Malicious Rust Crate arrayref Runs a Build-Time Payload - Real-time Open Source Software Supply Chain Security
Login Start for Free 1.5k
Back Discover & Monitor<br>SCA & SBOM Scan dependencies, generate SBOMs, enforce policy.
AI Agent Discovery See every AI tool and SDK in your org.
AI Agent Monitoring Audit every action your AI agents take.
Protect<br>Developer Security Block malicious packages at install-time.
CI/CD Security Block malicious packages in your pipeline.
MCP Server Block threats inside your AI coding agent.
Agent API Threat intelligence API for custom agents.
Threat Intelligence Real-time malicious package verdicts.
Govern<br>Endpoint Protection Package events & AI inventory in the cloud.
Platform Centralized policies, dashboard, compliance.
Open Source<br>Vet Scan and govern your dependencies across every PR and build.
PMG Block malicious packages at install-time, before they enter your codebase.
xbom Generate AI-enriched BOMs using real code evidence, not just manifests.
GRYPH Monitor every AI coding agent action across your projects and workflows.
Login Start for Free 1.5k
Back to Blog
Malicious Rust Crate arrayref Runs a Build-Time Payload<br>Malware<br>Security
SafeDep Team<br>• Aug 20, 2026 • 7 min read
On this page 6 sections
On this page
` rules instead of the old inline `prose-* / [&_…]`<br>modifier string — that string compiled to ~40 complex selectors that<br>Chrome iOS (WKWebView) re-matched on every scroll recalc, blanking the<br>page. Base `prose prose-lg prose-invert` reset is kept. Running text is<br>capped at a readable measure in that file; code blocks, tables, and<br>embeds intentionally span the full column.<br>-->
Summary
On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on<br>crates.io. Version 0.3.10 added a dependency on a typosquatted crate called<br>proc-macro1, whose build script downloads and runs a remote binary while a project compiles.<br>The code runs at build time, so simply compiling a project that pulled the bad versions is enough<br>to trigger it. The crates.io team has since removed the malicious versions.
Packages involved
The genuine arrayref and append-only-vec crates are maintained by droundy, whose account<br>appears to have been compromised. The corresponding GitHub repositories are no longer available.<br>github.com/droundy/arrayref,<br>github.com/droundy/append-only-vec, and the entire github.com/droundy account all return 404,<br>so the upstream code is no longer available for inspection. A separate account, dtolney, published<br>proc-macro1.<br>The username closely resembles David Tolnay’s real dtolnay account. Its metadata forges<br>authors = ["David Tolnay [email protected]>"] and points repository at a<br>dtolnay/proc-macro1 path that returns 404.
CrateVersionPublisherStatusarrayref0.3.10droundy (compromised)Malicious, removedproc-macro1all versionsdtolney (impersonation)Malicious typosquat, entire crate removedappend-only-vec0.1.9droundy (compromised)Flagged by reporters, same actorarrayref0.3.9 and earlierdroundyClean
Note that proc-macro1 is not proc-macro2. The real crate that macro authors depend on is<br>proc-macro2. The src/ of the malicious proc-macro1<br>is a genuine copy of proc-macro2, so builds kept working while the build script ran.
What the build script does
The payload lives in the build script of proc-macro1 1.0.107. It stores its server address as<br>base64 fragments and reassembles them at build time, quoted in the advisory:
// proc-macro1-1.0.107/build.rs (quoted in rustsec/advisory-db#3161)
const SRC_URL_PARTS: &[&str] =
&["aHR0cHM6Ly8=", "MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "OTA4OS8="];
const END_URL_PARTS: &[&str] =
&["MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "NDQz"];
Decoded, those fragments produce the payload host hxxps://23[.]254[.]165[.]112:9089/ and the<br>command and control address 23[.]254[.]165[.]112:443. The script fetches an architecture-specific<br>binary over a TLS connection that accepts any certificate without validation, then runs it detached<br>from the build. On Unix it drops and runs /tmp/rust-setup. On Windows it writes a PowerShell<br>script and a VBScript launcher under %TEMP% and starts them hidden, then abandons<br>the child process so the compiler does not wait for it.
How it spread
The owner account yanked the older arrayref releases 0.3.5 through 0.3.9. Yanking a<br>crate makes Cargo print a “consider updating to a version that is not yanked” warning, which nudges<br>developers toward the only non-yanked release, the malicious 0.3.10. The reporter who filed the<br>RustSec advisory noted this is how they hit<br>it.
arrayref is widely used as a transitive dependency. It sits deep in common Rust graphs through<br>tiny-skia, sctk-adwaita, and winit, which places it under most GUI work built on egui,<br>eframe, and iced. The crate has about 245 million all-time downloads (244,989,384 at time of<br>writing), with the clean 0.3.9 release accounting for roughly 152 million. Those numbers measure<br>how widely the crate is used rather than a count...