RUSTSEC-2026-0265
`proc-macro1` was removed from crates.io due to malicious code
It was reported proc-macro1 contained a build script that would download a
malicious payload.
This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked.
This crate was used as part of a malware campaign targeted at users of
arrayref, which was downloaded 2,285 times before being removed; see
the arrayref advisory for more detail.
Thanks to the Research Team at Nextron Systems GmbH for reporting this to the Rust security response working group, and thanks to Emily Albini for coordinating with the crates.io and infra-admin teams.
What each source reports
OSV No score
`proc-macro1` was removed from crates.io due to malicious code
It was reported proc-macro1 contained a build script that would download a
malicious payload.
This crate had two versions, both published on 2026-08-20. The crate was removed from crates.io and related user accounts were locked.
This crate was used as part of a malware campaign targeted at users of
arrayref, which was downloaded 2,285 times before being removed; see
the arrayref advisory for more detail.
Thanks to the Research Team at Nextron Systems GmbH for reporting this to the Rust security response working group, and thanks to Emily Albini for coordinating with the crates.io and infra-admin teams.
- Record
RUSTSEC-2026-0265- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
proc-macro1crates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0265 is a vulnerability with no CVSS score yet in proc-macro1, published August 20, 2026. No source lists public exploit code. No source names a fixed version.