Replies: 6 comments 7 replies
-
|
thanks for reporting this! we'll see if there is something we can do about it. |
Beta Was this translation helpful? Give feedback.
-
|
status report:
|
Beta Was this translation helpful? Give feedback.
-
|
Very cool, thanks! |
Beta Was this translation helpful? Give feedback.
-
|
If anyone realizes they have exposed their creds through this attack, please contact us at [email protected] asap (and contact GitHub as well)! (no shame!!!) |
Beta Was this translation helpful? Give feedback.
-
|
Has anyone reported this infrastructure attack to the Cybersecurity and Infrastructure Security Agency (CISA)? |
Beta Was this translation helpful? Give feedback.
-
|
there has been no infrastructure attack. that is only what the phishing email claimed. the only attack that is real is the phishing attack itself. |
Beta Was this translation helpful? Give feedback.
-
|
I guess I have a different definition of infrastructure. The way I'm seeing it is that Rust is used in infrastructure code. The attacker tried to gain control to the distribution of the infrastructure code, thereby taking over control of the infrastructure? If, not CISA, then I think FBI ought to be notified? |
Beta Was this translation helpful? Give feedback.
-
Following the same logic, anytime there's a failed login attempt to any account on crates.io that has published a crate, a notification and report should be issued. That does not look useful / sustainable. |
Beta Was this translation helpful? Give feedback.
-
|
FYI: out of interest i went to
|
Beta Was this translation helpful? Give feedback.
-
|
And now: <html><head></head><body>SOLD! wow that was quick.<br>
whoever thinks this was "sophisticated" is clearly fearmongering. it took me less than 15mins to setup the whole thing, if we neglect 30mins for btc and xmr confirmation times.<br>
goodbye.
</body></html> |
Beta Was this translation helpful? Give feedback.
-
Even though there's probably not much merit to the claims, it'd be interesting to look into unusual token issuance activity since when that domain was registered. Creation Date: 2025-09-12T07:13:16.998Z |
Beta Was this translation helpful? Give feedback.
-
|
Yes, we have been monitoring, and we're considering revocation of tokens created since that time out of an abundance of caution. |
Beta Was this translation helpful? Give feedback.
-
|
Hi everyone, Last night I put together a small proof of concept to explore adding a cooldown window for newly published crates on crates.io to improve supply-chain security in Cargo https://crates.io/crates/cargo-cooldown I'd love feedback on feasibility and possible integration paths. For now it queries the crates.io HTTP API because the registry index still doesn’t include publish timestamps, which are needed to enforce the cooldown age check. That is very inefficient. Thanks! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
In light of the recent NPM compromise, I wanted to warn others who might receive similar messages. Immediately after publishing a new version of https://crates.io/crates/zerofs, I received the following:
The page looks like:
It seems that the phishing website is a full proxy to Github:
Beta Was this translation helpful? Give feedback.
All reactions