A build script is code that Cargo can compile and run automatically during a Rust build, usually from a build.rs file. It is used for custom tasks such as generating source files, checking system libraries, or setting compile-time configuration before the main crate is built.
Build scripts matter in security because they run inside the build pipeline, not just in the final application. That gives them access to the build host, environment variables, workspace files, and sometimes network access. In a supply-chain attack, a malicious dependency or compromised package can abuse a build script to inspect secrets, alter generated code, or exfiltrate data during compilation. Defenders reduce the risk by reviewing new build scripts carefully, restricting CI secrets, sandboxing builds, and monitoring for unexpected outbound traffic during compilation.