If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
arrayref 0.3.10 was published to crates.io from a maintainer account (droundy) that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared dependency, so building any project that resolves arrayref 0.3.10 pulls in and builds proc-macro1, whose build script downloads and executes an architecture-specific remote binary at build time from https://23.254.165.112:9089/ and passes 23.254.165.112:443 as a command-and-control address. Part of a coordinated crates.io campaign on 2026-08-20 that also trojanized internment and append-only-vec. The malicious release has been removed from crates.io; releases 0.3.9 and earlier are unaffected.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]1[.]0 other packages →
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]2[.]0 other packages →
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]3[.]0 other packages →
- hxxps://23[.]254[.]165[.]112:9089/rust-crate_0[.]4[.]0 other packages →
IP addresses
- 23[.]254[.]165[.]112 other packages →