rust

Compiling a Rust crate runs the author's code.

crates.io federates all publish identity to GitHub, turning one account takeover into build-time code execution across every downstream Cargo project.