A Rust package impersonating the popular arrayref crate has been caught running code the moment a project builds, not after.
Supply-chain security researchers at SafeDep identified the package as arrayref-proc-macro1 on the crates.io registry, its name a near-match for arrayref, a legitimate and widely used crate for casting byte slices into fixed-size arrays. According to SafeDep's research, published August 20, 2026, the package carries what the researchers call a build-time payload - code that executes as part of compiling a project rather than waiting for the finished binary to run. Beyond identifying the package and its build-time behavior, further technical detail was not immediately available. The discovery quickly drew attention from developers monitoring open-source security research.
Typosquatting on package registries is a well-worn con - fake libraries riding a popular name's coattails have hit npm and PyPI for years. What is different in Rust's case is timing: crates.io allows procedural-macro packages to compile and execute as part of the build itself, so a malicious dependency does not need anyone to ever run the finished program to act.
Rust's ecosystem is younger and smaller than npm's, which has limited how often it shows up in this kind of research - arrayref-proc-macro1 is a reminder that smaller doesn't mean safer, just less examined so far.