Rust advisories / proc-macro-en
VulnerabilityRUSTSEC-2026-0264 · proc-macro-en
RUSTSEC-2026-0264: `proc-macro-en` was removed from crates.io due to malicious code
Short answerA security vulnerability in the proc-macro-en crate: `proc-macro-en` was removed from crates.io due to malicious code. No severity score was published. No fixed version: replace the crate or remove the affected code path.
| Crate | proc-macro-en |
|---|---|
| Type | Vulnerability (malicious) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-08-20 |
| Last changed | 2026-08-21 |
| Also known as | none |
What to do
- Find who pulls it in:
cargo tree -i proc-macro-en. - Avoid the affected API, or replace the crate.
Details from the advisory
We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack.
This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked.
This crate was used as part of a malware campaign targeted at users of arrayref, which was downloaded 2,285 times before being removed; see the arrayref advisory for more detail.
References
- Package: crates.io/crates/proc-macro-en
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0264.html
- Web: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for proc-macro-en
Up next
Same crateproc-macro-en: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?