The Rust crate arrayref 0.3.10, published August 20, 2026 at 07:15 UTC, silently added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2 impersonating maintainer dtolnay. The build script fetched and executed a remote binary from a Hostwinds VPS during compilation, meaning simply building a project triggered the payload without any code being called. The attacker fabricated a GitHub and crates.io persona (dtolney) and appears to have compromised the legitimate arrayref maintainer's account, yanking older safe versions to push users toward the malicious release. Exposure lasted roughly 86 minutes before crates.io removed both packages. Because arrayref has around 245 million downloads and sits underneath winit, egui, iced, blake3, Solana, and Ethereum crates, the blast radius is large. Affected developers should check Cargo.lock for arrayref 0.3.10 or proc-macro1, look for dropped binaries and network egress to 23.254.165.112, rotate credentials if compromised, and pin arrayref to =0.3.9.
Table of contents
What happenedHow the attack worksWhy it matters: blast radiusAm I affected? What to do nowIndicators of compromiseReferenceQuestions this post answers
Is the Rust crate arrayref version 0.3.10 safe to use?
No, arrayref 0.3.10 is compromised. Published August 20, 2026 at 07:15 UTC, it added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2, whose build.rs downloads and executes a remote binary from a Hostwinds VPS at build time. crates.io deleted both packages roughly 86 minutes after publication, but anyone who resolved arrayref during that window should assume compromise. daily.dev surfaces supply-chain incidents like this so teams can react before a compromised dependency spreads further.
How do I check if my Rust project was affected by the arrayref proc-macro1 supply chain attack?
Run grep -A2 'name = "arrayref"' Cargo.lock and check for version 0.3.10 or any entry named proc-macro1; either means the payload executed on that machine. Also look for artifacts at /tmp/rust-setup or %TEMP%\rust-setup.ps1, and network egress to 23.254.165.112 on ports 9089 or 443. If found, rotate all credentials, tokens, and keys reachable from that host. Track dependency compromise indicators like these on daily.dev before they hit your own build pipeline.
How did the proc-macro1 typosquat impersonate the real proc-macro2 crate maintainer on crates.io?
The attacker created a GitHub account named dtolney and a matching crates.io account, impersonating David Tolnay (dtolnay), the real author of proc-macro2. They published a clean copy of proc-macro2 under the squatted name proc-macro1 as staging, then added malicious build dependencies and forged author metadata (David Tolnay <rchaitm@gmail.com>) with a nonexistent repository link before the attack went live. Following account-impersonation tactics like this on daily.dev helps developers spot typosquats before installing them.