{
    "byline": null,
    "charset": "UTF-8",
    "dir": null,
    "excerpt": "On August 20, 2026, a compromised release of the popular Rust crate arrayref appeared on\ncrates.io. Version 0.3.10 added a dependency on a typosquatted crate called\nproc-macro1, whose build script downloads and runs a remote binary while a project compiles.\nThe code runs at build time, so simply compiling a project that pulled the bad versions is enough\nto trigger it. The crates.io team has since removed the malicious versions.",
    "lang": null,
    "length": 11285,
    "publishedTime": null,
    "siteName": null,
    "title": "Malicious Rust Crate arrayref Runs a Build-Time Payload"
}