🚨 SlowMist TI Alert 🚨 A coordinated Rust supply chain attack affecting the legitimate crates `arrayref@0.3.10`, `internment@0.8.7`, and `append-only-vec@0.1.9`. The compromised releases introduced the malicious `proc-macro1` dependency, which automatically downloads and executes cross-platform malware during Cargo builds. arrayref is deeply embedded in the Rust ecosystem. Its previous clean release, v0.3.9, accumulated roughly 152 million downloads, while the crate also appears transitively in dependency chains involving widely used Rust GUI stacks. It also has a significant footprint across the Solana ecosystem, including Solana token, staking, and validator-related components. These usage figures do not indicate that those projects or hosts were compromised. Potential attacker actions include build-time remote code execution, host profiling, persistence, browser-related data collection, and execution of additional scripts or shell commands. Users should inspect Cargo.lock files and build environments for affected versions. Importantly, arrayref = "0.3.9" does not strictly pin v0.3.9 and may resolve to v0.3.10 during fresh dependency resolution or updates. Where appropriate, use an exact requirement such as arrayref = "=0.3.9" and verify the resolved version in Cargo.lock. Rotate potentially exposed credentials and rebuild affected systems from trusted environments. You can also visit https://www.misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! https://github.com/rustsec/advisory-db/issues/3161 https://enterprise.misteye.io/threat-intelligence/SM-2026-166133(SlowMist)