Crateward

twip 0.1.0-alpha.1

Done dynamic on Linux job 284167 crates.io SBOM Findings (VEX)

A build script was added since 0.0.0.

53
high
False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

PointsSignalWhereWhat
10build_script_added
diff · twip
A build script was added since 0.0.0.
10network_lookup
network · skia-bindings
github.comThe build looked up github.com.
10network_lookup
network · skia-bindings
codeload.github.comThe build looked up codeload.github.com.
5exec_downloader
trace · skia-bindings
/usr/bin/curlThe build ran /usr/bin/curl.
5new_behavior
diff · twip
exec:downloaderNew since the previous version: exec:downloader.
5new_behavior
diff · twip
exec:interpreterNew since the previous version: exec:interpreter.
3exec_interpreter
trace · skia-bindings
/usr/bin/python3The build ran /usr/bin/python3.
2static:yara:invisible_characters
static · twip
tests/fixtures/make-fixtures.py:458medium severity yara:invisible_characters in test code: Zero width or invisible characters, which can hide identifiers or payloads
2static:yara:sandbox_evasion
static · twip
tests/fixtures/dictionaries/en_US.dic:23519medium severity yara:sandbox_evasion in test code: Checks for virtual machines, sandboxes or debuggers
1static:build_script
static · twip
build.rslow severity build_script in build_script code: build.rs
2 without points
SignalWhereWhat
new_behavior
diff · twip
net:codeload.github.comNew since the previous version: net:codeload.github.com.
new_behavior
diff · twip
net:github.comNew since the previous version: net:github.com.

Behavior

New since the previous version

exec:downloader exec:interpreter net:codeload.github.com net:github.com static:yara:invisible_characters static:yara:sandbox_evasion

Profile

exec:downloader exec:interpreter net:codeload.github.com net:github.com static:yara:invisible_characters static:yara:sandbox_evasion

Static findings

7 groups
medium yara_match invisible_characters test 1
medium yara_match sandbox_evasion test 1
low build_script build_script 1
low foreign_functions library 1
info url_literal library 48
info unsafe_code library 3
info unsafe_code binary 1

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended
agent reported the end
Guest
exit code 101
Run time
42.2 s
VM restore
65 ms
Payload
7060 files, 95.2 MiB
Files opened
9932

Processes 174

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

ProcessArgumentsStartTookExit
cargo /usr/local/bin/cargo build --locked --offline 8 ms 42.0 s 25856
└rustc /usr/local/bin/rustc ×19 --crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow 227 ms 708 ms 0
└toolchain /usr/bin/cc -m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustc9L1Ojw/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib 778 ms 153 ms 0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc5feFfB.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustc9L1Ojw/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L 785 ms 146 ms 0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc5feFfB.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustc9L1Ojw/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6 788 ms 142 ms 0
└build_script proc-macro2 939 ms 88 ms 0
└rustc /usr/local/bin/rustc ×3 --version 940 ms 14 ms 0
└rustc /usr/local/bin/rustc --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu 955 ms 33 ms 256
└rustc /usr/local/bin/rustc ×61 --crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow 1.1 s 49 ms 0
└build_script quote 1.6 s 9 ms 0
└rustc /usr/local/bin/rustc --version 1.6 s 6 ms 0
└build_script libc 5.0 s 9 ms 0
└rustc /usr/local/bin/rustc --version 5.0 s 7 ms 0
└build_script serde_core 5.0 s 9 ms 0
└rustc /usr/local/bin/rustc --version 5.0 s 7 ms 0
└build_script prettyplease 8.2 s 2 ms 0
└build_script zmij 8.2 s 9 ms 0
└rustc /usr/local/bin/rustc --version 8.2 s 7 ms 0
└build_script rustix 8.2 s 35 ms 0
└rustc /usr/local/bin/rustc ×2 --crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-d1a934849d48d427/out/rustix_test_can_compile - 8.2 s 16 ms 0
└build_script clang-sys 8.3 s 1 ms 0
└build_script serde_json 16.1 s 1 ms 0
└build_script crc32fast 18.6 s 9 ms 0
└rustc /usr/local/bin/rustc --version 18.6 s 6 ms 0
└build_script bindgen 24.9 s 1 ms 0
└build_script libc 38.6 s 8 ms 0
└rustc /usr/local/bin/rustc --version 38.6 s 6 ms 0
└build_script crc32fast 39.6 s 9 ms 0
└rustc /usr/local/bin/rustc --version 39.6 s 7 ms 0
└build_script getrandom 41.4 s 1 ms 0
└build_script serde_core 41.4 s 8 ms 0
└rustc /usr/local/bin/rustc --version 41.4 s 6 ms 0
└build_script skia-bindings 41.9 s 90 ms 25856
└other /usr/bin/pkg-config ×2 --libs --cflags freetype2 41.9 s 2 ms 256
└other /usr/bin/curl ×2 -L -f -sS -C - --create-dirs --output /work/target/debug/build/skia-bindings-3ab38663892a8d08/out/.cache/skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-graphite-jpegd-jpege-pdf-vulkan.tar.gz https://github.com/rust-skia/skia-binaries/releases/download/0.153.3/skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-graphite-jpegd-jpege-pdf-vulkan.tar.gz 41.9 s 57 ms 5632
└unknown 42.0 s 1 ms 32512
└other /usr/bin/python3 --version 42.0 s 4 ms 0

Network 4

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com codeload.github.com

DestinationProtocolWhat was sentBytes
:443tlsSNI github.com, inside TLS: GET /rust-skia/skia-binaries/releases/download/0.153.3/skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-graphite-jpegd-jpege-pdf-vulkan.tar.gz, host github.com, agent curl/8.14.11.5 KiB
:443tlsSNI codeload.github.com, inside TLS: GET /rust-skia/skia/tar.gz/m153-0.101.2, host codeload.github.com, agent curl/8.14.11.5 KiB
Sockets in the trace 6
WhenProgramHowAddressType
41.9 s/usr/bin/curlconnectunix:/var/run/nscd/socketstream
41.9 s/usr/bin/curlconnect:53datagram
41.9 s/usr/bin/curlconnect:443stream
42.0 s/usr/bin/curlconnectunix:/var/run/nscd/socketstream
42.0 s/usr/bin/curlconnect:53datagram
42.0 s/usr/bin/curlconnect:443stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files
662
Directories
197
Size
392.1 MiB
Compiled units
125
Scan
stopped at a limit

Nothing outside the build areas.

Output

Standard error
   Compiling proc-macro2 v1.0.107
   Compiling quote v1.0.47
   Compiling unicode-ident v1.0.27
   Compiling cfg-if v1.0.5
   Compiling memchr v2.8.3
   Compiling syn v3.0.9
   Compiling serde_core v1.0.229
   Compiling libc v0.2.191
   Compiling glob v0.3.4
   Compiling clang-sys v1.9.1
   Compiling bitflags v2.13.2
   Compiling rustix v1.1.6
   Compiling zmij v1.0.23
   Compiling prettyplease v0.2.37
   Compiling aho-corasick v1.1.5
   Compiling libloading v0.8.9
   Compiling crc32fast v1.5.3
   Compiling linux-raw-sys v0.12.1
   Compiling minimal-lexical v0.2.1
   Compiling log v0.4.34
   Compiling shlex v2.0.1
   Compiling serde_json v1.0.154
   Compiling regex-syntax v0.8.11
   Compiling find-msvc-tools v0.1.15
   Compiling cc v1.10.0
   Compiling regex-automata v0.4.18
   Compiling nom v7.1.3
   Compiling synstructure v0.14.0
   Compiling syn v2.0.119
   Compiling bindgen v0.72.1
   Compiling winnow v1.0.4
   Compiling simd-adler32 v0.3.10
   Compiling adler2 v2.0.1
   Compiling itoa v1.0.18
   Compiling either v1.19.0
   Compiling itertools v0.13.0
   Compiling miniz_oxide v0.9.1
   Compiling toml_parser v1.1.5+spec-1.1.0
   Compiling xattr v1.6.1
   Compiling cexpr v0.6.0
   Compiling regex v1.13.1
   Compiling filetime v0.2.29
   Compiling toml_datetime v1.1.2+spec-1.1.0
   Compiling serde_spanned v1.1.2
   Compiling rustc-hash v2.1.3
   Compiling shlex v1.3.0
   Compiling toml_writer v1.1.3+spec-1.1.0
   Compiling toml v1.1.8+spec-1.1.0
   Compiling tar v0.4.46
   Compiling flate2 v1.1.10
   Compiling zerofrom-derive v0.1.8
   Compiling bytemuck_derive v1.12.1
   Compiling heck v0.5.0
   Compiling pkg-config v0.3.34
   Compiling skia-bindings v0.153.3
   Compiling bytemuck v1.25.2
   Compiling zerofrom v0.1.8
   Compiling yoke-derive v0.8.4
   Compiling stable_deref_trait v1.2.1
   Compiling hashbrown v0.17.1
   Compiling getrandom v0.4.3
   Compiling foldhash v0.2.0
   Compiling yoke v0.8.4
   Compiling font-types v0.12.7
error: failed to run custom build command for `skia-bindings v0.153.3`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/skia-bindings-1a166a04fe7db96e/build-script-build` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-env-changed=SKIA_DEBUG
  cargo:rerun-if-env-changed=FREETYPE2_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=FREETYPE2_STATIC
  cargo:rerun-if-env-changed=FREETYPE2_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=FONTCONFIG_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=FONTCONFIG_STATIC
  cargo:rerun-if-env-changed=FONTCONFIG_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SKIA_SOURCE_DIR
  cargo:rerun-if-env-changed=FORCE_SKIA_BUILD
  cargo:rerun-if-env-changed=FORCE_SKIA_BINARIES_DOWNLOAD
  TRYING TO DOWNLOAD AND INSTALL SKIA BINARIES: 0.153.3/b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-graphite-jpegd-jpege-pdf-vulkan
  cargo:rerun-if-env-changed=SKIA_BINARIES_URL
    FROM: https://github.com/rust-skia/skia-binaries/releases/download/0.153.3/skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-graphite-jpegd-jpege-pdf-vulkan.tar.gz
  DOWNLOAD AND INSTALL FAILED: curl error code: "22"
  curl stderr: "curl: (22) The requested URL returned error: 404\n"
  STARTING A FULL BUILD
  HOST: x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=CLANGCC
  cargo:rerun-if-env-changed=CC
  cargo:rerun-if-env-changed=CLANGCXX
  cargo:rerun-if-env-changed=CXX
  cargo:rerun-if-env-changed=OPT_LEVEL
  cargo:rerun-if-env-changed=SKIA_USE_SYSTEM_LIBRARIES
  cargo:rerun-if-env-changed=SDKTARGETSYSROOT
  cargo:rerun-if-env-changed=SDKROOT
  cargo:rerun-if-env-changed=SKIA_NINJA_COMMAND
  cargo:rerun-if-env-changed=SKIA_GN_COMMAND
  Probing 'python'
  Probing 'python3'
  Python 3 found: "python3"
  Synchronizing Skia dependencies
  DOWNLOADING: https://codeload.github.com/rust-skia/skia/tar.gz/m153-0.101.2

  --- stderr

  thread 'main' (1577) panicked at /cw/vendor/skia-bindings-0.153.3/build_support/binary_cache/download.rs:81:35:
  Failed to download https://codeload.github.com/rust-skia/skia/tar.gz/m153-0.101.2 (curl error code: "22"
  curl stderr: "curl: (22) The requested URL returned error: 404\n")
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

9
WhenFromToEventWorker
2026-10-27 03:12 UTCDiscoveredFetchedfetchedfetcher-12688
2026-10-27 03:12 UTCFetchedReadyForSandboxstatic_analysis_completedstatic-12726
2026-10-27 03:12 UTCReadyForSandboxRunningsandbox_startedorchestrator-12760-slot1
2026-10-27 03:13 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-12760-slot1
2026-10-27 03:13 UTCDynamicallyAnalyzedReadyForSandboxscoredanalyzer-12816
2026-10-27 03:13 UTCReadyForSandboxRunningsandbox_startedorchestrator-12760-slot0
2026-10-27 03:14 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-12760-slot0
2026-10-27 03:14 UTCDynamicallyAnalyzedScoredscoredanalyzer-12816
2026-10-27 03:14 UTCScoredDonefinalizedanalyzer-12816