Malicious releases of three Rust crates introduced a typosquatted dependency whose build script executed a cross-platform backdoor during compilation, exposing developer workstations and CI runners. The implant collected system and browser-profile information, established platform-specific persistence, executed downloaded scripts, and used DGA-generated domains if its primary C2 failed. Wiz identified substantial infrastructure overlap with the DPRK-attributed Mastra campaign and with UNC1069's axios supply-chain attack, including a shared C2 path, SSL issuer, hosting range, and related IP infrastructure. These overlaps support meaningful North Korean context, although Wiz did not conclusively attribute the arrayref compromise to a specific DPRK actor.