Help catch internal-crate squatting attacks when adding a dependency

[epage]

Problem

Say a company has an internal registry and with an internal crate company-utils. If an attacker knows this and creates a malicious crate in crates.io with that name, people will pick it up when running cargo add and forgetting the --registry flag

Proposed Solution

Warn the user when a new registry dependency is added without --registry and the dependency name exists in one of the configured registries.Se

Notes

See also killercup/cargo-edit#451

[epage]

For typo squatting, see #10655

[kornelski]

Checking for dupes in alternative registries would tell them what crates.io crates users are adding, and such information disclosure may be undesirable. To mitigate this, I suggest using only the local registry caches to check if there is a crate with an overlapping name.

Users of private registries will usually already have their private crates' metadata cached from previous uses or via other private dependencies, so the check can be effective even if limited to only local cache. It's unfortunate it can't be 100% reliable, but I think some warning is better than none at all.