arrayref: the malware that ran before anyone pressed "run"

A tiny Rust library that thousands of projects pull in without thinking was published in a poisoned version. The nasty part: the code fired during compilation — before the program it belonged to had ever been started.

On August 20, 2026, the Rust project published a security notice about a supply chain attack on crates.io, the shop window where Rust code libraries live. Two packages were involved: arrayref, a small helper that sits deep in the dependency lists of a lot of software, and proc-macro1, a name one character away from proc-macro2, which is in almost everything written in Rust. Security firm SafeDep pulled the poisoned version apart and found the payload sitting in the build step.

Here is the part worth slowing down for. Most malicious code waits until you launch the program. This one ran while the program was being assembled. A developer types the command to compile, walks off to make coffee, and by the time they come back the machine has already executed someone else's code. Nothing was launched. Nothing was clicked. The build itself was the trigger.