RUSTSEC-2026-0265None▾ Sunlit`proc-macro1` was removed from crates.io due to malicious code
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
It was reported proc-macro1 contained a build script that would download a
malicious payload.
This crate had two versions, both published at 2026-08-20 and it was used in a supply chain attack targeting popular crates. The crate was removed from crates.io and related user accounts were locked.
Thanks to the Research Team at Nextron Systems GmbH for reporting this to the Rust security response working group, and thanks to Emily Albini for coordinating with the crates.io and infra-admin teams.
proc-macro1 >= 0.0.0-0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.