Skip to content
Open-Source Registry

cargo / aheui / 0.0.1

aheui 0.0.1

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnshigh
processes
381
operations
60K
packages
261
compiler runs
288
connections
1
build time
1m 23s
job time
1m 23s
capture
754 KB
records
107K
bytes / record
7.1
run e336a10d-77ff-4d7c-894e-70e0ffd8c480 · built 2026-11-03 · complete View on crates.io
Reviewed by Bitbison: secrets-exposureaheui's interpreter rpaheui requires rustpython ^0.3.1, whose VM copies every environment variable set at compile time into the library. Every aheui binary carries the full environment of the machine that compiled it, tokens and keys included, and no release can reach the fixed rustpython 0.6.

Graph

binary · retained · product · graph v2
2

Checks

12 of 16 clear Sensitive data access and transfer Known vulnerabilities +2 more
Build behavior✓▲✓✓✓✓✓✓✓✓
Supply chain▲▲▲✓✓
Pipeline✓

Detections

2
  • aheui contains GITHUB_TOKEN and 37 other credentials
    aheui
    high
  • 38 credentials copied into 3 files
    env_vars.rs
    low

Detection

highwitnessed

aheui contains GITHUB_TOKEN and 37 other credentials

Credential copied by the build

Subject
/home/runner/work/aheui-rust/aheui-rust/target/release/aheui
Jobs
build-test
Rule
credential-copied

Evidence

  1. Credentials found in a file the build wrotecause

    GITHUB_TOKEN and 37 other credentials in /home/runner/work/aheui-rust/aheui-rust/target/release/aheui

    subject /home/runner/work/aheui-rust/aheui-rust/target/release/aheui

  2. Why it matterscontext

    Credentials were exposed in this file.

Remediation

Remove what writes the credential into the artifact: anyone who has the artifact has the credential.

Detection

lowwitnessed

38 credentials copied into 3 files

Credential copied by the build

Subject
/home/runner/work/aheui-rust/aheui-rust/target/release/build/rustpython-vm-53978ec9e4c9625a/out/env_vars.rs
Reaches
aheui-563f05f46c929a17member
Jobs
build-test
Rule
credential-copied

Evidence

  1. Credentials found in a file the build wrotecause

    GITHUB_TOKEN and 37 other credentials in /home/runner/work/aheui-rust/aheui-rust/target/release/build/rustpython-vm-53978ec9e4c9625a/out/env_vars.rs, written by build-script-build

    subject /home/runner/work/aheui-rust/aheui-rust/target/release/build/rustpython-vm-53978ec9e4c9625a/out/env_vars.rs

    by /home/runner/work/aheui-rust/aheui-rust/target/release/build/rustpython-vm-08144a4a34c32fce/build-script-build

  2. Credentials found in a file the build wrotecause

    GITHUB_TOKEN and 37 other credentials in /home/runner/work/aheui-rust/aheui-rust/target/release/deps/aheui-563f05f46c929a17, written by rust-lld

    subject /home/runner/work/aheui-rust/aheui-rust/target/release/deps/aheui-563f05f46c929a17

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld -flavor gnu -plugin /usr/libexec/gcc/x86_64-li…

  3. Credentials found in a file the build wrotecause

    GITHUB_TOKEN and 37 other credentials in /home/runner/work/aheui-rust/aheui-rust/target/release/deps/librustpython_vm-9c440b5576d53bc9.rlib, written by rustc

    subject /home/runner/work/aheui-rust/aheui-rust/target/release/deps/librustpython_vm-9c440b5576d53bc9.rlib

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/rustc --crate-name rustpython_vm --edition=2021 /home/runner/.cargo/registry/src/index.crate…

  4. Why it matterscontext

    Credentials were exposed in this file.

In aheui

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/aheui-rust/aheui-rust/target/release/build/rustpython-vm-08144a4a34c32fce/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2563
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2563
  3. build-script-build/home/runner/work/aheui-rust/aheui-rust/target/release/build/rustpython-vm-08144a4a34c32fce/build-script-build5925

Remediation

Keep credentials out of build output: logs, caches and build directories outlive the job.

Network

1 peers
  • static.crates.io:8080 the package manager · cargo (aheui-rust) via crates.io · 17,818 files · went into an output ecosystem
Vulnerabilities24FixSeverity
Dependencies
libz-sys 1.1.16>=1.1.31
RUSTSEC-2026-0418libz-sys build script leaks environment variables in the build directoryhigh
lz4_flex 0.11.3>=0.11.6
CVE-2026-32829lz4_flex's decompression can leak information from uninitialized memory or reused output bufferhigh
rustpython-vm 0.3.1>=0.6.0
RUSTSEC-2026-0394Build environment compiled into the library and readable at runtimehigh
ansi_term 0.12.1none published
RUSTSEC-2021-0139ansi_term is Unmaintainedlow
anyhow 1.0.81>=1.0.103
RUSTSEC-2026-0190Unsoundness in `Error::downcast_mut()`low
atty 0.2.14none published
GHSA-g98v-hv3f-hcfratty potential unaligned readlow
RUSTSEC-2024-0375`atty` is unmaintainedlow
keccak 0.1.5>=0.1.6
GHSA-3288-p39f-rqpvUnsoundness in opt-in ARMv8 assembly backend for `keccak`low
memmap2 0.5.10>=0.9.11
RUSTSEC-2026-0186Unchecked pointer offset in crate `memmap2`low
rand 0.8.5>=0.8.6
GHSA-cq8v-f236-94qcRand is unsound with a custom logger using rand::rng()low
unic-char-property 0.9.0none published
RUSTSEC-2025-0081`unic-char-property` is unmaintainedlow
unic-char-range 0.9.0none published
RUSTSEC-2025-0075`unic-char-range` is unmaintainedlow
unic-common 0.9.0none published
RUSTSEC-2025-0080`unic-common` is unmaintainedlow
unic-emoji-char 0.9.0none published
RUSTSEC-2025-0090`unic-emoji-char` is unmaintainedlow
unic-normal 0.9.0none published
RUSTSEC-2025-0082`unic-normal` is unmaintainedlow
unic-ucd-age 0.9.0none published
RUSTSEC-2025-0102`unic-ucd-age` is unmaintainedlow
unic-ucd-bidi 0.9.0none published
RUSTSEC-2025-0083`unic-ucd-bidi` is unmaintainedlow
unic-ucd-category 0.9.0none published
RUSTSEC-2025-0094`unic-ucd-category` is unmaintainedlow
unic-ucd-hangul 0.9.0none published
RUSTSEC-2025-0079`unic-ucd-hangul` is unmaintainedlow
unic-ucd-ident 0.9.0none published
RUSTSEC-2025-0100`unic-ucd-ident` is unmaintainedlow
unic-ucd-normal 0.9.0none published
RUSTSEC-2025-0078`unic-ucd-normal` is unmaintainedlow
unic-ucd-version 0.9.0none published
RUSTSEC-2025-0098`unic-ucd-version` is unmaintainedlow
adler 1.0.2none published
RUSTSEC-2025-0056adler crate is unmaintained, use adler2 insteadinfo
paste 1.0.14 buildnone published
RUSTSEC-2024-0436paste - no longer maintainedinfo

Dependencies

281
Dependencies281Build behaviour
adler321.2.0
ahash0.8.11build script
ansi_term0.12.1
anstream0.6.13
anstyle1.0.6
anstyle-parse0.2.3
anstyle-query1.0.2
anyhow1.0.81build script
ascii1.1.0
atomic0.5.3
atty0.2.14
base640.13.1
bitflags1.3.2
bitflags2.5.0
blake20.10.6
block-buffer0.10.4
bstr0.2.17
caseless0.2.1build script
cfg-if1.0.0
chrono0.4.37
clap2.34.0
clap4.5.4
clap_builder4.5.2
clap_lex0.7.0
colorchoice1.0.0
cpufeatures0.2.12
crc32fast1.4.0build script
crossbeam-utils0.8.19build script
crypto-common0.1.6
csv-core0.1.11
digest0.10.7
dirs-next2.0.0
dirs-sys-next0.1.2
dns-lookup2.0.4
dyn-clone1.0.17
either1.10.0
endian-type0.1.2
env_logger0.9.3
equivalent1.0.1
exitcode1.1.2
fd-lock4.0.2
flate21.0.28
generic-array0.14.7build script
gethostname0.2.3
getrandom0.2.12
half1.8.3
hashbrown0.14.3
hex0.4.3
hexf-parse0.2.1
home0.5.9
iana-time-zone0.1.60
indexmap2.2.6
itertools0.11.0
keccak0.1.5
lalrpop-util0.20.2
lazy_static1.4.0
ld-linux-x86-64.so.2system library
lexical-parse-float0.8.5
lexical-parse-integer0.8.6
lexical-util0.8.5
libc0.2.153build script
libc.so.6system library
libgcc_s.so.1system library
libm0.2.8build script
libm.so.6system library
libmvec.so.1system library
libsqlite3-sys0.25.2build script
libz-sys1.1.16build script
linux-raw-sys0.4.13
lock_api0.4.11build script
log0.4.21
lz4_flex0.11.3
mac_address1.1.5
malachite0.4.6
malachite-base0.4.6
malachite-bigint0.2.0
malachite-nz0.4.6
malachite-q0.4.6
matches0.1.10
md-50.10.6
memchr2.7.2
memmap20.5.10
memoffset0.6.5build script
memoffset0.9.1build script
mt199372.0.1
nibble_vec0.1.0
nix0.23.2
nix0.27.1
nix0.28.0build script
num-complex0.4.5
num-integer0.1.46
num-traits0.2.18build script
num_cpus1.16.0
num_enum0.7.2
once_cell1.19.0
optional0.5.0
page_size0.4.2
parking_lot0.12.1
parking_lot_core0.9.9build script
phf0.11.2
phf_shared0.11.2
ppv-lite860.2.17
puruspe0.2.4
radium0.7.0build script
radix_trie0.2.1
rand0.8.5
rand_chacha0.3.1
rand_core0.6.4
regex-automata0.1.10
result-like0.4.6
rpaheui0.0.1
rustc-hash1.1.0
rustix0.38.32build script
rustpython0.3.1
rustpython-ast0.3.1
rustpython-codegen0.3.1
rustpython-common0.3.1
rustpython-compiler0.3.1
rustpython-compiler-core0.3.1
rustpython-format0.3.1
rustpython-literal0.3.1
rustpython-parser0.3.1build script
rustpython-parser-core0.3.1
rustpython-parser-vendored0.3.1
rustpython-pylib0.3.1
rustpython-sre_engine0.3.1
rustpython-stdlib0.3.1build script
rustpython-vm0.3.1build scriptruns toolsgit
rustyline14.0.0
ryu1.0.17
scopeguard1.2.0
sha-10.10.1
sha20.10.8
sha30.10.8
siphasher0.3.11
smallvec1.13.2
socket20.5.6
static_assertions1.1.0
strsim0.11.1
strsim0.8.0
strum0.24.1
subtle2.5.0
termcolor1.4.1
termios0.3.3
textwrap0.11.0
thread_local1.1.8
timsort0.1.3
tinyvec1.6.0
tinyvec_macros0.1.1
twox-hash1.6.3
typenum1.17.0build script
ucd0.1.1
uname0.1.1
unic-char-property0.9.0
unic-char-range0.9.0
unic-common0.9.0
unic-emoji-char0.9.0
unic-normal0.9.0
unic-ucd-age0.9.0
unic-ucd-bidi0.9.0
unic-ucd-category0.9.0
unic-ucd-hangul0.9.0
unic-ucd-ident0.9.0
unic-ucd-normal0.9.0
unic-ucd-version0.9.0
unicode-casing0.1.0
unicode-normalization0.1.23
unicode-segmentation1.11.0
unicode-width0.1.11
unicode_names21.2.2build script
utf8parse0.2.1
uuid1.8.0
vec_map0.8.2
volatile0.3.0
which4.4.2
xml-rs0.8.20
zerocopy0.7.32
adler1.0.2
miniz_oxide0.7.2
thiserror1.0.58build script
aho-corasick1.1.3
android-tzdata0.1.1
android_system_properties0.1.5
anstyle-wincon3.0.2
autocfg1.2.0
bumpalo3.15.4
cc1.0.90
cfg_aliases0.1.1
clap_derive4.5.4proc macro
clipboard-win5.3.0
convert_case0.4.0
core-foundation0.9.4
core-foundation-sys0.8.6
crunchy0.2.2build script
derive_more0.99.17proc macro
errno0.3.8
error-code3.2.0
getopts0.2.21
glob0.3.1
heck0.4.1
heck0.5.0
hermit-abi0.1.19
hermit-abi0.3.9
iana-time-zone-haiku0.1.2build script, not run
Inflector0.11.4
is-macro0.3.5proc macro
js-sys0.3.69
libredox0.1.3
maplit1.0.2
num_enum_derive0.7.2proc macro
paste1.0.14build scriptproc macro
phf_codegen0.11.2
phf_generator0.11.2
pkg-config0.3.30
pmutil0.5.3
proc-macro-crate1.3.1
proc-macro21.0.79build script
quote1.0.35
redox_syscall0.4.1
redox_users0.4.5
regex1.10.4
regex-automata0.4.6
regex-syntax0.8.3
result-like-derive0.4.6proc macro
rustc_version0.4.0
rustpython-derive0.3.1proc macro
rustpython-derive-impl0.3.1
rustpython-doc0.3.0
rustversion1.0.14build scriptproc macro
schannel0.1.23
semver1.0.22build script
strum_macros0.24.3proc macro
syn1.0.109build script
syn2.0.58
syn-ext0.4.0
system-configuration0.5.1
system-configuration-sys0.5.0build script, not run
textwrap0.15.2
thiserror-impl1.0.58proc macro
tiny-keccak2.0.2build script
toml_datetime0.6.5
toml_edit0.19.15
unicode-ident1.0.12
unicode_names2_generator1.2.2
uuid-macro-internal1.8.0proc macro
vcpkg0.2.15prebuilt objects
version_check0.9.4
wasi0.11.0+wasi-snapshot-preview1
wasm-bindgen0.2.92build script, not run
wasm-bindgen-backend0.2.92
wasm-bindgen-macro0.2.92proc macro
wasm-bindgen-macro-support0.2.92
wasm-bindgen-shared0.2.92build script, not run
widestring1.1.0
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.6
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows0.52.0
windows-core0.52.0
windows-sys0.48.0
windows-sys0.52.0
windows-targets0.48.5
windows-targets0.52.4
windows_aarch64_gnullvm0.48.5build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.4build script, not runprebuilt objects
windows_aarch64_msvc0.48.5build script, not runprebuilt objects
windows_aarch64_msvc0.52.4build script, not runprebuilt objects
windows_i686_gnu0.48.5build script, not runprebuilt objects
windows_i686_gnu0.52.4build script, not runprebuilt objects
windows_i686_msvc0.48.5build script, not runprebuilt objects
windows_i686_msvc0.52.4build script, not runprebuilt objects
windows_x86_64_gnu0.48.5build script, not runprebuilt objects
windows_x86_64_gnu0.52.4build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.4build script, not runprebuilt objects
windows_x86_64_msvc0.48.5build script, not runprebuilt objects
windows_x86_64_msvc0.52.4build script, not runprebuilt objects
winnow0.5.40
winreg0.10.1build script, not run
zerocopy-derive0.7.32proc macro

Versions1

Raw data

capture
754 KB
records
106,719
bytes per record
7.1

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-11-03 · run e336a10d-77ff-4d7c-894e-70e0ffd8c480

analysis 0.1.0 · 2026-11-02 · 3bf4062 · graph v2

aheui 0.0.1 puts its compile environment inside the binary through rustpython-vm 0.3

secrets-exposureCovers 0.0.1Reviewed by BitbisonUpdated 2026-11-04

aheui's interpreter rpaheui requires rustpython ^0.3.1, whose VM copies every environment variable set at compile time into the library. Every aheui binary carries the full environment of the machine that compiled it, tokens and keys included, and no release can reach the fixed rustpython 0.6.

What the package does

aheui is a command-line interpreter for Aheui, an esoteric programming language written in Hangul. It is a thin wrapper over the rpaheui crate, which runs the reference interpreter on RustPython.

Compiling aheui compiles rustpython-vm 0.3.1, whose build script writes every environment variable of the compile into a source file that the library includes. The finished aheui executable therefore holds, as plain strings, every variable that was set when it was compiled: on a developer machine or a CI runner that means tokens such as GITHUB_TOKEN, cloud keys and registry tokens. Anyone with a copy of the binary can read them with strings, and Python code run by the embedded interpreter can read them through sysconfig.get_config_vars().

What the code does

  • aheui's Cargo.toml depends on rpaheui 0.0.1, and its Cargo.lock pins rustpython-vm 0.3.1.
  • rpaheui 0.0.1 (checksum 0991f824…b08d, as the crates.io index gives it) requires rustpython and rustpython-derive ^0.3.1. For a 0.x version that requirement stays within 0.3, so neither the locked nor a fresh resolution can reach rustpython 0.6.0, the first release without the dump.
  • rustpython-vm 0.3.x's build script writes $OUT_DIR/env_vars.rs from std::env::vars_os(), and src/stdlib/sysconfigdata.rs line 22 includes it in build_time_vars. The registry's review of rustpython-vm describes the mechanism; it is RUSTSEC-2026-0394.

aheui and rpaheui have one release each, both from April 10, 2024.

Conclusion

secrets-exposure: every aheui 0.0.1 binary contains the whole environment it was compiled in, through rustpython-vm 0.3.1, and no version requirement in the chain allows the fix.

Compile aheui only with a clean environment (env -i with just what cargo needs), never on a CI runner that holds secrets, and do not distribute a binary compiled elsewhere. If one has left the machine that compiled it, treat every secret in that environment as exposed and rotate it. A fix needs rpaheui to move to rustpython 0.6 or later.

Indicators

files
env_vars.rs
packages
cargo:rpaheui@0.0.1cargo:rustpython-vm@0.3.1
symbols
sysconfig.get_config_vars

Examined

0.0.1
sha256:2f7dc9025a4f8309ad7788e2f624992973f2449cf6fbad9edd3ba919c4f10dff

Links