Security Alert: Build-Time Payload Discovered in Malicious Rust Crate arrayref

---

📌 Executive Summary

On August 20, 2026, a security breach was identified involving a compromised release of the widely used Rust crate arrayref on crates.io. The attackers released version 0.3.10, which introduced a dependency on a typosquatted crate named proc-macro1.

The danger lies in the build script of proc-macro1, which executes a remote binary during the compilation process. Because this occurs at build time, any developer or CI/CD pipeline simply compiling a project that pulls this version is automatically infected.

🛠️ Attack Vector Flow

---

📦 Affected Packages & Impersonation

The attack targeted crates maintained by the user droundy, whose account was compromised. Interestingly, the username droundy is a close imitation of the well-known developer dtolnay. The attackers went as far as forging metadata to claim the author was David Tolnay (using a fake email) and pointing to a non-existent GitHub repository.

Currently, the GitHub account github.com/droundy and its associated repositories (arrayref, append-only-vec) return 404 Not Found, removing the possibility of upstream code inspection.

Status of Compromised Crates

[!IMPORTANT] Note: proc-macro1 is not the same as the legitimate proc-macro2. To avoid detection, the attackers copied the actual source code of proc-macro2 into proc-macro1 so that the project would still compile successfully while the malware ran in the background.

---

🔍 Technical Analysis of the Payload

The Build Script Execution

The malicious logic is embedded within the build.rs file of proc-macro1 version 1.0.107. To evade simple string searches, the attackers stored the server addresses as base64 fragments.

Example from the RustSec advisory:

// proc-macro1-1.0.107/build.rs
const SRC_URL_PARTS : [ str ] = [ 
    "aHR0cHM6Ly8=", "MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "OTA4OS8=" 
]; 
const END_URL_PARTS : [ str ] = [ 
    "MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "NDQz" 
];

When decoded, these strings reveal:

• Payload Host: hxxps://23[.]254[.]165[.]112:9089/
• C2 Server: 23[.]254[.]165[.]112:443

Execution Logic

The script establishes a TLS connection (ignoring all certificate validation) to fetch a binary tailored to the host's architecture.

• On Unix systems: The binary is saved to /tmp/rust-setup.
• On Windows systems: It writes a PowerShell script (rust-setup.ps1) and a VBScript launcher (rust-setup-launch.vbs) to the %TEMP% directory. The VBScript launches the PowerShell script in hidden mode and detaches the process so the Rust compiler doesn't hang while waiting for the malware to finish.

---

📈 Distribution & Impact

The "Yanking" Strategy

The attackers utilized a clever social engineering trick: they yanked legitimate versions 0.3.5 through 0.3.9 of arrayref.

In the Rust ecosystem, when a version is yanked, cargo issues a warning suggesting the user update to a non-yanked version. This effectively nudged developers to upgrade to the malicious version 0.3.10.

Reach and Scale

The crate is a deep dependency for several major GUI frameworks. If you use any of the following, you may have been exposed:

• winit $\rightarrow$ sctk-adwaita $\rightarrow$ tiny-skia $\rightarrow$ arrayref
• Frameworks: egui, eframe, and iced.

Download Statistics: The total download count is approximately 245 million. We can represent the ratio of clean-to-total downloads as: $\text{Clean Ratio} \approx \frac{152,000,000}{244,989,384} \approx 62\%$

---

🚩 Indicators of Compromise (IoCs)

Network & File Indicators

Cryptographic Hashes (SHA256)

---

🛠️ Technical Deep Dive: The Injection

The arrayref crate is typically very lean, consisting of only four macros. Prior to version 0.3.10, it had no runtime dependencies and no build script. The compromise was achieved by adding a single line to the Cargo.toml manifest:

[package]
name = "arrayref"
version = "0.3.10"
build = false

[dependencies]
proc-macro1 = "1.0.107" # <--- The Malicious Injection

🛡️ Remediation Checklist

• Check Cargo.lock for arrayref version 0.3.10.
• Check Cargo.lock for any version of proc-macro1.
• Scan %TEMP% (Windows) or /tmp/ (Unix) for rust-setup files.
• Audit network logs for connections to 23.254.165.112.
• Force downgrade to a known safe version of arrayref (e.g., 0.3.9).