The compiler was the delivery mechanism.

The Rust supply-chain incident looked like a bad crate release. The sharper lesson is where the payload ran: Cargo built a declared dependency before the application started. arrayref 0.3.10 added a dependency on the typosquatted proc-macro1; its build.rs downloaded and launched a platform-specific payload during compilation. 1

The Rust Security Response Team says arrayref 0.3.10 was online for 86 minutes, alongside malicious releases of internment and append-only-vec, before crates.io removed them. The official notice also says proc-macro1 and several similarly named crates were deleted. 2

The reach came from dependency graphs. arrayref is a transitive dependency in paths that include tiny-skia, sctk-adwaita, and winit, so GUI projects built on egui, eframe, or iced could encounter it indirectly. SafeDep reports about 245 million all-time downloads; that number measures usage breadth, not the number of compromised builds. 1

The practical check is a build trace, not a download headline. Look for the malicious package versions in local or CI caches, and investigate the indicators shown in the final frame. The Rust team’s notice provides the package list and a local-cache check. 2