nazriel/toasty

1131 files·commit f41e435·scanned 1h ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

scored by engine v7: rules have changed since, rescan for the current result

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

Created 20 days ago

No stars or forks

Created 20 days ago

No community activity

Partial architecture graph

threat-state: dangerouslive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.crates/toasty-core/src/stmt/eval.rs

    /// sub-expression fails.
    pub fn eval(&self, mut input: impl Input) -> Result<Value> {
        self.eval_ref(&ScopeStack::Root, &mut input)
    }

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.crates/toasty/src/engine/eval.rs

    /// casts); every other operation is schema-free.
    pub(crate) fn eval(&self, schema: &Schema, input: impl stmt::Input) -> Result<stmt::Value> {
        use stmt::TypedInput;

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.crates/toasty-core/tests/stmt_eval_reference.rs

// ---------------------------------------------------------------------------
// eval() with FixedRefInput — always resolves to the same value
// -----------------------------------------------------...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoAuthor has no other public repositoriesGitHub user "renovate[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

926 files scanned @ f41e435 | 10/29/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation0

supply chain2

owasp / injection0

telemetry

files 926/1131rules hit 5engine v7commit f41e435

github

nazriel/toasty

An async ORM for Rust

20d

1131 files

926 scanned(82%)

f41e435

architecture░▒▓

entry (0) flagged (3) pkg (91)

491 nodes · 287 edgesscroll to zoom · click node to jump to finding