Threats Tagged 'proc-macro1'

A supply chain attack compromised three legitimate Rust crates (arrayref, internment, append-only-vec) by injecting a malicious dependency named proc-macro1, a typosquat of proc-macro2. This malicious package executed malware during Cargo builds via its build.rs script, delivering platform-specific backdoors for Linux, macOS, and Windows. The malware profiled victims, collected browser data, established persistence, and enabled remote command execution. It communicated with command-and-control infrastructure at 23.254.165.112 and used a domain generation algorithm for fallback. Developer workstations, CI/CD runners, and release infrastructure were particularly at risk. The Rust Security Response Team removed the malicious releases and locked the maintainer account to mitigate the threat.