--- title: Rust Supply-Chain Attack: arrayref 0.3.10 and the... description: The Rust crate arrayref 0.3.10, published August 20, 2026 at 07:15 UTC, silently added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2... canonical: https://daily.dev/posts/rust-supply-chain-attack-arrayref-0-3-10-and-the-proc-macro1-typosquat-execute-a-remote-payload-at--8zkhailuk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat Execute a Remote Payload at Build Time | daily.dev og:description: The Rust crate arrayref 0.3.10, published August 20, 2026 at 07:15 UTC, silently added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2... og:url: https://daily.dev/posts/rust-supply-chain-attack-arrayref-0-3-10-and-the-proc-macro1-typosquat-execute-a-remote-payload-at--8zkhailuk og:image: https://api.daily.dev/og/posts/8ZkHaIluK.png og:image:alt: Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat Execute a Remote Payload at Build Time og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat Execute a Remote Payload at Build Time **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 4 min read · 3 upvotes · 0 comments ## Summary The Rust crate arrayref 0.3.10, published August 20, 2026 at 07:15 UTC, silently added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2 impersonating maintainer dtolnay. The build script fetched and executed a remote binary from a Hostwinds VPS during compilation, meaning simply building a project triggered the payload without any code being called. The attacker fabricated a GitHub and crates.io persona (dtolney) and appears to have compromised the legitimate arrayref maintainer's account, yanking older safe versions to push users toward the malicious release. Exposure lasted roughly 86 minutes before crates.io removed both packages. Because arrayref has around 245 million downloads and sits underneath winit, egui, iced, blake3, Solana, and Ethereum crates, the blast radius is large. Affected developers should check Cargo.lock for arrayref 0.3.10 or proc-macro1, look for dropped binaries and network egress to 23.254.165.112, rotate credentials if compromised, and pin arrayref to =0.3.9. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened with arrayref 0.3.10 and proc-macro1 on crates.io? Arrayref version 0.3.10, published from a compromised maintainer account on crates.io, added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2 created by an attacker impersonating dtolnay. The build.rs script in proc-macro1 downloaded and executed a remote binary from a Hostwinds VPS at 23.254.165.112:9089 during compilation, affecting any machine that built a project resolving arrayref during an 86-minute exposure window. _Track fast-moving crates.io supply-chain incidents like this one on daily.dev before they hit your build pipeline._ ### How do I check if my Rust project was affected by the arrayref proc-macro1 supply chain attack? Run grep -A2 'name = "arrayref"' Cargo.lock and check whether version 0.3.10 or any proc-macro1 entry appears; either means the payload ran on that machine. Also look for artifacts at /tmp/rust-setup or %TEMP%\rust-setup.ps1, and network egress to 23.254.165.112 on ports 9089 or 443, which indicate compromise requiring credential rotation. _Developers auditing dependencies for compromise follow incident writeups like this via daily.dev._ ### What should I pin arrayref to after the 0.3.10 supply-chain compromise? Pin arrayref to exactly version 0.3.9, since yanked versions remain downloadable for existing lockfiles and Cargo currently resolves the unpinned ^0.3 range to the 2017-era 0.3.4 until the maintainer situation is resolved. Avoid blindly upgrading in response to Cargo's yanked-version warning, since that warning was weaponized to nudge users toward the malicious 0.3.10 release. _Rust developers pinning safe dependency versions after supply-chain incidents can follow ongoing coverage on daily.dev._ --- Tags: [#cyber](https://daily.dev/tags/cyber), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/rust-supply-chain-attack-arrayref-0-3-10-and-the-proc-macro1-typosquat-execute-a-remote-payload-at--8zkhailuk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat Execute a Remote Payload at Build Time","url":"https://daily.dev/posts/rust-supply-chain-attack-arrayref-0-3-10-and-the-proc-macro1-typosquat-execute-a-remote-payload-at--8zkhailuk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rust-supply-chain-attack-arrayref-0-3-10-and-the-proc-macro1-typosquat-execute-a-remote-payload-at--8zkhailuk"},"datePublished":"2026-08-20T09:42:07.190Z","dateModified":"2026-09-13T20:22:07.020Z","description":"The Rust crate arrayref 0.3.10, published August 20, 2026 at 07:15 UTC, silently added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1ee4617f06993393d0cbc32326a2f8e4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1ee4617f06993393d0cbc32326a2f8e4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rust-supply-chain-attack-arrayref-0-3-10-and-the-proc-macro1-typosquat-execute-a-remote-payload-at--8zkhailuk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,rust,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat Execute a Remote Payload at Build Time"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rust-supply-chain-attack-arrayref-0-3-10-and-the-proc-macro1-typosquat-execute-a-remote-payload-at--8zkhailuk#faq","mainEntity":[{"@type":"Question","name":"What happened with arrayref 0.3.10 and proc-macro1 on crates.io?","acceptedAnswer":{"@type":"Answer","text":"Arrayref version 0.3.10, published from a compromised maintainer account on crates.io, added a dependency on proc-macro1 1.0.107, a typosquat of proc-macro2 created by an attacker impersonating dtolnay. The build.rs script in proc-macro1 downloaded and executed a remote binary from a Hostwinds VPS at 23.254.165.112:9089 during compilation, affecting any machine that built a project resolving arrayref during an 86-minute exposure window. Track fast-moving crates.io supply-chain incidents like this one on daily.dev before they hit your build pipeline."}},{"@type":"Question","name":"How do I check if my Rust project was affected by the arrayref proc-macro1 supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Run grep -A2 'name = \"arrayref\"' Cargo.lock and check whether version 0.3.10 or any proc-macro1 entry appears; either means the payload ran on that machine. Also look for artifacts at /tmp/rust-setup or %TEMP%\\rust-setup.ps1, and network egress to 23.254.165.112 on ports 9089 or 443, which indicate compromise requiring credential rotation. Developers auditing dependencies for compromise follow incident writeups like this via daily.dev."}},{"@type":"Question","name":"What should I pin arrayref to after the 0.3.10 supply-chain compromise?","acceptedAnswer":{"@type":"Answer","text":"Pin arrayref to exactly version 0.3.9, since yanked versions remain downloadable for existing lockfiles and Cargo currently resolves the unpinned ^0.3 range to the 2017-era 0.3.4 until the maintainer situation is resolved. Avoid blindly upgrading in response to Cargo's yanked-version warning, since that warning was weaponized to nudge users toward the malicious 0.3.10 release. Rust developers pinning safe dependency versions after supply-chain incidents can follow ongoing coverage on daily.dev."}}]} ```