A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.

This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% of arrayref download traffic across all versions, as most users had older versions of arrayref in their lockfiles.