Lightning Talk: A Case Study in Cross-Ecosystem Security Response - Lori Lorusso, Rust Foundation

Why It Matters

Cross‑ecosystem collaboration accelerates detection and mitigation of supply‑chain attacks, safeguarding the integrity of critical open‑source infrastructure like Rust’s Cargo registry.

Key Takeaways

• Rust Foundation joined OpenSSF Alpha Omega to boost security.
• Cross‑ecosystem phishing attacks on npm, PyPI, and MPM highlighted supply‑chain risks.
• Rust’s security team leveraged shared threat monitoring for rapid incident response.
• Alpha Omega grants foster collaboration, tooling, and trusted publishing for crates.
• Canonical’s gold membership strengthens Rust’s ecosystem and long‑term sustainability.

Summary

The Rust Foundation used a Lightning Talk to illustrate how cross‑ecosystem collaboration can harden open‑source supply‑chain security. Identified as a critical project by OpenSSF in 2022, Rust launched its Security Initiative, securing crates through threat modeling, ecosystem scanning, and trusted publishing infrastructure, while leveraging an Alpha Omega grant to staff a dedicated security team.

The talk highlighted a wave of phishing attacks that compromised npm, PyPI, and MPM, where malicious actors harvested API tokens via deceptive emails and published malware‑infused packages. When a similar attack hit Rust’s Cargo registry—home to 230,000 crates and 242 billion downloads—the foundation’s security team, informed by threat alerts shared by Python’s security developer, responded within hours, preventing broader compromise.

Key examples included the use of GitHub as a single identity provider, the rapid alert from newly registered domains that triggered immediate investigation, and the role of Alpha Omega’s quarterly grantee meetings and Slack channels in facilitating real‑time information exchange. The announcement of Canonical’s gold membership underscored growing industry support, as the company commits resources to Rust’s tooling and governance.

The episode demonstrates that coordinated, cross‑project communication—backed by grant‑funded tooling and shared monitoring—can dramatically reduce response times and mitigate supply‑chain threats. For developers and enterprises, the message is clear: active participation in OpenSSF initiatives and foundation networks is essential to protect the software supply chain.

Original Description

Lightning Talk: A Case Study in Cross-Ecosystem Security Response - Lori Lorusso, Rust Foundation

Companies use multiple open source projects and programming languages in their product stack creating a potential ‘wheel of misfortune’ when thinking about the rise in software supply chain attacks. Taking it one step further malicious actors are targeting programming languages to get to the core of how products are built. The rise in attacks at the programming language level seen as recently as September 2025 has amplified the need for cross communication between language ecosystems. Using the phishing attacks on Rust and Python as a case study we will show how Alpha-Omega facilitated stronger links between ecosystems, specifically the Rust Foundation and Python Software Foundation (grantees of Alpha-Omega) and how this helped improve security response times and outcomes when the phishing attacks were launched.