Malicious Rust crate Arrayref runs a build-time payload