Rust maintainers are being phished through fake job calls, and the prize is your crate

The Rust project says people who maintain widely used crates are being approached with an attractive pretext — a role, a contract, a collaboration — and steered into a video call where something has to be installed or pasted into a terminal before the conversation can continue. The company on the other side looks real enough to survive a quick look, profiles included. Rust names two earlier rounds of the same play: one in June against a group of well-known developers, and a compromise of the arrayref crate last month.

What it means

The laptop is not the objective here — the publishing credential on it is. A maintainer account with release rights is worth more than any single machine, because one push reaches every project that depends on the package, and nobody reviews a version bump.

So the defence is not "be careful on calls". It is arranging things so that a compromised developer machine cannot ship a release on its own:

• publishing tokens live in a hardware key or a CI secret, never in a shell profile on the machine that opens email;
• releases go out from a pipeline that requires a second person, not from a laptop;
• scope tokens to one crate, with an expiry, so a stolen one has a blast radius and a clock.

And the part that is easy to miss: the giveaway in every version of this attack is that a stranger's problem is solved by running something on your machine. A missing codec, a broken meeting client, a one-line fix for the clipboard — the shape is the same whatever the wrapper is. Nobody who genuinely wants to hire you needs a command run on your box first.

Why the interview is the vector

A job conversation is the one context in which a stranger can ask a professional to install something and be taken seriously. It supplies a plausible reason to move to a call, a plausible reason for a tool you have not heard of, and a social cost for refusing — nobody wants to be the candidate who could not get their audio working.

That is what makes it more effective than a phishing mail. Mail asks you to trust a link; this asks you to keep a conversation going, and the payload is the smallest step in it.

The organisational version of the fix

For a maintainer, the answer is hardware keys and a release pipeline. For a company, it is a policy sentence: nothing gets installed during a call, ever, for any reason. The reason a rule beats vigilance here is that vigilance is exactly what the pretext is designed to spend — by the time the request arrives, forty minutes of rapport have been built specifically so that saying no feels rude.