proc-macro1
A substitute implementation of the compiler's `proc_macro` API to decouple token-based libraries from the procedural macro use case.
Activity
- Latest release
- 3w ago
- Total releases
- 2
- Cadence
- ~daily
- Last 12 months
- 2
Reach
- Downloads
- 0
Details
- License
- MIT OR Apache-2.0
- First release
- Aug 20, 2026
| Version | Released | |
|---|---|---|
1.0.107
patch
2 CVEs
RUSTSEC-2026-0265
Aug 20, 2026
`proc-macro1` was removed from crates.io due to malicious code It was reported This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users of
Thanks to the Research Team at Nextron Systems GmbH for reporting this to the Rust security response working group, and thanks to Emily Albini for coordinating with the crates.io and infra-admin teams. References Updated Aug 21, 2026 · Source: OSV.dev
MAL-2026-14338
Malware
Aug 20, 2026
Malicious code in proc_macro1 (crates.io)
Critical
proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay rchaitm@gmail.com' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\rust-setup.ps1 and launches it via a %TEMP%\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io. References Updated Aug 21, 2026 · Source: OSV.dev |
1.0.107
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.0.106
initial
2 CVEs
RUSTSEC-2026-0265
Aug 20, 2026
`proc-macro1` was removed from crates.io due to malicious code It was reported This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked. This crate was used as part of a malware campaign targeted at users of
Thanks to the Research Team at Nextron Systems GmbH for reporting this to the Rust security response working group, and thanks to Emily Albini for coordinating with the crates.io and infra-admin teams. References Updated Aug 21, 2026 · Source: OSV.dev
MAL-2026-14338
Malware
Aug 20, 2026
Malicious code in proc_macro1 (crates.io)
Critical
proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay rchaitm@gmail.com' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\rust-setup.ps1 and launches it via a %TEMP%\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io. References Updated Aug 21, 2026 · Source: OSV.dev |