Two widely used Rust crates, append-only-vec (4M+ downloads) and arrayref (244M+ downloads), were compromised by their own maintainer's account being abused to inject a malicious dependency on a typosquatted package called proc-macro1. The build.rs script in proc-macro1 downloads and executes an OS/architecture-specific payload at build time via base64-obfuscated URLs, requiring only compilation, not usage, to trigger infection. A related lookalike package, proc-macro-en, was also found impersonating the same maintainer. The actual second-stage payload could not be recovered since the delivery host stopped serving it during analysis. Indicators of compromise including package versions and network addresses are provided for detection.
Questions this post answers
What happened with the arrayref and append-only-vec Rust crate compromise?
Both crates, maintained by the same author, had a malicious dependency on a typosquatted package called proc-macro1 injected into their manifests. The library source code itself remained the genuine upstream code, but proc-macro1's build.rs script runs automatically during compilation, downloading and executing an OS-specific payload without requiring any of the crate's functions to be called. Track emerging Rust supply chain incidents like this one as they surface on daily.dev.
How does the proc-macro1 malicious Rust package execute its payload without being called?
It abuses Cargo's build.rs mechanism, which Cargo automatically compiles and runs during a build. The script hides its command-and-control address (23.254.165.112) as base64-encoded string fragments, selects a payload matching the victim's OS and architecture, downloads it over HTTPS, writes it to disk (e.g. /tmp/rust-setup on Unix), marks it executable, and spawns it detached with output suppressed. Developers vetting Rust dependencies for build-time risks can follow coverage like this on daily.dev.
Which versions of arrayref and append-only-vec are compromised by the proc-macro1 supply chain attack?
append-only-vec version 0.1.9 and arrayref version 0.3.10 are the compromised releases, pulling in the malicious proc-macro1 dependency at version 1.0.107. A related lookalike package named proc-macro-en at version 1.0.10 was also published under an author name impersonating the crates' legitimate maintainer, droundy. daily.dev helps developers stay ahead of exact version numbers flagged in incidents like this.