Reported malicious arrayref releases executed a backdoor during compilation. For Rust teams, dependency security must cover what build tooling executes, not only production runtime code.