Malicious Rust Crate 'arrayref' Discovered Executing Remote Payloads in Build Scripts

Open-source security firm SafeDep has discovered a malicious package published to the Rust community registry crates.io under a typo-squatted name mimicking the legitimate `arrayref` crate. The compromised package contained stealthy procedural macros designed to execute remote code during cargo build compilation.

When a developer includes the malicious dependency, the crate `build.rs` script fetches an obfuscated binary payload from an external server and executes it with local user permissions, attempting to extract environment variables and SSH private keys.

The crates.io security team acted swiftly to remove the malicious version and revoke publisher credentials, urging Rust developers to lock dependency lockfiles.