The supply-chain attack exists before the CVE does. Scan for the attack.

An advisory database is a list of incidents that already happened, got noticed, got triaged and got published. Every supply-chain attack has a window — days to years — in which it is live and no database knows it. The xz backdoor sat in a trusted release; faster_log stole wallet keys from crates.io for weeks with a clean cargo audit report. rustinel is built for that window, and composes with the tools that aren’t.

A pull request adds one dependency. There is no advisory to match — when this crate was live on crates.io, no database knew it. Three independent signals flag it statically, source never executed.

$ cargo rustinel diff --base-lockfile main/Cargo.lock --head-lockfile pr/Cargo.lock \
    --source-path vendor/ --policy rustinel.toml

Risk delta: 12 → 64 (+52) HIGH
Decision: FAIL

Added packages:
  + [email protected]

Top findings:
  [HIGH] [email protected]: source scans the project’s own .rs files and
         contacts a known exfiltration endpoint (*.workers.dev)
  [HIGH] [email protected]: crate name is one edit away from the popular
         crate `fast_log` — likely typosquat / impersonation
  [LOW ] [email protected]: version published 2 day(s) ago — the window
         in which an attack lives before anyone has reviewed it

Fig. 1 — the September 2025 faster_log crypto-stealer, reconstructed as a permanent test in rustinel’s suite. Every finding carries evidence, a confidence score and the dependency path that pulls the crate into the tree.

All detectors are static and read-only. rustinel never runs build.rs, never compiles, never loads the code it analyzes — analysis is substring- and structure-level over unpacked sources, lockfiles and registry metadata.

Baseline coverage

RustSec advisory matching (full cargo-audit parity, v4 database, offline cache) · yanked versions · license detection with SPDX expression evaluation and allow/deny policy · unsafe usage counts · native/FFI surface · duplicate versions · lockfile-poisoning diff (a redirected source or swapped checksum on an unchanged version) · a dependency path on every transitive finding.

A heuristic scanner is only useful if it does not cry wolf. Every number below is reproducible from the repository: the data study ships as a script, the reconstructions run as permanent tests, and parity is enforced by a CI gate.

0 / 966

false positives from the signals that assert malice, across 966 real crates — full dependency closures plus freshly-published crates.io uploads. Methodology and raw numbers.

1 : 1

advisory parity with cargo-audit, verified finding-for-finding against the live RustSec database on every CI run.

8 fuzz targets

coverage-guided fuzzing over every parser that touches untrusted input — lockfiles, manifests, sources, advisories — running nightly.

Reconstructed incidents

Each reconstruction is a deterministic, permanently-passing test — what advisory scanners structurally cannot see.

Dependencies change in pull requests, so that is where review belongs. The GitHub Action posts a sticky comment with the risk delta — created once, updated in place on every push — and fails the check on a policy violation.

# .github/workflows/supply-chain.yml
permissions:
  contents: read
  pull-requests: write
jobs:
  supply-chain:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: |
          git show "origin/${{ github.base_ref }}:Cargo.lock" \
            > base.Cargo.lock || cp Cargo.lock base.Cargo.lock
      - uses: kosiorkosa47/rustinel@v0
        with:
          command: diff
          base-lockfile: base.Cargo.lock
          head-lockfile: Cargo.lock
          policy: rustinel.toml
          online-metadata: "true"
          # code-scanning: "true"  # findings -> Security tab

Three built-in profiles (strict / balanced / permissive), overridable per project. The engine is fail-closed by design: misconfiguration degrades loudly, never silently.

# rustinel.toml
version = 1

[profile]
name = "balanced"

[risk]
max_project_score   = 70
fail_on_delta_above = 35

[advisories]
fail_on = ["critical", "high"]

[licenses]
deny = ["GPL-3.0", "AGPL-3.0"]

[deny]
crates = ["leftpad-rs"]

cargo rustinel export emits standards-grade artifacts from the same scan — deterministic (--no-timestamp for byte-identical output), JSON-encoded, with correct provenance qualifiers for git and alternate-registry dependencies.

A supply-chain tool must not be a supply-chain risk. Every input rustinel touches is treated as hostile.

1. No executionNever runs build.rs, never runs cargo build on an analyzed project, never loads or executes dependency code. Analysis is static and read-only.
2. Offline by defaultAdvisory matching runs from a local cache. The only network feature, --online-metadata, is opt-in; a --no-default-features build contains no HTTPS client at all.
3. SSRF-proof lookupsOnline queries go to a fixed host with validated crate-name paths and redirects disabled. No request target is ever derived from analyzed data.
4. Hostile-input hardenedEvery parser of untrusted input is panic-guarded and continuously fuzzed (8 nightly coverage-guided targets).
5. Bounded everythingSize-capped reads — oversized files are scanned as a prefix, never skipped. Depth- and entry-bounded walks; symlinks never followed.
6. Injection-safe outputPR comments, SARIF and terminal output escape untrusted text, including Trojan-Source bidi overrides and zero-width characters.
7. Loud degradationA failed lookup, a partial result, a capped walk — every degraded answer says so. No silent fail-open paths.