Malicious Rust crate arrayref runs a build-time payload

A compromised release of the popular Rust crate arrayref appeared on crates.io on August 20, 2026. Version 0.3.10 added a dependency on a typosquatted crate called proc-macro1, whose build script downloads and runs a remote binary while a project compiles. The code executes at build time, so simply compiling a project that pulled the bad versions is enough to trigger it. The crates.io team has since removed the malicious releases.

Which packages are involved

The genuine arrayref and append-only-vec crates are maintained by droundy, whose account appears to have been compromised: the GitHub repositories are no longer available. proc-macro1 was published by an account named dtolney, which closely resembles David Tolnay's real dtolnay handle. Its metadata forges authors = David Tolnay and points the repository field at a path that returns 404.

The malicious versions are arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, plus proc-macro1, proc-macro-en, aovine, arone, aronenao and tinymember. proc-macro1 is not the real proc-macro2: its src directory is a copy of proc-macro2, so builds kept working and the substitution went unnoticed.

What the build script does

The payload lives in the build script of proc-macro1 1.0.107. It stores its server address as base64 fragments and reassembles it at build time; decoded, those fragments produce the host hxxps://23.254.165.112:9089/ and the command-and-control address 23.254.165.112:443. The script fetches an architecture-specific binary over TLS without validating certificates, then detaches it from the build: on Unix it drops and runs /tmp/rust-setup, on Windows it writes a PowerShell script plus a VBScript launcher under %TEMP% and starts them hidden.

How it spread

The owner account yanked the older arrayref releases 0.3.5 through 0.3.9. Yanking makes Cargo print a warning that nudges developers toward the only non-yanked release — the malicious 0.3.10. The reporter who filed the RustSec advisory says that is how they hit it.

arrayref is widely used as a transitive dependency and sits deep in common Rust graphs through tiny-skia, sctk-adwaita and winit, which places it under most GUI work built on egui, eframe and iced. The crate has about 245 million all-time downloads, with the clean 0.3.9 accounting for roughly 152 million. SafeDep's write-up lists SHA256 hashes for the removed artifacts and network indicators for the payload host.