Hijacked Rust crate arrayref pulls typosquatted dep that runs malware at build time

A compromised release of arrayref, a tiny but heavily-used Rust crate, briefly shipped malware to anyone who compiled a project depending on it. On August 20, 2026, version 0.3.10 landed on crates.io with a single new manifest entry: a dependency on proc-macro1, a crate typosquatting the ubiquitous proc-macro2. Its source was a mechanical find-and-replace copy of the real thing, so builds succeeded normally, but its build script fetched an architecture-specific binary from a hardcoded IP over a TLS connection that accepted any certificate, then launched it detached from the compiler. On Unix it dropped and ran /tmp/rust-setup; on Windows it staged a PowerShell payload behind a VBScript launcher to escape Cargo’s job object. Because the code executes at build time with no feature flag or environment guard, merely compiling was enough to trigger it. Attackers forged David Tolnay’s identity in the package metadata (the account dtolney impersonating dtolnay) to lend the fake crate credibility.