Description
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
droundy arrayref
Default version status: unaffected
0.3.10affected
References
- https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref ↗
- https://github.com/rustsec/advisory-db/issues/3161 ↗
- https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack ↗
- https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/ ↗
- https://rustsec.org/advisories/RUSTSEC-2026-0260.html ↗