'bs58' jumped out at me as a random looking package name.
It implements the base58 encoding, which is used primarily by... Bitcoin.
I'd love to see the explanation of why "a TUI file manager" needs a crate closely associated with crypto coins and not much else.
It is precisely this kind of thing that makes Rust a no-go for most enterprises.
"I just want a CLI tool."
"Congratulations, your servers are mining crypto!"
PS: bs58 is maintained by one anonymous person and their package is used in just about every Rust crypto library and hence application. Compromise his account in the same manner as the 'xz tools' attack and you could still billions in crypto!
It doesn't actually use it, this is just referencing it in the dependency graph (Cargo.lock). bs58 is an optional (feature-gated) transitive dependency of another crate, which is never referenced at all in the top-level crate. The build.rs doesn't run or anything.
I believe there's (several) open issues about changing this behavior of the lock file, but I have moved on from Rust so don't know the status of things.
That said, this is confusing behavior. I remember I first noticed it when a bunch of crates were showing up in my lock file for every OS under the sun, even though I was specifically using a "wayland" (linux-only) feature.
Not to defend Rust's crazy culture of dependencies, mind you.