Rust crate arrayref version 0.3.10 compromised on August 20, 2026; typosquatted proc-macro1 dependency downloads and executes malicious binary at build-time, affecting developers compiling projects with the tainted package.

Malicious Rust Crate arrayref Runs a Build-Time Payload

Summary On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on crates.io. Version 0.3.10 added a dependency on a typosquatted crate called proc-macro1, whose build script downloads and runs a remote binary while a project compiles. The code runs at build time, so simply compiling a project that pulled the bad versions is enough to trigger it. The crates.io team has since removed the malicious versions. Packages involved The genuine arrayref and append-only-vec c...