body { background: #06080c; color: #e5e9f0; margin: 0; } .rw-nojs-bar { max-width: 880px; margin: 0 auto; padding: 18px 16px 14px; } .rw-nojs-bar .rw-nojs-brand { font: 700 20px/1 Inter, system-ui, sans-serif; color: #e5e9f0; text-decoration: none; } .rw-nojs-nav { max-width: 880px; margin: 0 auto; padding: 0 16px 14px; border-bottom: 1px solid #1c2230; font: 500 14px/1.4 Inter, system-ui, sans-serif; } .rw-nojs-nav a { color: #6f9bff; margin: 0 14px 6px 0; text-decoration: none; display: inline-block; } .rw-nojs-nav a:hover { text-decoration: underline; } .rw-nojs-note { max-width: 880px; margin: 12px auto 0; padding: 0 16px; font: 400 13px/1.5 Inter, system-ui, sans-serif; color: #8a93a6; } #root [data-rw-crawler] { max-width: 880px; margin: 0 auto; padding: 8px 16px 48px; font: 400 16px/1.65 Inter, system-ui, sans-serif; color: #e5e9f0; } #root [data-rw-crawler] a { color: #6f9bff; } #root [data-rw-crawler] h1 { font-size: 28px; line-height: 1.2; } #root [data-rw-crawler] h2 { font-size: 20px; margin-top: 28px; } #root [data-rw-crawler] img { max-width: 100%; height: auto; } #root [data-rw-crawler] ul { padding-left: 0; list-style: none; } #root [data-rw-crawler] li { margin: 0 0 18px; } #root [data-rw-crawler] .rw-pagination { margin: 28px 0 0; display: flex; flex-wrap: wrap; gap: 12px; align-items: baseline; } #root [data-rw-crawler] .rw-pagination strong { color: #e5e9f0; } .rw-nojs-footer { max-width: 880px; margin: 40px auto 0; padding: 22px 16px 44px; border-top: 1px solid #1c2230; font: 400 13px/1.6 Inter, system-ui, sans-serif; color: #8a93a6; } .rw-nojs-footer .rw-nojs-fcols { display: flex; flex-wrap: wrap; gap: 28px 40px; margin-bottom: 20px; } .rw-nojs-footer h2 { font-size: 11px; letter-spacing: 0.05em; text-transform: uppercase; color: #b7c0d3; margin: 0 0 8px; } .rw-nojs-footer a { color: #6f9bff; text-decoration: none; display: block; margin: 0 0 5px; } .rw-nojs-footer a:hover { text-decoration: underline; } .rw-nojs-footer .rw-nojs-legal { font: 400 12px/1.6 Inter, system-ui, sans-serif; color: #6b7384; margin: 0; } .rw-nojs-footer .rw-nojs-legal a { display: inline; } RuntimeWire Investigations Stories AI Startups Venture Products Funding Exits Models Head-to-Head About You're browsing RuntimeWire with JavaScript disabled. Articles and navigation work fully. Interactive features — search, comments, and newsletter signup — require JavaScript.

Matt Mastracci says a fake VC interview tried to turn his maintainer laptop into a supply-chain foothold

The Rust maintainer found a TypeScript take-home repo that hid PinpinRAT in a TypeScript patch and PNG payload.

By Ryan Merket · Published Jul 2nd, 2026, 11:00am CT

Illustration of a project file tree highlighting a concealed compromise in a TypeScript take-home repo used to hide the PinpinRAT targeting Rust maintainer Matt Mastracci's laptop.

The Rust maintainer found a TypeScript take-home repo that hid PinpinRAT in a TypeScript patch and PNG payload.

Sections

Investigations Stories AI Startups Venture Products Funding Exits

Publication

About FAQ Contact Editorial Policy Corrections Policy Ethics

Tools

AI Model Pricing Head-to-Head

Legal

Privacy Terms

© 2026 RuntimeWire, Inc. All rights reserved.
An independent startup and technology publication based in Austin, Texas and San Francisco, California. Send tips to tips@runtimewire.com.