rustup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The docs show rustup uses RUSTUP_DIST_SERVER (https://static.rust-lang.org) and RUSTUP_UPDATE_ROOT (https://static.rust-lang.org/rustup) at runtime to download toolchains and rustup self-updates (i.e., remote executables are fetched and may be executed), so these URLs are runtime dependencies that can control executed code.