SECURITY Signal 405
Compromised Rust crates arrayref and append-only-vec execute remote payload at build time via malicious proc-macro1 dependency
↗
A supply chain attack compromised two popular Rust crates by injecting a dependency on the typosquatted proc-macro1 package, whose build.rs downloads and executes a remote payload during compilation.
Because the malicious code runs in build.rs, merely compiling a project that depends on either crate triggers the infection without calling any crate functionality. With arrayref at 244 million downloads and append-only-vec at 4 million, this is the largest Rust crate compromise by download count.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The attacker added a single dependency line on proc-macro1 to the manifests of arrayref 0.3.10 and append-only-vec 0.1.9, both maintained by the same developer.
proc-macro1 is a typosquat of proc-macro2 that copies the real crate's description, author name, and documentation, with its malicious logic entirely in build.rs.
The build script downloads an OS- and architecture-specific payload over HTTPS, writes it to disk, and spawns it detached so it survives after the build finishes.
THE CLUSTER