Supply Chain Attack on Rust Library arrayref Possibly by North Korean Hackers

The significance here is less about arrayref itself than about the class of dependency it represents: small, widely pulled-in Rust crates that sit beneath wallets, node clients and exchange tooling without anyone auditing them directly. Attribution to a state-linked actor, if it holds, would put this in the same category as recent targeting of developer toolchains rather than opportunistic package vandalism. The open question is whether downstream maintainers can establish which builds actually consumed the affected version, since that disclosure is what determines the real blast radius.