{"id":"MAL-2026-14338","summary":"Malicious code in proc_macro1 (crates.io)","details":"proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay \u003crchaitm@gmail.com\u003e' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\\rust-setup.ps1 and launches it via a %TEMP%\\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io.","modified":"2026-08-21T00:30:10.291917913Z","published":"2026-08-20T00:00:00Z","database_specific":{"iocs":{"ips":["23.254.165.112"],"urls":["https://23.254.165.112:9089/rust-crate_0.1.0","https://23.254.165.112:9089/rust-crate_0.2.0","https://23.254.165.112:9089/rust-crate_0.3.0","https://23.254.165.112:9089/rust-crate_0.4.0"],"files":[{"note":"Unix second-stage binary, executed with 23.254.165.112:443 as argv[1]","paths":["/tmp/rust-setup"],"source":"DROPPED"},{"source":"DROPPED","note":"Windows PowerShell second-stage","paths":["%TEMP%\\rust-setup.ps1"]},{"source":"DROPPED","note":"Windows VBScript launcher for the PowerShell stage","paths":["%TEMP%\\rust-setup-launch.vbs"]}]}},"references":[{"type":"REPORT","url":"https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/"},{"type":"WEB","url":"https://github.com/rustsec/advisory-db/issues/3161"}],"affected":[{"package":{"name":"proc-macro1","ecosystem":"crates.io","purl":"pkg:cargo/proc-macro1"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/proc_macro1/MAL-2026-14338.json"}}],"schema_version":"1.9.0","credits":[{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"},{"name":"jhobern","contact":["https://github.com/jhobern"],"type":"REPORTER"}]}