Executive brief
The arrayref Rust library, a widely-used utility crate for array operations, was compromised to include a malicious dependency that downloads and executes arbitrary code during the build process. Developers who built projects using the affected version would unknowingly execute a remote payload, potentially compromising their development machines and entire build environments with arbitrary code execution capabilities.
Technical details
A supply chain attack compromised the arrayref crate (v0.3.10) by introducing a malicious dependency on a typosquatted proc-macro1 crate. The attacker's proc-macro1 build script downloads and executes a remote binary from 23.254.165.112:9089, with no certificate validation (AcceptAll verifier). The payload runs during compilation with context-specific executables (Linux: /tmp/rust-setup, Windows: PowerShell via VBS launcher) that spawn detached processes and communicate with a command-and-control server. The attack leverages yanked previous versions (0.3.5–0.3.9) to lure developers to upgrade to the malicious 0.3.10. Patches are not applicable; the malicious versions were deleted from crates.io on 2026-08-20, and the crate maintainer's account was locked.
Affected products
- Rust arrayref 0.3.10
- Rust proc-macro1 1.0.107
- Rust internment 0.8.7
- Rust append-only-vec 0.1.9
Timeline
- 2026-08-20: disclosed: Rust Security Response Team notified of proc-macro1 malice; malicious arrayref 0.3.10 published 07:15 UTC
- 2026-08-20: other: arrayref 0.3.10 deleted after 86 minutes online
- 2026-08-20: other: append-only-vec 0.1.9 deleted after 107 minutes online
- 2026-08-21: advisory