Malicious Rust crate Arrayref runs a build-time payload

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on...https://github.com/rustsec/advisory-db/issues/3161