proc-macro1

GHSA-m83q-4x86-96wh

Malicious code in proc_macro1 (crates.io)

Details

**Severity:** Critical

**Affected versions:** `> 0`

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay <[email protected]>' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\rust-setup.ps1 and launches it via a %TEMP%\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3b4ff66ce44ef274813534c270e0984580ad4f11/osv/malicious/crates.io/proc_macro1/MAL-2026-14338.json))

**References:**
- https://github.com/rustsec/advisory-db/issues/3161
- https://github.com/ossf/malicious-packages/blob/3b4ff66ce44ef274813534c270e0984580ad4f11/osv/malicious/crates.io/proc_macro1/MAL-2026-14338.json
- https://safedep.io/arrayref-proc-macro1-rust-build-time-malware
- https://github.com/advisories/GHSA-m83q-4x86-96wh

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.