A typosquatted package named proc-macro1 turned out to be the delivery vehicle for a build-time attack on the Rust ecosystem. Three popular crates, arrayref, internment, and append-only-vec, received poisoned releases on August 20 from a compromised maintainer account, and crates.io removed all of them within about two hours.
Each tainted release carried a direct dependency on proc-macro1, and its build script downloaded and ran a remote payload during compilation. Merely resolving the dependency triggered execution, so projects never had to call anything from the crates themselves. The three libraries are widespread, with hundreds of millions of cumulative downloads.
Nextron Systems first reported the malicious build script at 07:15 UTC, and the Rust Security Response Team confirmed it after pulling the packages. The response team’s guidance: scan ~/.cargo/registry/cache for leftover files and pin arrayref to 0.3.9 or earlier. The RUSTSEC-2026-0260 advisory lists no CVE and says there is no evidence that any project actually compiled the bad versions.
Researchers at Wiz see infrastructure overlap between this campaign and recent supply-chain activity attributed to North Korea, a pattern that has surfaced in earlier crates.io incidents.
