criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/walgit-cli/src/import.rs

    // Collect refs from the source repo.
    let refs_output = Command::new("git")
        .args(["for-each-ref", "--format=%(objectname) %(refname)"])
        .current_dir(&git_dir)

+8

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/walgit-cli/src/import_direct.rs

fn count_loose(git_dir: &Path) -> u64 {
    Command::new("git")
        .args(["count-objects"])
        .current_dir(git_dir)

+8

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.crates/walgit-cli/src/mirror.rs

async fn gcloud_identity_token() -> Result<String> {
    let out = Command::new("gcloud")
        .args(["auth", "print-identity-token"])
        .stdin(Stdio::null())

+8

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/walgit-server/tests/e2e.rs

    // SAFETY: test-only env var, read by the publish path of this process.
    unsafe { std::env::set_var("WALGIT_TEST_PUBLISH_GAP_MS", "150") };
    let server = Server::start().await?;
    server.p...

+3

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/walgit-wal/src/registry.rs

    #[allow(unsafe_code)]
    let mut st: libc::statvfs = unsafe { std::mem::zeroed() };
    // SAFETY: c is NUL-terminated and live; st is aligned writable storage for statvfs.
    #[allow(unsafe_cod...

+3

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.crates/walgit-git/tests/upload_gix_scale.rs

    #[allow(unsafe_code)]
    let mut ru: libc::rusage = unsafe { std::mem::zeroed() };
    // SAFETY: ru is aligned writable storage; RUSAGE_SELF is a supported selector.
    #[allow(unsafe_code)]

+3

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/walgit-server/src/auth.rs

//!   1. an **ID token** from the issuer in `Authorization: Bearer` (RS256/ES256,
//!      signature against the issuer's JWKS, `iss`, `exp`, `aud` ∈ `audiences` ∪
//!      {`oauth_client_id`}, `email...

+5

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/walgit-server/src/events.rs

/// (sha1 of the body — the consumer's dedup key) and, when `events.webhook_secret`
/// is set, `X-Walgit-Signature: sha256=<hex HMAC-SHA256 of the body>`. A non-2xx
/// answer fails the batch; the cu...

+5

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.crates/walgit-server/src/lib.rs

    clippy::cast_precision_loss,
    clippy::cast_sign_loss,
    clippy::doc_lazy_continuation,
    clippy::expect_used,

+5

tobi/walgit

FINDINGS ░▒▓

tobi/walgit

architecture░▒▓