First-Come Registry Trust

Package registries accept uploads on a first-come, first-served basis without default safety policing, so installing crates can execute malicious or unreviewed code until external review/audit systems catch up.