Replies: 6 comments 7 replies
|
thanks for reporting this! we'll see if there is something we can do about it. |
|
status report:
|
|
Very cool, thanks! |
|
If anyone realizes they have exposed their creds through this attack, please contact us at help@crates.io asap (and contact GitHub as well)! (no shame!!!) |
|
Has anyone reported this infrastructure attack to the Cybersecurity and Infrastructure Security Agency (CISA)? |
|
there has been no infrastructure attack. that is only what the phishing email claimed. the only attack that is real is the phishing attack itself. |
|
I guess I have a different definition of infrastructure. The way I'm seeing it is that Rust is used in infrastructure code. The attacker tried to gain control to the distribution of the infrastructure code, thereby taking over control of the infrastructure? If, not CISA, then I think FBI ought to be notified? |
Following the same logic, anytime there's a failed login attempt to any account on crates.io that has published a crate, a notification and report should be issued. That does not look useful / sustainable. |
|
FYI: out of interest i went to
|
|
And now: <html><head></head><body>SOLD! wow that was quick.<br>
whoever thinks this was "sophisticated" is clearly fearmongering. it took me less than 15mins to setup the whole thing, if we neglect 30mins for btc and xmr confirmation times.<br>
goodbye.
</body></html> |
Even though there's probably not much merit to the claims, it'd be interesting to look into unusual token issuance activity since when that domain was registered. Creation Date: 2025-09-12T07:13:16.998Z |
|
Yes, we have been monitoring, and we're considering revocation of tokens created since that time out of an abundance of caution. |
|
Hi everyone, Last night I put together a small proof of concept to explore adding a cooldown window for newly published crates on crates.io to improve supply-chain security in Cargo https://crates.io/crates/cargo-cooldown I'd love feedback on feasibility and possible integration paths. For now it queries the crates.io HTTP API because the registry index still doesn’t include publish timestamps, which are needed to enforce the cooldown age check. That is very inefficient. Thanks! |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
In light of the recent NPM compromise, I wanted to warn others who might receive similar messages. Immediately after publishing a new version of https://crates.io/crates/zerofs, I received the following:
The page looks like:
It seems that the phishing website is a full proxy to Github:
All reactions