MAL-2026-14338

Dashboard / Malicious Package / MAL-2026-14338

MAL-2026-14338

Summary: Malicious code in proc_macro1 (crates.io)

Details: proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay <[email protected]>' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\rust-setup.ps1 and launches it via a %TEMP%\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io.

References: https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/, https://github.com/rustsec/advisory-db/issues/3161