Crateward

cadaclysm-sdk 0.11.0

Done dynamic on Linux job 211966 crates.io SBOM Findings (VEX)

high severity secret_environment_variable in build_script code: CARGO_REGISTRIES_

65
high
False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

PointsSignalWhereWhat
30static:secret_environment_variable
static · cadaclysm-sdk
build.rs:201high severity secret_environment_variable in build_script code: CARGO_REGISTRIES_
10network_lookup
network · cadaclysm-sdk
github.comThe build looked up github.com.
10new_high_finding
diff · cadaclysm-sdk
build.rs:201New since 0.10.0: secret_environment_variable
5exec_downloader
trace · cadaclysm-sdk
/usr/bin/curlThe build ran /usr/bin/curl.
5new_behavior
diff · cadaclysm-sdk
exec:downloaderNew since the previous version: exec:downloader.
5new_behavior
diff · cadaclysm-sdk
net:github.comNew since the previous version: net:github.com.
6 without points
SignalWhereWhat
static:build_script
static · cadaclysm-sdk
build.rslow severity build_script in build_script code: build.rs
static:downloader_pattern
static · cadaclysm-sdk
build.rs:34high severity downloader_pattern in build_script code: https://github.com/rdeioris/cadaclysm-sdk/releases/download at build.rs:34 with std::process::Command::new at build.rs:150
static:environment_enumeration
static · cadaclysm-sdk
build.rs:199low severity environment_enumeration in build_script code: std::env::vars_os, keys only
static:process_spawn
static · cadaclysm-sdk
build.rs:150medium severity process_spawn in build_script code (6 places): std::process::Command::new
static:shell_command
static · cadaclysm-sdk
build.rs:312high severity shell_command in build_script code: curl could not fetch {url}
static:url_literal
static · cadaclysm-sdk
build.rs:34low severity url_literal in build_script code: https://github.com/rdeioris/cadaclysm-sdk/releases/download

Behavior

New since the previous version

exec:downloader net:github.com static:secret_environment_variable

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn static:secret_environment_variable static:shell_command

Static findings

9 groups
high downloader_pattern build_script 1
  • https://github.com/rdeioris/cadaclysm-sdk/releases/download at build.rs:34 with std::process::Command::new at build.rs:150 build.rs:34
high secret_environment_variable build_script 1
high shell_command build_script 1
medium process_spawn build_script 3
low process_spawn library 3
low build_script build_script 1
low environment_enumeration build_script 1
low url_literal build_script 1
  • https://github.com/rdeioris/cadaclysm-sdk/releases/download build.rs:34
info unsafe_code library 8

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended
agent reported the end
Guest
exit code 0
Run time
8.1 s
VM restore
58 ms
Payload
82 files, 1.1 MiB
Files opened
614

Processes 11

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

ProcessArgumentsStartTookExit
cargo /usr/local/bin/cargo build --locked --offline 5 ms 8.0 s 0
└rustc /usr/local/bin/rustc ×4 --crate-name cfg_if --edition=2018 /cw/vendor/cfg-if-1.0.5/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("core", "rustc-dep-of-std")) -C metadata=8fbcd44a3da28d1d -C extra-filename=-d05893e10c9c8e83 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow 119 ms 212 ms 0
└rustc /usr/local/bin/rustc --crate-name build_script_build --edition=2021 /cw/vendor/cadaclysm-sdk-0.11.0/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="download" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "download", "raw-window-handle")) -C metadata=a3f4de1a56ba0ed1 -C extra-filename=-19e7d3891e84ca35 --out-dir /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35 -L dependency=/work/target/debug/deps --cap-lints allow 334 ms 734 ms 0
└toolchain /usr/bin/cc -m64 /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/rustcKsm9qh/symbols.o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35.build_script_build.4b43ce2db12a1f50-cgu.0.rcgu.o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35.build_script_build.4b43ce2db12a1f50-cgu.1.rcgu.o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35.build_script_build.4b43ce2db12a1f50-cgu.2.rcgu.o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35.build_script_build.4b43ce2db12a1f50-cgu.3.rcgu.o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35.build_script_build.4b43ce2db12a1f50-cgu.4.rcgu.o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35.6d9j50rqodzrkxc7rlkhfroog.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rl 920 ms 146 ms 0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccYDAasX.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/rustcKsm9qh/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gn 928 ms 138 ms 0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccYDAasX.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/build_script_build-19e7d3891e84ca35 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/cadaclysm-sdk-19e7d3891e84ca35/rustcKsm9qh/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x 930 ms 134 ms 0
└build_script cadaclysm-sdk 1.0 s 63 ms 0
└other /usr/bin/curl --fail --silent --show-error --location --retry 2 --output /work/target/debug/build/cadaclysm-sdk-2db7cb526e71d338/out/SHA256SUMS-0.11.0 https://github.com/rdeioris/cadaclysm-sdk/releases/download/v0.11.0/SHA256SUMS 1.0 s 61 ms 5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

DestinationProtocolWhat was sentBytes
:443tlsSNI github.com, inside TLS: GET /rdeioris/cadaclysm-sdk/releases/download/v0.11.0/SHA256SUMS, host github.com, agent curl/8.14.11.5 KiB
Sockets in the trace 3
WhenProgramHowAddressType
1.1 s/usr/bin/curlconnectunix:/var/run/nscd/socketstream
1.1 s/usr/bin/curlconnect:53datagram
1.1 s/usr/bin/curlconnect:443stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files
60
Directories
28
Size
54.6 MiB
Compiled units
8
Scan
stopped at a limit

Nothing outside the build areas.

Output

Standard error
   Compiling cfg-if v1.0.5
   Compiling cadaclysm-sdk v0.11.0
   Compiling libloading v0.8.9
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.04s

Timeline

9
WhenFromToEventWorker
2026-10-20 03:56 UTCDiscoveredFetchedfetchedfetcher-12688
2026-10-20 03:56 UTCFetchedReadyForSandboxstatic_analysis_completedstatic-12726
2026-10-20 03:56 UTCReadyForSandboxRunningsandbox_startedorchestrator-12760-slot1
2026-10-20 03:56 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-12760-slot1
2026-10-20 03:56 UTCDynamicallyAnalyzedReadyForSandboxscoredanalyzer-12816
2026-10-20 03:56 UTCReadyForSandboxRunningsandbox_startedorchestrator-12760-slot2
2026-10-20 03:57 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-12760-slot2
2026-10-20 03:57 UTCDynamicallyAnalyzedScoredscoredanalyzer-12816
2026-10-20 03:57 UTCScoredDonefinalizedanalyzer-12816