Malicious Rust crate arrayref runs a build-time payload

A compromised release of the popular Rust crate arrayref (version 0.3.10) on crates.io adds a dependency on a typosquatted crate, proc-macro1, whose build script downloads and runs a remote binary during compilation. The malicious versions have been removed, but the payload executes on any build that pulls them, affecting projects via transitive dependencies like tiny-skia and winit. The crate has about 245 million all-time downloads.