There is a supply-chain attack on crates.io, with the proc-macro1 crate. It's a copy of proc-macro2, but has a build.rs script that installs malware. This is a transitive dependency of some things.