Archive
Crateward analyzed new crates.io releases for malicious behavior: static analysis of the published files, then a build in a Firecracker microVM traced with eBPF, with a fake internet and fake credentials to catch what a build sends out. These are selected reports from that work, as its dashboard showed them.
Versions seen
318777
2026-09-30 to 2026-10-30
Analyzed
318736
16% built and traced in a VM
Reports here
258
made 2026-10-30 08:50 UTC
Verdicts by level
A level comes from the score of explainable evidence, each signal with its points. High and critical verdicts went to a person for review. Each report says whether one was reviewed, and how.
Reports
| Score | Crate | Strongest evidence | Coverage |
|---|---|---|---|
| 100 | spider_firewall 2.42.0
critical false positive |
The planted github_token_env left the VM. | VM run |
| 100 | spider_firewall 2.41.0
critical false positive |
The planted github_token_env left the VM. | VM run |
| 100 | spider_firewall 2.40.0
critical false positive |
The planted github_token_env left the VM. | VM run |
| 100 | spider_firewall 2.39.0
critical false positive |
The planted github_token_env left the VM. | VM run |
| 100 | spider_firewall 2.38.0
critical false positive |
The planted github_token_env left the VM. | VM run |
| 100 | monica_rand_core 0.10.3
critical confirmed |
The build ran /tmp/code-helper, a program in a writable location, which the build put there. | VM run |
| 100 | monica_rand_core 0.10.2
critical confirmed |
The build ran /tmp/code-helper, a program in a writable location, which the build put there. | VM run |
| 100 | monica_rand_core 0.10.1
critical confirmed |
The build ran /tmp/code-helper, a program in a writable location, which the build put there. | VM run |
| 71 | systemd-run 0.10.0
high false positive |
The build left a set ID file at /work/.warm/upper/debug/build/systemd-run-2aaaaa72dd8f3613/out/test-aux/nosgid. | VM run |
| 71 | masler 0.1.2
high false positive |
/work/target/debug/build/masl-as-cc276e8bf76a91cb/build-script-build opened /proc/572/environ. | VM run |
| 71 | masler 0.1.0-alpha.7
high false positive |
/work/target/debug/build/masl-as-499a84e59525845b/build-script-build opened /proc/572/environ. | VM run |
| 71 | masler 0.1.0-alpha.5
high false positive |
/work/target/debug/build/masl-as-07d6fa97d8bc92bf/build-script-build opened /proc/573/environ. | VM run |
| 67 | bmux_mermaid_render 0.0.1-alpha.4
high false positive |
The build left an executable at /work/home/.cargo/git/db/mermaid-rs-renderer-354b99861d3bc8af/hooks/README.sample. | VM run |
| 65 | cadaclysm-sdk 0.11.0
high false positive |
high severity secret_environment_variable in build_script code: CARGO_REGISTRIES_ | VM run |
| 63 | deq-runtime 0.5.12
high false positive |
high severity downloader_pattern in build_script code: https://archives.boost.io/release/{BOOST_VERSION}/source/{archive_name}.tar.gz at build.rs:94 with std::process::Command::new at build.rs:99 | VM run |
| 61 | lbug 0.21.2
high false positive |
high severity shell_command in build_script code: powershell | VM run |
| 61 | lbug 0.21.1
high false positive |
high severity shell_command in build_script code: powershell | VM run |
| 61 | lbug 0.21.0-pre.20260929
high false positive |
high severity shell_command in build_script code: powershell | VM run |
| 61 | lbug 0.21.0
high false positive |
high severity shell_command in build_script code: powershell | VM run |
| 60 | ghostty-vt-sys 0.6.0+ghostty.1.3.2-main.b40acce
high false positive |
A build script was added since 0.0.1. | VM run |
| 60 | deq-runtime 0.5.10
high false positive |
high severity shell_command in build_script code (3 places): certutil | VM run |
| 60 | deq-runtime 0.5.8
high false positive |
high severity shell_command in build_script code (3 places): certutil | VM run |
| 60 | deq-runtime 0.5.7
high false positive |
high severity shell_command in build_script code (3 places): certutil | VM run |
| 58 | ramp-ffmpeg 9.0.2
high false positive |
high severity environment_enumeration in build_script code: std::env::vars | VM run |
| 58 | deq-runtime 0.5.16
high false positive |
high severity downloader_pattern in build_script code: https://archives.boost.io/release/{BOOST_VERSION}/source/{archive_name}.tar.gz at build.rs:94 with std::process::Command::new at build.rs:99 | VM run |
| 58 | deq-runtime 0.5.15
high false positive |
high severity downloader_pattern in build_script code: https://archives.boost.io/release/{BOOST_VERSION}/source/{archive_name}.tar.gz at build.rs:94 with std::process::Command::new at build.rs:99 | VM run |
| 58 | deq-runtime 0.5.14
high false positive |
high severity downloader_pattern in build_script code: https://archives.boost.io/release/{BOOST_VERSION}/source/{archive_name}.tar.gz at build.rs:94 with std::process::Command::new at build.rs:99 | VM run |
| 57 | walletkit-sqlite 0.26.0
high false positive |
The build looked up github.com. | VM run |
| 56 | github-copilot-sdk 1.0.23-preview.1
high false positive |
high severity downloader_pattern in build_script code: ureq::Error at build/download.rs:6 with std::process::Command at build/in_process/tests.rs:417 | VM run |
| 55 | gmsh_ffi 0.2.2
high false positive |
high severity shell_command in build_script code: curl failed | VM run |
| 55 | gmsh_ffi 0.2.1
high false positive |
high severity shell_command in build_script code: curl failed | VM run |
| 55 | gmsh_ffi 0.2.0
high false positive |
high severity shell_command in build_script code: curl failed | VM run |
| 55 | compose-rust 0.0.0
high false positive |
high severity shell_command in build_script code (7 places): curl exited {code} | VM run |
| 55 | bao-mozjs-sys 153.3.0-2
high false positive |
high severity downloader_pattern in build_script code: https://github.com/servo/mozjs/releases at build.rs:1566 with std::process::Command::new at build.rs:330 | VM run |
| 53 | twip 0.1.0-alpha.1
high false positive |
A build script was added since 0.0.0. | VM run |
| 53 | oxijolt-sys 1.1.0+jolt-5.6.0
high false positive |
high severity downloader_pattern in build_script code: http:// at build/prebuilt_curl.rs:174 with curl was not found at build/prebuilt.rs:117 | VM run |
| 52 | anr 0.2.0
high false positive |
A build script was added since 0.1.1. | VM run |
| 52 | freya-edit 0.5.0-rc.8
high false positive |
The build looked up github.com. | VM run |
| 51 | cubecl-cpu 0.12.0-pre.1
high false positive |
A build script was added since 0.11.3. | VM run |
| 50 | cp2k-spfft-sys 2026.2.0
high false positive |
high severity downloader_pattern in build_script code: https://github.com/eth-cscs/SpFFT/archive/17ddf73fe65547f93a5439185baf10cd7b49532f.tar.gz at build.rs:74 with std::process::Command::new at build.rs:83 | VM run |
| 50 | arkitekt-mesh-smoltcp 0.9.0
high false positive |
high severity environment_enumeration in build_script code: std::env::vars | VM run |
| 50 | day-piece-webview 0.4.4
high false positive |
high severity downloader_pattern in build_script code: https://www.nuget.org/api/v2/package/Microsoft.Web.WebView2/{VERSION} at build.rs:176 with std::process::Command::new at build.rs:191 | VM run |
| 50 | zgx-ghostty-sys 0.1.0
high false positive |
high severity downloader_pattern in build_script code: https://github.com/ghostty-org/ghostty.git at build.rs:25 with std::process::Command::new at build.rs:74 | VM run |
| 50 | uzor-fonts 1.5.8
high false positive |
high severity downloader_pattern in build_script code: https://raw.githubusercontent.com/UZOR-dev/uzor-fonts/{REPO_COMMIT} at build.rs:117 with std::process::Command::new at build.rs:121 | VM run |
| 50 | shine-cli 2.6.0
high false positive |
high severity exfiltration_endpoint in build_script code: transfer.sh | VM run |
| 50 | tickloop 0.2.6
high false positive |
high severity downloader_pattern in build_script code: https://github.com/tickloopai/homebrew-tap/releases/download at build.rs:6 with std::process::Command::new at build.rs:65 | VM run |
| 50 | r0z-sys 0.2.0
high false positive |
high severity downloader_pattern in build_script code: ureq::Agent::config_builder at build/sodium.rs:328 with std::process::Command::new at build/sodium.rs:313 | VM run |
| 50 | naui-winui3 0.10.0
high false positive |
high severity downloader_pattern in build_script code: https://api.nuget.org/v3-flatcontainer/{id}/{version}/{name} at build.rs:391 with std::process::Command::new at build.rs:396 | VM run |
| 50 | shine-cli 2.5.0
high false positive |
high severity downloader_pattern in build_script code: https://example.test at cli/src/apps/refresh.rs:215 with std::process::Command::new at cli/build.rs:49 | VM run |
| 50 | zpl-rs 0.1.9
high false positive |
The build looked up api.github.com. | VM run |
| 50 | shine-cli 2.4.0
high false positive |
high severity downloader_pattern in build_script code: https://example.test at cli/src/apps/refresh.rs:208 with std::process::Command::new at cli/build.rs:49 | VM run |
| 50 | aur-scanner-core 2.2.0
high false positive |
New since 2.1.1: yara:reverse_shell | VM run |
| 50 | reqtls 0.4.0-alpha3
high false positive |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 50 | github-copilot-sdk 1.0.17-preview.0
high false positive |
The build looked up github.com. | VM run |
| 50 | parlar-moonshine 0.1.4
high false positive |
high severity downloader_pattern in build_script code: https://github.com/moonshine-ai/moonshine/releases/download/{VERSION}/{name}.tar.gz at build.rs:49 with std::process::Command::new at build.rs:51 | VM run |
| 50 | fusion-pcu-mlx 0.0.7
high false positive |
high severity downloader_pattern in build_script code: https://codeload.github.com/ml-explore/mlx/tar.gz/64ea011cb65f14d9ce2737e60db9a4ae91ed7441 at ffi/rust/build/acquisition/acquisition.rs:25 with std::process::Command at ffi/rust/build/acquisition/acqu… | VM run |
| 50 | github-copilot-sdk 1.0.15-unstable.36793206303.g13aa136
high false positive |
The build looked up github.com. | VM run |
| 50 | github-copilot-sdk 1.0.15-unstable.36638597907.ge270afd
high false positive |
The build looked up github.com. | VM run |
| 49 | ramp-ffmpeg-sys 9.0.4
medium |
A build script wrote the whole environment, with the planted github_token_env, into its build directory. | VM run |
| 48 | turbo-surf-v8 150.4.0
medium |
high severity environment_enumeration in build_script code: std::env::vars | VM run |
| 48 | turbo-surf-v8 149.3.0
medium |
high severity environment_enumeration in build_script code: std::env::vars | VM run |
| 48 | libsodium-sys-stable 1.24.3
medium |
high severity downloader_pattern in build_script code: http://download.libsodium.org/libsodium/releases at build.rs:414 with std::process::Command::new at build.rs:171 | VM run |
| 48 | libsodium-sys-stable 1.24.2
medium |
high severity downloader_pattern in build_script code: http://download.libsodium.org/libsodium/releases at build.rs:414 with std::process::Command::new at build.rs:171 | VM run |
| 48 | libsodium-sys-stable 1.24.1
medium |
high severity downloader_pattern in build_script code: http://download.libsodium.org/libsodium/releases at build.rs:408 with std::process::Command::new at build.rs:166 | VM run |
| 48 | jetstreamer-utils 0.8.1
medium |
high severity shell_command in build_script code: curl https://clickhouse.com/ | sh | VM run |
| 48 | jetstreamer-utils 0.8.0
medium |
high severity shell_command in build_script code: curl https://clickhouse.com/ | sh | VM run |
| 48 | katana-render-runtime 0.4.22
medium |
high severity included_binary in build_script code (8 places): src/markdown/generated/zenuml-runtime-assets.bin.br (840248 bytes) | VM run |
| 48 | freya 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-devtools 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-borderless-plugin 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-winit 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-web 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-metrics-plugin 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-android 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-testing 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-html 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-material-design 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-markdown 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-code-editor 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-components 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-terminal 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-router 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-sdk 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-radio 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-i18n 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-query 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-camera 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-core 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-animation 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | freya-clipboard 0.5.0-rc.8
medium |
The build looked up github.com. | VM run |
| 48 | katana-render-runtime 0.4.21
medium |
high severity included_binary in build_script code (8 places): src/markdown/generated/zenuml-runtime-assets.bin.br (840248 bytes) | VM run |
| 48 | mise 2026.9.15
medium |
high severity downloader_pattern in build_script code: https:// at build/registry_url.rs:8 with std::process::Command::new at build.rs:119 | VM run |
| 47 | murmur-cli 0.8.0
medium |
A build script was added since 0.7.0. | VM run |
| 47 | barretenberg-rs 6.0.0-nightly.20261016.a
medium |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 7.0.0-nightly.20261014
medium |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 5.3.0-nightly.20261013
medium |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 7.0.0-nightly.20261012
medium |
The build looked up github.com. | VM run |
| 47 | dittolive-ditto-sys 5.1.0-experimental-innovapptive-memory.2
medium false positive |
The build looked up software.ditto.live. | VM run |
| 47 | barretenberg-rs 7.0.0-nightly.20261007
medium false positive |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 5.3.0-nightly.20260930
medium false positive |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 6.0.0-rc.2
medium |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 7.0.0-nightly.20260927
medium false positive |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 5.3.0-nightly.20260927
medium false positive |
The build looked up github.com. | VM run |
| 47 | barretenberg-rs 7.0.0-nightly.20260925
medium |
The build looked up github.com. | VM run |
| 46 | tailrace-console 1.0.0
medium |
A build script was added since 0.0.0. | VM run |
| 46 | github-copilot-sdk 1.0.23-preview.3
medium |
high severity downloader_pattern in build_script code: ureq::Error at build/download.rs:6 with std::process::Command at build/in_process/tests.rs:417 | VM run |
| 46 | nosman 0.25.7
medium |
The build looked up nodos.dev. | VM run |
| 46 | github-copilot-sdk 1.0.23-preview.2
medium |
high severity downloader_pattern in build_script code: ureq::Error at build/download.rs:6 with std::process::Command at build/in_process/tests.rs:417 | VM run |
| 46 | gnostr-crawler 971106.1845.126068
medium |
high severity downloader_pattern in build_script code: wss:// at build.rs:41 with std::process::Command::new at build.rs:163 | VM run |
| 46 | gnostr-crawler 970857.1845.452560
medium |
high severity downloader_pattern in build_script code: wss:// at build.rs:33 with std::process::Command::new at build.rs:147 | VM run |
| 46 | gnostr-crawler 970402.1846.51281
medium false positive |
high severity downloader_pattern in build_script code: wss:// at build.rs:33 with std::process::Command::new at build.rs:147 | VM run |
| 46 | nosman 0.25.3
medium |
The build looked up nodos.dev. | VM run |
| 45 | deformable 0.1.1
medium |
high severity shell_command in build_script code: curl ended with {} | VM run |
| 45 | thunderstrike 0.1.3
medium |
high severity shell_command in build_script code: download failed: {url} (curl {status}) | VM run |
| 45 | excelreader 7.3.3
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | thunderstrike 0.1.2
medium |
high severity shell_command in build_script code: download failed: {url} (curl {status}) | VM run |
| 45 | thunderstrike 0.1.1
medium |
high severity shell_command in build_script code: download failed: {url} (curl {status}) | VM run |
| 45 | cp2k-pexsi-sys 2026.2.0
medium |
high severity downloader_pattern in build_script code: https://github.com/milesix/pexsi/archive/refs/tags/v2.0.0.tar.gz at build.rs:98 with std::process::Command::new at build.rs:104 | VM run |
| 45 | cp2k-trexio-sys 2026.2.0
medium |
high severity downloader_pattern in build_script code: https://www.cp2k.org/static/downloads/trexio-{ver}.tar.gz at build.rs:55 with std::process::Command::new at build.rs:61 | VM run |
| 45 | cp2k-superlu-dist-sys 2026.2.0
medium |
high severity downloader_pattern in build_script code: https://github.com/xiaoyeli/superlu_dist/archive/refs/tags/v7.2.0.tar.gz at build.rs:52 with std::process::Command::new at build.rs:58 | VM run |
| 45 | cp2k-libvdwxc-sys 2026.2.0
medium |
high severity downloader_pattern in build_script code: https://www.cp2k.org/static/downloads/libvdwxc-{ver}.tar.gz at build.rs:52 with std::process::Command::new at build.rs:58 | VM run |
| 45 | cp2k-greenx-sys 2026.2.0
medium |
high severity downloader_pattern in build_script code: https://www.cp2k.org/static/downloads/greenX-{ver}.tar.gz at build.rs:67 with std::process::Command::new at build.rs:73 | VM run |
| 45 | cp2k-gauxc-sys 2026.2.0
medium |
high severity downloader_pattern in build_script code: https://github.com/wavefunction91/GauXC/archive/{GAUXC_REV}.tar.gz at build.rs:126 with std::process::Command::new at build.rs:132 | VM run |
| 45 | cp2k-dbcsr-sys 2026.2.0
medium |
high severity downloader_pattern in build_script code: https://github.com/cp2k/dbcsr.git at build.rs:57 with std::process::Command::new at build.rs:51 | VM run |
| 45 | thruput-sys 0.58.0
medium |
high severity secret_environment_variable in build_script code: CARGO_REGISTRIES_THRUPUT_INDEX | VM run |
| 45 | excelreader 7.3.2
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | excelreader 7.3.1
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | xlsynth-sys 0.76.0
medium |
The build looked up github.com. | VM run |
| 45 | ramp-ffmpeg-sys 9.0.5
medium |
A build script wrote the whole environment, with the planted github_token_env, into its build directory. | VM run |
| 45 | excelreader 7.3.0
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | boxlite 0.10.8
medium |
high severity environment_enumeration in build_script code: std::env::vars | VM run |
| 45 | excelreader 7.2.0
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | cp2k-pexsi-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://github.com/milesix/pexsi/archive/refs/tags/v2.0.0.tar.gz at build.rs:98 with std::process::Command::new at build.rs:104 | VM run |
| 45 | cp2k-trexio-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://www.cp2k.org/static/downloads/trexio-{ver}.tar.gz at build.rs:55 with std::process::Command::new at build.rs:61 | VM run |
| 45 | cp2k-superlu-dist-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://github.com/xiaoyeli/superlu_dist/archive/refs/tags/v7.2.0.tar.gz at build.rs:52 with std::process::Command::new at build.rs:58 | VM run |
| 45 | cp2k-libvdwxc-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://www.cp2k.org/static/downloads/libvdwxc-{ver}.tar.gz at build.rs:52 with std::process::Command::new at build.rs:58 | VM run |
| 45 | cp2k-spfft-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://github.com/eth-cscs/SpFFT/archive/17ddf73fe65547f93a5439185baf10cd7b49532f.tar.gz at build.rs:74 with std::process::Command::new at build.rs:83 | VM run |
| 45 | cp2k-greenx-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://www.cp2k.org/static/downloads/greenX-{ver}.tar.gz at build.rs:67 with std::process::Command::new at build.rs:73 | VM run |
| 45 | cp2k-gauxc-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://github.com/wavefunction91/GauXC/archive/{GAUXC_REV}.tar.gz at build.rs:126 with std::process::Command::new at build.rs:132 | VM run |
| 45 | cp2k-dbcsr-sys 0.3.2
medium |
high severity downloader_pattern in build_script code: https://github.com/cp2k/dbcsr.git at build.rs:57 with std::process::Command::new at build.rs:51 | VM run |
| 45 | raw_player 2026.3.0-canary.1
medium |
high severity shell_command in build_script code (3 places): certutil | VM run |
| 45 | excelreader 7.1.0
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | utoipa-swagger-ui 10.0.2
medium |
high severity shell_command in build_script code: curl download file exited with error status: {status} | VM run |
| 45 | xlsynth-sys 0.75.0
medium |
The build looked up github.com. | VM run |
| 45 | wsb 0.227.4750
medium |
The build looked up github.com. | VM run |
| 45 | deformable 0.1.0
medium |
high severity shell_command in build_script code: curl ended with {} | VM run |
| 45 | boxlite 0.10.7
medium |
high severity environment_enumeration in build_script code: std::env::vars | VM run |
| 45 | spicedb-embedded-sys 0.8.0
medium |
high severity shell_command in build_script code: curl failed ({}). Check network and that release v{} exists with asset libspicedb-{}.tar.gz | VM run |
| 45 | raw_player 2026.3.0-canary.0
medium |
high severity shell_command in build_script code (3 places): certutil | VM run |
| 45 | litert-lm-edge-sys 0.2.6
medium |
high severity shell_command in build_script code (6 places): curl is not runnable: {error} | VM run |
| 45 | ll-core 0.2.1
medium |
high severity shell_command in build_script code (5 places): curl spawn failed (is `curl` on PATH?) | VM run |
| 45 | ll-core 0.2.0
medium |
high severity shell_command in build_script code (5 places): curl spawn failed (is `curl` on PATH?) | VM run |
| 45 | excelreader 7.0.0
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | excelreader 7.0.0-rc.4
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | excelreader 7.0.0-rc.3
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | excelreader 7.0.0-rc.2
medium |
high severity shell_command in build_script code (2 places): powershell | VM run |
| 45 | github-copilot-sdk 1.0.22-preview.2
medium |
The build looked up github.com. | VM run |
| 45 | boxlite 0.10.6
medium |
high severity environment_enumeration in build_script code: std::env::vars | VM run |
| 19 | infino 0.11.18
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | day-cli 0.6.3
low |
medium severity process_spawn in build_script code (272 places): std::process::Command::new | VM run |
| 19 | kingfisher-rules 3.0.1
low |
high severity exfiltration_endpoint in library code: https://api.telegram.org/bot{{ TOKEN }}/getMe | VM run |
| 19 | snouty 0.9.0-rc.1
low |
medium severity process_spawn in build_script code (66 places): std::process::Command::new | VM run |
| 19 | atuin-daemon 18.24.4
low |
medium severity process_spawn in build_script code (6 places): std::process::Command::new | VM run |
| 19 | mnn-src 3.4.0-rc1
low |
A build script was added since 0.0.0. | VM run |
| 19 | ebman 0.48.0
low |
high severity exfiltration_endpoint in library code: https://hooks.slack.com/services/EXAMPLE | VM run |
| 19 | faucet-cli 1.16.0
low |
high severity exfiltration_endpoint in test code: https://hooks.slack.com/services/T0/B0/x | VM run |
| 19 | rust_widgets 3.1.1
low |
medium severity process_spawn in build_script code (22 places): std::process::Command::new | VM run |
| 19 | alef 0.115.6
low |
medium severity process_spawn in build_script code (242 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.154
low |
medium severity process_spawn in build_script code (151 places): std::process::Command::new | VM run |
| 19 | oj_js 0.2.52
low |
The build looked up github.com. | VM run |
| 19 | rust_widgets 3.1.0
low |
medium severity process_spawn in build_script code (22 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.153
low |
medium severity process_spawn in build_script code (151 places): std::process::Command::new | VM run |
| 19 | infino 0.11.17
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | oj_js 0.2.51
low |
The build looked up github.com. | VM run |
| 19 | vizier 0.13.5
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.152
low |
medium severity process_spawn in build_script code (150 places): std::process::Command::new | VM run |
| 19 | infino 0.11.16
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | atuin-daemon 18.24.3
low |
medium severity process_spawn in build_script code (6 places): std::process::Command::new | VM run |
| 19 | oj_js 0.2.50
low |
The build looked up github.com. | VM run |
| 19 | brokk-mj-core 2.61.2
low |
medium severity process_spawn in build_script code (78 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.151
low |
medium severity process_spawn in build_script code (149 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.61.1
low |
medium severity process_spawn in build_script code (78 places): std::process::Command::new | VM run |
| 19 | rust_widgets 3.0.0
low |
medium severity process_spawn in build_script code (22 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.61.0
low |
medium severity process_spawn in build_script code (77 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.150
low |
medium severity process_spawn in build_script code (149 places): std::process::Command::new | VM run |
| 19 | skillcask 0.10.0
low |
medium severity process_spawn in build_script code (9 places): std::process::Command::new | VM run |
| 19 | holon 0.55.0
low |
medium severity process_spawn in build_script code (69 places): std::process::Command::new | VM run |
| 19 | infino 0.11.15
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.149
low |
medium severity process_spawn in build_script code (149 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.148
low |
medium severity process_spawn in build_script code (149 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.147
low |
medium severity process_spawn in build_script code (152 places): std::process::Command::new | VM run |
| 19 | infino 0.11.14
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.146
low |
medium severity process_spawn in build_script code (152 places): std::process::Command::new | VM run |
| 19 | luaskills 0.7.2
low |
medium severity process_spawn in build_script code (66 places): std::process::Command::new | VM run |
| 19 | kingfisher-rules 3.0.0
low |
high severity exfiltration_endpoint in library code: https://api.telegram.org/bot{{ TOKEN }}/getMe | VM run |
| 19 | vizier 0.13.4
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | uqa-sql 0.6.2
low |
A build script was added since 0.6.1. | VM run |
| 19 | guigu-agent-bridge 0.2.24
low |
medium severity process_spawn in build_script code (54 places): std::process::Command::new | VM run |
| 19 | sipnab 0.5.231
low |
medium severity process_spawn in build_script code (24 places): std::process::Command::new | VM run |
| 19 | rust_widgets 2.9.4
low |
medium severity process_spawn in build_script code (22 places): std::process::Command::new | VM run |
| 19 | skillcask 0.9.4
low |
medium severity process_spawn in build_script code (9 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.145
low |
medium severity process_spawn in build_script code (152 places): std::process::Command::new | VM run |
| 19 | atuin-daemon 18.24.2
low |
medium severity process_spawn in build_script code (6 places): std::process::Command::new | VM run |
| 19 | alef 0.115.5
low |
medium severity process_spawn in build_script code (247 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.60.0
low |
medium severity process_spawn in build_script code (77 places): std::process::Command::new | VM run |
| 19 | skillcask 0.9.3
low |
medium severity process_spawn in build_script code (7 places): std::process::Command::new | VM run |
| 19 | skillcask 0.9.2
low |
medium severity process_spawn in build_script code (7 places): std::process::Command::new | VM run |
| 19 | luaskills 0.7.1
low |
medium severity process_spawn in build_script code (66 places): std::process::Command::new | VM run |
| 19 | regorus 0.14.0
low |
medium severity process_spawn in build_script code (2 places): std::process::Command::new | VM run |
| 19 | luaskills 0.7.0
low |
medium severity process_spawn in build_script code (66 places): std::process::Command::new | VM run |
| 19 | oxijolt 1.3.0+jolt-5.6.0
low |
A build script was added since 1.2.0+jolt-5.6.0. | VM run |
| 19 | crawlberg-browser 1.12.3
low |
The build looked up github.com. | VM run |
| 19 | eryx 0.12.1
low |
high severity yara:reverse_shell in test code: Reverse shell idioms | VM run |
| 19 | rsconstruct 0.9.144
low |
medium severity process_spawn in build_script code (152 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.59.1
low |
medium severity process_spawn in build_script code (75 places): std::process::Command::new | VM run |
| 19 | reifydb-allocator-jemalloc 0.10.1
low |
The build ran /usr/bin/chmod. | VM run |
| 19 | alef 0.115.4
low |
medium severity process_spawn in build_script code (247 places): std::process::Command::new | VM run |
| 19 | skillcask 0.9.1
low |
medium severity process_spawn in build_script code (7 places): std::process::Command::new | VM run |
| 19 | eryx 0.12.0
low |
high severity yara:reverse_shell in test code: Reverse shell idioms | VM run |
| 19 | alef 0.115.3
low |
medium severity process_spawn in build_script code (247 places): std::process::Command::new | VM run |
| 19 | crawlberg-browser 1.12.2
low |
The build looked up github.com. | VM run |
| 19 | speccoder-runtime 0.3.0
low |
A build script was added since 0.2.0. | VM run |
| 19 | day-cli 0.6.2
low |
medium severity process_spawn in build_script code (266 places): std::process::Command::new | VM run |
| 19 | alef 0.115.2
low |
medium severity process_spawn in build_script code (247 places): std::process::Command::new | VM run |
| 19 | forklaunch 1.34.0
low |
high severity exfiltration_endpoint in library code: {"id": "cfg-1", "serviceName": "iam", "slackWebhookUrl": "https://hooks.slack.com/x"} | VM run |
| 19 | alef 0.115.1
low |
medium severity process_spawn in build_script code (247 places): std::process::Command::new | VM run |
| 19 | hush-secrets 0.1.28
low |
medium severity process_spawn in build_script code (17 places): std::process::Command::new | VM run |
| 19 | skillcask 0.9.0
low |
medium severity process_spawn in build_script code (7 places): std::process::Command::new | VM run |
| 19 | volant 0.1.0-alpha.13
low |
medium severity process_spawn in build_script code (228 places): std::process::Command::new | VM run |
| 19 | alef 0.115.0
low |
medium severity process_spawn in build_script code (247 places): std::process::Command::new | VM run |
| 19 | rust_widgets 2.9.3
low |
medium severity process_spawn in build_script code (22 places): std::process::Command::new | VM run |
| 19 | mosaica-python 0.1.0-rc.4
low |
A build script was added since 0.0.0. | VM run |
| 19 | brokk-mj-core 2.58.0
low |
medium severity process_spawn in build_script code (75 places): std::process::Command::new | VM run |
| 19 | mur-common 2.97.0
low |
medium severity process_spawn in build_script code (16 places): std::process::Command::new | VM run |
| 19 | skillcask 0.8.0
low |
medium severity process_spawn in build_script code (6 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.57.1
low |
medium severity process_spawn in build_script code (75 places): std::process::Command::new | VM run |
| 19 | holochain_cli_sandbox 0.8.0-dev.13
low |
The build ran /usr/bin/chmod. | VM run |
| 19 | holochain_cli_client 0.8.0-dev.13
low |
The build ran /usr/bin/chmod. | VM run |
| 19 | skillcask 0.7.0
low |
medium severity process_spawn in build_script code (6 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.57.0
low |
medium severity process_spawn in build_script code (75 places): std::process::Command::new | VM run |
| 19 | infino 0.11.13
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | reifydb-allocator-jemalloc 0.10.0
low |
The build ran /usr/bin/chmod. | VM run |
| 19 | day-cli 0.6.1
low |
medium severity process_spawn in build_script code (267 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.142
low |
medium severity process_spawn in build_script code (150 places): std::process::Command::new | VM run |
| 19 | compose-rust 0.0.3
low |
New since the previous version: disk:outside. | VM run |
| 19 | rust_widgets 2.9.2
low |
medium severity process_spawn in build_script code (37 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.56.1
low |
medium severity process_spawn in build_script code (75 places): std::process::Command::new | VM run |
| 19 | sipnab 0.5.230
low |
medium severity process_spawn in build_script code (24 places): std::process::Command::new | VM run |
| 19 | brokk-mj-core 2.56.0
low |
medium severity process_spawn in build_script code (75 places): std::process::Command::new | VM run |
| 19 | muslib 0.2.1
low |
A build script was added since 0.2.0. | VM run |
| 19 | podbox-cli 0.9.1
low |
medium severity process_spawn in build_script code (85 places): std::process::Command::new | VM run |
| 19 | rsconstruct 0.9.141
low |
medium severity process_spawn in build_script code (148 places): std::process::Command::new | VM run |
| 19 | infino 0.11.12
low |
medium severity process_spawn in build_script code (8 places): std::process::Command::new | VM run |
| 19 | oj_js 0.2.46
low |
The build looked up github.com. | VM run |
| 19 | zgx-desktop 0.1.0
low |
A build script was added since 0.0.1. | VM run |
| 19 | microsandbox-cli 0.7.11
low |
The build looked up github.com. | VM run |
| 19 | forklaunch 1.33.0
low |
high severity exfiltration_endpoint in library code: {"id": "cfg-1", "serviceName": "iam", "slackWebhookUrl": "https://hooks.slack.com/x"} | VM run |
| 19 | alef 0.114.2
low |
medium severity process_spawn in build_script code (247 places): std::process::Command::new | VM run |
Crateward is MIT OR Apache-2.0. Fonts under the SIL Open Font License (OFL.txt).