Malicious `proc-macro1` crate leads to supply chain attack on `arrayref` and other Rust crates

Malicious Crate Discovery

On August 20, 2026, the Rust Security Response Team received a report regarding the `proc-macro1` crate containing malicious code. Investigation confirmed that the crate's build script was designed to download a malicious payload. Several other related crates, including `proc-macro-en`, `aovine`, `arone`, `aronenao`, and `tinymember`, were also identified as malicious and subsequently deleted from crates.io.

Supply Chain Compromise

Further analysis revealed that the widely used `arrayref` crate had been republished with a dependency on the malicious `proc-macro1` crate. The compromised versions of `arrayref` were yanked, and the Rust team restored the legitimate versions. Other crates from the same author, `internment` and `append-only-vec`, were similarly affected. The author's account was locked as a precautionary measure, as their credentials or computer were likely compromised, though the author is not believed to be malicious.

Affected Versions and Remediation

The malicious versions removed include `append-only-vec@0.1.9` (online for 107 minutes), `arrayref@0.3.10` (online for 86 minutes), and `internment@0.8.7` (online for 90 minutes). All versions of `proc-macro1`, `proc-macro-en`, `aovine`, `arone`, `aronenao`, and `tinymember` were also deleted. Developers are advised to check their local dependencies to ensure these malicious crates were not pulled into their projects. A command-line utility was provided to assist in this verification process.

Industry Impact

This incident underscores the ongoing threat of supply chain attacks within the software ecosystem. The compromise of popular crates, even for a short duration, can lead to widespread security vulnerabilities in downstream projects. The swift response by the Rust Security Response Team mitigated the potential damage, but it serves as a reminder for continuous vigilance in dependency management and security practices.