I've compared nearly all Rust crates.io crates to contents of their git repositories.
Here's a dump of this data (33MB compressed, 150K files): https://lib.rs/data/rust-repo-checks.tar.xz
The comparison algorithm and the JSON format is described here:
https://gitlab.com/lib.rs/main/-/blob/main/tarball/src/comparator.rs
@kornel did you find any cool sshd backdoors yet? :)
@guenther I'm releasing the data, because I don't have time to review it all.