Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

A compromised Rust maintainer account was used to publish malicious versions of popular crates, affecting packages with a combined 245 million downloads. The attack exploited the trusted position of a legitimate account to inject a typosquatted dependency ('proc-macro1') that executed a remote payload at build time—meaning developers were compromised simply by compiling their project, without ever running the malicious code directly. This highlights the critical risk of transitive, build-time dependencies in modern software supply chains, where implicit trust in package registries can be weaponized. The incident underscores that supply chain attacks do not require a vulnerability in software itself—only access to a trusted publishing identity.