Two malicious Rust crates—proc-macro1 version 1.0.107 and proc-macro-en version 1.0.10—impersonate the naming, source, authorship, and metadata of the legitimate proc-macro2 ecosystem.
Both contain the same malicious build.rs, byte for byte. Building either crate directly or as a transitive dependency downloads and launches a platform-specific payload. Commands that may trigger execution include cargo build, cargo check, and cargo test.
The build script: