Yes, you have to trust the dependencies you use with Cargo. Rust is not a sandbox language. Rust's safety is only for catching mistakes, not a defence against

Yes, you have to trust the dependencies you use with Cargo. Rust is not a sandbox language. Rust's safety is only for catching mistakes, not a defence against actively malicious code. There are projects like https://lib.rs/cargo-crev https://lib.rs/cargo-crev and https://lib.rs/cargo-vet https://lib.rs/cargo-vet for tracking code reviews and verified-to-be-safe dependencies.