Detached Execution of Dropped rust-setup Payload from Build Process

Duo Tech@duotech

•updated Aug 21, 2026•1•0•2

Detects a build process (cargo/rustc/build-script-build) that drops an executable to /tmp/rust-setup and launches it detached so it persists after the build completes — the payload-delivery mechanism used by the compromised proc-macro1 Rust crate.