An attacker compromised a Rust maintainer account and poisoned `arrayref 0.3.10`, `internment 0.8.7`, and `append-only-vec 0.1.9` with a dependency on a build-time dropper. Compiling an affected dependency downloaded and executed a second-stage payload from `23.254.165.112:9089` while allowing the build to finish successfully. Organizations that resolved the malicious releases during the August 20 exposure window should treat their build systems as compromised, rotate accessible credentials, purge caches, and rebuild artifacts from clean sources.