{"id":"MAL-2026-14338","title":"Malicious code in proc_macro1 (crates.io)","summary":"Malicious code in proc_macro1 (crates.io)","severity":"none","vendor":"proc-macro1","product":"proc-macro1","ecosystem":"rust","affected":["proc-macro1"],"published":"2026-08-20","updated":"2026-08-21","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-14338","references":[{"url":"https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"},{"url":"https://github.com/rustsec/advisory-db/issues/3161"}],"tags":["osv","rust"],"ingestedAt":"2026-08-21T19:23:48.984Z","slug":"MAL-2026-14338","body":"## Overview\n\nproc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay <rchaitm@gmail.com>' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\\rust-setup.ps1 and launches it via a %TEMP%\\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io.\n\n## Affected packages\n\n- `proc-macro1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}