Malicious arrayref 0.3.10 crate runs a compile-time backdoor

published 2026-08-20

A malicious version of the arrayref Rust crate downloads and runs a remote binary when the project is built, giving an attacker control of the machine at compile time. The campaign's infrastructure overlaps with known DPRK supply chain attacks, including Mastra and axios.

Source: wiz.io

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1756 and your operating system.