On August 20, we detected two popular Rust crates from the same maintainer, append-only-vec (4M downloads) and arrayref (244M downloads), were compromised. The attacker added a malicious dependency on a package called proc-macro1 , which downloads a remote payload during the build and executes it on the developer's machine. Because the dependency runs at build time, simply compiling a project that pulls in either crate is enough to trigger the infection, with no need to call any of the crate's actual functionality. This is considerably more significant than the Onering crate compromise we covered in June. This time the blast radius is much larger, making it the largest Rust crate compromise we have seen by download count.
We first caught proc-macro1 in our pipeline as a new package doing something suspicious, downloading a remote file and executing it. The name is a typosquat of proc-macro2 , one of the most widely used crates in the Rust ecosystem, and the package copies the real crate's description, author name, and documentation to pass as the genuine project. Given the low download count, we did not think much of it at first. However, within the same hour we then saw two popular packages from the maintainer of append-only-vec and arrayref suddenly depend on proc-macro1 . That is what turned a regular typosquat into a real supply chain incident.
The two compromised crates are clean at first sight. Their library source is the genuine upstream code, and neither crate references proc-macro1 anywhere in its source. The entire compromise is a single injected line in each manifest:
The malicious logic lives entirely in the build.rs file of proc-macro1 , which Cargo compiles and runs automatically during a build. The build script hides its network destination as base64 fragments to evade string scanners:
At build time it selects a payload for the victim's exact operating system and CPU architecture (Linux x86_64, Windows x86_64, macOS x86_64, macOS aarch64), then downloads it over HTTPS with a plain GET request. On Unix and macOS it writes the downloaded bytes to disk, marks the file executable, and spawns it detached with its output suppressed:
On Windows it writes a PowerShell script and launches it hidden through a wscript and .vbs launcher, a technique the code's own notes is chosen to escape Cargo's job object so the spawned process keeps running after the build finishes.
We also detected a similar malicious package called proc-macro-en , published under the author name daveroundy . That author name mimics droundy , the legitimate maintainer of append-only-vec and arrayref , which suggests the attacker was building out additional lookalike packages and impersonating the same maintainer to lend them credibility.
If you are an Aikido user, check your central feed and filter on malware issues. This will surface as a 100/100 critical issue. Aikido rescans nightly, but we recommend triggering a manual rescan now.
If you are not yet an Aikido user, you can create an account and connect your repos. Our malware coverage is included in the free plan, no credit card required.
For broader coverage across your whole team, Aikido's Device Protection gives you visibility and control over the software packages installed on your team's devices. It covers browser extensions, code libraries, IDE plugins, and build dependencies, all in one place. Stop malware before it gets installed.
For future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.
Secure your code, cloud, and runtime in one central system. Find and fix vulnerabilities fast automatically.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
