An unidentified attacker compromised versions of the popular Rust crates `arrayref` and `append-only-vec` by injecting a dependency on the typosquatted `proc-macro1` package. Its Cargo build script downloads and executes cross-platform malware that steals Chromium browser credentials and wallet-extension data, establishes macOS LaunchAgent persistence, and supports remote shell commands. Aikido identified `23.254.165.112` as the payload-delivery and command-and-control host and published SHA-256 hashes for Linux and macOS payloads.