excelreader 7.0.0-rc.3
high severity shell_command in build_script code (2 places): powershell
45
medium
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.
Evidence
| Points | Signal | Where | What |
|---|---|---|---|
| 30 | static:shell_command static · excelreader | build.rs:131 | high severity shell_command in build_script code (2 places): powershell |
| 10 | network_lookup network · excelreader | github.com | The build looked up github.com. |
| 5 | exec_downloader trace · excelreader | /usr/bin/curl | The build ran /usr/bin/curl. |
4 without points
| Signal | Where | What |
|---|---|---|
| static:build_script static · excelreader | build.rs | low severity build_script in build_script code: build.rs |
| static:downloader_pattern static · excelreader | build.rs:54 | high severity downloader_pattern in build_script code: https://github.com/{REPO}/releases/download/v{version}/{asset_name} at build.rs:54 with std::process::Command::new at build.rs:131 |
| static:process_spawn static · excelreader | build.rs:131 | medium severity process_spawn in build_script code (4 places): std::process::Command::new |
| static:url_literal static · excelreader | build.rs:54 | low severity url_literal in build_script code: https://github.com/{REPO}/releases/download/v{version}/{asset_name} |
Behavior
Profile
exec:downloader net:github.com static:downloader_pattern static:process_spawn static:shell_command
Static findings
8 groups
high shell_command build_script 2
powershellbuild.rs:131Invoke-WebRequest -Uri '{url}' -OutFile '{}'build.rs:136
high downloader_pattern build_script 1
https://github.com/{REPO}/releases/download/v{version}/{asset_name} at build.rs:54 with std::process::Command::new at build.rs:131build.rs:54
medium process_spawn build_script 4
std::process::Command::newbuild.rs:131 build.rs:142 build.rs:173 build.rs:189
low build_script build_script 1
build.rsbuild.rs
low foreign_functions library 1
extern blocksrc/ffi.rs:236
low url_literal build_script 1
https://github.com/{REPO}/releases/download/v{version}/{asset_name}build.rs:54
info unsafe_code library 9
19 unsafe blocks, functions or implssrc/aggregate.rs:1213 unsafe blocks, functions or implssrc/arrow.rs:33 src/writer.rs:2421 unsafe blocks, functions or implssrc/ffi.rs:4902 unsafe blocks, functions or implssrc/options.rs:4377 unsafe blocks, functions or implssrc/rows.rs:1026 unsafe blocks, functions or implssrc/source.rs:4239 unsafe blocks, functions or implssrc/workbook.rs:1017 unsafe blocks, functions or implssrc/writer_handle.rs:42
info unsafe_code binary 1
4 unsafe blocks, functions or implsbenches/alloc_bench.rs:10
Run: check
failed- Ended
- agent reported the end
- Guest
- exit code 101
- Run time
- 6.8 s
- VM restore
- 105 ms
- Payload
- 330 files, 4.0 MiB
- Files opened
- 1496
Processes 29
Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.
| Process | Arguments | Start | Took | Exit |
|---|---|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 6 ms | 6.7 s | 25856 |
| └rustc /usr/local/bin/rustc ×3 | --crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow | 247 ms | 656 ms | 0 |
| └toolchain /usr/bin/cc | -m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcBFJt0t/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib | 758 ms | 142 ms | 0 |
| └toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 | -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccctLDyU.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcBFJt0t/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L | 766 ms | 134 ms | 0 |
| └toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld | -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccctLDyU.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcBFJt0t/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6 | 768 ms | 131 ms | 0 |
| └build_script proc-macro2 | 907 ms | 83 ms | 0 | |
| └rustc /usr/local/bin/rustc ×3 | --version | 908 ms | 8 ms | 0 |
| └rustc /usr/local/bin/rustc | --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu | 917 ms | 32 ms | 256 |
| └rustc /usr/local/bin/rustc ×7 | --crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow | 990 ms | 50 ms | 0 |
| └build_script quote | 1.1 s | 10 ms | 0 | |
| └rustc /usr/local/bin/rustc | --version | 1.1 s | 8 ms | 0 |
| └build_script excelreader | 6.6 s | 140 ms | 25856 | |
| └other /usr/bin/curl | -fSL -o /work/target/debug/build/excelreader-cbe27ac1faeead26/out/excelreader-native-linux-x64.so https://github.com/GabrielMarquezMatte/ExcelReader/releases/download/v7.0.0-rc.3/excelreader-native-linux-x64.so | 6.6 s | 138 ms | 5632 |
Network 2
The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.
Looked up github.com
| Destination | Protocol | What was sent | Bytes |
|---|---|---|---|
| :443 | tls | SNI github.com, inside TLS: GET /GabrielMarquezMatte/ExcelReader/releases/download/v7.0.0-rc.3/excelreader-native-linux-x64.so, host github.com, agent curl/8.14.1 | 1.5 KiB |
Sockets in the trace 3
| When | Program | How | Address | Type |
|---|---|---|---|---|
| 6.6 s | /usr/bin/curl | connect | unix:/var/run/nscd/socket | stream |
| 6.6 s | /usr/bin/curl | connect | :53 | datagram |
| 6.6 s | /usr/bin/curl | connect | :443 | stream |
Files 0
Secrets opened
None.
Written outside the build directories
None.
Scratch disk 0
- Files
- 93
- Directories
- 41
- Size
- 46.2 MiB
- Compiled units
- 14
Nothing outside the build areas.
Output
Standard error
Compiling proc-macro2 v1.0.107
Compiling unicode-ident v1.0.27
Compiling quote v1.0.47
Compiling shlex v2.0.1
Compiling find-msvc-tools v0.1.14
Compiling cc v1.8.0
Compiling syn v3.0.9
Compiling excelreader v7.0.0-rc.3
error: failed to run custom build command for `excelreader v7.0.0-rc.3`
Caused by:
process didn't exit successfully: `/work/target/debug/build/excelreader-d82f949a1202515c/build-script-build` (exit status: 101)
--- stdout
cargo:rerun-if-env-changed=EXCELREADER_NATIVE_LIB_DIR
cargo:rerun-if-changed=excelreader.def
--- stderr
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (22) The requested URL returned error: 404
thread 'main' (726) panicked at /cw/vendor/excelreader-7.0.0-rc.3/build.rs:150:18:
downloading https://github.com/GabrielMarquezMatte/ExcelReader/releases/download/v7.0.0-rc.3/excelreader-native-linux-x64.so failed with exit status exit status: 22
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Timeline
6
| When | From | To | Event | Worker |
|---|---|---|---|---|
| 2026-10-14 20:42 UTC | Discovered | Fetched | fetched | fetcher-286769 |
| 2026-10-14 20:42 UTC | Fetched | ReadyForSandbox | static_analysis_completed | static-286807 |
| 2026-10-14 20:42 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-289279-slot2 |
| 2026-10-14 20:43 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-289279-slot2 |
| 2026-10-14 20:43 UTC | DynamicallyAnalyzed | Scored | scored | analyzer-289309 |
| 2026-10-14 20:43 UTC | Scored | Done | finalized | analyzer-289309 |