Woofun AI reports that a supply chain attack has compromised three Rust libraries: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The tainted versions include malicious proc-macro1 dependencies designed to download and execute cross-platform malware during the Cargo build process. SlowMist highlighted that arrayref, with its clean v0.3.9 version garnering approximately 152 million downloads, is integral to various Rust GUI frameworks and critical Solana ecosystem components, including tokens, staking, and validators. While high usage does not confirm active exploitation, attackers could potentially achieve remote code execution, gather server intelligence, establish persistence, or steal browser data. Users are advised to audit Cargo.lock files, enforce exact version constraints, rotate exposed credentials, and rebuild systems within secure environments.