PkgRadar

Cargo · crates.io

xlsynth-sys

Rs Build Time Command Combo: Process spawn (std::process::Command) paired with network / base64 / env-token read at build time.

Why PkgRadar flagged 0.55.0

SeveritySignalEvidence
highRs Build Time Command ComboProcess spawn (std::process::Command) paired with network / base64 / env-token read at build time. · xlsynth-sys-0.55.0/build.rs
highRs Build Time NetworkHTTP / TCP network call inside build.rs — downloads at compile time. · xlsynth-sys-0.55.0/build.rs
highRs Build Time Fs Out Of BandFilesystem path outside the build OUT_DIR / cargo cache (/etc, $HOME, ~/.ssh, /tmp/*.sh). · xlsynth-sys-0.55.0/build.rs
mediumRemote Payloadmatched "curl " · xlsynth-sys-0.55.0/build.rs

Scanned versions

VersionVerdictScoreScanned (UTC)
0.55.0High risk812026-06-10
0.54.0High risk812026-06-05
0.52.1High risk812026-05-30
0.52.0High risk812026-05-30
0.51.0High risk812026-05-30

Related campaigns

Block this in CI

PkgRadar gates xlsynth-sys (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem cargo [email protected]