Rust and crates.io Ecosystem

The arrayref compromise turned cargo update into the delivery channel

Wiz says a compile-time payload reached builds through a typosquatted dependency, and the attacker yanked every clean arrayref release so the responsible fix resolved to the poisoned one.