arrayref 0.3.10 added dependency proc-macro1 1.0.107 (typosquat of proc-macro2) whose build.rs downloads and executes a binary from https://23.254.165.112:9089/ during compile. Any build resolving arrayref 0.3.10 or proc-macro1 runs payload with user/CI privileges. Delete these from Cargo.lock, re-lock, and hunt /tmp/rust-setup or %TEMP%rust-setup.ps1 plus egress to 23.254.165.112:9089/443.