Rust Ecosystem Hit by Supply Chain Attacks with Malicious Crates

Security researchers uncovered malicious Rust crates impersonating proc-macro2 that install PowerShell backdoors via build scripts. The Rust blog confirmed a broader supply chain attack, including the hijacked arrayref crate; malicious versions have since been removed or rolled back.

2026-08-20 ~ 2026-08-21 · 2 related posts

• Malicious Rust crates impersonate proc-macro2 to drop PowerShell backdoor — cyb3rops · 2026-08-20
• Rust ecosystem hit by supply chain attack via malicious arrayref crate — peterjliu · 2026-08-21