##cratesio
LightNews LightNews
jbzfn.bsky.social
｢ I just think it's pretty messed up that crates[.]io still requires a GitHub account to login, therefore to publish Rust packages. GitHub shouldn't be a shadow dependency of the language ecosystem ｣
infosec.exchange/@mttaggart/1...

#rust #cratesio #github #opensource
Taggart :ifin: (@mttaggart@infosec.exchange)
I just think it's pretty messed up that crates[.]io still requires a GitHub account to login, therefore to publish Rust packages. GitHub shouldn't be a shadow dependency of the language ecosystem.
infosec.exchange
June 26, 2026 at 9:00 PM
jbzfn.bsky.social
¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯ No one owes you supply-chain security

purplesyringa.moe/blog/no-one-...

#rust #cratesio #supplychain #opensource #cybersecurity
No one owes you supply-chain security
In case you’re unaware, I’m not a developer. I’m actually an autistic catgirl annoyed by suboptimal use of computing power, and fixing that happens to involve programming. Crucially, it also includes...
purplesyringa.moe
April 13, 2026 at 11:01 AM
erik.thauvin.net
How Safe is the Rust Ecosystem? A Deep Dive into crates.io

#cargo #cargodeny #cratesio #rustlang

mr-leshiy-blog.web.app/...
How Safe is the Rust Ecosystem? A Deep Dive into crates.io
mr-leshiy-blog.web.app
January 11, 2026 at 7:04 PM
happy-homhom.bsky.social
Rustのパッケージを配る場所、crates.ioとは何か
https://papoo.work/doc/aa89441d2812cf99
#rust #cratesio #package_registry #library
Rustのパッケージを配る場所、crates.ioとは何か
papoo.work
May 22, 2026 at 10:51 PM
happy-homhom.bsky.social
Rustのパッケージを配る場所、crates.ioとは何か
https://papoo.work/doc/aa89441d2812cf99
#rust #cratesio #package_registry #library
Rustのパッケージを配る場所、crates.ioとは何か
papoo.work
May 20, 2026 at 10:40 AM
hendryadrian.bsky.social
Rust team members and popular crate owners are being targeted with fake job and contract offers that lead to video calls, credential theft, and malicious package pushes. #Rust #cratesio #NorthKorea
Rust Team Members And Popular Crate Owners Targeted Via Video Calls
The Rust project warned that attackers are using fake job offers and contract opportunities to lure Rust developers and crate owners into video calls, where they try to steal credentials and push malicious packages. The campaign has been linked to earlier incidents involving the arrayref crate and other Rust developers, with...
www.hendryadrian.com
September 21, 2026 at 3:30 PM
cyberveille-ch.bsky.social
📢 Campagne ciblée contre les membres de la communauté Rust et propriétaires de crates populaires

Cet article émane de l'équipe crates.io et du groupe de travail sécurité. Il alerte sur une campagne active ciblant des membres prominents…

🔴 vérification factuelle basse
#Rust #CratesIo #Cyberveille
Campagne ciblée contre les membres de la communauté Rust et propriétaires de crates populaires
Cet article émane de l'équipe crates.io et du groupe de travail sécurité. Il alerte sur une campagne active ciblant des membres prominents de la communauté Rust et des propriétaires de crates populaires. Les attaquants utilisent des appels vidéo frauduleux comme vecteur d'infection, en se présentant sous des prétextes légitimes (offre d'emploi, projet, opportunité contractuelle).
cyberveille.ch
September 21, 2026 at 1:00 AM
Seriously #cratesio - you have no signing, provenance or transparency logging facilities in your registry. in 2026 ? WTH #rust 😞
September 9, 2026 at 3:56 AM
cyberveille-ch.bsky.social
📢 Attaque supply chain Rust : trois crates hijackées sur crates.io, liens avec la Corée du Nord

Le 20 août 2026, Wiz Research publie une analyse technique d'une attaque de chaîne d'approvisionnement ciblant l'écosystème Rust via le…

🟢 vérification factuelle haute
#Rust #CratesIo #Cyberveille
Attaque supply chain Rust : trois crates hijackées sur crates.io, liens avec la Corée du Nord
Le 20 août 2026, Wiz Research publie une analyse technique d'une attaque de chaîne d'approvisionnement ciblant l'écosystème Rust via le registre officiel crates.io. L'article s'appuie également sur des données de Google Threat Intelligence.
cyberveille.ch
August 22, 2026 at 6:30 PM
royans.bsky.social
North Korean State-Sponsored Supply Chain Attack on Rust's crates.io

https://simplysecuregroup.com/rust-supply-chain-attack-puts-build-time-malware-in-crates-with-245-million-downloads
https://flagthis.com/tldr/6508

##SupplyChain ##ThreatActor ##SapphireSleet ##Rust ##cratesio
August 22, 2026 at 4:43 AM
blindthoughts.bsky.social
Rust Supply Chain Attack: Poisoned Crates with 245M Downloads Execute Infostealer at Build Time

https://blindthoughts.com/rust-supply-chain-attack-arrayref-infostealer

#rust #supplychainattack #malware #cratesio #infosec
August 20, 2026 at 10:17 PM
hendryadrian.bsky.social
Hackers hijacked the arrayref Rust crate maintainer account and pushed a malicious update that ran during compilation, also poisoning append-only-vec and internment in a supply-chain attack. #Rust #Cratesio #DPRK
Hackers poison arrayref Rust crate to push infostealer malware
Hackers compromised the maintainer account for the Rust crate arrayref and pushed a malicious update that executed during compilation, while also poisoning append-only-vec and internment in the same supply-chain attack. The campaign affected widely used Rust projects and showed infrastructure overlaps with recent DPRK-linked attacks, prompting developers to check for compromise and rotate exposed secrets. #arrayref #append-only-vec #internment #proc-macro1 #StepSecurity #Wiz #Cratesio #Rust
www.hendryadrian.com
August 20, 2026 at 7:00 PM
threadlinqs.bsky.social
DPRK typosquat backdoor infected 3 Rust crates (244M downloads) via build.rs infostealer. https://intel.threadlinqs.com/threat/TL-2026-2083 #ThreatIntel #procmacro1 #procmacroen #Cratesio
Popular Rust Packages With 244M Downloads Compromised in Supply Chain Attack
August 20, 2026 at 4:36 PM
projectmoon.social.agnos.is
It seems arrayref had its old versions yanked, thus leaving only the hacked version for resolution.

#rust #cratesio
August 20, 2026 at 8:19 AM
pingoru.bsky.social
🟠 crates.io is reporting a Partial Outage since 14:22 UTC

"DoS Attack"

Affects: crates.io

Live timeline → https://pingoru.io/providers/cratesio/incidents/6083447

#cratesio #cratesioDown
July 11, 2026 at 2:29 PM
thedailytechfeed.com
TrapDoor attack hits npm, PyPI, Crates.io, stealing crypto wallets and SSH keys from developers. #TrapDoor #SupplyChainAttack #npm #PyPI #CratesIO #CyberSecurity #Crypto #AI thedailytechfeed.com/trapdoor-sup...
May 25, 2026 at 6:01 AM
pixelsandpulse.bsky.social
Big news for Rust developers! Servo, the performant browser engine, is now officially on Crates.io. This dramatically simplifies embedding web content and introduces a stable LTS release strategy. Say goodbye to manual dependency wrestling!

https://www.tpp.blog/2osc530

#servo #cratesio #rust
April 13, 2026 at 2:18 PM
reconbee.bsky.social
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO reconbee.com/trapdoor-sup...

#TrapDoor #supplychainattack #credentials #malware #npm #pyPI #cratesIO #supplychain
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm PyPI and CratesIO
plants persistence through read more about TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm PyPI and CratesIO
reconbee.com
May 25, 2026 at 7:27 AM
pingoru.bsky.social
⚠️ crates.io is reporting a Incident since 01:20 UTC

"crates.io slowness"

Affects: crates.io

Live timeline → https://pingoru.io/providers/cratesio/incidents/4012032

#cratesio #cratesioDown
crates.io: crates.io slowness — June 14, 2026 · Pingoru
crates.io incident on June 14, 2026: crates.io responses are unusually slow due to database issues, with occasional 500s due to database timeouts. We are investigating. Started 1:20 AM UTC, resolved ongoing (● 8m). Affected: crates.io.
pingoru.io
June 14, 2026 at 1:28 AM
erik.thauvin.net
crates.io: development update

#cratesio #rustlang

blog.rust-lang.org/2026...
crates.io: development update | Rust Blog
Empowering everyone to build reliable and efficient software.
blog.rust-lang.org
January 21, 2026 at 12:47 PM