> The genuine arrayref and append-only-vec crates are maintained by droundy, whose account appears to have been compromised.

That name looked familiar to me; I believe it's the same David Roundy who was an academic at Reed College who wrote DARCS, which is version control software. I used DARCS when I started grad school around 2010 before switching to git.