fusion-pcu-mlx 0.0.7

Done dynamic on Linux job 46957 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://codeload.github.com/ml-explore/mlx/tar.gz/64ea011cb65f14d9ce2737e60db9a4ae91ed7441 at ffi/rust/build/acquisition/acquisition.rs:25 with std::process::Command at ffi/rust/build/acquisition/acqu…

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · fusion-pcu-mlx	ffi/rust/build/acquisition/acquisition.rs:25	high severity downloader_pattern in build_script code: https://codeload.github.com/ml-explore/mlx/tar.gz/64ea011cb65f14d9ce2737e60db9a4ae91ed7441 at ffi/rust/build/acquisition/acquisition.rs:25 with std::process::Command at ffi/rust/build/acquisition/acqu…
10	build_script_added diff · fusion-pcu-mlx		A build script was added since 0.0.6.
10	new_high_finding diff · fusion-pcu-mlx	ffi/rust/build/acquisition/acquisition.rs:25	New since 0.0.6: downloader_pattern

3 without points

Signal	Where	What
static:build_script static · fusion-pcu-mlx	ffi/rust/build/build.rs	low severity build_script in build_script code: ffi/rust/build/build.rs
static:process_spawn static · fusion-pcu-mlx	ffi/rust/build/acquisition/acquisition.rs:87	medium severity process_spawn in build_script code (26 places): std::process::Command
static:url_literal static · fusion-pcu-mlx	ffi/rust/build/acquisition/acquisition.rs:25	low severity url_literal in build_script code (9 places): https://codeload.github.com/ml-explore/mlx/tar.gz/64ea011cb65f14d9ce2737e60db9a4ae91ed7441

Behavior

New since the previous version

static:downloader_pattern static:process_spawn

Profile

static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://codeload.github.com/ml-explore/mlx/tar.gz/64ea011cb65f14d9ce2737e60db9a4ae91ed7441 at ffi/rust/build/acquisition/acquisition.rs:25 with std::process::Command at ffi/rust/build/acquisition/acqu… ffi/rust/build/acquisition/acquisition.rs:25

medium process_spawn build_script 25

low url_literal build_script 6

https://codeload.github.com/ml-explore/mlx/tar.gz/64ea011cb65f14d9ce2737e60db9a4ae91ed7441 ffi/rust/build/acquisition/acquisition.rs:25
https://codeload.github.com/ml-explore/mlx-c/tar.gz/a341b4925024b88b2c593468f16e12f5e17315da ffi/rust/build/acquisition/acquisition.rs:32
https://developer.apple.com/metal/cpp/files/metal-cpp_26.zip ffi/rust/build/acquisition/acquisition.rs:39
https://github.com/nlohmann/json/releases/download/v3.11.3/json.tar.xz ffi/rust/build/acquisition/acquisition.rs:46
https://codeload.github.com/fmtlib/fmt/tar.gz/407c905e45ad75fc29bf0f9bb7c5c2fd3475976f ffi/rust/build/acquisition/acquisition.rs:53
https://codeload.github.com/antirez/gguf-tools/tar.gz/8fa6eb65236618e28fd7710a0fba565f7faa1848 ffi/rust/build/acquisition/acquisition.rs:60

low build_script build_script 1

ffi/rust/build/build.rs ffi/rust/build/build.rs

low process_spawn binary 1

std::process::Command::new benches/compiled_matmul/support/activity/activity.rs:22

info unsafe_code library 12

4 unsafe blocks, functions or impls ffi/rust/c_api/admission/admission.rs:20 ffi/rust/c_api/tests/tests.rs:49
11 unsafe blocks, functions or impls ffi/rust/c_api/array/array.rs:29
9 unsafe blocks, functions or impls ffi/rust/c_api/callback/callback.rs:21
2 unsafe blocks, functions or impls ffi/rust/c_api/calls/calls.rs:27 ffi/rust/c_api/owner/owner.rs:36 ffi/rust/c_api/text/text.rs:16 ffi/rust/typed/typed.rs:35
7 unsafe blocks, functions or impls ffi/rust/c_api/device/device.rs:26 ffi/rust/c_api/session/session.rs:34
3 unsafe blocks, functions or impls ffi/rust/c_api/loading/loading.rs:45
13 unsafe blocks, functions or impls ffi/rust/c_api/prepared/prepared.rs:60

info url_literal test 3

https:// tests/native_prepare/native_prepare.rs:63
https://invalid.invalid tests/native_prepare/native_prepare.rs:165 tests/native_prepare/native_prepare.rs:262

info unsafe_code binary 1

3 unsafe blocks, functions or impls benches/compiled_matmul/census.rs:29

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 5.5 s
VM restore: 65 ms
Payload: 797 files, 8.3 MiB
Files opened: 1261

Processes 20

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 17 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	5.4 s
└build_script generic-array		151 ms	114 ms
└rustc /usr/local/bin/rustc	--verbose --version	153 ms	111 ms
└rustc /usr/local/bin/rustc ×12	--crate-name typenum --edition=2018 /cw/vendor/typenum-1.20.1/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("const-generics", "i128", "scale-info", "scale_info", "strict")) -C metadata=c2f9d4ec114b3c29 -C extra-filename=-08d86263206dd805 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	267 ms	862 ms
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2024 /cw/vendor/fusion-pcu-mlx-0.0.7/ffi/rust/build/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --warn=unexpected_cfgs --warn=clippy::pedantic --warn=clippy::nursery --warn=clippy::all --check-cfg cfg(target_arch, values("spirv")) --cfg feature="default" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("allocation-census", "benchmark-control", "default", "tensor")) -C metadata=b88c80f459a5a775 -C extra-filename=-ab4dd2651312ac2f --out-dir /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f -L dependency=/work/target/debug/deps	2.0 s	690 ms
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/rustcQ1UKdl/symbols.o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f.build_script_build.9e6e8d29b398b58c-cgu.0.rcgu.o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f.build_script_build.9e6e8d29b398b58c-cgu.1.rcgu.o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f.build_script_build.9e6e8d29b398b58c-cgu.2.rcgu.o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f.build_script_build.9e6e8d29b398b58c-cgu.3.rcgu.o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f.build_script_build.9e6e8d29b398b58c-cgu.4.rcgu.o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f.build_script_build.9e6e8d29b398b58c-cgu.5.rcgu.o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd265	2.5 s	155 ms
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccHLwgWK.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/rustcQ1UKdl/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-	2.5 s	148 ms
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccHLwgWK.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/build_script_build-ab4dd2651312ac2f /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/fusion-pcu-mlx-ab4dd2651312ac2f/rustcQ1UKdl/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib	2.5 s	144 ms
└build_script fusion-pcu-mlx		2.7 s	1 ms

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 124
Directories: 40
Size: 47.0 MiB
Compiled units: 24

Nothing outside the build areas.

Output

Standard error

   Compiling generic-array v0.14.7
   Compiling typenum v1.20.1
   Compiling block-buffer v0.10.4
   Compiling crypto-common v0.1.7
   Compiling cfg-if v1.0.5
   Compiling digest v0.10.7
   Compiling cpufeatures v0.2.17
   Compiling sha2 v0.10.9
   Compiling fusion-pcu-mlx v0.0.7
   Compiling libloading v0.8.9
   Compiling fusion-pcu-core v0.0.7
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.44s

Timeline

When	From	To	Event	Worker
2026-10-01 05:13 UTC	Discovered	Fetched	fetched	fetcher-627152
2026-10-01 05:13 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-450252
2026-10-01 05:13 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot2
2026-10-01 05:13 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot2
2026-10-01 05:13 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-523934
2026-10-01 05:13 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot2
2026-10-01 05:13 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot2
2026-10-01 05:13 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-523934
2026-10-01 05:13 UTC	Scored	Done	finalized	analyzer-523934