Comment by praseodym

Unfortunately Cargo doesn’t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them).

There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681