Malicious Rust crate Arrayref runs a build-time payload

7.5 relevance

Malicious Rust crate supply chain attack is highly relevant to open source security and infrastructure.

AI/ML safedep.io

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a solutions architect focused on open-source supply chain security, this incident highlights how build-time payloads in Rust crates can compromise CI/CD pipelines and developer machines, especially when widely-used transitive dependencies are targeted via account compromise and typosquatting.

Key Takeaways

Audit your Rust project's dependency tree for typosquatted or yanked crates, and consider pinning versions or using tools like `cargo deny` to block build-script execution from untrusted sources.

Malicious Rust crate Arrayref runs a build-time payload

Summary

A compromised release of the popular Rust crate `arrayref` (v0.3.10) on crates.io added a dependency on a typosquatted crate `proc-macro1`, whose build script downloads and executes a remote binary at compile time. The attacker yanked older `arrayref` versions to push developers toward the malicious release, and the crate's 245 million all-time downloads place it as a transitive dependency in GUI frameworks like egui and iced. The crates.io team removed the malicious versions, but the `droundy` account and upstream repos remain unavailable.

Author

SafeDep Team