thunderstrike 0.1.3

Done dynamic on Linux job 311948 crates.io SBOM Findings (VEX) Compare with 0.1.2

high severity shell_command in build_script code: download failed: {url} (curl {status})

medium

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
30	static:shell_command static · thunderstrike	build.rs:129	high severity shell_command in build_script code: download failed: {url} (curl {status})
10	network_lookup network · thunderstrike	github.com	The build looked up github.com.
5	exec_downloader trace · thunderstrike	/usr/bin/curl	The build ran /usr/bin/curl.

4 without points

Signal	Where	What
static:build_script static · thunderstrike	build.rs	low severity build_script in build_script code: build.rs
static:downloader_pattern static · thunderstrike	build.rs:24	high severity downloader_pattern in build_script code: https://github.com/TheManhattanProject/thunderstrike-client/releases/download at build.rs:24 with std::process::Command::new at build.rs:120
static:process_spawn static · thunderstrike	build.rs:120	medium severity process_spawn in build_script code (2 places): std::process::Command::new
static:url_literal static · thunderstrike	build.rs:24	low severity url_literal in build_script code: https://github.com/TheManhattanProject/thunderstrike-client/releases/download

Behavior

Profile

exec:downloader net:github.com static:downloader_pattern static:process_spawn static:shell_command

Static findings

high downloader_pattern build_script 1

https://github.com/TheManhattanProject/thunderstrike-client/releases/download at build.rs:24 with std::process::Command::new at build.rs:120 build.rs:24

high shell_command build_script 1

download failed: {url} (curl {status}) build.rs:129

medium process_spawn build_script 2

std::process::Command::new build.rs:120 build.rs:149

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/sys.rs:109

low url_literal build_script 1

https://github.com/TheManhattanProject/thunderstrike-client/releases/download build.rs:24

info native_link build_script 1

links = "thunderstrike_client" Cargo.toml

info unsafe_code library 1

49 unsafe blocks, functions or impls src/lib.rs:148

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 1.0 s
VM restore: 106 ms
Payload: 17 files, 101.6 KiB
Files opened: 271

Processes 7

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 4 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	1.0 s	25856
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2021 /cw/vendor/thunderstrike-0.1.3/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=fed6f7eda94e1513 -C extra-filename=-123aab27e47959d3 --out-dir /work/target/debug/build/thunderstrike-123aab27e47959d3 -L dependency=/work/target/debug/deps --cap-lints allow	110 ms	836 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/thunderstrike-123aab27e47959d3/rustcTcepkn/symbols.o /work/target/debug/build/thunderstrike-123aab27e47959d3/build_script_build-123aab27e47959d3.build_script_build.2d03fe9e0b015c68-cgu.0.rcgu.o /work/target/debug/build/thunderstrike-123aab27e47959d3/build_script_build-123aab27e47959d3.build_script_build.2d03fe9e0b015c68-cgu.1.rcgu.o /work/target/debug/build/thunderstrike-123aab27e47959d3/build_script_build-123aab27e47959d3.build_script_build.2d03fe9e0b015c68-cgu.2.rcgu.o /work/target/debug/build/thunderstrike-123aab27e47959d3/build_script_build-123aab27e47959d3.du2uuqxpd66hc8rlmir0es0z0.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustli	803 ms	139 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccSCeDQc.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/thunderstrike-123aab27e47959d3/build_script_build-123aab27e47959d3 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/thunderstrike-123aab27e47959d3/rustcTcepkn/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gn	810 ms	132 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccSCeDQc.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/thunderstrike-123aab27e47959d3/build_script_build-123aab27e47959d3 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/thunderstrike-123aab27e47959d3/rustcTcepkn/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x	813 ms	128 ms	0
└build_script thunderstrike		950 ms	63 ms	256
└other /usr/bin/curl	--fail --location --silent --show-error --retry 3 --connect-timeout 30 --output /work/target/debug/build/thunderstrike-7df5edc7a3e562f3/out/thunderstrike-native-0.1.3-linux-x64.tar.gz.part https://github.com/TheManhattanProject/thunderstrike-client/releases/download/v0.1.3/thunderstrike-native-0.1.3-linux-x64.tar.gz	951 ms	62 ms	5632

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up github.com

Destination	Protocol	What was sent	Bytes
:443	tls	SNI github.com, inside TLS: GET /TheManhattanProject/thunderstrike-client/releases/download/v0.1.3/thunderstrike-native-0.1.3-linux-x64.tar.gz, host github.com, agent curl/8.14.1	1.5 KiB

Sockets in the trace 3

When	Program	How	Address	Type
990 ms	/usr/bin/curl	connect	unix:/var/run/nscd/socket	stream
991 ms	/usr/bin/curl	connect	:53	datagram
992 ms	/usr/bin/curl	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 18
Directories: 22
Size: 9.2 MiB
Compiled units: 0

Nothing outside the build areas.

Output

Standard error

   Compiling thunderstrike v0.1.3
error: failed to run custom build command for `thunderstrike v0.1.3`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/thunderstrike-123aab27e47959d3/build-script-build` (exit status: 1)
  --- stdout
  cargo:rerun-if-changed=build.rs
  cargo:rerun-if-changed=checksums.txt
  cargo:rerun-if-env-changed=DOCS_RS
  cargo:rerun-if-env-changed=THUNDERSTRIKE_LIB_DIR
  cargo:rerun-if-env-changed=THUNDERSTRIKE_DOWNLOAD_BASE
  cargo:rerun-if-env-changed=THUNDERSTRIKE_SKIP_VERIFY

  --- stderr
  curl: (22) The requested URL returned error: 404

  thunderstrike: download failed: https://github.com/TheManhattanProject/thunderstrike-client/releases/download/v0.1.3/thunderstrike-native-0.1.3-linux-x64.tar.gz (curl exit status: 22)

Timeline

When	From	To	Event	Worker
2026-10-29 15:06 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-29 15:06 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-29 15:09 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot2
2026-10-29 15:09 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot2
2026-10-29 15:09 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-29 15:09 UTC	Scored	Done	finalized	analyzer-12816