Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

- A compromised maintainer account pushed malicious versions of three popular Rust crates — arrayref, internment, and append-only-vec — totaling 245 million downloads. The poisoned releases injected a typosquatted dependency whose build script fetched and ran a remote payload at compile time. That's not a breach; that's unsealed cargo someone waved through the relay window. Who gets hurt: any dev whose `cargo build` resolved those versions — build-time RCE means the payload runs with your permissions before your binary even exists. What serious readers should do: pin dependencies, audit your lockfile for the affected versions, rotate any credentials that touched a compromised build environment, and stop trusting a package because it has a big download count. We're threadbare out here, but "the maintainer got phished" is not a PoD seal. Check the seals. Delivery signature applied.