MAL-2026-14335

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/aronenao/MAL-2026-14335.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14335
Published
2026-08-20T00:00:00Z
Modified
2026-08-21T00:01:42.164351976Z
Summary
Malicious code in aronenao (crates.io)
Details

aronenao is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a build-script payload; building it results in the download and execution of a remote binary from https://23.254.165.112:9089/ with 23.254.165.112:443 as command and control. All versions have been removed from crates.io. The individual build script of this crate was not analyzed directly; its behavior is attributed from the campaign.

References
Credits

Affected packages

crates.io / aronenao

Package

Name
aronenao
View open source insights on deps.dev
Purl
pkg:cargo/aronenao

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/aronenao/MAL-2026-14335.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]