PkgRadar

Cargo · crates.io

vorto

Rs Build Time Command Combo: Process spawn (std::process::Command) paired with network / base64 / env-token read at build time.

Why PkgRadar flagged 0.15.3

SeveritySignalEvidence
highRs Build Time Command ComboProcess spawn (std::process::Command) paired with network / base64 / env-token read at build time. · vorto-0.15.3/src/grammar/build.rs
highRs Build Time Env Token ReadReads CI/CD secret env vars (AWS / GitHub / GitLab / Cargo / NPM tokens) at build time. · vorto-0.15.3/src/grammar/build.rs

Scanned versions

VersionVerdictScoreScanned (UTC)
0.15.3High risk1002026-06-09
0.15.2High risk1002026-06-05
0.15.1High risk1002026-05-31
0.15.0High risk1002026-05-30
0.14.0High risk1002026-05-30
0.13.0High risk1002026-05-30

Block this in CI

PkgRadar gates vorto (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem cargo [email protected]
Start free — 25 scans / moView full evidence