Open
Description
The Cargo.lock file is updated by many contributors, sometimes a bot?, and there's no record of the 3rd party dependencies having their code reviewed.
This seems risky to me, given how big impact the 3rd party code could have on the compiler and all downstream Rust users. The crates in the lockfile have many owners, some which are not members of rust-lang org. If any of the crates had malware, it could attack rust-lang org infrastructure, computers of core developers, etc. This doesn't require malice from any of the people involved — it could also happen due other security issues like leak of an auth token, or one of crate owners having their machine infected with malware.