Malicious Rust crate Arrayref runs a build-time payload

On August 20, 2026, a compromised release of the popular Rust crate arrayref was found on crates.io. This version included a dependency on a typosquatted crate called proc-macro1, which contained malicious code. When a project compiled using this version of arrayref, the build script in proc-macro1 downloaded and ran a remote binary, triggering the malicious payload.

The crates.io team quickly removed the malicious versions, but the genuine arrayref and append-only-vec crates were maintained by an account that appeared to have been compromised. The GitHub repositories for these crates were also removed, making it difficult to inspect the upstream code. The malicious code was located in the build script of proc-macro1, not in arrayref itself.

Arrayref, a small crate with only four macros, added a dependency on proc-macro1 in version 0.3.10, which triggered the build script to run. Proc-macro1 was essentially a copy of proc-macro2, but with the necessary dependencies added to the build script to enable the malicious functionality. The malicious build script stored the server address and command and control address as base64 fragments, which were decoded at build time.

It then downloaded and executed an architecture-specific binary over a TLS connection without validation. This payload was designed to work on both Unix and Windows platforms. The owner account yanked older arrayref releases, pushing users towards the malicious 0.3.10 release. Arrayref is widely used as a transitive dependency in many Rust projects, making it a significant security concern.