Read the build script top to bottom and ask what it touches: files, environment, network and processes. A legitimate build.rs compiles bundled C code, finds system libraries or generates code into OUT_DIR. Be wary of network access, writes outside OUT_DIR, shelling out to download tools, or reading secrets from the environment.
What a build script is
The Cargo reference describes a build.rs in a package root that Cargo compiles and runs just before building the package. It talks to Cargo by printing lines that start with the cargo prefix, and it can use its own build dependencies, listed separately from normal ones. It runs with your privileges, on your machine or CI runner, at compile time.
Normal behavior
| Behavior | Why it is expected |
|---|---|
| Compiling bundled C or C++ source | Many crates wrap native libraries |
| Locating system libraries | Emits link instructions |
Generating Rust code into OUT_DIR | The documented place for generated files |
| Printing rerun-if instructions | Tells Cargo when to run again |
| Setting cfg flags | Feature detection |
Red flags
| Red flag | Why it matters |
|---|---|
| Network requests or downloading binaries | Fetches code you never reviewed |
Writing outside OUT_DIR | The docs say scripts should not modify files outside that directory, and Cargo checks packaged builds do not change sources |
| Spawning shell commands with built strings | Command injection and surprise tools |
| Reading home directory, SSH or cloud credential files | No build needs these |
| Dumping all environment variables | Secrets often live there |
| Obfuscated or encoded strings | No honest build script needs them |
| A build dependency that seems unrelated | Build dependencies run at build time too |
The ten minute routine
- Check size. A large script deserves more time, a tiny one may be fine.
- Read the build dependency list in the manifest. Look up anything unfamiliar.
- Search the script for process spawning, network libraries and file operations.
- Confirm outputs go to
OUT_DIR. - Look at the rerun settings. Missing ones are a quality issue, odd ones may be a hiding place.
- Diff against the previous release when updating. A new build script, or a changed one, in a minor release is worth a closer look.
- Record your conclusion and the version you reviewed.
Reduce exposure
Build in a sandbox without credentials. Prefer vendored dependencies so a build cannot fetch surprises. Consider a vetting tool that records reviews, and a policy that new build scripts need a second reader.
Limits
A ten minute read catches obvious problems, not a skilled attacker. For crates in critical paths, take longer or use an independent audit.
Quick check
Does a build script run for dev dependencies?
Any crate in the graph that has a build script runs it when it is compiled, including those pulled in for tests.
Is a build script automatically suspicious?
No. Many legitimate crates use one. What matters is what it does.
Safeguard zero-day discovery and SBOM and dependency scanning help track new risks in dependencies, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
