News › security
By Zayden R., August 22, 2026
Rust's arrayref crate version 0.3.10 was compromised, adding a malicious build-time payload via proc-macro1. Engineers should verify dependencies and update their projects to avoid security risks.
On August 20, 2026, a significant security breach emerged in the Rust ecosystem as malicious code was discovered in version 0.3.10 of the popular arrayref crate. The compromised version introduced a dependency on a typosquatted crate named proc-macro1, which executed a build-time payload designed to download and run a remote binary during compilation. This incident highlights the persistent vulnerabilities in open-source software supply chains.
The threat was identified when security teams noticed the unusual behavior associated with the proc-macro1 crate, which masqueraded as the legitimate proc-macro2 crate. The malicious activity was linked to a build script that triggered the payload, posing a serious risk for any project that compiled using the affected versions. As reported by LWN, the crates.io team responded promptly by removing the malicious versions and locking the compromised accounts.
Further investigation by security researchers, including those from Wiz, revealed that the infrastructure used in this attack bore similarities to previous campaigns associated with North Korean threat actors. In addition to arrayref, other crates such as [email protected] and [email protected] were also affected, all redirecting through proc-macro1. This kind of supply chain attack underscores the importance of stringent dependency management and continuous security monitoring.
For developers and system administrators, the immediate action is to audit their projects for dependencies on these compromised crates. Updating to secure versions and ensuring that their systems are not inadvertently running malicious code is critical. With the upstream GitHub repositories for these crates now inaccessible, engineers should exercise caution and verify their codebases thoroughly.
This breach serves as a stark reminder of the vulnerabilities inherent in open-source ecosystems, urging developers to adopt proactive security measures in their software development lifecycle.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.