Reposted by Paul F.
The Rust crate arrayref was backdoored this morning, malicious versions live 07:15 to 09:25 UTC. A cargo build in that window could have run a credential stealer. Check ~/.cargo/registry/cache for arrayref 0.3.10 and proc-macro1. blog.rust-lang.org/2026/...
blog.rust-lang.org
Supply chain attack on arrayref
Rust Security Response WG on the compromised arrayref, append-only-vec and internment releases.