> In the end it is your decision to use unaudited or refuse unaudited crates.
replyIt should be the default behavior of the package manager to allow downloading only audited/trusted packages. Forcing end-users of the language to be responsible for audit of all dependencies is impractical.
If you want that you can always use vetted package repositories like Nexus. Many companies do.
reply