Summary On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on crates.io. Version 0.3.10 added a dependency on a typosquatted crate called proc-macro1 , whose build script downloads and runs a remote binary while a project compiles. The code runs at build time, so simply compiling a project that pulled the bad versions is enough to trigger it. The crates.io team has since removed the malicious versions. Packages involved The genuine arrayref and append-only-vec crates are maintained by droundy , whose account appears to have been compromised. The corresponding GitHub repositories are no longer available. github.com/droundy/arrayref , github.com/droundy/append-only-vec , and the entire github.com/droundy account all return 404, so the upstream code is no longer available for inspection. A separate account, dtolney , published proc-macro1 . The username closely resembles David Tolnay’s real dtolnay account.…