tinyvec 1.13.3

Source: https://github.com/Lokathor/tinyvec
Artifact scanned: tinyvec-1.13.3.crate (crate · 58.9 KB · SHA-256 fd3ca314f692…)
Compared with: tinyvec-1.13.2.crate (0 signals introduced since)
Files: 29 scanned, 9 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 07:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review path-command-shadow fuzz/README.md:4:1

[embedded bash] redirect writes to `cargo` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
> cargo install honggfuzz
> cargo hfuzz run arrayish
```
dismissed LLM, confidence 0.93 A markdown README showing standard cargo/honggfuzz commands for fuzzing a Rust crate.
Reasoning
The snippet is ordinary build instructions for honggfuzz (`cargo install honggfuzz`, `cargo hfuzz run arrayish`). The leading `>` is markdown blockquote syntax, not a shell redirect, so the claimed write to `cargo` does not exist. The finding comes from misparsing the blockquote as a redirect. A README for a Rust fuzzing harness is a legitimate context.
info ~~critical~~ → info by review path-command-shadow fuzz/README.md:5:1

[embedded bash] redirect writes to `cargo` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
> cargo install honggfuzz
> cargo hfuzz run arrayish
```
dismissed LLM, confidence 0.93 A markdown README with the same standard cargo/honggfuzz fuzzing commands, flagged by a blockquote misparse.
Reasoning
This is the same snippet as the first finding: legitimate `cargo install honggfuzz` and `cargo hfuzz run` commands in a blockquote. The `>` is markdown quoting, not a redirect, so no file named `cargo` is written and no PATH hijack is set up.
info ~~critical~~ → info by review path-command-shadow fuzz/README.md:10:1

[embedded bash] redirect writes to `cargo` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)
```
> cargo hfuzz run-debug arrayish hfuzz_workspace/arrayish/*.fuzz
```
dismissed LLM, confidence 0.93 A markdown README line showing a honggfuzz debug run command for a fuzz target.
Reasoning
The snippet is `cargo hfuzz run-debug arrayish hfuzz_workspace/arrayish/*.fuzz`, a normal honggfuzz debug-run invocation. The leading `>` is a markdown blockquote marker, and nothing in the line redirects output to a file named `cargo`. The path-command-shadow signal is a false positive.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o tinyvec-1.13.3.crate 'https://static.crates.io/crates/tinyvec/tinyvec-1%2E13%2E3.crate'
printf '%s  %s\n' fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee tinyvec-1.13.3.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf tinyvec-1.13.3.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg