On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on crates.io. Version 0.3.10 added a dependency on a typosquatted crate called proc-macro1, whose build script downloads and runs a remote binary while a project compiles. The code runs at build time, so simply compiling a project that pulled the bad versions is enough to trigger it. The crates.io team has since removed the malicious versions.

The genuine arrayref and append-only-vec crates are maintained by droundy, whose account appears to have been compromised. The corresponding GitHub repositories are no longer available. A separate account, dtolney, published proc-macro1, closely resembling David Tolnay's real dtolnay account.

The payload lives in the build script of proc-macro1 1.0.107. It stores its server address as base64 fragments and reassembles them at build time, producing the payload host hxxps://23[.]254[.]165[.]112:9089/ and command and control address 23[.]254[.]165[.]112:443. The script fetches an architecture-specific binary over a TLS connection that accepts any certificate without validation, then runs it detached from the build.

The owner account yanked older arrayref releases 0.3.5 through 0.3.9, nudging developers toward the only non-yanked release, the malicious 0.3.10. arrayref is widely used as a transitive dependency, sitting deep in common Rust graphs through tiny-skia, sctk-adwaita, and winit.