Malicious proc-macro1/build-script-build Reference Triggers Child Process Spawn

Duo Tech@duotech

•updated Aug 21, 2026•3•0•8

Detects process activity referencing the typosquatted proc-macro1 crate or build-script-build.exe spawning a child process — the build-time execution chain used to trigger the malicious proc-macro1 payload on Windows build hosts.