crates.io / zerovec / 0.11.8

zerovec 0.11.8

Source

https://github.com/unicode-org/icu4x

Artifact scanned

zerovec-0.11.8.crate (crate · 127.8 KB · SHA-256 bb0464e17806…)

Compared with

zerovec-0.11.7.crate (0 signals introduced since)

Files

57 scanned, 10 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-24 09:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review encoding-base64 src/map2d/databake.rs:100:147

   base64-like blob (113 bytes, compression ratio 0.87) (raw pass, confidence 0.60)

                           b"\x1C\0\0\0\0\0\x04\0\x08\0\x0C\0\x10\0\x14\0\x18\0\x1C\0 \0$\0(\0,\x000\x004\08\0<\0@\0D\0H\0L\0P\0T\0X\0\\\0`\0d\0h\0l\0NbatPalmArabGlagShawAdlmLinbArabArabYeziArabLatnLimbNkooMongArabPhlpDevaKhojSindArabCyrlDevaArabHansBopoHanbHant"
                       )
                   },

   likely benign LLM, confidence 0.93 Generated binary data table in a Rust byte-string literal, likely ICU-style locale/script lookup data.

   Reasoning

   The snippet is a Rust byte-string literal of binary lookup-table data (offsets as little-endian u16/u32 with NUL bytes, followed by script tags like Arab, Latn, Deva). This is typical ICU4X/CLDR-style generated data baked into a crate. The base64 signal is a false positive triggered by a long run of alphanumeric characters; there is no decoding or execution.

2. info warn → info by review encoding-base64 src/map2d/databake.rs:134:147

   base64-like blob (113 bytes, compression ratio 0.87) (raw pass, confidence 0.60)

                           b"\x1C\0\0\0\0\0\x04\0\x08\0\x0C\0\x10\0\x14\0\x18\0\x1C\0 \0$\0(\0,\x000\x004\08\0<\0@\0D\0H\0L\0P\0T\0X\0\\\0`\0d\0h\0l\0NbatPalmArabGlagShawAdlmLinbArabArabYeziArabLatnLimbNkooMongArabPhlpDevaKhojSindArabCyrlDevaArabHansBopoHanbHant"
                       )
                   },

   likely benign LLM, confidence 0.93 Second generated binary data table in the same databake file, same benign structure.

   Reasoning

   Same pattern as the other finding in the same generated databake file: a binary byte-string constant with offset tables and script/locale identifiers. The raw-pass base64 heuristic matches the alphanumeric tail; nothing decodes or executes it.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o zerovec-0.11.8.crate 'https://static.crates.io/crates/zerovec/zerovec-0%2E11%2E8.crate'
printf '%s  %s\n' bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8 zerovec-0.11.8.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf zerovec-0.11.8.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg