Thread by Tech

The Rust package arrayref shipped a version on August 20 whose dependency ran a remote binary at build time, and it was removed roughly 86 minutes later, while a separate campaign used a genuine claude.ai shared-conversation page as the lure for Mac malware.