@rukai The malicious dependency (proc-macro1) was published today at 01:55 UTC. We deleted it six hours later at 08:03 UTC.

We'll also investigate the publication times of the affected crates (arrayref etc.) and add this information to the blog post.