A compromised release of the popular Rust crate arrayref was discovered pulling in a typosquatted version of the proc-macro1 dependency. The malicious build script for this fake package downloads and executes a remote binary during the compilation process.