Rust crates arrayref & append-only-vec compromised via malicious proc-macro1 dependency

What Happened

On August 20, 2026, two widely-downloaded Rust crates: arrayref (244M downloads) and append-only-vec (4M downloads), were compromised by an attacker who injected a single malicious dependency line into each crate's Cargo.toml manifest, pointing to a typosquatted package called proc-macro1 (mimicking the legitimate proc-macro2). The malicious logic resides entirely in proc-macro1's build.rs file, which Cargo automatically compiles and executes at build time, meaning any developer who simply builds a project depending on either crate triggers the infection without calling any library functionality. The build script decodes base64-obfuscated URLs at runtime to download a platform-specific payload (Linux x86_64, Windows x86_64, macOS x86_64, macOS aarch64) from a remote host, writes it to disk, and executes it detached so it persists after the build finishes. A related lookalike package, proc-macro-en, was also published under the author name 'daveroundy', impersonating the legitimate maintainer 'droundy', suggesting the attacker was building additional infrastructure for the same campaign.

Affected Packages

- proc-macro1 version 1.0.107 (malicious dependency) 

- proc-macro-en version 1.0.10 (malicious dependency) 

- append-only-vec version 0.1.9 (uses the malicious dependency)

- arrayref version 0.3.10 (uses the malicious dependency)

For Semgrep Customers

1. Trigger a new scan if you haven't recently on your projects

2. Inspect using this URL: https://semgrep.dev/orgs/-/supply-chain/t/all?f=CgAqAEIASgBaAHIAigEDkYUUogEAqgEAsgEAugEA0gEA2gEA4gEA6gEA%2BgEAiAIBkgIAmgIAugIA8gIA%2BgIAggMAigMAmgMBAaIDAKoDALoDAA%3D%3D

3. Check the advisories page to see if any projects have installed these package versions recently: https://semgrep.dev/orgs/semgrep/advisories/ssc-cb02a3f3-d8cd-43b0-9334-c9ab0bf078c1    

Dependency filter: https://semgrep.dev/orgs/semgrep/supply-chain/t/dependencies?packages=proc-macro1%3Aexact-name%3Aexact%3A1.0.107%2Cproc-macro-en%3Aexact-name%3Aexact%3A1.0.10%2Cappend-only-vec%3Aexact-name%3Aexact%3A0.1.9%2Carrayref%3Aexact-name%3Aexact%3A0.3.10

Indicators of Compromise

Packages

- proc-macro1@1.0.107

- proc-macro-en@1.0.10

- append-only-vec@0.1.9

- arrayref@0.3.10

Domains / C2 Servers

- 23.254.165.112:9089

- 23.254.165.112:443

Files / System Artifacts

- /tmp/rust-setup

- rust-crate_0.1.0 (Linux x86_64 ELF, SHA-256: 408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434)

- rust-crate_0.4.0 (macOS aarch64 Mach-O, SHA-256: 74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306)