Rust Supply-Chain Attack: arrayref and proc-macro1 Crates Compromised
- Severity
- HIGH
- Affected component
- arrayref (cargo)
- Affected versions
- >= 0.3.10-0
- Patched version
- Not yet available
A confirmed supply-chain attack has compromised the arrayref and proc-macro1 Rust crates. These packages contain malicious code that executes during the build process, potentially affecting projects that use them.
What happened
The arrayref 0.3.10 and proc-macro1 packages in Rust have been compromised to execute a remote payload at build time. These versions contain malicious code that is executed during the build process. The attack was first flagged on August 20, 2026, and confirmed shortly thereafter. The malicious code was introduced via a dependency on a typosquatted package, proc-macro1, which impersonates the legitimate proc-macro2 crate.
The compromised versions of arrayref and proc-macro1 were published and subsequently removed from crates.io within a short timeframe. There is no evidence that these malicious versions were actually used in the wild. However, the potential impact is significant, given the popularity of the arrayref crate, which has over 53 million downloads in the past 90 days.
What to do about it
- Avoid using arrayref 0.3.10 and proc-macro1 in your projects.
- Monitor for any suspicious activities in your build processes.
- Consider using version control to track changes in your dependencies.
- Pin arrayref at version 0.3.9 or earlier to avoid the compromised version.
- Search your local cargo cache for any deleted crate files related to the affected versions.
- No official fix has been published yet. Monitor the primary sources for updates.
How 0Day would have caught this
arrayref is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project uses arrayref version 0.3.10 or later, or if it has a dependency on proc-macro1.
What should I do right now?
Immediately avoid using arrayref 0.3.10 and proc-macro1. Monitor your build processes for any suspicious activities and consider pinning arrayref to version 0.3.9 or earlier.
Has this been exploited in the wild?
There is no evidence that the malicious versions of arrayref and proc-macro1 were actually used in the wild.
Sources
- Malicious Rust Crate Arrayref Runs a Build-Time Payload
- Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
- Hackers poison arrayref Rust crate to push infostealer malware
- Rust Supply Chain Attack Linked to North Korean Hackers
- Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat Execute a Remote Payload at Build Time
- Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns