SafeDep says poisoned arrayref release ran malware during Rust builds

Why it matters

The attack abused Cargo's normal build process, showing why dependency security is moving from advisory feeds to controls that block packages before their scripts execute.

SafeDep, the supply-chain security startup co-founded by Abhisek Datta (@abh1sek), reported on August 20, 2026 that a compromised release of the widely used Rust crate arrayref downloaded and executed malware during compilation. The crates.io team subsequently removed the malicious packages, according to SafeDep. (safedep.io)

The attack turned an ordinary Cargo build into the delivery mechanism. arrayref version 0.3.10 added a dependency on proc-macro1, a package impersonating the legitimate proc-macro2. Cargo automatically compiled that dependency, which caused its build.rs script to fetch and launch a binary from a remote server. A developer only had to compile a project whose dependency resolution selected the poisoned release.

For Datta, the case sits directly inside the problem he has spent his career working on. His public biography describes earlier work in vulnerability research, reverse engineering and malware analysis, followed by founding security consultancy 3S Labs and leading technology at Appsecco. SafeDep now packages that experience into products intended to inspect dependencies before they reach laptops, repositories, coding agents or CI systems, including SafeDep's open-source package monitor. (abhisek.github.io)

A same-day package chain

On August 20, 2026, SafeDep says the malicious proc-macro1 1.0.107 and the apparently compromised droundy account's arrayref 0.3.10 appeared on crates.io. The RustSec report identifies both packages as part of the campaign.

The impersonation relied on names that looked reasonable during a hurried dependency review. The dtolney publisher account differs by one letter from dtolnay, the account used by Rust maintainer David Tolnay (@dtolnay). Package metadata falsely listed Tolnay as an author and pointed to a nonexistent repository under his GitHub account. The available evidence identifies Tolnay as the impersonation target, with no indication that he participated in the publication.

The malicious package also copied the source code of the real proc-macro2. That choice kept dependent builds functioning normally while the added build script operated in the background. SafeDep found that arrayref itself retained its familiar macro implementation; the important change was a single dependency entry in Cargo.toml. Cargo builds declared non-optional dependencies even when the parent crate never calls them. (safedep.io)

SafeDep's package table classifies all versions of proc-macro1 as a malicious typosquat and says the entire crate was removed. Its technical analysis identifies version 1.0.107 as containing the downloader and publishes hashes for versions 1.0.106 and 1.0.107. (safedep.io)

The payload detached from the build

The proc-macro1 build script reconstructed its server address from base64 fragments, avoiding a plainly visible URL in the source. The script fetches an architecture-specific binary over TLS, then launches it detached from the build. On Unix it writes and runs /tmp/rust-setup. On Windows it creates PowerShell and VBScript launchers in the temporary directory, starts them hidden and abandons the child process so the compiler does not wait for it. (safedep.io)

SafeDep published the associated file hashes and two network indicators: the defanged host 23[.]254[.]165[.]112 on ports 9089 and 443. Its analysis establishes how the downloader executed. It does not establish what the second-stage payload did after launch or how many systems ran it.

Teams whose August 20 builds resolved arrayref 0.3.10 should search lockfiles and build logs for that exact version and proc-macro1 1.0.107. Build hosts should also be checked for /tmp/rust-setup on Unix, rust-setup.ps1 and rust-setup-launch.vbs on Windows, and connections to the published network indicators. A successful compilation does not clear the host; the copied library code was designed to let builds succeed.

Yanking the safe releases created the lure

The account controlling arrayref yanked versions 0.3.5 through 0.3.9, according to SafeDep and the RustSec report. Cargo warns users when a selected release has been yanked and suggests moving to one that remains available. At the time, that path pointed toward 0.3.10. The reporter who encountered the package said the warning was what led to the poisoned version. (github.com)

That maneuver exploited developer trust in a real package rather than waiting for someone to mistype a dependency name. arrayref appears deep in Rust GUI dependency graphs through packages including tiny-skia, sctk-adwaita and winit, placing it underneath frameworks such as egui, eframe and iced.

SafeDep counted about 245 million all-time downloads for arrayref, including roughly 152 million for the clean 0.3.9 release. Those numbers measure years of use. They do not count machines exposed to 0.3.10. The relevant denominator is the number of dependency resolutions and builds completed during the malicious release's availability window, which the published analysis does not provide. (safedep.io)

Datta's pre-install bet gets another test

Datta is building SafeDep around the judgment that package security has to move in front of execution. SafeDep says its package firewall can sit between public registries and developer machines, CI runners or AI coding agents, blocking a dependency before an install or build script runs. SafeDep also maintains open-source tools for dependency review and package interception. Those are company claims about SafeDep's controls, rather than evidence that its software blocked this specific Rust incident. (safedep.io)

Competitors are selling controls at the same enforcement point. Endor Labs introduced Package Firewall in May, while Socket announced a $60 million Series C at a $1 billion valuation as it expanded its own behavioral package analysis and blocking products.

The arrayref compromise brings SafeDep's pre-execution argument to Rust: package reputation and a clean application build offer little protection when attackers can publish code that executes before the application exists.

The campaign paired an apparently compromised droundy maintainer account with a separate dtolney impersonation account, using a trusted package and a plausible dependency to get code into Cargo builds. Datta's wager is that developers will pay for a control capable of making a decision before that code runs.