Crateward

day-cli 0.6.2

Done dynamic on Linux job 285496 crates.io SBOM Findings (VEX) Compare with 0.6.1

medium severity process_spawn in build_script code (266 places): std::process::Command::new

19
low
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

PointsSignalWhereWhat
10static:process_spawn
static · day-cli
build.rs:17medium severity process_spawn in build_script code (266 places): std::process::Command::new
2static:environment_enumeration
static · day-cli
src/ops.rs:221medium severity environment_enumeration in library code: std::env::vars_os
2static:included_binary
static · day-cli
src/pack/android.rs:306medium severity included_binary in library code (4 places): resources/day-dev.keystore (2778 bytes)
2static:obfuscated_data
static · day-cli
src/devices.rs:3021medium severity obfuscated_data in library code (2 places): 101 /sdk/emulator/emulator -avd day-ci-medium-tablet -port 5554 -no-window -gpu swiftshader_indirect\u{a} 102 /sdk/emulator/qemu/linux-x86_64/qemu-system-x86_64-headless -avd day-ci-medium-tablet -po…
2static:shell_command
static · day-cli
src/diagnose.rs:450medium severity shell_command in library code (8 places): powershell
1static:build_script
static · day-cli
build.rslow severity build_script in build_script code: build.rs

Behavior

Profile

static:environment_enumeration static:included_binary static:obfuscated_data static:process_spawn static:shell_command

Static findings

11 groups
medium shell_command library 8
medium included_binary library 4
medium obfuscated_data library 2
  • 101 /sdk/emulator/emulator -avd day-ci-medium-tablet -port 5554 -no-window -gpu swiftshader_indirect\u{a} 102 /sdk/emulator/qemu/linux-x86_64/qemu-system-x86_64-headless -avd day-ci-medium-tablet -po… src/devices.rs:3021
  • oemmode=rd buildvariant=eng developer_mode=1 console=ttyS0,115200 sn=0023456789 init=/bin/init hardware=virt root=/dev/ram0 rw ip=dhcp ohos.boot.hardware=virt ohos.required_mount.system=/dev/block/vdb… src/ohos.rs:197
medium environment_enumeration library 1
medium process_spawn build_script 1
low process_spawn library 261
low network_access library 41
low process_spawn test 4
low build_script build_script 1
info url_literal library 193
info unsafe_code library 6

Run: check

succeeded
Ended
agent reported the end
Guest
exit code 0
Run time
591 ms
VM restore
72 ms
Payload
12252 files, 287.2 MiB
Files opened
509

Processes 2

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

ProcessArgumentsStartTookExit
cargo /usr/local/bin/cargo check --locked --offline 5 ms 575 ms 0
└rustc /usr/local/bin/rustc --crate-name crateward_probe --edition=2021 lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata -C embed-bitcode=no -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=d9152fcf76bf9b7f -C extra-filename=-8c7788aadf5d3a75 --out-dir /work/target/debug/deps -C incremental=/work/target/debug/incremental -L dependency=/work/target/debug/deps 308 ms 257 ms 0

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files
21
Directories
19
Size
77.8 KiB
Compiled units
1

Nothing outside the build areas.

Output

Standard error
warning: crateward-probe v0.0.0 (/cw/probe) ignoring invalid dependency `target` which is missing a lib target
    Checking crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.52s

Timeline

6
WhenFromToEventWorker
2026-10-27 06:19 UTCDiscoveredFetchedfetchedfetcher-12688
2026-10-27 06:19 UTCFetchedReadyForSandboxstatic_analysis_completedstatic-12726
2026-10-27 06:20 UTCReadyForSandboxRunningsandbox_startedorchestrator-12760-slot2
2026-10-27 06:20 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-12760-slot2
2026-10-27 06:20 UTCDynamicallyAnalyzedScoredscoredanalyzer-12816
2026-10-27 06:20 UTCScoredDonefinalizedanalyzer-12816