The Rust 'arrayref' crate version 0.3.10 includes a malicious dependency that registers with a command-and-control server. This embedded malicious code can be triggered during the compilation of any project using this crate, resulting in arbitrary code execution. The vulnerability is identified as CWE-506 (Embedded Malicious Code) and has a CVSS v3.1 score of 9.8, indicating critical severity. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability leads to full compromise of the build environment, allowing an attacker to execute arbitrary code remotely without requiring privileges or user interaction. This can result in complete loss of confidentiality, integrity, and availability of the affected system during the build process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using version 0.3.10 of the 'arrayref' crate or audit and remove any suspicious dependencies. Consider using alternative versions or crates that do not include the malicious dependency.