The problem is that build scripts run automatically without user consent or intevention.
`cargo add` is sufficient to compromise you, before you have a chance to even vet the code.
`cargo add` is sufficient to compromise you, before you have a chance to even vet the code.
> any command starting with cargo can run arbitrary code when operating on an untrusted repository, and should be treated the same as cargo run.