VulnerabilityRUSTSEC-2026-0265 · proc-macro1
RUSTSEC-2026-0265: `proc-macro1` was removed from crates.io due to malicious code
Short answerA security vulnerability in the proc-macro1 crate: `proc-macro1` was removed from crates.io due to malicious code. No severity score was published. No fixed version: replace the crate or remove the affected code path.
| Crate | proc-macro1 |
|---|---|
| Type | Vulnerability (malicious) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | not scored |
| Published | 2026-08-20 |
| Last changed | 2026-08-21 |
| Also known as | none |
What to do
- Find who pulls it in:
cargo tree -i proc-macro1. - Avoid the affected API, or replace the crate.
Details from the advisory
It was reported proc-macro1 contained a build script that would download a malicious payload.
This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked.
This crate was used as part of a malware campaign targeted at users of arrayref, which was downloaded 2,285 times before being removed; see the arrayref advisory for more detail.
Thanks to the Research Team at Nextron Systems GmbH for reporting this to the Rust security response working group, and thanks to Emily Albini for coordinating with the crates.io and infra-admin teams.
References
- Package: crates.io/crates/proc-macro1
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0265.html
- Web: blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for proc-macro1
Up next
Same crateproc-macro1: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?