Yanking a crate better than deleting it
Rust Internals [Unofficial]
April 15, 2026
I think there should be an option on crates.io to forbid new releases which are semver-compatible with existing crate releases (maybe with some warning for downstream users). You could use it before transferring ownership, thus preventing new owner from publishing malicious patch releases which would be consumed automatically by downstream.
Discussion in the ATmosphere