zerovec 0.11.9

Source: https://github.com/unicode-org/icu4x
Artifact scanned: zerovec-0.11.9.crate (crate · 128.9 KB · SHA-256 f58a2799cfe9…)
Compared with: zerovec-0.11.8.crate (0 signals introduced since)
Files: 57 scanned, 10 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 3.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 05:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 src/map2d/databake.rs:100:147

base64-like blob (113 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
                        b"\x1C\0\0\0\0\0\x04\0\x08\0\x0C\0\x10\0\x14\0\x18\0\x1C\0 \0$\0(\0,\x000\x004\08\0<\0@\0D\0H\0L\0P\0T\0X\0\\\0`\0d\0h\0l\0NbatPalmArabGlagShawAdlmLinbArabArabYeziArabLatnLimbNkooMongArabPhlpDevaKhojSindArabCyrlDevaArabHansBopoHanbHant"
                    )
                },
```
likely benign LLM, confidence 0.93 Baked Unicode/ICU lookup-table byte string in a Rust data module, falsely flagged as a base64 blob.
Reasoning
The snippet is a Rust byte-string literal of binary lookup-table data (offsets as little-endian u16/u32 with \0 bytes, followed by script tag names like Arab, Latn, Cyrl). This is typical ICU/icu_datagen baked data in a Unicode-library crate. The base64-like flag is a raw-pass false positive triggered by the long run of alphanumeric text; there is no decoding, execution, or network behavior.
info ~~warn~~ → info by review encoding-base64 src/map2d/databake.rs:134:147

base64-like blob (113 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
                        b"\x1C\0\0\0\0\0\x04\0\x08\0\x0C\0\x10\0\x14\0\x18\0\x1C\0 \0$\0(\0,\x000\x004\08\0<\0@\0D\0H\0L\0P\0T\0X\0\\\0`\0d\0h\0l\0NbatPalmArabGlagShawAdlmLinbArabArabYeziArabLatnLimbNkooMongArabPhlpDevaKhojSindArabCyrlDevaArabHansBopoHanbHant"
                    )
                },
```
likely benign LLM, confidence 0.93 Second baked binary data byte string in the same generated databake module, also a raw-pass false positive.
Reasoning
Same snippet pattern as the other finding in this file: a binary data table literal with script/tag names embedded, generated data for map2d lookups. The raw-pass base64 heuristic matched on the alphanumeric tail; no decoding or code execution is present.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o zerovec-0.11.9.crate 'https://static.crates.io/crates/zerovec/zerovec-0%2E11%2E9.crate'
printf '%s  %s\n' f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40 zerovec-0.11.9.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf zerovec-0.11.9.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg