crates.io / num-bigint / 0.5.1

num-bigint 0.5.1

Source

https://github.com/rust-num/num-bigint

Tag scanned

num-bigint-0.5.1

Compared with

num-bigint-0.5.0 (3 signals introduced since)

Files

57 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

2.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 21:22

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info unicode-mixed-script src/biguint/division.rs:305:24 new in this release

   identifier `βⁿ` mixes scripts: Greek + Other (in string/comment) (raw pass, confidence 0.40)

           } else {
               // set Q = βⁿ-1 and set R₁ = [A₁;A₂] - [B₁;0] + [0;B₁]
               //                        (= [A₁;A₂] - QB₁)
               q = BigUint {

2. info unicode-mixed-script src/biguint/division.rs:311:31 new in this release

   identifier `βⁿ` mixes scripts: Greek + Other (in string/comment) (raw pass, confidence 0.40)

               r1 = concat_biguint(&(a1 - &b1), a2, level) + &b1;
               // also Q*B₂ = (βⁿ-1)B₂ = βⁿB₂ - B₂
               d = (&b2 << (level * usize::from(BITS))) - &b2;
           };

3. info unicode-mixed-script src/biguint/division.rs:311:46 new in this release

   identifier `βⁿB₂` mixes scripts: Greek + Other + Latin (in string/comment) (raw pass, confidence 0.40)

               r1 = concat_biguint(&(a1 - &b1), a2, level) + &b1;
               // also Q*B₂ = (βⁿ-1)B₂ = βⁿB₂ - B₂
               d = (&b2 << (level * usize::from(BITS))) - &b2;
           };

4. info warn → info by review ifs-manipulation ci/test_full.sh:16:3

   `IFS` set to `.` — non-standard separator enables word-splitting obfuscation (ast pass, confidence 0.80)

   check_version() {
     IFS=. read -ra rust <<< "$RUST_VERSION"
     IFS=. read -ra want <<< "$1"
     [[ "${rust[0]}" -gt "${want[0]}" ||

   likely benign LLM, confidence 0.95 A bash helper that splits a Rust version string on dots to compare major/minor/patch numbers in a CI test script.

   Reasoning

   Setting IFS=. for a single read command to split a version string like 1.70.0 into an array is a standard, idiomatic bash version-comparison pattern in CI scripts. The IFS change is scoped to the read command, operates on a version variable, and has no network, decoding, or execution behavior. The finding's message about word-splitting obfuscation does not fit this context.

5. info warn → info by review ifs-manipulation ci/test_full.sh:17:3

   `IFS` set to `.` — non-standard separator enables word-splitting obfuscation (ast pass, confidence 0.80)

     IFS=. read -ra rust <<< "$RUST_VERSION"
     IFS=. read -ra want <<< "$1"
     [[ "${rust[0]}" -gt "${want[0]}" ||
      ( "${rust[0]}" -eq "${want[0]}" &&

   likely benign LLM, confidence 0.95 Second IFS-scoped read in the same version-check function, splitting the requested version into components for comparison.

   Reasoning

   This is the same scoped IFS=. read used to split the wanted version into an array for numeric comparison within check_version. It is a legitimate, common bash idiom in a CI script with no obfuscated or malicious behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rust-num/num-bigint num-bigint && cd num-bigint
git checkout num-bigint-0.5.1
disclude scan --severity info --diff num-bigint-0.5.0 .