Malicious Rust Crate 'arrayref' Executes Arbitrary Payload at Build Time

Supply chain security analysts at SafeDep have uncovered a malicious package named `arrayref-proc-macro1` on the Crates.io repository. The crate attempted to compromise developer systems by executing hidden shell scripts during standard `cargo build` compilation cycles.

The malicious code leveraged Rust procedural macro capabilities to download encrypted payloads from external command-and-control servers during macro expansion, harvesting local environment variables and SSH keys.

The Rust Security Response Team has removed the offending package and advises developers to audit build dependencies and restrict build script network permissions using sandboxing tools.