bao-mozjs-sys 153.3.0-2

Done dynamic on Linux job 35401 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://github.com/servo/mozjs/releases at build.rs:1566 with std::process::Command::new at build.rs:330

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · bao-mozjs-sys	build.rs:1566	high severity downloader_pattern in build_script code: https://github.com/servo/mozjs/releases at build.rs:1566 with std::process::Command::new at build.rs:330
10	network_lookup network · bao-mozjs-normalizer-glue	index.crates.io	The build looked up index.crates.io.
10	network_lookup network · bao-mozjs-locale-glue	index.crates.io	The build looked up index.crates.io.
5	new_behavior diff · bao-mozjs-sys	net:index.crates.io	New since the previous version: net:index.crates.io.

6 without points

Signal	Where	What
static:build_script static · bao-mozjs-sys	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · bao-mozjs-sys	build.rs:330	medium severity process_spawn in build_script code (8 places): std::process::Command::new
static:shell_command static · bao-mozjs-sys	build.rs:1590	high severity shell_command in build_script code: curl download failed with {status}: `{curl:?}`
static:url_literal static · bao-mozjs-sys	build.rs:1047	low severity url_literal in build_script code (2 places): MozTools or MozillaBuild not found!\u{a} Follow instructions on: https://github.com/servo/mozjs?tab=readme-ov-file#windows
static:yara:embedded_macho_executable static · bao-mozjs-sys	mozjs/testing/mozbase/mozgeckoprofiler/mozgeckoprofiler/dump_syms_mac	medium severity yara:embedded_macho_executable in library code: A Mach-O executable shipped inside the crate
static:yara:sandbox_evasion static · bao-mozjs-sys	mozjs/build/pgo/js-input/sunspider/string-tagcloud.html:266	medium severity yara:sandbox_evasion in library code: Checks for virtual machines, sandboxes or debuggers

Behavior

New since the previous version

net:index.crates.io

Profile

net:index.crates.io static:downloader_pattern static:process_spawn static:shell_command static:yara:embedded_macho_executable static:yara:sandbox_evasion

Static findings

high downloader_pattern build_script 1

https://github.com/servo/mozjs/releases at build.rs:1566 with std::process::Command::new at build.rs:330 build.rs:1566

high shell_command build_script 1

curl download failed with {status}: `{curl:?}` build.rs:1590

medium process_spawn build_script 8

std::process::Command::new build.rs:330 build.rs:531 build.rs:534 build.rs:1058 build.rs:1374 build.rs:1450 build.rs:1519 build.rs:1573

medium yara_match embedded_macho_executable library 1

A Mach-O executable shipped inside the crate mozjs/testing/mozbase/mozgeckoprofiler/mozgeckoprofiler/dump_syms_mac

medium yara_match sandbox_evasion library 1

Checks for virtual machines, sandboxes or debuggers mozjs/build/pgo/js-input/sunspider/string-tagcloud.html:266

low url_literal build_script 2

MozTools or MozillaBuild not found!\u{a} Follow instructions on: https://github.com/servo/mozjs?tab=readme-ov-file#windows build.rs:1047
https://github.com/servo/mozjs/releases build.rs:1566

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/lib.rs:73

info unsafe_code library 6

5 unsafe blocks, functions or impls src/glue.rs:18
3 unsafe blocks, functions or impls src/jsgc.rs:358
29 unsafe blocks, functions or impls src/jsimpls.rs:36
16 unsafe blocks, functions or impls src/jsval.rs:551
1 unsafe blocks, functions or impls src/lib.rs:78
27 unsafe blocks, functions or impls src/trace.rs:47

info native_link build_script 1

links = "mozjs" Cargo.toml

info unsafe_code test 1

1 unsafe blocks, functions or impls tests/evaluate.rs:52

Run: full

failed

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 101
Run time: 50.0 s
VM restore: 72 ms
Payload: 20484 files, 334.4 MiB
Files opened: 14300

Processes 223

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 199 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	6 ms	49.7 s	25856
└rustc /usr/local/bin/rustc ×91	--crate-name cfg_if --edition=2018 /cw/vendor/cfg-if-1.0.5/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("core", "rustc-dep-of-std")) -C metadata=8fbcd44a3da28d1d -C extra-filename=-d05893e10c9c8e83 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	332 ms	221 ms	0
└rustc /usr/local/bin/rustc ×26	--crate-name build_script_build --edition=2021 /cw/vendor/rustix-1.1.5/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --warn=unexpected_cfgs --check-cfg cfg(alloc_c_string) --check-cfg cfg(alloc_ffi) --check-cfg cfg(apple) --check-cfg cfg(asm_experimental_arch) --check-cfg cfg(bsd) --check-cfg cfg(core_c_str) --check-cfg cfg(core_ffi_c) --check-cfg cfg(core_intrinsics) --check-cfg cfg(criterion) --check-cfg	2.3 s	267 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/rustix-f3996fcb1b2e1347/rustckgctuB/symbols.o /work/target/debug/build/rustix-f3996fcb1b2e1347/build_script_build-f3996fcb1b2e1347.build_script_build.81b667ff47ac4765-cgu.0.rcgu.o /work/target/debug/build/rustix-f3996fcb1b2e1347/build_script_build-f3996fcb1b2e1347.build_script_build.81b667ff47ac4765-cgu.1.rcgu.o /work/target/debug/build/rustix-f3996fcb1b2e1347/build_script_build-f3996fcb1b2e1347.0abxgekof0w737q5fmz0qqc4i.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustl	2.5 s	110 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccvmIOG4.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/rustix-f3996fcb1b2e1347/build_script_build-f3996fcb1b2e1347 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/rustix-f3996fcb1b2e1347/rustckgctuB/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/.	2.5 s	105 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccvmIOG4.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/rustix-f3996fcb1b2e1347/build_script_build-f3996fcb1b2e1347 /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/rustix-f3996fcb1b2e1347/rustckgctuB/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gn	2.5 s	102 ms	0
└build_script rustix		2.7 s	34 ms	0
└rustc /usr/local/bin/rustc ×2	--crate-type=rlib --emit=metadata --target x86_64-unknown-linux-gnu -o /work/target/debug/build/rustix-0f4e2900de2476d1/out/rustix_test_can_compile -	2.7 s	15 ms	0
└build_script serde		6.6 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	6.6 s	6 ms	0
└build_script getrandom		8.8 s	1 ms	0
└build_script cbindgen		15.5 s	4 ms	0
└build_script icu_properties_data		19.0 s	2 ms	0
└build_script icu_locale_data		19.6 s	1 ms	0
└build_script icu_casemap_data		19.6 s	1 ms	0
└build_script bao-mozjs-icu-normalizer-data		23.2 s	2 ms	0
└build_script clang-sys		23.3 s	1 ms	0
└build_script crc32fast		26.1 s	8 ms	0
└rustc /usr/local/bin/rustc	--version	26.1 s	7 ms	0
└build_script icu_calendar_data		27.1 s	1 ms	0
└build_script encoding_rs		27.1 s	1 ms	0
└build_script icu_segmenter_data		30.4 s	1 ms	0
└build_script bindgen		31.4 s	2 ms	0
└build_script icu_time_data		31.4 s	2 ms	0
└build_script bao-mozjs-icu-collator-data		31.4 s	1 ms	0
└build_script bao-mozjs-src-intl		46.5 s	1 ms	0
└build_script bao-mozjs-src-python		46.5 s	1 ms	0
└build_script encoding_c_mem		46.5 s	2 ms	0
└build_script bao-mozjs-src-js		46.5 s	1 ms	0
└build_script encoding_c		49.0 s	1 ms	0
└build_script bao-mozjs-locale-glue		49.6 s	75 ms	25856
└cargo /usr/local/bin/cargo	metadata --all-features --format-version 1 --manifest-path ./Cargo.toml	49.6 s	71 ms	25856

Network 8

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up index.crates.io index.crates.io.0.2.2

Destination	Protocol	What was sent	Bytes
:443	tls	SNI index.crates.io, inside TLS: GET /config.json, host index.crates.io, agent cargo/1.98.1 (797e8a9bc 2026-08-05)	1.5 KiB
:443	tls	SNI index.crates.io, inside TLS: GET /config.json, host index.crates.io, agent cargo/1.98.1 (797e8a9bc 2026-08-05)	1.6 KiB
:443	tls	SNI index.crates.io, inside TLS: GET /config.json, host index.crates.io, agent cargo/1.98.1 (797e8a9bc 2026-08-05)	1.6 KiB
:443	tls	SNI index.crates.io, inside TLS: GET /config.json, host index.crates.io, agent cargo/1.98.1 (797e8a9bc 2026-08-05)	1.6 KiB
:443	tls	SNI index.crates.io, inside TLS: GET /config.json, host index.crates.io, agent cargo/1.98.1 (797e8a9bc 2026-08-05)	1.6 KiB
:443	tls	SNI index.crates.io, inside TLS: GET /config.json, host index.crates.io, agent cargo/1.98.1 (797e8a9bc 2026-08-05)	1.6 KiB

Sockets in the trace 3

When	Program	How	Address	Type
49.7 s	/usr/local/bin/cargo	connect	unix:/var/run/nscd/socket	stream
49.7 s	/usr/local/bin/cargo	connect	:53	datagram
49.7 s	/usr/local/bin/cargo	connect	:443	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 980
Directories: 283
Size: 663.8 MiB
Compiled units: 183

Nothing outside the build areas.

Output

Standard error

   Compiling cfg-if v1.0.5
   Compiling zerofrom v0.1.8
   Compiling stable_deref_trait v1.2.1
   Compiling yoke v0.8.3
   Compiling libc v0.2.189
   Compiling zerovec v0.11.8
   Compiling rustix v1.1.5
   Compiling bitflags v2.13.2
   Compiling syn v2.0.119
   Compiling writeable v0.6.4
   Compiling linux-raw-sys v0.12.1
   Compiling serde v1.0.229
   Compiling utf8parse v0.2.2
   Compiling anstyle-parse v1.0.0
   Compiling tinystr v0.8.4
   Compiling litemap v0.8.3
   Compiling is_terminal_polyfill v1.70.2
   Compiling anstyle v1.0.14
   Compiling colorchoice v1.0.5
   Compiling anstyle-query v1.1.5
   Compiling anstream v1.0.0
   Compiling getrandom v0.4.3
   Compiling icu_locale_core v2.3.0
   Compiling potential_utf v0.1.6
   Compiling zerotrie v0.2.5
   Compiling clap_lex v1.1.1
   Compiling clap_builder v4.6.7
   Compiling icu_provider v2.3.1
   Compiling icu_collections v2.1.1
   Compiling hashbrown v0.17.1
   Compiling cbindgen v0.29.4
   Compiling equivalent v1.0.2
   Compiling once_cell v1.21.4
   Compiling fastrand v2.5.0
   Compiling tempfile v3.27.0
   Compiling toml v0.9.12+spec-1.1.0
   Compiling indexmap v2.14.2
   Compiling clap v4.6.7
   Compiling log v0.4.34
   Compiling icu_properties_data v2.1.2
   Compiling smallvec v1.16.2
   Compiling unicode-bidi v0.3.18
   Compiling icu_casemap_data v2.1.1
   Compiling icu_locale_data v2.1.2
   Compiling icu_properties v2.1.2
   Compiling icu_locale v2.1.1
   Compiling icu_casemap v2.1.1
   Compiling bao-mozjs-icu-collections v153.3.0
   Compiling glob v0.3.4
   Compiling clang-sys v1.9.1
   Compiling libm v0.2.16
   Compiling bao-mozjs-icu-normalizer-data v153.3.0
   Compiling encoding_rs v0.8.42
   Compiling core_maths v0.1.1
   Compiling icu_calendar_data v2.1.1
   Compiling minimal-lexical v0.2.1
   Compiling regex-syntax v0.8.11
   Compiling regex-automata v0.4.18
   Compiling crc32fast v1.5.2
   Compiling nom v7.1.3
   Compiling bao-mozjs-utf16-iter v153.3.0
   Compiling bao-mozjs-utf8-iter v153.3.0
   Compiling write16 v1.0.0
   Compiling libloading v0.8.9
   Compiling bao-mozjs-icu-collator-data v153.3.0
   Compiling icu_time_data v2.1.1
   Compiling pkg-config v0.3.34
   Compiling bindgen v0.72.1
   Compiling adler2 v2.0.1
   Compiling core_detect v1.0.0
   Compiling simdutf8 v0.1.5
   Compiling multiversion_no_op v1.0.0
   Compiling simd-adler32 v0.3.10
   Compiling either v1.18.0
   Compiling icu_segmenter_data v2.1.1
   Compiling vcpkg v0.2.15
   Compiling scopeguard v1.2.0
   Compiling libz-sys v1.1.29
   Compiling itertools v0.13.0
   Compiling miniz_oxide v0.9.1
   Compiling bao-mozjs-icu-normalizer v153.3.0
   Compiling cexpr v0.6.0
   Compiling regex v1.13.1
   Compiling calendrical_calculations v0.2.4
   Compiling bao-mozjs-properties-glue v153.3.0
   Compiling bao-mozjs-unicode-bidi-ffi v153.3.0
   Compiling bao-mozjs-normalizer-glue v153.3.0
   Compiling bao-mozjs-collator-glue v153.3.0
   Compiling bao-mozjs-locale-glue v153.3.0
   Compiling xattr v1.6.1
   Compiling filetime v0.2.29
   Compiling strck v1.0.0
   Compiling same-file v1.0.6
   Compiling encoding_c v0.9.8
   Compiling ixdtf v0.6.6
   Compiling bao-mozjs-src-js v153.3.0-0
   Compiling encoding_c_mem v0.2.6
   Compiling bao-mozjs-src-python v153.3.0-0
   Compiling rustc-hash v2.1.3
   Compiling bao-mozjs-src-intl v153.3.0-0
   Compiling shlex v1.3.0
   Compiling icu_calendar v2.1.1
   Compiling diplomat_core v0.14.0
   Compiling walkdir v2.5.0
   Compiling tar v0.4.46
error: failed to run custom build command for `bao-mozjs-locale-glue v153.3.0`

Caused by:
  process didn't exit successfully: `/work/target/debug/build/bao-mozjs-locale-glue-91078fec33033cc8/build-script-build` (exit status: 101)
  --- stdout
  cargo:include=/work/target/debug/build/bao-mozjs-locale-glue-09084de07159b9db/out/include

  --- stderr

  thread 'main' (1975) panicked at /cw/vendor/bao-mozjs-locale-glue-153.3.0/build.rs:7:10:
  Unable to generate bindings: CargoMetadata("./Cargo.toml", Metadata(Output { status: ExitStatus(unix_wait_status(25856)), stdout: "", stderr: "    Updating crates.io index\nerror: no matching package named `icu_locale` found\nlocation searched: crates.io index\nrequired by package `bao-mozjs-locale-glue v153.3.0 (/cw/vendor/bao-mozjs-locale-glue-153.3.0)`\n" }))
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Timeline

When	From	To	Event	Worker
2026-09-29 23:38 UTC	Discovered	Fetched	fetched	fetcher-627152
2026-09-29 23:38 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-450252
2026-09-29 23:38 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot2
2026-09-29 23:39 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot2
2026-09-29 23:39 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-523934
2026-09-29 23:39 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot0
2026-09-29 23:40 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot0
2026-09-29 23:40 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-523934
2026-09-29 23:40 UTC	Scored	Done	finalized	analyzer-523934