Cargo Build Scripts can execute arbitrary code on the build host (by design)

While this not a security vulnerability, it is a significant supply chain security issue, which cargo-geiger might choose to address in addition to it's existing scope, by flagging dependencies which use build scripts in its output.

Non-Rust code becomes part of the final binary during the build. The mechanism that does this in Cargo is called Build Scripts, and the default name for those files is build.rs.

Using this mechanism, developers can write imperative build scripts in Rust, which can execute arbitrary code in order to

obtain source code or binary blobs, outside of the dependency tree tracked by Cargo, in any way they like
build this Non-Rust code in any way they like
instruct Cargo to link the build result into the final binary, by passing additional compiler/liker flags back to Cargo's.

https://github.com/geiger-rs/cargo-geiger/issues/103 and https://github.com/geiger-rs/cargo-geiger/issues/6 are existing issues about marking Non-Rust code as unsafe.

Flagging dependencies with build scripts in them should be the same as
flagging all Non-Rust code that ships as part of the binary plus any existing less conventional uses of build scripts.

Since users would want to run such a check before the first build a project, ideally a check which looks for build scripts should not require building the checked project. Otherwise a malicious dependency can compromise the system before the build is executed. In that case it can technically falsify the output of the cargo-geiger command.

geiger-rs / cargo-geiger

Cargo Build Scripts can execute arbitrary code on the build host (by design) #524