Active Rust supply chain attack compromises two widely used crates, arrayref (244M downloads) and append-only-vec (4M downloads), published by the same maintainer. A single injected manifest line adds a dependency on proc-macro1, a typosquat of proc-macro2 whose build.rs downloads and executes a platform-specific remote payload at compile time - merely building a project that pulls in either crate is sufficient to trigger infection, with no need to invoke the crate's functionality. A related lookalike, proc-macro-en, was published under an author name impersonating the legitimate maintainer. This is the largest Rust crate compromise observed by download count.