A compromised Rust crate ran malware every time you hit compile

Simply compiling your code was enough to download and run remote malware on your machine.

On August 20, 2026, attackers hijacked the maintainer account behind arrayref, a Rust crate with roughly 245 million downloads. They published version 0.3.10, adding a dependency on proc-macro1—a fake clone of the real proc-macro2 library. According to a SafeDep security analysis, the bad crate included a build script that secretly fetched and ran a remote binary during compilation. The attackers also yanked older clean versions, tricking Cargo into auto-upgrading developers to the malicious release.

Why it matters: You didn't need to run the final app or use the malicious macro to get infected. Cargo executes build scripts automatically at compile time. Because arrayref sits deep inside popular GUI libraries like winit and egui, the malicious code quietly touched developer environments across the Rust ecosystem.

Know this: The crates.io team quickly removed the bad packages. If you compiled Rust projects using arrayref around the incident, check your machine for /tmp/rust-setup on Unix or suspicious scripts under %TEMP% on Windows.

It's a stark reminder that running cargo build means executing arbitrary code from every package in your tree.