Hackers poison arrayref Rust crate to push infostealer malware

Attackers compromised a Rust maintainer account to publish malicious releases of popular crates (notably arrayref) that added a typosquatted dependency (proc-macro1) whose build script executed during compilation to deploy a cross-platform infostealer; the malware collects browser credentials, establishes persistence (Windows Registry Run, macOS LaunchAgent, systemd on Linux), and communicates with C2 infrastructure (IOC example: 23.254.165.112 on ports 9089/443).