Malware: `arrayref` 0.3.10 executes a remote payload at build time via typosquatted `proc-macro1` · Issue #3161 · rustsec/advisory-db · GitHub
//voltron/issues_fragments/issue_layout" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
rustsec
advisory-db
Public
Notifications<br>You must be signed in to change notification settings
Fork<br>525
Star<br>1.2k
Malware: arrayref 0.3.10 executes a remote payload at build time via typosquatted proc-macro1 #3161
New issue<br>Copy link
New issue<br>Copy link
Closed as not planned
Closed as not planned<br>Malware: arrayref 0.3.10 executes a remote payload at build time via typosquatted proc-macro1#3161
Copy link
Description
jhobern<br>opened on Aug 20, 2026
Issue body actions
arrayref 0.3.10 (2026-08-20 07:15 UTC, by droundy) adds a first-ever
dependency on proc-macro1 1.0.107 (07:11 UTC, by dtolney), whose build.rs
downloads and executes a remote binary. Both are live as I file this;
security@rust-lang.org emailed separately.
Affected: arrayref =0.3.10, proc-macro1 all versions. 1.0.106 is a clean
copy of proc-macro2 published 5h earlier — staging, but not itself malicious.
arrayref ≤0.3.9 are clean.
Reach: tiny-skia → sctk-adwaita → winit, so under egui/eframe, iced,
and most Rust GUI work. 0.3.9 has ~152M downloads.
Delivery: 0.3.5–0.3.9 are all yanked under the owner account, so cargo's
consider updating to a version that is not yanked warning is the lure. That is
how I hit it. droundy is presumably compromised.
Payload — proc-macro1-1.0.107/build.rs
const SRC_URL_PARTS: &[&str] =<br>&["aHR0cHM6Ly8=", "MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "OTA4OS8="];<br>const END_URL_PARTS: &[&str] =<br>&["MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "NDQz"];
→ https://23.254.165.112:9089/, 23.254.165.112:443. Fetched over rustls with
an AcceptAll ServerCertVerifier (all three verify methods return success
unconditionally), selecting rust-crate_0.1.0/_0.2.0/_0.3.0/_0.4.0 by
target, then executed with the second URL as argv[1]:
Unix: /tmp/rust-setup, chmod +x, detached spawn, stdio null.
Windows: %TEMP%\rust-setup.ps1 via a %TEMP%\rust-setup-launch.vbs launcher
under wscript.exe //B //Nologo + CREATE_NO_WINDOW, then
std::mem::forget(child) — commented in-source as escaping cargo's job object
so the build does not wait on it.
src/ is genuine proc-macro2, so builds succeed normally. Metadata forges
authors = ["David Tolnay "] and
repository = ".../dtolnay/proc-macro1" (404).
IOCs
23.254.165.112:9089 payload host<br>23.254.165.112:443 C2 (argv[1])<br>/tmp/rust-setup<br>%TEMP%\rust-setup.ps1 , rust-setup-launch.vbs<br>rust-crate_0.1.0 / _0.2.0 / _0.3.0 / _0.4.0
sha256<br>arrayref 0.3.10 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae<br>proc-macro1 1.0.107 61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4<br>proc-macro1 1.0.106 b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436
Reactions are currently unavailable
Metadata<br>Metadata<br>Assignees
No one assigned
Labels
No labelsNo labels
Type
No type
Projects
No projects
Milestone
No milestone
Relationships
None yet
Development
No branches or pull requests
Issue actions<br>Open in GitHub Copilot app
You can’t perform that action at this time.