🧰 proc-macro2

The items that name it 2

• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeupas affected products2026-08-22

  Legitimate crate by David Tolnay; explicitly stated as NOT affected/compromised, only its typosquats are malicious

• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
  writeupas tools2026-08-20It is written here as proc-macro2 (legitimate crate).

  Legitimate crate with 154M+ downloads that proc-macro1 typosquats.