Popular Rust Crates Compromised in Build-Time Supply Chain Attack

A coordinated supply chain attack compromised three legitimate Rust crates maintained by David Roundy by injecting a malicious dependency called proc-macro1, a typosquat of the legitimate proc-macro2 crate. The malicious package executed cross-platform malware automatically during Cargo builds via its build.rs script. It deployed platform-specific stage-2 backdoors on Linux, macOS, and Windows that profiled victims, collected browser data, established persistence, and provided remote command execution. The malware communicated with command-and-control infrastructure at IP 23.254.165.112 and used a domain generation algorithm as fallback. Developer workstations, CI/CD runners, and release infrastructure were at risk due to the compromise occurring during normal compilation processes. The Rust Security Response Team responded by removing the malicious releases and locking the maintainer account.

The attack enabled attackers to execute malware during the build process of Rust projects, potentially compromising developer machines, CI/CD environments, and release infrastructure. This could lead to credential theft, persistent backdoors, remote command execution, and exfiltration of sensitive data such as browser information. The supply chain nature of the attack increases risk as compromised dependencies are widely used and trusted.

The Rust Security Response Team has removed the malicious releases and locked the compromised maintainer account. Users should ensure they are not using the compromised versions of the affected crates and update dependencies accordingly. Review build logs and environments for signs of compromise. No official patch is indicated, but the malicious versions have been removed from the ecosystem. Users should verify dependency integrity and avoid typosquatted packages.