---
id: MAL-2026-14338
title: Malicious code in proc_macro1 (crates.io)
summary: Malicious code in proc_macro1 (crates.io)
severity: none
vendor: proc-macro1
product: proc-macro1
ecosystem: rust
affected:
  - proc-macro1
published: '2026-08-20'
updated: '2026-08-21'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-14338'
references:
  - url: 'https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/'
  - url: 'https://github.com/rustsec/advisory-db/issues/3161'
tags:
  - osv
  - rust
ingestedAt: '2026-08-21T19:23:48.984Z'
---

## Overview

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay <rchaitm@gmail.com>' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\rust-setup.ps1 and launches it via a %TEMP%\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io.

## Affected packages

- `proc-macro1`

## Remediation

Refer to the advisory for the patched release.