Malicious Rust crate Arrayref runs a build-time payload
Points and comments are a snapshot, not live.
A compromised Rust crate on crates.io uses a typosquatted dependency to run a build-time payload.
Version 0.3.10 of the popular `arrayref` crate adds a dependency on `proc-macro1`, a typosquat of `proc-macro2`. The build script of `proc-macro1` downloads and runs a remote binary during compilation on supported platforms (Linux x86_64, Windows x86_64, macOS x86_64 and aarch64). The payload host is at 23.254.165.112:9089. The crates.io team removed the malicious versions. The maintainer's account appears compromised, with updates also pushed to `internment` and `append-only-vec`. The `arrayref` crate has ~245 million all-time downloads.
What commenters are saying
Commenters see this as Node.js-style supply chain attacks migrating to Rust. Many criticize Cargo for lacking security controls like pnpm's default opt-in for build scripts, though some note that restricting build scripts alone won't stop runtime attacks. A common suggestion is sandboxing builds (e.g., bubblewrap) as developer machines are high-value targets with credentials. Others argue that the solution is audited collections of dependencies rather than trusting individual maintainers. Some point to existing tools like cargo-deny and cargo-crev.