A compromised crates.io account published `arrayref` 0.3.10 with a dependency on the typosquatted `proc-macro1` crate, causing malicious code to run automatically during Cargo builds. The dependency's build script reconstructed an obfuscated URL, downloaded an architecture-specific payload from 23.254.165.112, and launched it in a detached process on Linux, Windows, or macOS. Older clean `arrayref` releases were yanked, potentially steering developers toward the malicious version, while copied `proc-macro2` source helped the dependency appear legitimate. crates.io subsequently removed the malicious releases.