Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

...