External Publication
Visit Post

Easily inspect dependencies

Rust Internals [Unofficial] April 25, 2026
Source

Unfortunately, crates can run arbitrary code at build time, and IDEs can easily trigger a cargo check or LSP that builds and runs procedural macros.

This creates a risk of running the potentially-malicious code before you finish reviewing it.

Currently the easiest safe official method is to view code at https://docs.rs - there's a link in the dropdown to a source code view that shows files from the tarball.

Discussion in the ATmosphere

Loading comments...