The arrayref compromise turned cargo update into the delivery channel

A Rust build script is ordinary code that runs on whatever machine is doing the compiling. That is why Wiz researchers Rami McCarthy and Benjamin Read wrote that building an affected project was by itself sufficient to execute the payload ^[6]. Nothing had to be imported, called, or shipped to production. The only visible change in the poisoned release was a new dependency, proc-macro1, on a crate that had not added a dependency in ten years ^[8][3].

The timing is worth doing arithmetic on. Yanking started 24 seconds after arrayref 0.3.10 was published, and the five legitimate versions went four seconds apart ^[8], which puts the whole clean version history of the crate out of reach roughly forty seconds after the malicious one appeared ^[1]. Five hours earlier the attacker had stood up a GitHub account one letter off David Tolnay's and published a build-script-free copy of proc-macro2, which StepSecurity's Sai Likhith describes as a decoy whose only job was to give the crate a publishing history before anyone inspected it ^[9]. Eighteen versions carrying malicious build scripts had already been staged two days ahead of that ^[2][10].

The yank is the part that should change behaviour. A yank warning is one of the few registry signals teams act on within the hour, and Likhith's account is that developers and CI maintainers seeing it reached for `cargo update -p arrayref`, which resolved to the single non-yanked modern release ^[11]. He says the original reporter was hit exactly that way ^[12]. Any policy that treats a yank as a reason to move fast is now a policy the attacker can trigger on demand.

Exposure here is not a procurement decision anyone made. Wiz puts arrayref in more than 35 percent of all environments and in three quarters of environments where Rust is present ^[7]. A crate that small arrives transitively, so "we do not depend on arrayref" is a statement about a manifest, not about a build.

Two numbers in the same report describe the crate's reach: 245 million downloads in the reporting, 152 million in Likhith's quoted line ^[2][11], a gap of 93 million ^[3]. Download counts are the main proxy teams use for how much scrutiny a dependency deserves, and this one is not stable enough within a single article to carry that weight.

The payload's own requirements point at the control that was missing. Wiz describes a build script that reassembles a command-and-control URL from Base64 fragments, turns off TLS certificate validation with a custom AcceptAll verifier, then fetches and runs an OS- and architecture-specific binary ^[13]. All of that needs outbound network access from the builder. Wiz also reports infrastructure overlap with North Korean-linked supply-chain campaigns ^[5], which is a claim about who was operating, not about what would have stopped them.