cargo-crev

There are projects like crev [0] which attempt to get around this by using a web of trust to audit dependencies. Rust has cargo-crev [1] as an implementation. Here's the previous HN discussion [2]. [0] https://github.com/crev-dev/crev/ [1] https://github.com/crev-dev/cargo-crev [2] https://news.ycombinator.com/item?id=18824923

Maybe using crev? https://github.com/crev-dev/crev https://github.com/crev-dev/cargo-crev Probably just publish it and eventually you will get some review or bug reports.

Isn't this chain of trust essentially what crev [0] tries to do? FWIW Rust implements cargo-crev [1], but I suppose you could extend this to AUR packages with a bit of work. [0] https://github.com/crev-dev/crev/ [1] https://github.com/crev-dev/cargo-crev

cargo-geiger will recursively warn you of unsafe code in dependencies: https://github.com/anderejd/cargo-geiger It's not a silver bullet, it will show you areas where memory safety issues could arise, but doesn't necessarily prove the presence of memory safety issues. Memory safety issues aren't the only type of security bug so them being impossible also doesn't mean it's entirely safe. You can think of issues like injection attacks or faulty ACL logic happening without memory unsafety. There's also cargo-crev, which is an attempt at making a web of trust for reviews of third party packages: https://github.com/crev-dev/cargo-crev - for a longer form article on what crev's goals are and how it works, I found this explained it for me: https://wiki.alopex.li/ActuallyUsingCrev

No, you are basically right, but the number of nodes in the dependency tree doesn't really mean that you really have to review all of those. Usually you end up with a big basket of actual dependent projects, and with some versions for them (which leads to the big explosion of the number of nodes in the dep tree). Naturally it should be easy to specify a whitelist of licenses. (Of course then one has to decide whether to trust the package.json-s.) That said, security review is hard for any ecosystem. Go probably has inherent advantages compared to the JS ecosystem, simply by virtue of being younger, having a real standard library, being more focused (no browser vs nodeJS issues) etc. PS: there are projects that aim to do collaborative audit/review for Rust ( https://github.com/crev-dev/cargo-crev ) there should be something like that for t