Compromised crate poisons arrayref: check your Rust deps now
Rust Security Response Team confirmed the proc-macro1 crate was malicious (a build script fetched a payload), deleted it and seven sibling crates, and found the popular arrayref had been republished to depend on it. Malicious versions like arrayref@0.3.10 (live 86 minutes) were yanked and removed; authors using these packages should audit their dependency caches.