Crateward

rust_widgets 2.9.2

Done dynamic on Linux job 272500 crates.io SBOM Findings (VEX)

medium severity process_spawn in build_script code (37 places): std::process::Command::new

19
low
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

PointsSignalWhereWhat
10static:process_spawn
static · rust_widgets
build.rs:546medium severity process_spawn in build_script code (37 places): std::process::Command::new
2static:included_binary
static · rust_widgets
src/render/text/font_assets/arabic.rs:24medium severity included_binary in library code (12 places): src/render/text/font_assets/arabic.ttf (70576 bytes)
2static:obfuscated_data
static · rust_widgets
src/render/text/cjk_bitmap_data.rs:29medium severity obfuscated_data in library code (3 places): array of 2361 integer literals
2static:shell_command
static · rust_widgets
src/platform/types/values.rs:138medium severity shell_command in library code (2 places): powershell
2static:yara:invisible_characters
static · rust_widgets
src/render/text/color_bitmap.rs:28medium severity yara:invisible_characters in library code: Zero width or invisible characters, which can hide identifiers or payloads
1static:build_script
static · rust_widgets
build.rslow severity build_script in build_script code: build.rs

Behavior

Profile

static:included_binary static:obfuscated_data static:process_spawn static:shell_command static:yara:invisible_characters

Static findings

12 groups
medium included_binary library 12
medium obfuscated_data library 3
medium process_spawn build_script 2
medium shell_command library 2
medium yara_match invisible_characters library 1
low foreign_functions library 20
low process_spawn library 20
low process_spawn binary 15
low build_script build_script 1
low network_access library 1
info url_literal library 234
info unsafe_code library 55

Run: check

failed
Ended
agent reported the end
Guest
exit code 101
Run time
25.7 s
VM restore
61 ms
Payload
24241 files, 527.8 MiB
Files opened
6720

Processes 109

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

ProcessArgumentsStartTookExit
cargo /usr/local/bin/cargo check --locked --offline 5 ms 25.6 s 25856
└rustc /usr/local/bin/rustc ×12 --crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow 513 ms 699 ms 0
└toolchain /usr/bin/cc -m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustczbzK9c/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib 1.0 s 166 ms 0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cco3P9eq.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustczbzK9c/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L 1.0 s 149 ms 0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cco3P9eq.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustczbzK9c/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6 1.0 s 143 ms 0
└build_script proc-macro2 1.2 s 83 ms 0
└rustc /usr/local/bin/rustc ×3 --version 1.2 s 6 ms 0
└rustc /usr/local/bin/rustc --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu 1.2 s 35 ms 256
└rustc /usr/local/bin/rustc ×36 --crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow 1.3 s 47 ms 0
└build_script quote 1.9 s 9 ms 0
└rustc /usr/local/bin/rustc --version 1.9 s 6 ms 0
└build_script libc 10.1 s 9 ms 0
└rustc /usr/local/bin/rustc --version 10.1 s 6 ms 0
└build_script serde_core 10.2 s 9 ms 0
└rustc /usr/local/bin/rustc --version 10.2 s 7 ms 0
└build_script serde 11.0 s 8 ms 0
└rustc /usr/local/bin/rustc --version 11.0 s 6 ms 0
└build_script target-lexicon 16.8 s 9 ms 0
└rustc /usr/local/bin/rustc --version 16.8 s 6 ms 0
└build_script libm 18.8 s 1 ms 0
└build_script num-traits 19.5 s 41 ms 0
└rustc /usr/local/bin/rustc ×3 --version --verbose 19.5 s 7 ms 0
└build_script zerocopy 20.5 s 9 ms 0
└rustc /usr/local/bin/rustc --version 20.5 s 7 ms 0
└build_script glib-sys 25.6 s 6 ms 256
└other /usr/bin/pkg-config --libs --cflags glib-2.0 glib-2.0 >= 2.56 25.6 s 3 ms 256

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files
390
Directories
659
Size
209.4 MiB
Compiled units
62

Nothing outside the build areas.

Output

Standard error
   Compiling proc-macro2 v1.0.107
   Compiling unicode-ident v1.0.27
   Compiling quote v1.0.47
   Compiling syn v2.0.119
   Compiling syn v3.0.9
   Compiling libc v0.2.191
   Compiling hashbrown v0.17.1
   Compiling equivalent v1.0.3
   Compiling indexmap v2.14.2
   Compiling serde_core v1.0.229
   Compiling serde v1.0.229
   Compiling pkg-config v0.3.34
    Checking cfg-if v1.0.5
   Compiling toml_datetime v0.6.3
   Compiling winnow v0.5.40
   Compiling version_check v0.9.5
   Compiling serde_spanned v0.6.9
   Compiling toml_edit v0.20.2
   Compiling target-lexicon v0.12.16
   Compiling smallvec v1.16.4
   Compiling cfg-expr v0.15.8
   Compiling toml v0.8.2
   Compiling version-compare v0.2.1
   Compiling heck v0.5.0
   Compiling system-deps v6.2.2
   Compiling autocfg v1.5.1
   Compiling libm v0.2.16
    Checking once_cell v1.21.4
    Checking bitflags v2.13.2
   Compiling num-traits v0.2.19
    Checking log v0.4.34
   Compiling zerocopy v0.8.63
    Checking memchr v2.8.3
   Compiling zerocopy-derive v0.8.63
   Compiling bytemuck_derive v1.12.1
    Checking bytemuck v1.25.2
    Checking arrayvec v0.7.8
   Compiling glib-sys v0.18.1
warning: glib-sys@0.18.1: 
error: failed to run custom build command for `glib-sys v0.18.1`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/glib-sys-07db8535aa0f0ea4/build-script-build` (exit status: 1)
  --- stdout
  cargo:rerun-if-env-changed=GLIB_2.0_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:warning=
  pkg-config exited with status code 1
  > PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 pkg-config --libs --cflags glib-2.0 'glib-2.0 >= 2.56'

  pkg-config output:
    Package glib-2.0 was not found in the pkg-config search path.
    Perhaps you should add the directory containing `glib-2.0.pc'
    to the PKG_CONFIG_PATH environment variable
    Package 'glib-2.0', required by 'virtual:world', not found
    Package 'glib-2.0', required by 'virtual:world', not found

  The system library `glib-2.0` required by crate `glib-sys` was not found.
  The file `glib-2.0.pc` needs to be installed and the PKG_CONFIG_PATH environment variable must contain its parent directory.
  The PKG_CONFIG_PATH environment variable is not set.

  HINT: if you have installed the library, try setting PKG_CONFIG_PATH to the directory containing `glib-2.0.pc`.

Timeline

6
WhenFromToEventWorker
2026-10-26 00:09 UTCDiscoveredFetchedfetchedfetcher-12688
2026-10-26 00:09 UTCFetchedReadyForSandboxstatic_analysis_completedstatic-12726
2026-10-26 00:09 UTCReadyForSandboxRunningsandbox_startedorchestrator-12760-slot1
2026-10-26 00:09 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-12760-slot1
2026-10-26 00:09 UTCDynamicallyAnalyzedScoredscoredanalyzer-12816
2026-10-26 00:09 UTCScoredDonefinalizedanalyzer-12816