https://lib.rs/cargo-crev https://lib.rs/cargo-crev tries to address this. It allows you to review the actual published source of your dependencies. It then ca

https://lib.rs/cargo-crev https://lib.rs/cargo-crev tries to address this. It allows you to review the actual published source of your dependencies. It then can check whether your project only uses reviewed dependencies. Reviewing everything is of course a lot of work, so there’s an option to mark crate owners as trusted, and also reuse code reviews made by people you trust.