Proc macros can run arbitrary code, so this POC is not that interesting - apart from raising awareness for the problem.<p>This can be done even easier without users having to use a macro: with `build.rs` build scripts, which are run by default. So all you'd need is to compromise some popular dependency with a custom build.rs<p>Many other languages have the same (or at least similar) problem (Makefiles, npm hooks, ...)<p>There is an interesting proposal and prototype for compiling proc macros to WASM so they can be run in a sandbox: <a href="https://github.com/dtolnay/watt" rel="nofollow">https://github.com/dtolnay/watt</a><p>But in the end it doesn't make that much difference: nothing prevents a random library from just reading your secrets and calling curl to send it to a server at runtime.<p>Build time execution is definitely an additional attack vector.<p>But if you use a third party dependency, you have to trust it or review all it's code for every version. There is no way around this, and it's true for any language.