Threats Tagged 'proc-macro1'

On August 20, 2026, malicious versions of three Rust crates ([email protected], [email protected], and [email protected]) were published to crates.io. These crates included a typosquatted dependency named proc-macro1, whose build script downloads and executes a remote binary during compilation. This binary installs a backdoor that communicates with command and control servers over HTTPS, exfiltrates host and browser data, enumerates installed applications, and persists via common OS mechanisms such as Registry Run keys, LaunchAgents, or systemd user services. The attack infrastructure overlaps with North Korean threat actor operations, notably the Mastra campaign and previous DPRK-linked supply chain attacks. No official remediation guidance is currently available.

A supply chain attack targeted three popular Rust crates (arrayref, internment, and append-only-vec) by injecting a malicious typosquatted dependency named proc-macro1. This malicious package executed malware during Cargo builds across Linux, macOS, and Windows platforms, delivering backdoors that profiled victims, stole browser data, maintained persistence, and enabled remote command execution. The attack threatened developer workstations, CI/CD pipelines, and release infrastructure. The Rust Security Response Team removed the malicious releases and locked the maintainer's account to mitigate the threat.