arrayref is a widely used Rust crate with over 245 million downloads. A malicious version (0.3.10) was published via a compromised maintainer account, adding a dependency on the malicious proc-macro1 crate. The compromised version was removed within 86 minutes, and developers are advised to pin to 0.3.9 or earlier.