cargo / sms_local_bulk / 0.1.0

sms_local_bulk 0.1.0

Riskcritical Vulnshigh

processes: 383
operations: 32K
packages: 155
compiler runs: 197
connections: 2
build time: 41s
job time: 41s
capture: 380 KB
records: 55K
bytes / record: 6.9

run ead5e251-7013-49a5-8c05-d76817cfe085 · built 2026-11-05 · complete View on crates.io Release

Graph

secret-exfil · critical

Checks

14 of 17 clear Sensitive data access and transfer Known vulnerabilities +1 more

Build behavior✓▲✓✓✓✓✓✓✓✓✓

Supply chain▲✓▲✓✓

Pipeline✓

Detections

Credential store contents reached a network peer

httpbin.org:443 › httpbin.org:443

critical
Code this build ran used live credentials

sms_local_bulk-0cea7a8b67961a11 › httpbin.org:443

info

Network

2 peers

httpbin.org:443 sms_local_bulk's own build code · sms_local_bulk-0cea7a8b67961a11 · Amazon.com, Inc. unjudged
static.crates.io:8080 the package manager · cargo (bulk-sms) via crates.io · 9,369 files · went into an output ecosystem

Vulnerabilities16		Fix	Severity
Dependencies
h2 0.3.26		>=0.4.16
RUSTSEC-2026-0258	h2 unbounded empty DATA frames		high
openssl 0.10.71		>=0.10.80
CVE-2026-41676	rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1		high
CVE-2026-41678	rust-openssl has incorrect bounds assertion in aes key wrap		high
CVE-2026-41681	rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check		high
CVE-2026-41898	rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer		high
CVE-2026-42327	rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs		high
CVE-2026-44662	rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding		medium
CVE-2026-45784	rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers		medium
GHSA-4fcv-w3qc-ppgg	rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`		medium
CVE-2026-41677	rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length		low
bytes 1.10.1		>=1.11.1
CVE-2026-25541	bytes has integer overflow in BytesMut::reserve		medium
dotenv 0.15.0		none published
RUSTSEC-2021-0141	dotenv is Unmaintained		low
pin-utils 0.1.0		none published
RUSTSEC-2026-0441	`pin-utils` is unmaintained		low
rustls-pemfile 1.0.4		none published
RUSTSEC-2025-0134	rustls-pemfile is unmaintained		low
tokio 1.44.1		>=1.51.6
GHSA-rr8g-9fpq-6wmg	Tokio broadcast channel calls clone in parallel, but does not require `Sync`		low
RUSTSEC-2026-0386	`AsyncFd::new` and related constructors violate I/O safety		low

Dependencies167	Build behaviour
base640.21.7
bitflags2.9.0
bytes1.10.1
cfg-if1.0.0
dotenv0.15.0
encoding_rs0.8.35
equivalent1.0.2
fnv1.0.7
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.1
futures-channel0.3.31
futures-core0.3.31
futures-sink0.3.31
futures-task0.3.31
futures-util0.3.31
h20.3.26
hashbrown0.15.2
http0.2.12
http-body0.4.6
httparse1.10.1	build script
hyper0.14.32
hyper-tls0.5.0
icu_collections1.5.0
icu_locid1.5.0
icu_locid_transform1.5.0
icu_locid_transform_data1.5.1	build script
icu_normalizer1.5.0
icu_normalizer_data1.5.1	build script
icu_properties1.5.1
icu_properties_data1.5.1	build script
icu_provider1.5.0
idna1.0.3
idna_adapter1.2.0
indexmap2.8.0
ipnet2.11.0
itoa1.0.15
ld-linux-x86-64.so.2	system library
libc0.2.171	build script
libc.so.6	system library
libcrypto.so.3	system library
libgcc_s.so.1	system library
libm.so.6	system library
libmvec.so.1	system library
libssl.so.3	system library
litemap0.7.5
lock_api0.4.12	build script
log0.4.27
memchr2.7.4
mime0.3.17
mio1.0.3
native-tls0.2.14	build script
once_cell1.21.3
openssl0.10.71	build script
openssl-probe0.1.6
openssl-sys0.9.106	build script
parking_lot0.12.3
parking_lot_core0.9.10	build script
percent-encoding2.3.1
pin-project-lite0.2.16
pin-utils0.1.0
reqwest0.11.27
rustls-pemfile1.0.4
ryu1.0.20
scopeguard1.2.0
serde1.0.219	build script
serde_json1.0.140	build script
serde_urlencoded0.7.1
signal-hook-registry1.4.2
slab0.4.9	build script
smallvec1.14.0
socket20.5.9
stable_deref_trait1.2.0
sync_wrapper0.1.2
tinystr0.7.6
tokio1.44.1
tokio-native-tls0.3.1
tokio-util0.7.14
tower-service0.3.3
tracing0.1.41
tracing-core0.1.33
try-lock0.2.5
url2.5.4
utf16_iter1.0.5
utf8_iter1.0.4
want0.3.1
write161.0.0
writeable0.5.5
yoke0.7.5
zerofrom0.1.6
zerovec0.10.4
httpdate1.0.3
addr2line0.24.2
adler22.0.0
autocfg1.4.0
backtrace0.3.74
bitflags1.3.2
bumpalo3.17.0
cc1.2.17
core-foundation0.9.4
core-foundation-sys0.8.7
displaydoc0.2.5	proc macro
errno0.3.10
fastrand2.3.0
getrandom0.3.2	build script, not run
gimli0.31.1
icu_provider_macros1.5.0	proc macro
js-sys0.3.77
linux-raw-sys0.9.3
miniz_oxide0.8.5
object0.36.7	build script, not run
openssl-macros0.1.1	proc macro
pkg-config0.3.32
proc-macro21.0.94	build script
quote1.0.40
r-efi5.2.0
redox_syscall0.5.10
rustc-demangle0.1.24
rustix1.0.3	build script, not run
rustversion1.0.20	build script, not runproc macro
schannel0.1.27
security-framework2.11.1
security-framework-sys2.14.0
serde_derive1.0.219	proc macro
shlex1.3.0
syn2.0.100
synstructure0.13.1
system-configuration0.5.1
system-configuration-sys0.5.0	build script, not run
tempfile3.19.1
tokio-macros2.5.0	proc macro
unicode-ident1.0.18
vcpkg0.2.15	prebuilt objects
wasi0.11.0+wasi-snapshot-preview1
wasi0.14.2+wasi-0.2.4
wasm-bindgen0.2.100	build script, not run
wasm-bindgen-backend0.2.100
wasm-bindgen-futures0.4.50
wasm-bindgen-macro0.2.100	proc macro
wasm-bindgen-macro-support0.2.100
wasm-bindgen-shared0.2.100	build script, not run
web-sys0.3.77
windows-sys0.48.0
windows-sys0.52.0
windows-sys0.59.0
windows-targets0.48.5
windows-targets0.52.6
windows_aarch64_gnullvm0.48.5	build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6	build script, not runprebuilt objects
windows_aarch64_msvc0.48.5	build script, not runprebuilt objects
windows_aarch64_msvc0.52.6	build script, not runprebuilt objects
windows_i686_gnu0.48.5	build script, not runprebuilt objects
windows_i686_gnu0.52.6	build script, not runprebuilt objects
windows_i686_gnullvm0.52.6	build script, not runprebuilt objects
windows_i686_msvc0.48.5	build script, not runprebuilt objects
windows_i686_msvc0.52.6	build script, not runprebuilt objects
windows_x86_64_gnu0.48.5	build script, not runprebuilt objects
windows_x86_64_gnu0.52.6	build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5	build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6	build script, not runprebuilt objects
windows_x86_64_msvc0.48.5	build script, not runprebuilt objects
windows_x86_64_msvc0.52.6	build script, not runprebuilt objects
winreg0.50.0
wit-bindgen-rt0.39.0	build script, not runprebuilt objects
yoke-derive0.7.5	proc macro
zerofrom-derive0.1.6	proc macro
zerovec-derive0.10.3	proc macro

Versions1

1 of 1 jobs captured: build-test success · Generated 2026-11-05 · run ead5e251-7013-49a5-8c05-d76817cfe085

analysis 0.1.0 · 2026-11-04 · 5e67feb · graph v2

sms_local_bulk sends the SMSLocal API key it reads from .env to httpbin.org

Conclusion: secrets-exposure
Covers: 0.1.0
Reviewed by: Bitbison
Updated: 2026-11-06

A demo crate that POSTs the SMSLOCAL_API_KEY value from the environment to httpbin.org.

sms_local_bulk, published on crates.io by Smslocal001 (shown as "SMS LOCAL"), is a demo crate that simulates sending bulk SMS through the SMSLocal API. It has been on crates.io since April 1, 2025 and is still served. It is not covert malware: the README openly documents the mock request to httpbin.org and a dummy API key. However, the code sends the SMSLOCAL_API_KEY it loads from a .env file to httpbin.org, a third-party echo service, so a real key configured in the environment would leave for a third party.

What sms_local_bulk does

When compiled and run, sms_local_bulk loads the .env file, reads the SMSLOCAL_API_KEY variable (using a dummy value when it is not set), and sends an HTTP POST to https://httpbin.org/post whose form body carries the apikey, the recipient numbers, the message and the sender. It prints the response, writes it to sms_response.html in the working directory, and on Windows opens that file in the default browser.

What the code does

src/lib.rs:25 — dotenv().ok() loads the .env file into the process environment.
src/lib.rs:26 — env::var("SMSLOCAL_API_KEY") reads the API key, falling back to dummy_api_key_123456.
src/lib.rs:30-35 — constructs the request payload with the apikey field set to that value.
src/lib.rs:39-43 — client.post("https://httpbin.org/post").form(&payload).send() sends it to httpbin.org.
src/lib.rs:50-51 — writes the response to sms_response.html.
src/lib.rs:54-60 — on Windows, opens sms_response.html in the default browser.
README.md — documents the httpbin.org mock endpoint and instructs users to set SMSLOCAL_API_KEY to a dummy value.

Timeline (UTC)

When	What
April 1, 2025	sms_local_bulk 0.1.0 published on crates.io
November 6, 2026	still served, about 19 months after publication

If you installed it

Do not put a real SMSLocal API key (or any other secret) in a .env file this program can read. send_bulk_sms always sends the value of SMSLOCAL_API_KEY to httpbin.org, and there is no flag or setting that disables the request. Use a dummy value as the README suggests, or remove the crate.

Indicators

hosts: httpbin.org
files: .envsms_response.html
processes: sms_local_bulk

What was examined

0.1.0: sha256:c56ff01451bf9ef035232411c756afb2327b5ebfb6fa1a66ebdbe93a22ac9d51