Crates.io currently says:

> A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.

> This compromised version was published on 2026-08-20 and removed approximately 86 minutes later, with no evidence of actual usage.

I don't know what more you want. Do you want the malicious version to continue to be available?