github.com / tencentcloud

tencentcloud/CubeSandbox

Go·4044 files·commit bb31dbb·scanned 4d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 13,032+ stars — findings likely false positives

verdict accurate?

13,032 stars

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.CubeMaster/pkg/base/localcache/util/util_test.go

	"testing"
	"unsafe"
)

warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.CubeMaster/pkg/base/utils/strings.go

	"reflect"
	"unsafe"

	"slices"

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.CubeShim/shim/src/main.rs

            eprintln!("handle runtime info request failed: {err}");
            unsafe {
                libc::exit(1);
            }

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.Cubelet/pkg/utils/dentry.go

	subCmd := fmt.Sprintf("cat /proc/1/mountinfo | grep %s", backendFile)
	cmd := exec.CommandContext(context.Background(), "/usr/bin/bash", "-c", subCmd)
	_, err := cmd.Output()
	return err == nil

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.Cubelet/pkg/utils/process_test.go


	cmd := exec.Command(script)
	require.NoError(t, cmd.Start())
	t.Cleanup(func() {

warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.Cubelet/pkg/utils/queue.go

	"sync/atomic"
	"unsafe"
)

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.Cubelet/pkg/utils/shell.go

	defer cancel()
	cmd := exec.CommandContext(ctx, "/usr/bin/bash", "-lc", arg)
	cmd.Stderr = &stderrBuffer
	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}

    }
    let ret = unsafe { libc::setns(file.unwrap().as_raw_fd(), libc::CLONE_NEWNS) };
    if ret < 0 {
        exit_proc_failed(format!("setns failed:{}", std::io::Error::last_os_error()));

    pub fn try_clone(&self) -> Result<Self> {
        let fd = unsafe { libc::dup(self.path_fd()) };
        if fd < 0 {
            Err(Error::last_os_error())

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.agent/rustjail/src/container.rs

        let exec_path = std::env::current_exe()?;
        let mut child = std::process::Command::new(exec_path);

        #[allow(unused_mut)]

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.agent/src/console.rs

async fn run_debug_console_serial(shell: String, fd: RawFd) -> Result<()> {
    let mut child = match tokio::process::Command::new(shell)
        .arg("-i")
        .kill_on_drop(true)

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.agent/src/main.rs

    let _lock = rustjail::container::WAIT_PID_LOCKER.lock().await;
    let output = Command::new("/etc/rc.local").spawn();

    match output {

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.examples/claude-code-integration/tests/test_cubesandbox_exec.py

        )
        subprocess.run(["bash", "-c", first], cwd=tmp_path, check=True)

        second = executor._state_shell(

    rewritten = _updated_input(payload)["command"]
    completed = subprocess.run(
        rewritten,
        cwd=tmp_path,

    env["PATH"] = str(Path(sys.executable).parent) + os.pathsep + env["PATH"]
    return subprocess.run(
        ["bash", str(installer), *arguments],
        check=check,

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.examples/openai-agents-example/main.py

        stdout = result.stdout if hasattr(result, "stdout") else str(result)
        print(f"  exec ({exec_ms:.0f} ms): {stdout.strip()}")
    except Exception as e:
        print(f"  exec failed: {e}...

            try:
                exec(payload["content"]["code"], namespace)
            except ValueError as exc:
                await context.executions[msg_id].put(

criticalRemote script piped into a shellA shell script downloads remote content and executes it directly (e.g. `curl … | bash`). The payload is never stored or reviewable and can change server-side — a classic malware/backdoor install pattern.hypervisor/workflows/1check.sh

echo "install cargo toolchain..."
curl https://sh.rustup.rs -sSf | sh -s -- -y
source "$HOME/.cargo/env"

+10

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.sdk/python/tests/test_l7_custom_port_e2e.py

    encoded = base64.b64encode(source.encode()).decode()
    return f"python3 -c \"import base64;exec(base64.b64decode('{encoded}'))\""

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.CubeOps/internal/config/config_test.go

log_level: "debug"
cubemaster_addr: "http://1.2.3.4:8089"
sandbox_domain: "test.example.com"
database_url: "mysql://root:pass@127.0.0.1:3306/testdb"

warningGo net/http with hardcoded IPHardcoded public IP addresses in HTTP clients are common in malware C2 configurations.CubeOps/internal/config/config_test.go

log_level: "debug"
cubemaster_addr: "http://1.2.3.4:8089"
sandbox_domain: "test.example.com"
database_url: "mysql://root:pass@127.0.0.1:3306/testdb"

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.hypervisor/test_infra/src/lib.rs

            // Don't treat child.kill() as a problem
            if output.status.signal() == Some(9) && r.is_ok() {
                return;
            }

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.sdk/node/src/commands.ts

      if (data.stdout) {
        stdout.push(Buffer.from(data.stdout, "base64").toString("utf-8"));
      }
      if (data.stderr) {

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.sdk/node/src/pty.ts

        if (data.pty) {
          yield Buffer.from(data.pty, "base64");
        }
        const end = event.end;

warningHardcoded IP address in network callFetching data from hardcoded IP addresses instead of domain names is suspicious and may indicate C2 communication.CubeMaster/pkg/service/httpservice/cube/template_from_image_baseurl_test.go

	r.Host = "9.135.79.34:8089"
	if got, want := requestBaseURL(r), "http://9.135.79.34:8089"; got != want {
		t.Fatalf("requestBaseURL() = %q, want %q", got, want)
	}

warningGo net/http with hardcoded IPHardcoded public IP addresses in HTTP clients are common in malware C2 configurations.CubeMaster/pkg/service/httpservice/cube/template_from_image_baseurl_test.go

	r.Host = "9.135.79.34:8089"
	if got, want := requestBaseURL(r), "http://9.135.79.34:8089"; got != want {
		t.Fatalf("requestBaseURL() = %q, want %q", got, want)
	}

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.dev-env/create_vm.sh

QEMU_SERIAL_LOG="${WORK_DIR}/qemu-serial.log"
ASKPASS_SCRIPT="${WORK_DIR}/.ssh-askpass.sh"
SSH_COMMON_OPTS=(
  -o StrictHostKeyChecking=no

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.dev-env/login.sh


ASKPASS_SCRIPT="${WORK_DIR}/.ssh-askpass.sh"

LOG_TAG="login"

criticalPython base64 payload executionDecoding a base64 blob and passing it to exec()/compile() is a common obfuscation technique in Python malware.sdk/python/tests/test_l7_custom_port_e2e.py

    encoded = base64.b64encode(source.encode()).decode()
    return f"python3 -c \"import base64;exec(base64.b64decode('{encoded}'))\""

infoSuspicious file in repoVery large source file (526KB) — could contain obfuscated payloadCubeShim/protoc/src/agent.rs+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

2651 files scanned @ bb31dbb | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration25

file system access10

obfuscation8

supply chain2

owasp / injection0

telemetry

files 2651/4044rules hit 31engine v7commit bb31dbb

github

tencentcloud/CubeSandbox

Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.

13032

1178

203d

4044 files

2651 scanned(66%)

bb31dbb

architecture░▒▓

entry (1) flagged (184) pkg (683)

1083 nodes · 2063 edgesscroll to zoom · click node to jump to finding