Cargo is Rust’s package manager and build tool. It downloads crates, resolves dependency versions, compiles source code, runs tests, and produces final binaries. In practice, Cargo is the entry point for most Rust development, so it controls much of what happens before an application ever runs.
That matters in security because Cargo can also execute build scripts, such as build.rs, during compilation. A malicious or compromised dependency may use that phase to inspect environment variables, read workspace files, or trigger network activity inside a CI runner or developer machine. Defenders therefore treat Cargo builds as part of the attack surface: they review dependency changes, limit secrets on build hosts, isolate automation, and monitor unexpected behavior during compilation.