Supply Chain Attack Compromises Popular Rust Crates, Injecting Malware into Developer Systems
Two widely used Rust crates, `append-only-vec` (4 million downloads) and `arrayref` (244 million downloads), have been compromised in a supply chain attack. On August 20, a malicious dependency named `proc-macro1` was injected into these crates. This dependency, a typosquat of the legitimate `proc-macro2`, downloads and executes a remote payload during the build process on a developer's machine. The infection occurs simply by compiling a project that uses either of the compromised crates, without needing to call any of their specific functionalities. The malicious logic resides in the `build.rs` file of `proc-macro1`, which is automatically compiled and run by Cargo. The payload is designed to be platform-specific, targeting Linux x86_64, Windows x86_64, and macOS (x86_64 and aarch64). This incident represents the largest Rust crate compromise by download count observed to date. 
