uzor-fonts 1.5.8

Done dynamic on Linux job 257078 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://raw.githubusercontent.com/UZOR-dev/uzor-fonts/{REPO_COMMIT} at build.rs:117 with std::process::Command::new at build.rs:121

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · uzor-fonts	build.rs:117	high severity downloader_pattern in build_script code: https://raw.githubusercontent.com/UZOR-dev/uzor-fonts/{REPO_COMMIT} at build.rs:117 with std::process::Command::new at build.rs:121
10	new_high_finding diff · uzor-fonts	build.rs:117	New since 1.5.7: downloader_pattern
10	new_high_finding diff · uzor-fonts	build.rs:126	New since 1.5.7: shell_command

6 without points

Signal	Where	What
static:build_script static · uzor-fonts	build.rs	low severity build_script in build_script code: build.rs
static:included_binary static · uzor-fonts	src/lib.rs:37	medium severity included_binary in library code (23 places): fonts/Roboto-Regular.ttf (305608 bytes)
static:process_spawn static · uzor-fonts	build.rs:121	medium severity process_spawn in build_script code: std::process::Command::new
static:shell_command static · uzor-fonts	build.rs:126	high severity shell_command in build_script code: curl could not be run ({e})
static:url_literal static · uzor-fonts	build.rs:95	low severity url_literal in build_script code (2 places): \u{a}uzor-fonts: feature `{}` needs {} and {why}.\u{a}Either put the file (sha256 {}) in a directory and set UZOR_FONTS_DIR to it,\u{a}or allow the download from https://github.com/UZOR-dev/uzor-fonts…
static:yara:sandbox_evasion static · uzor-fonts	fonts/NotoEmoji-Regular.ttf	medium severity yara:sandbox_evasion in library code: Checks for virtual machines, sandboxes or debuggers

Behavior

New since the previous version

static:downloader_pattern static:process_spawn static:shell_command

Profile

static:downloader_pattern static:included_binary static:process_spawn static:shell_command static:yara:sandbox_evasion

Static findings

high downloader_pattern build_script 1

https://raw.githubusercontent.com/UZOR-dev/uzor-fonts/{REPO_COMMIT} at build.rs:117 with std::process::Command::new at build.rs:121 build.rs:117

high shell_command build_script 1

curl could not be run ({e}) build.rs:126

medium included_binary library 23

fonts/Roboto-Regular.ttf (305608 bytes) src/lib.rs:37
fonts/Roboto-Bold.ttf (128676 bytes) src/lib.rs:40
fonts/Roboto-Italic.ttf (130872 bytes) src/lib.rs:43
fonts/Roboto-BoldItalic.ttf (132124 bytes) src/lib.rs:46
fonts/PTRootUI-VF.ttf (266616 bytes) src/lib.rs:54
fonts/Inter-400.ttf (340556 bytes) src/lib.rs:64
fonts/Inter-500.ttf (341128 bytes) src/lib.rs:66
fonts/Inter-550.ttf (341220 bytes) src/lib.rs:68
fonts/Inter-600.ttf (341796 bytes) src/lib.rs:70
fonts/Inter-650.ttf (341868 bytes) src/lib.rs:72
fonts/Inter-700.ttf (342248 bytes) src/lib.rs:74
fonts/JetBrainsMono-Regular.ttf (270224 bytes) src/lib.rs:92
fonts/JetBrainsMono-Bold.ttf (274096 bytes) src/lib.rs:95
fonts/SourceSerif4-Regular.ttf (261868 bytes) src/lib.rs:103
fonts/SourceSerif4-Bold.ttf (271568 bytes) src/lib.rs:106
fonts/SourceSerif4-It.ttf (187808 bytes) src/lib.rs:109
fonts/SourceSerif4-BoldIt.ttf (191832 bytes) src/lib.rs:112
fonts/SymbolsNerdFontMono-Regular.ttf (2507556 bytes) src/lib.rs:119
fonts/NotoSansSymbols2-Regular.ttf (656852 bytes) src/lib.rs:123
fonts/NotoSansArabic-Regular.ttf (170196 bytes) src/lib.rs:169
fonts/NotoSansDevanagari-Regular.ttf (157068 bytes) src/lib.rs:172
fonts/DejaVuSans.ttf (757076 bytes) src/lib.rs:182
fonts/NotoEmoji-Regular.ttf (1982596 bytes) src/lib.rs:186

medium process_spawn build_script 1

std::process::Command::new build.rs:121

medium yara_match sandbox_evasion library 1

Checks for virtual machines, sandboxes or debuggers fonts/NotoEmoji-Regular.ttf

low url_literal build_script 2

\u{a}uzor-fonts: feature `{}` needs {} and {why}.\u{a}Either put the file (sha256 {}) in a directory and set UZOR_FONTS_DIR to it,\u{a}or allow the download from https://github.com/UZOR-dev/uzor-fonts… build.rs:95
https://raw.githubusercontent.com/UZOR-dev/uzor-fonts/{REPO_COMMIT} build.rs:117

low build_script build_script 1

build.rs build.rs

info native_link build_script 1

links = "uzor_fonts_assets" Cargo.toml

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 1.0 s
VM restore: 85 ms
Payload: 39 files, 10.7 MiB
Files opened: 376

Processes 8

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 6 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	984 ms
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2021 /cw/vendor/uzor-fonts-1.5.8/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("cjk", "color-emoji", "default", "heavy")) -C metadata=c272c96e3dd0d929 -C extra-filename=-47129e7154a8bfea --out-dir /work/target/debug/build/uzor-fonts-47129e7154a8bfea -L dependency=/work/target/debug/deps --cap-lints allow	113 ms	483 ms
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/uzor-fonts-47129e7154a8bfea/rustcb2Fkli/symbols.o /work/target/debug/build/uzor-fonts-47129e7154a8bfea/build_script_build-47129e7154a8bfea.build_script_build.bd1ac7da4f73970c-cgu.0.rcgu.o /work/target/debug/build/uzor-fonts-47129e7154a8bfea/build_script_build-47129e7154a8bfea.66k7cfxl5f3t5ir21p5b5oykg.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/librus	442 ms	150 ms
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccedMggO.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/uzor-fonts-47129e7154a8bfea/build_script_build-47129e7154a8bfea /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/uzor-fonts-47129e7154a8bfea/rustcb2Fkli/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/u	450 ms	142 ms
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccedMggO.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/uzor-fonts-47129e7154a8bfea/build_script_build-47129e7154a8bfea /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/uzor-fonts-47129e7154a8bfea/rustcb2Fkli/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-	453 ms	137 ms
└build_script uzor-fonts		599 ms	2 ms
└rustc /usr/local/bin/rustc ×2	--crate-name uzor_fonts --edition=2021 /cw/vendor/uzor-fonts-1.5.8/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --cfg feature="default" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("cjk", "color-emoji", "default", "heavy")) -C metadata=482bbedc748aa690 -C extra-filename=-878b3dabebf02e5d --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow --check-cfg cfg(uzor_fonts_color_emoji)	601 ms	357 ms

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 46
Directories: 26
Size: 52.7 MiB
Compiled units: 4
Scan: stopped at a limit

Nothing outside the build areas.

Output

Standard error

   Compiling uzor-fonts v1.5.8
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.94s

Timeline

When	From	To	Event	Worker
2026-10-24 10:08 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-24 10:08 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-24 10:08 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-24 10:09 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-24 10:09 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-12816
2026-10-24 10:09 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-24 10:09 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-24 10:09 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-24 10:09 UTC	Scored	Done	finalized	analyzer-12816