Topic

Open Source Maintainer Security

The account security, device hygiene and publishing controls of the individuals who hold release rights to widely used open source packages.

Current clusters

security2 publishers

Fake recruiters are working the Rust maintainers who can publish to crates.io

The Rust Project's crates.io team says attackers posing as recruiters are luring team members and popular crate owners onto video calls that end in a pasted command. In August, one hijacked account shipped malicious crates.

Publishers:helpnetsecurity.comsecurityweek.com

Reality

Evidence72
Adoption58
Hype gap+8
Incentives40
Confidence70