The erg script specified in poise's pre-build can currently execute arbitrary code. Although this is unavoidable to some extent, it does pose a security risk.

https://blog.rust-lang.org/inside-rust/2023/09/01/crates-io-malware-postmortem.html

The following are some of the counterplans I can think of now:

• Create a sandbox environment and only allow execution within it
• Analyze the effects of build scripts to make it clear to the user whether the script is creating files or communicating externally, etc.

Reproducible command

poise init

Result

/Users/shiba/.erg/bin/poise: line 1: 33964 Segmentation fault: 11  python3 /Users/shiba/.erg/bin/poise.pyc $@

Version

CPython 3.9
Erg 0.6.31

Note

This may be the bug of the Erg code generator.