I think that even for core modules like an http server or client, but that's not the case and we don't need to get into that debate.

let's look at the actual package from OP

>https://docs.rs/arrayref/latest/arrayref/

>This package contains just four macros, which enable the creation of array references to portions of arrays or slices (or things that can be sliced).

I'm no rust programmer, but that doesn't sound like something that moves the needle. I talked about the ratio between value to risk being a relevant decision parameter, so getting infected by an http framework would be defensible, getting infected by adding this to a project to me is a PIP, and getting infected by installing leftpad or a custom cursor plugin in an IDE would be fireable.