Static analysis is embedded in rust, but you can't mitigate intended malicious behavior of software dependencies. That would be like a virus killer for dependencies. The past has shown that this isn't working.

There's cargo vet, cargo audit and I think various other tools. There's also a process for reporting and removing malicious ones and stuff like that, like you'd expect. Rust didn't really have a major supply chain attack as I'm avare. I remember one typo-squat with malicious code, but that was found pretty quickly and don't think it was exploited.