Rust crate arrayref 0.3.10 pulls in malware via proc-macro1 dependency

A newly published arrayref 0.3.10 on crates.io introduces its first-ever dependency on proc-macro1 1.0.107, a package whose build.rs downloads and executes a remote binary during compilation. Only arrayref 0.3.10 exactly and all versions of proc-macro1 are affected; the attackers yanked the previously clean 0.3.5-0.3.9 releases under the owner account to weaponize cargo's routine 'consider updating' warning as the social-engineering lure.

Because arrayref sits behind tiny-skia and sctk-adwaita in the dependency chain leading to winit, the exposure extends to popular Rust GUI stacks including egui/eframe and iced. arrayref 0.3.9 alone has roughly 152 million downloads, underscoring the scale of potential exposure even though only the newest release is malicious.

The malicious build script disables TLS certificate verification entirely, fetches an OS-specific payload, and launches it with a C2 address passed as a command-line argument. The child process escapes cargo's job object via mem::forget, allowing it to persist after the build finishes. Package metadata was forged to impersonate the real proc-macro2 author. Rust developers should immediately audit Cargo.lock files for arrayref 0.3.10 or any proc-macro1 dependency and check systems against the published indicators of compromise.