crates.io / untrusted / 0.9.0

untrusted 0.9.0

Source

https://github.com/briansmith/untrusted

Artifact scanned

untrusted-0.9.0.crate (crate · 14.1 KB · SHA-256 8ecb6da28b8a…)

Compared with

untrusted-0.8.0.crate (0 signals introduced since)

Files

11 scanned, 8 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

2.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-24 06:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info dynamic-execution mk/cargo.sh:145:5

   command name is a variable (`$llvm_version`) that this file sets only to plain text (ast pass, confidence 0.40)

       basename=$(basename "$executable")
       llvm-profdata-$llvm_version merge -sparse ""$coverage_dir"/$basename.profraw" -o "$coverage_dir"/$basename.profdata
       mkdir -p "$coverage_dir"/reports
       llvm-cov-$llvm_version export \

2. info dynamic-execution mk/cargo.sh:147:5

   command name is a variable (`$llvm_version`) that this file sets only to plain text (ast pass, confidence 0.40)

       mkdir -p "$coverage_dir"/reports
       llvm-cov-$llvm_version export \
         --instr-profile "$coverage_dir"/$basename.profdata \
         --format lcov \

3. info warn → info by review dynamic-execution mk/runner:21:1

   command name is a variable (`$*`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   
   $*

   likely benign LLM, confidence 0.80 A bash runner script executes its arguments as a command via bare `$*`, letting the caller choose what runs.

   Reasoning

   A bare `$*` at line 21 of a bash runner script expands all arguments as a command name. This is a common pattern in make-style or task-runner wrappers that execute the passed-in command. The snippet alone does not show malicious intent, but the command is taken from the caller with no visible validation, so it is a dynamic execution primitive worth noting. Given the file is a runner named mk, it most likely is a legitimate dispatch wrapper.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o untrusted-0.9.0.crate 'https://static.crates.io/crates/untrusted/untrusted-0%2E9%2E0.crate'
printf '%s  %s\n' 8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1 untrusted-0.9.0.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf untrusted-0.9.0.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg