The Rust project yanked three poisoned crates after a compromised account shipped a build-time backdoor.