Malicious Rust crate arrayref ran code at build time

AI summary

A compromised release of the Rust crate arrayref was published to crates.io with a typosquatted dependency that executed a payload during compilation. The malicious versions were later removed, but the crate’s wide transitive use and yanking of older safe releases increased the likelihood that builds would encounter the bad release.