Malicious Rust Crate Arrayref Runs a Build-Time Payload
A malicious actor compromised the Rust programming language crate 'arrayref' to inject a build-time payload. The attack used a typosquatted dependency to download and execute remote code during the compilation process.
Why it matters
This incident highlights the ongoing security risks in software supply chains and the vulnerability of open-source package managers to account takeovers.
Back to Blog Malicious Rust Crate arrayref Runs a Build-Time Payload Malware Security SafeDep Team • Aug 20, 2026 • 7 min read On this page 6 sections On this page
On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on crates.io. Version 0.3.10 added a dependency on a typosquatted crate called proc-macro1 , whose build script downloads and runs a remote binary while a project compiles. The code runs at build time, so simply compiling a project that pulled the bad versions is enough to trigger it. The crates.io team has since removed the malicious versions.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in