Not on crates.io, they're pretty adamant about "no scoping" approach to naming. Scoping does not really solve injecting malicious code into the dependency tree

Not on crates.io, they're pretty adamant about "no scoping" approach to naming. Scoping does not really solve injecting malicious code into the dependency tree in some update. Scoping is more of a defense against typosquatting via new crates. You can run your own crate registry if you're particularly concerned over what gets published on crates.io.