Protection/mitigation of SCA's with cargo

1

As SCA's keep on surfacing left and right, with quite a few attributable to a perfectly sane practice of preinstall hooks enabled by default in npm et al; is cargo in any way more secure, by design and/or surface area it covers?

I do not remember seeing any "hooks" anywhere near the Rust's package management toolkit, at least not in the traditional sense of the word; yet any crate that wishes to "preinstall" anything with a build.rs instead, can still do so - can it not?

2

There are various proposals in progress, such as adding sandboxing (but this needs further design work and somewhat conflicts with what a build.rs should be able to do) and adding a min-publish-age feature (but this depends on somebody spotting the attack).