Crateward

rust_widgets 3.1.1

Done dynamic on Linux job 312711 crates.io SBOM Findings (VEX) Compare with 3.1.0

medium severity process_spawn in build_script code (22 places): std::process::Command::new

19
low
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

PointsSignalWhereWhat
10static:process_spawn
static · rust_widgets
build.rs:554medium severity process_spawn in build_script code (22 places): std::process::Command::new
2static:included_binary
static · rust_widgets
src/render/text/font_assets/variable_fixtures.rs:33medium severity included_binary in library code (3 places): src/render/text/font_assets/variable_test.ttf (1004 bytes)
2static:obfuscated_data
static · rust_widgets
src/render/text/cjk_bitmap_data.rs:29medium severity obfuscated_data in library code (3 places): array of 2361 integer literals
2static:shell_command
static · rust_widgets
src/platform/types/values.rs:196medium severity shell_command in library code (2 places): powershell
2static:yara:invisible_characters
static · rust_widgets
src/render/text/color_bitmap.rs:28medium severity yara:invisible_characters in library code: Zero width or invisible characters, which can hide identifiers or payloads
1static:build_script
static · rust_widgets
build.rslow severity build_script in build_script code: build.rs

Behavior

Profile

static:included_binary static:obfuscated_data static:process_spawn static:shell_command static:yara:invisible_characters

Static findings

11 groups
medium included_binary library 3
medium obfuscated_data library 3
medium process_spawn build_script 2
medium shell_command library 2
medium yara_match invisible_characters library 1
low foreign_functions library 24
low process_spawn library 20
low build_script build_script 1
info unsafe_code library 62
info url_literal library 28
info unsafe_code binary 1

Run: check

failed
Ended
agent reported the end
Guest
exit code 101
Run time
24.2 s
VM restore
57 ms
Payload
21943 files, 508.3 MiB
Files opened
6048

Processes 98

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

ProcessArgumentsStartTookExit
cargo /usr/local/bin/cargo check --locked --offline 5 ms 24.1 s 25856
└rustc /usr/local/bin/rustc ×10 --crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow 454 ms 663 ms 0
└toolchain /usr/bin/cc -m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcKsFx3C/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib 945 ms 166 ms 0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2 -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccY8DjMd.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcKsFx3C/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L 952 ms 159 ms 0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld -flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccY8DjMd.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustcKsFx3C/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6 954 ms 156 ms 0
└build_script proc-macro2 1.1 s 85 ms 0
└rustc /usr/local/bin/rustc ×3 --version 1.1 s 7 ms 0
└rustc /usr/local/bin/rustc --cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu 1.1 s 34 ms 256
└rustc /usr/local/bin/rustc ×35 --crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow 1.2 s 53 ms 0
└build_script quote 1.9 s 10 ms 0
└rustc /usr/local/bin/rustc --version 1.9 s 8 ms 0
└build_script serde_core 2.2 s 10 ms 0
└rustc /usr/local/bin/rustc --version 2.2 s 7 ms 0
└build_script serde 2.3 s 10 ms 0
└rustc /usr/local/bin/rustc --version 2.3 s 8 ms 0
└build_script libc 7.8 s 10 ms 0
└rustc /usr/local/bin/rustc --version 7.8 s 8 ms 0
└build_script target-lexicon 14.4 s 10 ms 0
└rustc /usr/local/bin/rustc --version 14.4 s 7 ms 0
└build_script libm 20.7 s 2 ms 0
└build_script num-traits 21.6 s 48 ms 0
└rustc /usr/local/bin/rustc ×3 --version --verbose 21.6 s 8 ms 0
└build_script glib-sys 24.1 s 7 ms 256
└other /usr/bin/pkg-config --libs --cflags glib-2.0 glib-2.0 >= 2.56 24.1 s 3 ms 256

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files
365
Directories
548
Size
172.0 MiB
Compiled units
60

Nothing outside the build areas.

Output

Standard error
   Compiling proc-macro2 v1.0.107
   Compiling unicode-ident v1.0.27
   Compiling quote v1.0.47
   Compiling serde_core v1.0.229
   Compiling serde v1.0.229
   Compiling hashbrown v0.17.1
   Compiling equivalent v1.0.3
   Compiling pkg-config v0.3.34
   Compiling indexmap v2.14.2
   Compiling toml_datetime v0.6.3
   Compiling winnow v0.5.40
   Compiling libc v0.2.191
   Compiling serde_spanned v0.6.9
   Compiling toml_edit v0.20.2
   Compiling syn v3.0.9
   Compiling target-lexicon v0.12.16
   Compiling smallvec v1.16.4
   Compiling cfg-expr v0.15.8
   Compiling toml v0.8.2
   Compiling version-compare v0.2.1
   Compiling heck v0.5.0
   Compiling system-deps v6.2.2
   Compiling syn v2.0.119
   Compiling version_check v0.9.5
    Checking cfg-if v1.0.5
   Compiling autocfg v1.5.1
   Compiling libm v0.2.16
    Checking bitflags v2.13.2
   Compiling num-traits v0.2.19
    Checking log v0.4.34
    Checking once_cell v1.21.4
   Compiling bytemuck_derive v1.12.1
    Checking memchr v2.8.3
    Checking bytemuck v1.25.2
   Compiling glib-sys v0.18.1
    Checking arrayvec v0.7.8
warning: glib-sys@0.18.1: 
error: failed to run custom build command for `glib-sys v0.18.1`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/glib-sys-80ba380febd216ca/build-script-build` (exit status: 1)
  --- stdout
  cargo:rerun-if-env-changed=GLIB_2.0_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:warning=
  pkg-config exited with status code 1
  > PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 pkg-config --libs --cflags glib-2.0 'glib-2.0 >= 2.56'

  pkg-config output:
    Package glib-2.0 was not found in the pkg-config search path.
    Perhaps you should add the directory containing `glib-2.0.pc'
    to the PKG_CONFIG_PATH environment variable
    Package 'glib-2.0', required by 'virtual:world', not found
    Package 'glib-2.0', required by 'virtual:world', not found

  The system library `glib-2.0` required by crate `glib-sys` was not found.
  The file `glib-2.0.pc` needs to be installed and the PKG_CONFIG_PATH environment variable must contain its parent directory.
  The PKG_CONFIG_PATH environment variable is not set.

  HINT: if you have installed the library, try setting PKG_CONFIG_PATH to the directory containing `glib-2.0.pc`.

Timeline

6
WhenFromToEventWorker
2026-10-29 16:49 UTCDiscoveredFetchedfetchedfetcher-12688
2026-10-29 16:49 UTCFetchedReadyForSandboxstatic_analysis_completedstatic-12726
2026-10-29 16:49 UTCReadyForSandboxRunningsandbox_startedorchestrator-12760-slot0
2026-10-29 16:50 UTCRunningDynamicallyAnalyzedsandbox_completedorchestrator-12760-slot0
2026-10-29 16:50 UTCDynamicallyAnalyzedScoredscoredanalyzer-12816
2026-10-29 16:50 UTCScoredDonefinalizedanalyzer-12816