Rust supply chain attack: Malicious arrayref crate distributes build-time malware

A compromised release of the widely used Rust crate arrayref has been identified as a vector for a sophisticated supply chain attack. On 20 August 2026, version 0.3.10 of the crate was published on crates.io, introducing a dependency on a typosquatted package named proc-macro1. This malicious dependency contains a build script that downloads and executes a remote binary during the compilation process, compromising any project that builds the affected version.

The attack exploits the build-time execution environment of the Rust package manager, Cargo. The malicious code is not present in the arrayref source code itself but is triggered by a dependency entry in the manifest. When a project pulls in arrayref 0.3.10, Cargo fetches and builds the proc-macro1 crate. The build script of proc-macro1 version 1.0.107 then decodes a hidden server address, establishes a TLS connection that accepts any certificate without validation, and downloads an architecture-specific binary.

On Unix systems, the payload is written to /tmp/rust-setup and executed in a detached state. On Windows, the script writes a PowerShell payload and a VBScript launcher to the temporary directory, executing them hidden to escape the compiler’s job object. This allows the malicious code to persist and run independently of the build process. The proc-macro1 crate is a typosquat of the legitimate proc-macro2 library, with its source code being a mechanical find-and-replace of the genuine library to ensure builds continue to function seamlessly.

The incident has caused confusion among developers due to the actions of the compromised maintainer account, droundy. The account yanked previous releases of arrayref, versions 0.3.5 through 0.3.9. In the Rust ecosystem, yanking a crate causes Cargo to print a warning suggesting users update to a non-yanked version. This inadvertently directed developers toward the malicious 0.3.10 release. The GitHub repositories for the compromised crates and the droundy account are no longer available, returning 404 errors, which prevents upstream code inspection.

The crates.io team has removed the malicious versions from the registry. However, the incident highlights the significant risk posed by transitive dependencies in the Rust ecosystem. arrayref is a small crate with approximately 245 million all-time downloads and is a common transitive dependency for GUI frameworks such as egui, eframe, and iced. The attack demonstrates how malicious code can be hidden in build dependencies of widely used packages, bypassing standard source code reviews.

Developers are advised to audit their dependency trees for the presence of proc-macro1 or arrayref version 0.3.10. The RustSec advisory has been filed to alert the community. The incident underscores the need for robust supply chain security measures, including strict verification of dependency sources and monitoring of build-time activities.