Malicious Rust Crate 'arrayref' Executes Build-Time Payload
Original: Malicious Rust crate Arrayref runs a build-time payload
Why This Matters
This attack highlights the severe risk of build-time malware and supply chain compromise in the Rust ecosystem.
On August 20, 2026, a compromised version of the popular Rust crate 'arrayref' (v0.3.10) was published to crates.io, introducing a dependency on a typosquatted crate 'proc-macro1' that downloads and executes a remote binary at build time. The crates.io team has since removed the malicious versions.
On August 20, 2026, security firm SafeDep reported that version 0.3.10 of the widely used Rust crate 'arrayref' had been tampered with on crates.io. The compromised release introduced a dependency on a malicious crate named 'proc-macro1'—a typosquatted name closely mimicking the legitimate 'proc-macro2' crate associated with well-known Rust developer David Tolnay.
The malicious 'proc-macro1' crate contained a build script that downloads and executes a remote binary during compilation. Because the payload runs at build time, any developer who compiled a project referencing the compromised versions of 'arrayref' would have triggered execution—without any additional user interaction.
The legitimate 'arrayref' and 'append-only-vec' crates are maintained by the GitHub account 'droundy,' which appears to have been compromised. The corresponding GitHub repositories and the 'droundy' account itself now return 404 errors, making upstream code inspection impossible. The fraudulent 'proc-macro1' crate was published by an account named 'dtolney'—deliberately similar to David Tolnay's real 'dtolnay' account—and forged its author metadata to further impersonate him.
The crates.io security team has removed the malicious versions. SafeDep noted that indicators of compromise and a full technical analysis are available in their reporting.