisory is the clearest signal yet that no single package ecosystem gets to treat it as someone else’s problem.
The original insight is what the Rust team chose to publish alongside the warning: concrete process advice rather than just an alert. Its recommendation to initiate any unsolicited call on a platform the maintainer controls, rather than one the caller proposes, is a control most security awareness training for engineers still does not cover, because most engineers are not trained to treat a job interview as an attack surface. CyberTech has tracked this actor’s fake-job playbook before, including a Windows zero-day paired with fake job offers and an npm package hijacking campaign Amazon tied to a single North Korean crew.
