# Malicious Rust Crate 'arrayref' Runs Hidden Payload During Build

A malicious version of the Rust crate arrayref was published, disguised as a legitimate update. Its build script executes a hidden payload, compromising developers who compile projects that include it. This highlights the ongoing risk of supply-chain attacks in open-source package ecosystems.

**Importance:** 4/5

## Sources

### Technology
- [Hacker News](https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/) — Thu, 20 Aug 2026 13:23:12 +0000