Supply Chain Attack Compromises Popular Rust Crates arrayref and append-only-vec

On August 20, 2026, two widely used Rust crates, arrayref (244M downloads) and append-only-vec (4M downloads), were compromised through a malicious dependency on a typosquatted crate named proc-macro1. This dependency executes a remote payload during the build process, affecting any project that compiles these crates. The malicious code is embedded in the build script of proc-macro1, which downloads and runs a binary on the developer's machine without requiring any direct invocation of the compromised crates. The crates' maintainer, droundy, appears to have had their account compromised, leading to the injection of this malicious dependency. The attack's scope is significant, as arrayref is a transitive dependency in many Rust projects, particularly those involving GUI development. The crates.io team has removed the malicious versions, but the impact on developers who have already compiled projects with the affected versions remains a concern. The incident is considered the largest Rust crate compromise by download count, surpassing previous incidents.

Key Points: • Two popular Rust crates, arrayref and append-only-vec, were compromised via a malicious dependency. • The malicious crate proc-macro1 executes remote code during the build process, affecting many developers. • The attack's scope is extensive, with arrayref having 244 million downloads, making it a significant supply chain threat.