Compromised Rust crates on crates.io silently execute malware at build time
https://research.jfrog.com/post/arrayref-proc-macro1-crates-io/
Published: August 20, 2026 00:00
On August 20th, the popular Rust crates arrayref, internment, and append-only-vec were compromised on crates.io. The malicious versions silently pulled in proc-macro1, a typosquat of proc-macro2, whose build.rs downloads and executes a remote payload on…