Malware: `arrayref` 0.3.10 executes a remote payload at build time via typosquatted `proc-macro1`

arrayref 0.3.10 (2026-08-20 07:15 UTC, by droundy) adds a first-ever
dependency on proc-macro1 1.0.107 (07:11 UTC, by dtolney), whose build.rs
downloads and executes a remote binary. Both are live as I file this;
security@rust-lang.org emailed separately.

Affected: arrayref =0.3.10, proc-macro1 all versions. 1.0.106 is a clean
copy of proc-macro2 published 5h earlier — staging, but not itself malicious.
arrayref ≤0.3.9 are clean.

Reach: tiny-skia → sctk-adwaita → winit, so under egui/eframe, iced,
and most Rust GUI work. 0.3.9 has ~152M downloads.

Delivery: 0.3.5–0.3.9 are all yanked under the owner account, so cargo's
consider updating to a version that is not yanked warning is the lure. That is
how I hit it. droundy is presumably compromised.

const SRC_URL_PARTS: &[&str] =
    &["aHR0cHM6Ly8=", "MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "OTA4OS8="];
const END_URL_PARTS: &[&str] =
    &["MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "NDQz"];

→ https://23.254.165.112:9089/, 23.254.165.112:443. Fetched over rustls with
an AcceptAll ServerCertVerifier (all three verify methods return success
unconditionally), selecting rust-crate_0.1.0/_0.2.0/_0.3.0/_0.4.0 by
target, then executed with the second URL as argv[1]:

• Unix: /tmp/rust-setup, chmod +x, detached spawn, stdio null.
• Windows: %TEMP%\rust-setup.ps1 via a %TEMP%\rust-setup-launch.vbs launcher
  under wscript.exe //B //Nologo + CREATE_NO_WINDOW, then
  std::mem::forget(child) — commented in-source as escaping cargo's job object
  so the build does not wait on it.

src/ is genuine proc-macro2, so builds succeed normally. Metadata forges
authors = ["David Tolnay <rchaitm@gmail.com>"] and
repository = ".../dtolnay/proc-macro1" (404).

IOCs

23.254.165.112:9089                           payload host
23.254.165.112:443                            C2 (argv[1])
/tmp/rust-setup
%TEMP%\rust-setup.ps1 , rust-setup-launch.vbs
rust-crate_0.1.0 / _0.2.0 / _0.3.0 / _0.4.0

sha256
  arrayref 0.3.10       25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae
  proc-macro1 1.0.107   61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4
  proc-macro1 1.0.106   b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436