parlar-moonshine 0.1.4

Done dynamic on Linux job 50365 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://github.com/moonshine-ai/moonshine/releases/download/{VERSION}/{name}.tar.gz at build.rs:49 with std::process::Command::new at build.rs:51

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · parlar-moonshine	build.rs:49	high severity downloader_pattern in build_script code: https://github.com/moonshine-ai/moonshine/releases/download/{VERSION}/{name}.tar.gz at build.rs:49 with std::process::Command::new at build.rs:51
10	build_script_added diff · parlar-moonshine		A build script was added since 0.1.3.
10	new_high_finding diff · parlar-moonshine	build.rs:49	New since 0.1.3: downloader_pattern

3 without points

Signal	Where	What
static:build_script static · parlar-moonshine	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · parlar-moonshine	build.rs:51	medium severity process_spawn in build_script code (3 places): std::process::Command::new
static:url_literal static · parlar-moonshine	build.rs:49	low severity url_literal in build_script code: https://github.com/moonshine-ai/moonshine/releases/download/{VERSION}/{name}.tar.gz

Behavior

New since the previous version

static:downloader_pattern static:process_spawn

Profile

static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://github.com/moonshine-ai/moonshine/releases/download/{VERSION}/{name}.tar.gz at build.rs:49 with std::process::Command::new at build.rs:51 build.rs:49

medium process_spawn build_script 3

std::process::Command::new build.rs:51 build.rs:60
std::process::Command build.rs:65

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/lib.rs:178

low url_literal build_script 1

https://github.com/moonshine-ai/moonshine/releases/download/{VERSION}/{name}.tar.gz build.rs:49

info unsafe_code library 1

20 unsafe blocks, functions or impls src/lib.rs:118

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 2.8 s
VM restore: 132 ms
Payload: 674 files, 6.3 MiB
Files opened: 1149

Processes 20

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 17 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	2.8 s
└build_script generic-array		156 ms	109 ms
└rustc /usr/local/bin/rustc	--verbose --version	157 ms	107 ms
└rustc /usr/local/bin/rustc ×12	--crate-name typenum --edition=2018 /cw/vendor/typenum-1.20.1/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("const-generics", "i128", "scale-info", "scale_info", "strict")) -C metadata=c2f9d4ec114b3c29 -C extra-filename=-08d86263206dd805 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	266 ms	799 ms
└rustc /usr/local/bin/rustc	--crate-name build_script_build --edition=2024 /cw/vendor/parlar-moonshine-0.1.4/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=a28ec2108ba7bd19 -C extra-filename=-0fde8f3060dfbf8f --out-dir /work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f -L dependency=/work/target/debug/deps --extern sha2=/work/target/debug/deps/libsha2-a8fc11932f29aef6.rlib --cap-lints allow	1.9 s	278 ms
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/rustcXpPKpg/symbols.o /work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/build_script_build-0fde8f3060dfbf8f.build_script_build.6a17af8baa6936ae-cgu.0.rcgu.o /work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/build_script_build-0fde8f3060dfbf8f.build_script_build.6a17af8baa6936ae-cgu.1.rcgu.o /work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/build_script_build-0fde8f3060dfbf8f.6tsmy0k6blvmptu0a80jmoyy3.rcgu.o -Wl,--as-needed -Wl,-Bstatic /work/target/debug/deps/libsha2-a8fc11932f29aef6.rlib /work/target/debug/deps/libcpufeatures-fb48d1e8a2ee030a.rlib /work/target/debug/deps/libcfg_if-d05893e10c9c8e83.rlib /work/target/debug/deps/libdigest-fa0dd86653c64d42.rlib /work/target/debug/deps/libblock_buffer-9fb011f963fcbb5d.rlib /work/target/debug/deps/libcrypto_common-1b18ef7c2a6918be.rlib /work/target/debug/deps/libgeneric_array-0c3fb031f1d3ceb9.rlib /work/target/debug/deps/libtypenum-08d86263206dd805.rlib /usr/local/lib/ru	2.0 s	135 ms
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccRLsWkQ.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/build_script_build-0fde8f3060dfbf8f /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/rustcXpPKpg/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-li	2.0 s	129 ms
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccRLsWkQ.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/build_script_build-0fde8f3060dfbf8f /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/parlar-moonshine-0fde8f3060dfbf8f/rustcXpPKpg/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr	2.0 s	125 ms
└build_script parlar-moonshine		2.2 s	1 ms

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 126
Directories: 41
Size: 39.9 MiB
Compiled units: 24

Nothing outside the build areas.

Output

Standard error

   Compiling generic-array v0.14.7
   Compiling typenum v1.20.1
   Compiling crypto-common v0.1.7
   Compiling block-buffer v0.10.4
   Compiling cfg-if v1.0.5
   Compiling digest v0.10.7
   Compiling cpufeatures v0.2.17
   Compiling sha2 v0.10.9
   Compiling parlar-moonshine v0.1.4
   Compiling anyhow v1.0.104
   Compiling libloading v0.9.0
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.75s

Timeline

When	From	To	Event	Worker
2026-10-01 14:02 UTC	Discovered	Fetched	fetched	fetcher-627152
2026-10-01 14:02 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-450252
2026-10-01 14:02 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot2
2026-10-01 14:02 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot2
2026-10-01 14:02 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-523934
2026-10-01 14:02 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-639812-slot0
2026-10-01 14:02 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-639812-slot0
2026-10-01 14:02 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-523934
2026-10-01 14:02 UTC	Scored	Done	finalized	analyzer-523934