Unfortunately Cargo doesn’t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them).

There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681

ahh... we now have nodejs ecosystem attack techniques migrating to other systems as well...