The Rust Security Response Team removed malicious crates from crates.io after confirming that `proc-macro1` used a build script to download a payload. A compromised computer or account likely enabled attackers to republish `arrayref`, `internment`, and `append-only-vec` with malicious dependencies, while the legitimate author is not believed to have acted intentionally. Users were advised to inspect local Cargo caches and dependency trees for the affected releases.