Crates.io phishing

[Barre]

In light of the recent NPM compromise, I wanted to warn others who might receive similar messages. Immediately after publishing a new version of https://crates.io/crates/zerofs, I received the following:

Hi, Barre!

We recently discovered that an unauthorized actor had compromised the crates.io infrastructure and accessed a limited amount of user information. The attacker's access was revoked, and we are currently reviewing our security posture.

We are currently drafting a blog post to outline the timeline and the steps we took to mitigate this. In the meantime, we strongly suggest you to rotate your login info by signing in [redacted] to our internal SSO, which is a temporary fix to ensure that the attacker cannot modify any packages published by you.

The page looks like:

It seems that the phishing website is a full proxy to Github:

[Turbo87]

thanks for reporting this! we'll see if there is something we can do about it.

[Turbo87]

status report:

• we have sent a takedown request to the domain provider
• we have sent an email to the GitHub security team
• we have published https://blog.rust-lang.org/2025/09/12/crates-io-phishing-campaign/ and amplified it on social media
• we are monitoring API token creations for suspicious activity
• the domain has been reported to https://safebrowsing.google.com/

[Barre]

Very cool, thanks!

[carols10cents]

If anyone realizes they have exposed their creds through this attack, please contact us at help@crates.io asap (and contact GitHub as well)! (no shame!!!)

[MichaelMcDonnell]

Has anyone reported this infrastructure attack to the Cybersecurity and Infrastructure Security Agency (CISA)?

[Turbo87]

there has been no infrastructure attack. that is only what the phishing email claimed. the only attack that is real is the phishing attack itself.

[rursprung]

FYI: out of interest i went to https://rustfoundation.dev/ and it now shows this instead:

crates.io db along with juicy tokens for sale. email for buying! (free leak if no offer till sunday >.<)
security@rustfoundation.dev