GCVE-110-OSM-2026-10789

arrayref 0.3.10 was published from a compromised maintainer account (droundy) and added the crate's first-ever dependency on the typosquatted, malicious crate proc-macro1. Versions 0.3.5-0.3.9 were yanked under the same compromised account to push cargo's 'consider updating to a version that is not yanked' warning as a lure toward 0.3.10. arrayref <=0.3.9 remain clean. Malicious payload found in: dependency graph (Cargo.toml) Behavior: 0.3.10 introduces a new dependency on proc-macro1 1.0.107, a typosquat of proc-macro2 whose build.rs downloads and executes a remote binary at build time (see linked threat report for cargo/proc-macro1). SHA256 (arrayref 0.3.10): 25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae Reach: tiny-skia -> sctk-adwaita -> winit, exposing egui/eframe, iced, and most Rust GUI dependency trees.