Off-topic for aiqbench
This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.
Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.
On August 20, 2026, malicious versions of three Rust crates were published to crates.io: [email protected], [email protected], and [email protected]. The malicious crates added a typosquatted dependency (proc-macro1) whose build script downloads and executes a remote binary. Notably, proc-macro1 was the first dependency added to arrayref in its ten-year history. Because build scripts run during compilation, building an affected project was sufficient to execute the payload. arrayref can be found in over 35% of all environments. Even more notably, it's used in ¾ of all environments where Rust is present. The Rust Security Response Team deleted the malicious versions and locked the account, and assesses that…
Excerpt shown under the publisher's RSS terms · 104 words · full text and figures are on the publisher's site
Related coverage
Measuring Generative AI Content in Political Campaigns: Evidence of Rising Adoption and Non-Disclosure
arXiv · Nov 10, 2026
SPARC Segmentation to Prediction via Affine Regression and Counterfactuals
arXiv · Jul 29, 2026
SlowLab: Benchmarking Autonomous AI Agents on a Year of Experiments They Cannot Undo
arXiv · Oct 27, 2026
Measure by measure, studying society accurately
MIT News · Sep 16, 2026