If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay (dtolnay). Its metadata forges authors 'David Tolnay <rchaitm@gmail.com>' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependent builds succeed, but build.rs reconstructs a base64-encoded URL and downloads an architecture-specific remote binary from https://23.254.165.112:9089/ over TLS with certificate validation disabled (a custom verifier that accepts any certificate), then executes it detached, passing 23.254.165.112:443 as argv[1] (command and control). On Unix it writes and runs /tmp/rust-setup; on Windows it writes %TEMP%\rust-setup.ps1 and launches it via a %TEMP%\rust-setup-launch.vbs launcher under wscript.exe. The download and execution run unconditionally on every build on a supported platform. This crate was the payload carrier pulled in by the trojanized arrayref 0.3.10 release. All versions have been removed from crates.io.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]1[.]0 other packages →
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]2[.]0 other packages →
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]3[.]0 other packages →
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]4[.]0 other packages →
IP addresses
- 23[.]254[.]165[.]112 other packages →