3 ms·
You need to explicitly install these tools, so you can't "accidentally" invoke cargo-buidl from a transitive dependency or anything. It's not like a tool like
by royjacobs 4y ago
You need to explicitly install these tools, so you can't "accidentally" invoke cargo-buidl from a transitive dependency or anything.
It's not like a tool like npx which will allow you to invoke code in arbitrary packages.
- cozzyd 4y agoyeah it's great that "cargo buidl" doesn't automatically try to download and install cargo-buidl but if cargo-buidl somehow ends up in your $PATH (perhaps installed as a side effect of another package or even some other package manager like pip) then it will run. Though I guess someone could also just as easily put a malicious cargo in your $PATH and that will work in most cases, depending on precedence...