arrayref

Details

**Severity:** Critical

**Affected versions:** `= 0.3.10`

arrayref 0.3.10 was published to crates.io from a maintainer account (droundy) that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared dependency, so building any project that resolves arrayref 0.3.10 pulls in and builds proc-macro1, whose build script downloads and executes an architecture-specific remote binary at build time from https://23.254.165.112:9089/ and passes 23.254.165.112:443 as a command-and-control address. Part of a coordinated crates.io campaign on 2026-08-20 that also trojanized internment and append-only-vec. The malicious release has been removed from crates.io; releases 0.3.9 and earlier are unaffected.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3b4ff66ce44ef274813534c270e0984580ad4f11/osv/malicious/crates.io/arrayref/MAL-2026-14336.json))

**References:**
- https://github.com/rustsec/advisory-db/issues/3161
- https://github.com/ossf/malicious-packages/blob/3b4ff66ce44ef274813534c270e0984580ad4f11/osv/malicious/crates.io/arrayref/MAL-2026-14336.json
- https://safedep.io/arrayref-proc-macro1-rust-build-time-malware
- https://github.com/advisories/GHSA-jwh4-228v-r358

Compromised versions (1)

• = 0.3.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.