Malicious Rust crate Arrayref runs a build-time payload

“Fetches an architecture-specific binary over a TLS connection that accepts any certificate without validation, then runs it detached from the build.”

The payload runs at compile time, before a single test executes. Arrayref has around 245 million all-time downloads and pulls into egui and iced transitively, so most victims never chose it. Accepting any certificate means anyone on the path can swap the binary too. Build scripts get arbitrary code execution by design, and the ecosystem has decided that is fine.