A maintainer account on crates.io was compromised and used to publish malicious versions of three widely used Rust crates, adding a typosquatted dependency to the build chain before the Rust Project pulled the releases. The combined download count on the affected crates runs to 245 million, which is not a measure of how many builds pulled the poisoned version, only a measure of how many builds trusted the account that got taken over. Package registries verify the publisher's credentials. Nothing downstream verifies the code.

The pattern matches the Rust Foundation's existing guidance on npm-style typosquatting, published after prior registry incidents on other language ecosystems, and crates.io still relies on maintainer 2FA as opt-in rather than mandatory for high-download packages. Any CI pipeline pinning these crates by version tag rather than checksum pulled the malicious build automatically on the next `cargo update`. The control that would have changed the outcome is mandatory hardware-key 2FA on publish rights for crates above a download threshold, a policy crates.io has not adopted as of August 22, 2026.