About Crateward
Crateward is a supply chain scanner for crates.io. It looks at every new crate version for signs of malicious behavior, such as a build script that reads credentials or talks to the network, and reports what it finds to the people who can act on it.
How a version is analyzed
Every version gets a static analysis of its files. A version whose build
runs its own code (a build script, a procedural macro, or such a
dependency) is also built with cargo check inside a Firecracker
microVM. The VM has no internet: a fake one answers and records every
attempt. Planted fake credentials show whether the build reads them. Nothing
the build does leaves the VM except the record. A verdict names the reasons
and says what the analysis covered. A low risk level is not a claim that a
version is safe.
What is published
This site shows aggregate numbers only. Crateward never publishes a finding about a crate before it was reported and handled: malicious crates go to the crates.io team, and vulnerabilities to the crate's maintainers first. A finding appears here after that, with its timeline.
Contact
security@janfedler.de, for reports about Crateward itself, for a version you believe was flagged by mistake, and for anything about the requests it makes. False positives are treated as bugs.