Rust Team Members and Popular Crate Owners Targeted via Video Calls

The npm worms get the headlines, but this is the quieter path into your dependency tree: the Rust team says maintainers of popular crates are being approached with fake job offers, then asked on a video call to install a “missing audio codec” or paste a command. Same playbook that compromised the arrayref crate in August, and the tradecraft matches North Korea. If you maintain anything with real download counts, you are the attack surface.