DO NOT RUN ANY CARGO COMMANDS ON UNTRUSTED PROJECTS

Summary from the TLDR InfoSec newsletter

This post highlights two attack vectors by which malicious Rust code could target the cargo system. The first attack vector abuses the fact that a project could remap the `rustc` binary to any arbitrary path, which would compromise any cargo commands. The second attack vector could compromise plugins that don't use the cargo config files, such as `cargo crev`, by defining an alias for that command in the config.toml.