reqtls 0.4.0-alpha3

Done dynamic on Linux job 59723 crates.io SBOM Findings (VEX)

high severity shell_command in build_script code (2 places): powershell

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:shell_command static · reqtls	build/stream.rs:159	high severity shell_command in build_script code (2 places): powershell
10	network_lookup network · reqtls	ms.xllgl.top	The build looked up ms.xllgl.top.
10	new_high_finding diff · reqtls	build/mod.rs:68	New since 0.4.0-alpha2: downloader_pattern

5 without points

Signal	Where	What
static:build_script static · reqtls	build/mod.rs	low severity build_script in build_script code: build/mod.rs
static:downloader_pattern static · reqtls	build/mod.rs:68	high severity downloader_pattern in build_script code: std::net::TcpStream::connect at build/mod.rs:68 with std::process::Command::new at build/stream.rs:159
static:network_access static · reqtls	build/mod.rs:68	medium severity network_access in build_script code (6 places): std::net::TcpStream::connect
static:obfuscated_data static · reqtls	src/boring/signature.rs:261	medium severity obfuscated_data in library code: -----BEGIN CERTIFICATE-----\u{a}MIIHgjCCBwegAwIBAgITVwABYQfXwLGCln1OagAAAAFhBzAKBggqhkjOPQQDAzBX\u{a}MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgw\u{a}JgYDVQQDEx9NaWNyb3NvZnQgVExTIE…
static:process_spawn static · reqtls	build/stream.rs:159	medium severity process_spawn in build_script code (3 places): std::process::Command::new

Behavior

Profile

net:ms.xllgl.top static:downloader_pattern static:network_access static:obfuscated_data static:process_spawn static:shell_command

Static findings

high shell_command build_script 2

powershell build/stream.rs:159
certutil -hashfile {} SHA256 | Select-Object -Index 1 build/stream.rs:160

high downloader_pattern build_script 1

std::net::TcpStream::connect at build/mod.rs:68 with std::process::Command::new at build/stream.rs:159 build/mod.rs:68

medium network_access build_script 3

std::net::TcpStream::connect build/mod.rs:68
std::net::TcpStream build/stream.rs:63 build/stream.rs:70

medium process_spawn build_script 3

std::process::Command::new build/stream.rs:159 build/stream.rs:167 build/stream.rs:172

medium obfuscated_data library 1

-----BEGIN CERTIFICATE-----\u{a}MIIHgjCCBwegAwIBAgITVwABYQfXwLGCln1OagAAAAFhBzAKBggqhkjOPQQDAzBX\u{a}MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgw\u{a}JgYDVQQDEx9NaWNyb3NvZnQgVExTIE… src/boring/signature.rs:261

low foreign_functions library 18

extern block src/boring/bindings.rs:37 src/boring/bindings.rs:84 src/boring/bindings.rs:103 src/boring/bindings.rs:145 src/boring/evp/aead.rs:31 src/boring/evp/cipher.rs:41 src/boring/rsa/bindings.rs:404 src/buffer/mod.rs:23 src/buffer/reader.rs:7 src/coder/brotli.rs:21 src/coder/deflate.rs:15 src/coder/zstd.rs:21 src/connection/mod.rs:20 src/dns/stream.rs:83 src/ext.rs:12 src/finger.rs:72 src/gm_sm/sm2.rs:20 src/rand.rs:12

low network_access library 3

std::net::TcpStream::connect src/boring/rsa/certificate/store.rs:94
std::net::UdpSocket src/dns/stream.rs:59
std::net::UdpSocket::bind src/dns/stream.rs:92

low build_script build_script 1

build/mod.rs build/mod.rs

info unsafe_code library 36

1 unsafe blocks, functions or impls src/alpn.rs:30 src/buffer/encode.rs:140 src/coder/ext.rs:18 src/ext.rs:114 src/message/session_ticket.rs:87 src/rand.rs:20
5 unsafe blocks, functions or impls src/boring/base64.rs:14 src/coder/brotli.rs:70 src/coder/zstd.rs:49 src/dns/stream.rs:128
6 unsafe blocks, functions or impls src/boring/evp/aead.rs:75
7 unsafe blocks, functions or impls src/boring/evp/cipher.rs:60 src/boring/hash/hasher.rs:36 src/boring/hash/hmac.rs:18 src/connection/mod.rs:135
8 unsafe blocks, functions or impls src/boring/hash/mod.rs:29 src/boring/rsa/mod.rs:24
21 unsafe blocks, functions or impls src/boring/rsa/certificate/mod.rs:51 src/boring/signature.rs:21
20 unsafe blocks, functions or impls src/boring/rsa/certificate/siger/mod.rs:35
11 unsafe blocks, functions or impls src/boring/rsa/certificate/store.rs:28 src/export/coder.rs:13 src/export/hasher.rs:17
26 unsafe blocks, functions or impls src/boring/rsa/key.rs:22
24 unsafe blocks, functions or impls src/buffer/mod.rs:75
12 unsafe blocks, functions or impls src/buffer/reader.rs:25 src/gm_sm/sm2.rs:97
4 unsafe blocks, functions or impls src/coder/deflate.rs:61
10 unsafe blocks, functions or impls src/export/cipher.rs:15
3 unsafe blocks, functions or impls src/export/mod.rs:16 src/finger.rs:152 src/message/client_hello.rs:49
9 unsafe blocks, functions or impls src/export/url.rs:11
2 unsafe blocks, functions or impls src/extend/key_share.rs:47 src/ffi.rs:9 src/message/server_hello.rs:47

info url_literal library 18

{}:// src/url/mod.rs:133
:// src/url/mod.rs:157 src/url/mod.rs:177 src/url/uri.rs:75
https://docs.rs/urlencoding/2.1.3/urlencoding/ src/url/mod.rs:219
http://www.lxspider.com/?p=956 src/url/mod.rs:222
https://fxg.jinritemai.com/ffa/morder/order/list?btm_ppre=a2427.b76571.c902327.d871297&btm_pre=a2427.b76571.c902327.d871297&btm_show_id=1bf5f779-f687-47db-8637-4941db8e409f src/url/mod.rs:225
https://cn.bing.com/search?q=abogus%E8%A1%A5%E7%8E%AF%E5%A2%83&qs=UT&pq=abogus&sk=OS1LT1&sc=5-6&cvid=50BFA522127149719EEDBC510E8F26D2&sp=3&ghc=1&lq=0&ajf=60&mkt=zh-CN&FPIG=078354D7800D43BBA67D7529C688… src/url/mod.rs:228
https://www.baidu.com/ src/url/mod.rs:231
socks5://127.0.0.1:1023 src/url/mod.rs:234
http://127.0.0.1:8080 src/url/mod.rs:237
https://www.so.com/link?m=uJUHfEbfz+ZVSx90v4iLs4mlJ1cSfmojdrI1pYls/wftn5aL/ll53A6XAa1BSX2UtYWvcHBuUKSEURqhhVHtJNCWxeXYrgMOwkXoRLHGJ4yHLzOB1C61LDwQTgDd5OjTmAFlu3YJVdfU= src/url/mod.rs:240
wss://poe.game.qq.com/ src/url/mod.rs:243
wss://poe.game.qq.com/api/trade2/live/poe2/%E7%93%A6%E5%B0%94%E7%9A%84%E5%AE%BF%E5%91%BD/32Y6Wjkc5 src/url/mod.rs:245
wss://poe.game.qq.com/wss://poe.game.qq.com/api/trade2/live/poe2/%E7%93%A6%E5%B0%94%E7%9A%84%E5%AE%BF%E5%91%BD/32Y6Wjkc5 src/url/mod.rs:246
socks5://username:passwrod@127.0.0.1:1023/ src/url/mod.rs:250
https://login.gjzwfw.gov.cn/tacs-uc/sso/loginTrust?backUrl=https://oauth.hubei.gov.cn:8443/uias/mainChain.do?appCode=hbzwfw&checkUser=1 src/url/mod.rs:253
https://life5-normal-m-zjg.amemv.com/aweme/v2/poi_shelf_api/second_page_shelf?poi_id=6601125223309772808&item_id&poi_enter_id=371ffca81e3ed1abda840f56f9b47955&location_permission=1&extra_params=%7B%22… src/url/mod.rs:256

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 13.4 s
VM restore: 63 ms
Payload: 187 files, 1.1 MiB
Files opened: 723

Processes 11

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 9 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took
cargo /usr/local/bin/cargo	build --locked --offline	4 ms	13.4 s
└rustc /usr/local/bin/rustc	--crate-name build_script_mod --edition=2024 /cw/vendor/reqtls-0.4.0-alpha3/build/mod.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("cert_signer", "export", "log", "quic", "static_link", "zstd")) -C metadata=26a74b735fc5bb9f -C extra-filename=-0b7566f14d0cceee --out-dir /work/target/debug/build/reqtls-0b7566f14d0cceee -L dependency=/work/target/debug/deps --cap-lints allow	119 ms	831 ms
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/reqtls-0b7566f14d0cceee/rustcphk7ES/symbols.o /work/target/debug/build/reqtls-0b7566f14d0cceee/build_script_mod-0b7566f14d0cceee.build_script_mod.f6c9dc7a21e9b4ab-cgu.0.rcgu.o /work/target/debug/build/reqtls-0b7566f14d0cceee/build_script_mod-0b7566f14d0cceee.build_script_mod.f6c9dc7a21e9b4ab-cgu.1.rcgu.o /work/target/debug/build/reqtls-0b7566f14d0cceee/build_script_mod-0b7566f14d0cceee.build_script_mod.f6c9dc7a21e9b4ab-cgu.2.rcgu.o /work/target/debug/build/reqtls-0b7566f14d0cceee/build_script_mod-0b7566f14d0cceee.2zbxh2454k00jmsmgci1uh9pp.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755	793 ms	154 ms
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccUYarDe.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/reqtls-0b7566f14d0cceee/build_script_mod-0b7566f14d0cceee /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/reqtls-0b7566f14d0cceee/rustcphk7ES/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../	800 ms	147 ms
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccUYarDe.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/reqtls-0b7566f14d0cceee/build_script_mod-0b7566f14d0cceee /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/reqtls-0b7566f14d0cceee/rustcphk7ES/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu	805 ms	140 ms
└build_script reqtls		954 ms	10.1 s
└rustc /usr/local/bin/rustc ×5	--crate-name bytemuck --edition=2018 /cw/vendor/bytemuck-1.25.2/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --deny=unexpected_cfgs --check-cfg cfg(target_arch, values("spirv")) --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("aarch64_simd", "align_offset", "alloc_uninit", "avx512_simd", "bytemuck_derive", "const_zeroed", "derive", "extern_crate_alloc", "extern_crate_std", "impl_core_error", "latest_stable_rust", "min_const_generics", "must_cast", "must_cast_extra", "nightly_docs", "nightly_float", "nightly_portable_simd", "nightly_stdsimd", "pod_saturating", "rustversion", "track_caller", "transparentwrapper_extra", "unsound_ptr_pod_impl", "wasm_simd", "zeroable_atomics", "zeroable_maybe_uninit", "zeroable_u… -C metadata=c309cc4f662b8f68 -C extra-filename=-31d06f36c7eb3a75 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints	11.0 s	113 ms

Network 2

The VM has no internet. Every name it looks up resolves to 10.0.2.1, the fake internet, which accepts every connection and records what was sent. Below, it is shown by its port alone, such as :443. The name the build wanted is in the lookups, the HTTP host and the TLS SNI.

Looked up ms.xllgl.top

Destination	Protocol	What was sent	Bytes
:8080	unknown		37 B

Sockets in the trace 3

When	Program	How	Address	Type
957 ms	/work/target/debug/build/reqtls-0b7566f14d0cceee/build-script-mod	connect	unix:/var/run/nscd/socket	stream
957 ms	/work/target/debug/build/reqtls-0b7566f14d0cceee/build-script-mod	connect	:53	datagram
962 ms	/work/target/debug/build/reqtls-0b7566f14d0cceee/build-script-mod	connect	:8080	stream

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 68
Directories: 30
Size: 24.2 MiB
Compiled units: 10

Nothing outside the build areas.

Output

Standard error

   Compiling reqtls v0.4.0-alpha3
   Compiling bytemuck v1.25.2
   Compiling hex v0.4.3
   Compiling urlencoding v2.1.3
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 13.41s

Timeline

When	From	To	Event	Worker
2026-10-02 13:58 UTC	Discovered	Fetched	fetched	fetcher-2372261
2026-10-02 13:58 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-2372263
2026-10-02 13:58 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2445642-slot1
2026-10-02 13:59 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2445642-slot1
2026-10-02 13:59 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-2372276
2026-10-02 13:59 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2445642-slot2
2026-10-02 13:59 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2445642-slot2
2026-10-02 13:59 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-2372276
2026-10-02 13:59 UTC	Scored	Done	finalized	analyzer-2372276