Supply Chain Attack on Arrayref

Comments moved to https://news.ycombinator.com/item?id=49374269.

oof, not rust too. this has been brutal for the node ecosystem, hopefully cargo also gets the proper controls to help avoid this, like the in-flight min-publish-age

we put together a Scroll on how this manifested with node, if anyone finds it helpful to understand that attack vectors & mitigation steps: https://endash.us/toolkit/items/mini-shai-halud