Malicious Rust Crate arrayref Runs a Build-Time Payload
- Summary On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on crates.io.
- Version 0.3.10 added a dependency on a typosquatted crate called proc-macro1, whose build script downloads and runs a remote binary while a project compiles.
- The code runs at build time, so simply compiling a project that pulled the bad versions is enough to trigger it.
Unverified
- Summary On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on crates.io.
- Version 0.3.10 added a dependency on a typosquatted crate called proc-macro1, whose build script downloads and runs a remote binary while a project compiles.
- The code runs at build time, so simply compiling a project that pulled the bad versions is enough to trigger it.
Sources: Safedep