Backdoored arrayref crate ran infostealer at build time in DPRK-linked attack
Attackers hijacked the maintainer account behind arrayref, the tiny array-conversion crate sitting in roughly 75% of Rust environments, and shipped a 0.3.10 version that pulled a typosquatted proc-macro1 dependency. Its build script downloaded and ran an infostealer at compile time, after staging fake releases to push developers onto the poison. Wiz ties the infrastructure to DPRK-linked campaigns against Mastra and axios; crates.io has since pulled the malicious versions.