● Covered by 2 sources · 2 reportsMedium impact2 negative
Malicious `proc-macro1` crate leads to supply chain attack on `arrayref` and other Rust crates
Key points
- Malicious `proc-macro1` crate downloaded a malicious payload.
- `arrayref`, `internment`, `append-only-vec` were compromised.
- Malicious versions were online for 86 to 107 minutes.
- Rust Security Response Team removed malicious crates and locked accounts.
- Malicious `arrayref` version 0.3.10 was published.
- Compromised `arrayref` and `append-only-vec` crates were maintained by droundy.
- The `proc-macro1` crate was published by dtolney.
- The `proc-macro1` metadata forged David Tolnay as author.
Malicious Crate Discovery
On August 20, 2026, the Rust Security Response Team received a report regarding the `proc-macro1` crate containing malicious code. Investigation confirmed that the crate's build script was designed to download a malicious payload. Several other related crates, including `proc-macro-en`, `aovine`, `arone`, `aronenao`, and `tinymember`, were also identified as malicious and subsequently deleted from crates.io.
Supply Chain Compromise
Further analysis revealed that the widely used `arrayref` crate had been republished with a dependency on the malicious `proc-macro1` crate. The compromised versions of `arrayref` were yanked, and the Rust team restored the legitimate versions. Other crates from the same author, `internment` and `append-only-vec`, were similarly affected. The author's account was locked as a precautionary measure, as their credentials or computer were likely compromised, though the author is not believed to be malicious.
Affected Versions and Remediation
The malicious versions removed include `append-only-vec@0.1.9` (online for 107 minutes), `arrayref@0.3.10` (online for 86 minutes), and `internment@0.8.7` (online for 90 minutes). All versions of `proc-macro1`, `proc-macro-en`, `aovine`, `arone`, `aronenao`, and `tinymember` were also deleted. Developers are advised to check their local dependencies to ensure these malicious crates were not pulled into their projects. A command-line utility was provided to assist in this verification process.
Industry Impact
This incident underscores the ongoing threat of supply chain attacks within the software ecosystem. The compromise of popular crates, even for a short duration, can lead to widespread security vulnerabilities in downstream projects. The swift response by the Rust Security Response Team mitigated the potential damage, but it serves as a reminder for continuous vigilance in dependency management and security practices.
Updates
- Malicious `arrayref` version 0.3.10 was published.
- Compromised `arrayref` and `append-only-vec` crates were maintained by droundy.
- The `proc-macro1` crate was published by dtolney.
- The `proc-macro1` metadata forged David Tolnay as author.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub rust-lang/blog.rust-lang.org GitHub safedep/vet GitHub safedep/pmg GitHub safedep/xbom GitHub safedep/gryph GitHub rustsec/advisory-dbHow outlets covered it
A compromised version 0.3.10 of the popular Rust crate 'arrayref' was published on crates.io, including a dependency on a malicious typosquatted crate 'proc-macro1'. This dependency's build script downloaded and executed a remote binary during project compilation, affecting any project that pulled the compromised 'arrayref' version. The crates.io team has since removed the malicious versions.
The Rust Security Response Team identified and removed several malicious crates, including `proc-macro1`, which was used in a supply chain attack to compromise popular crates like `arrayref`, `internment`, and `append-only-vec`. This incident highlights the vulnerability of software supply chains to malicious package injections and necessitates developers to verify their dependencies.