QuantumScan
astral-sh/uv
The repository uses MD5 hashing in its extraction module (crates/uv-extract/src/hash.rs), which is cryptographically broken and vulnerable to collision attacks. While MD5 is used for file integrity verification rather than security-critical authentication, this represents a moderate risk as attackers could potentially craft malicious packages with matching MD5 checksums. The impact is contained to package integrity verification workflows, not authentication or encryption.
| File | Algorithm | Severity | |
|---|---|---|---|
| crates/uv-extract/src/hash.rs:21 | MD5 | criticalBusiness impact 55 | |
| crates/uv-extract/src/hash.rs:33 | MD5 | criticalBusiness impact 55 | |
| crates/uv-extract/src/hash.rs:45 | MD5 | criticalBusiness impact 55 | |
| crates/uv-extract/src/hash.rs:46 | MD5 | criticalBusiness impact 55 | |
| crates/uv-extract/src/hash.rs:11 | MD5 | criticalBusiness impact 55 |
Anyone with this link can view the risk score and top findings — no sign-in required. Source code stays private.
https://quantumscan.io/en/share/468ffad8-dfb9-4623-aa49-c4a9f3149c0eShow your project's post-quantum readiness in the README. The badge updates automatically after every new scan.
Preview
[](https://github.com/astral-sh/uv)<a href="https://github.com/astral-sh/uv"><img src="https://quantumscan.io/api/badge/astral-sh/uv.svg" alt="Post-Quantum Readiness" /></a>Add badge to your README
Show your quantum-safety score directly on GitHub.
[](https://quantumscan.io/en/scan/468ffad8-dfb9-4623-aa49-c4a9f3149c0e)Save your results & track future changes
Create a free account to get drift alerts, compliance PDF exports, and scan history.
- Weekly drift alerts when new vulnerabilities appear
- Track risk score over time across all your repos
- Export DORA / NIS2 compliance PDF for auditors
Free forever for design partners · No credit card