Some background on this: Cargo makes it very easy to add dependencies. Rust has the same culture of small, single-purpose libraries as npm (there is https://crates.io/crates/left_pad if you're wondering). This of course raises the question: what if someone puts some malware in a crate? Cargo itself has an OK security (and working on more end-to-end integrity checks), so it's unlikely that someone will inject malware…
> Rust is not a sandbox language. Even the "safe" subset of the language is still just about preventing bugs, but nowhere near a watertight sandbox required to protect programmers and users from straight-up malware running in their own program.
Not only that, but even just the act of building a dependency is unsafe as dependencies can specify build scripts (which is just Rust code that's compiled and executed prior to building the crate).