proc-macro1

{"modified":"2026-08-20T00:00:00Z","published":"2026-08-20T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-14338","summary":"Malicious code in proc_macro1 (crates.io)","details":"proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay <rchaitm@gmail.com>' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\\rust-setup.ps1 and launches it via a %TEMP%\\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io.","affected":[{"package":{"ecosystem":"crates.io","name":"proc-macro1"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"references":[{"type":"REPORT","url":"https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"},{"type":"WEB","url":"https://github.com/rustsec/advisory-db/issues/3161"}],"credits":[{"name":"SafeDep","type":"FINDER","contact":["https://safedep.io"]},{"name":"jhobern","type":"REPORTER","contact":["https://github.com/jhobern"]}],"database_specific":{"iocs":{"files":[{"note":"Unix second-stage binary, executed with 23.254.165.112:443 as argv[1]","paths":["/tmp/rust-setup"],"source":"DROPPED"},{"note":"Windows PowerShell second-stage","paths":["%TEMP%\\rust-setup.ps1"],"source":"DROPPED"},{"note":"Windows VBScript launcher for the PowerShell stage","paths":["%TEMP%\\rust-setup-launch.vbs"],"source":"DROPPED"}],"ips":["23.254.165.112"],"urls":["https://23.254.165.112:9089/rust-crate_0.1.0","https://23.254.165.112:9089/rust-crate_0.2.0","https://23.254.165.112:9089/rust-crate_0.3.0","https://23.254.165.112:9089/rust-crate_0.4.0"]}}}