arrayref Supply Chain Attack Hits Rust Builds

This is a serious reminder that trusted source code does not make build pipelines safe: one injected manifest dependency can turn routine compilation into host compromise.

• –Affected versions were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9.
• –The typosquat proc-macro1 mimicked proc-macro2 and executed automatically through Cargo’s build-script mechanism.
• –Developers and CI systems that refreshed lockfiles during the exposure window should audit artifacts, credentials, caches, and build hosts.
• –Lockfiles, frozen builds, dependency monitoring, and sandboxed CI are now baseline defenses for Rust projects.