Thread by Dev

Three popular Rust libraries, one with 245M downloads, were briefly poisoned to run a password stealer at compile time. Pulled within 2 hours, but any build in that window is exposed. Pin arrayref to 0.3.9, check your CI.