Wiz and Socket say malicious versions of Rust crates arrayref, internment, and append-only-vec were published on August 20 and removed within hours after they were found carrying a typosquatted dependency, proc-macro1. RustSec says it has no evidence the bad releases were used.
The trick is Cargo's build step: proc-macro1's build script runs when a project is compiled, so the payload fired on developer or CI machines before any library code was imported at runtime. Wiz says the infrastructure overlaps with recent DPRK-linked supply-chain activity, which makes this look like a repeatable delivery pattern, not a one-off typo-squat.
For Rust shops, the exposure is the machine and its build artifacts, not just the final binary. Any environment that compiled one of the tainted versions during the window may have executed the payload even if the shipped application looks clean, and the reporting still does not settle how many builds were touched.