PkgRadar

Cargo · crates.io

ktstr

Rs Build Time Command Combo: Process spawn (std::process::Command) paired with network / base64 / env-token read at build time.

Why PkgRadar flagged 0.8.0

SeveritySignalEvidence
highRs Build Time Command ComboProcess spawn (std::process::Command) paired with network / base64 / env-token read at build time. · ktstr-0.8.0/build.rs
highRs Build Time NetworkHTTP / TCP network call inside build.rs — downloads at compile time. · ktstr-0.8.0/build.rs
highRs Build Time Env Token ReadReads CI/CD secret env vars (AWS / GitHub / GitLab / Cargo / NPM tokens) at build time. · ktstr-0.8.0/build.rs
mediumRs Build Time CommandProcess spawn (std::process::Command) at build time. · ktstr-0.8.0/src/cli/kernel_build/build.rs

Scanned versions

VersionVerdictScoreScanned (UTC)
0.8.0High risk1802026-05-30

Related campaigns

Block this in CI

PkgRadar gates ktstr (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem cargo [email protected]