MAL-2026-14335

    Dashboard / Malicious Package / MAL-2026-14335

    MAL-2026-14335

    Published: 20 Aug 2026Last Modified: 20 Aug 2026

    Summary: Malicious code in aronenao (crates.io)

    Details: aronenao is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a build-script payload; building it results in the download and execution of a remote binary from https://23.254.165.112:9089/ with 23.254.165.112:443 as command and control. All versions have been removed from crates.io. The individual build script of this crate was not analyzed directly; its behavior is attributed from the campaign.

    References: https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/, https://github.com/rustsec/advisory-db/issues/3161

    Affected packages

    Package

    Name: aronenao

    Purl: pkg:cargo/aronenao

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    MAL-2026-14335 | CVE-DB