Well I was thinking that "cargo install foo" can already install cargo-buidl in your path by innocent means i.e. no Rust build script. But with build scripts (

Well I was thinking that "cargo install foo" can already install cargo-buidl in your path by innocent means i.e. no Rust build script. But with build scripts (build.rs) any crate indeed has arbitrary code execution at build time, so they can't be trusted, like you imply. However, sandboxing might be coming for build scripts, and when that's done, the typo attack is still there (package "foo" installing cargo-buidl).