Malicious Rust crate arrayref ran its payload at build time via proc macro
JeremyCMorgan · x · 2026-08-29
A compromised release of the popular Rust crate arrayref (v0.3.10) appeared on crates.io on Aug 20, 2026, according to SafeDep's analysis. Maintainer droundy's account appears to have been compromised, and the release added a dependency on the typosquatted crate proc-macro1.
Its build script downloads and runs a remote binary while the project compiles — a single cargo build is enough to trigger the payload, no runtime execution needed. append-only-vec from the same maintainer was also affected; crates.io has since removed the malicious versions.
Key takeaway for CI: proc macros and build scripts are an execution surface, so build environments need supply-chain protection too.
More from Safety
- 24 Hours Later: What I Built to Protect My AI After Getting Hacked Advice — Astrokanu · 2026-08-29
- Anthropic Launches Insights Tool for Privacy-Preserving AI Research — EricBuess · 2026-08-29
- Gary Marcus and Zack Korman analyze OpenAI/Hugging Face security standards — GaryMarcus · 2026-08-29
- Experiment: GPT-5.6 Sol tool calling controlled at 0.01 threshold — rayanpal_ · 2026-08-29
- Gary Marcus: Five Lessons From the OpenAI Attack on Hugging Face — Gary Marcus · 2026-08-29
- Gary Marcus to analyze OpenAI/Hugging Face attack, focusing on negligence — GaryMarcus · 2026-08-29