Skip to content
Open-Source Registry

cargo / bcode_read_plugin / 0.0.1-alpha.0

bcode_read_plugin 0.0.1-alpha.0

bitbison: no public build not built
processes
464
operations
72K
packages
345
compiler runs
187
connections
2
job time
6m 16s
capture
983 KB
records
132K
bytes / record
7.4

Build behaviourundeclared fetchfetch went into the outputread credentialsfetched outside crates.iocompiled C/C++

run c4fea7ab-0208-4fd8-9207-5bfe73052c90 · built 2026-10-19 · complete View on crates.io

This release did not build; nothing below stands for the package.

Graph

secret-exfil · critical
15

Checks

11 of 14 clear Network activity Sensitive data access and transfer +1 more
Build behavior▲▲✓✓✓✓✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

3
  • Credential store contents reached a network peer
    static.crates.io:8080 › static.crates.io:8080
    critical
  • Credential store read by build-time code
    bmux_mermaid_render 0.0.1-alpha.4
    high
  • Build script fetched what the build compiled, linked or ran
    bmux_mermaid_render 0.0.1-alpha.4 › github.com:443
    high

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
static.crates.io:8080
Destination
static.crates.io:8080
Jobs
build-test
Rule
secret-exfil · bcode

Witness chain

  1. /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config
    source
  2. static.crates.io:8080via /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

      Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast5271
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5271
  3. build-script-build/home/runner/work/bcode/bcode/target/release/build/bmux_mermaid_render-ac986a91d682a571/build-script-build7739
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…7740

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Credential store read by build-time code

Subject
bmux_mermaid_render 0.0.1-alpha.4
Jobs
build-test
Rule
credential-read · bcode

Evidence

  1. Credential store read by build-time codecause

    Credential store read by build-time code that does not own it: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    source /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast5271
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5271
  3. build-script-build/home/runner/work/bcode/bcode/target/release/build/bmux_mermaid_render-ac986a91d682a571/build-script-build7739
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…7740

Remediation

Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
bmux_mermaid_render 0.0.1-alpha.4
Destination
github.com:443
Jobs
build-test
Rule
egress · bcode

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by cargo

    subject github.com:443

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

  2. What a build script's fetch becamesupport

    1511 files came down; the build compiled or linked attr.rs, bigint.rs, buffer.rs +40 more

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/bcode/bcode/target/release/build/bmux_mermaid_render-ac986a91d682a571/build-script-build

  4. Tool commandsupport

    Command: /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast5271
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5271
  3. build-script-build/home/runner/work/bcode/bcode/target/release/build/bmux_mermaid_render-ac986a91d682a571/build-script-build7739
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…7740

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Network

2 peers
  • github.com:443 build code of bmux_mermaid_render · cargo (bcode) · GitHub, Inc. · 1,511 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (bcode) via crates.io · 19,032 files · went into an output ecosystem
Dependencies363Build behaviour
ab_glyph0.2.32
ab_glyph_rasterizer0.1.10
addr2line0.26.1
adler22.0.1
ahash0.8.12build script
aho-corasick1.1.5
allocator-api20.2.21
anstyle1.0.14
anyhow1.0.104build script
arbitrary1.4.2
async-trait0.1.92proc macro
autocfg1.5.1
base640.23.1
bcode_agent_profile0.0.1-alpha.0
bcode_command0.0.1-alpha.0
bcode_markdown_render0.0.1-alpha.0
bcode_model0.0.1-alpha.0
bcode_plugin_models0.0.1-alpha.0
bcode_plugin_sdk0.0.1-alpha.0
bcode_provider_auth_models0.0.1-alpha.0
bcode_session_models0.0.1-alpha.0
bcode_session_view_models0.0.1-alpha.0
bcode_shell_command_analysis_models0.0.1-alpha.0
bcode_skill_models0.0.1-alpha.0
bcode_tool0.0.1-alpha.0
bcode_tool_models0.0.1-alpha.0
bcode_usage_models0.0.1-alpha.0
bcode_workflow0.0.1-alpha.0
bcode_workflow_view_models0.0.1-alpha.0
bincode1.3.3
bit-set0.8.0
bit-vec0.8.0
bitflags2.13.2
block-buffer0.10.4
block-buffer0.12.1
bmux_fonts0.0.1-alpha.4
bmux_keyboard0.0.1-alpha.4
bmux_markdown0.0.1-alpha.4
bmux_mermaid_render0.0.1-alpha.4build scriptnetworkruns toolsgithub.com, static.crates.io, git
bmux_plugin_schema0.0.1-alpha.4
bmux_syntax_render0.0.1-alpha.4
bmux_text_edit0.0.1-alpha.4
bmux_tui0.0.1-alpha.4
bmux_tui_components0.0.1-alpha.4
borrow-or-share0.2.4
bumpalo3.20.3
bytecount0.6.9
bytemuck1.25.2
byteorder-lite0.1.0
bytes1.12.1
cc1.6.0
cfg-if1.0.5
clap4.6.7
clap_builder4.6.7
clap_derive4.6.7proc macro
clap_lex1.1.1
cobs0.3.0
color-hex0.2.0proc macro
colored3.1.1
cpp_demangle0.5.1build script, not run
cpufeatures0.2.17
cpufeatures0.3.1
cranelift-assembler-x640.136.3build script
cranelift-assembler-x64-meta0.136.3
cranelift-bforest0.136.3
cranelift-bitset0.136.3
cranelift-codegen0.136.3build scriptruns toolsgit
cranelift-codegen-meta0.136.3
cranelift-codegen-shared0.136.3
cranelift-control0.136.3
cranelift-entity0.136.3
cranelift-frontend0.136.3
cranelift-isle0.136.3build script
cranelift-native0.136.3
cranelift-srcgen0.136.3
crc32fast1.5.2build script
crossterm0.29.0
crossterm_winapi0.9.1
crypto-common0.1.7
crypto-common0.2.2
data-encoding2.11.1
deranged0.5.8
digest0.10.7
digest0.11.3
displaydoc0.2.7proc macro
document-features0.2.12proc macro
dyn-clone1.0.20
either1.18.0
email_address0.2.9
embedded-io0.4.0
embedded-io0.6.1
equivalent1.0.2
errno0.3.14
fancy-regex0.16.2
fancy-regex0.18.0
fastrand2.5.0
fdeflate0.3.7
find-msvc-tools0.1.14
flate21.1.10
fluent-uri0.4.1
flume0.12.0
fnv1.0.7
foldhash0.2.0
fontconfig-parser0.5.8
fontdb0.24.0
form_urlencoded1.2.2
fraction0.15.4
free_log_client0.5.0
free_log_models0.2.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-executor0.3.34
futures-io0.3.34
futures-macro0.3.34proc macro
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.3.4build script
getrandom0.4.3build script
gimli0.33.0
hashbrown0.16.1
hashbrown0.17.1
heck0.5.0
hex0.4.3
html-escape0.2.15
hybrid-array0.4.15
hyperchad_actions0.5.0
hyperchad_color0.5.0
hyperchad_docs_config0.5.0
hyperchad_docs_config_derive0.5.0proc macro
hyperchad_markdown0.5.0
hyperchad_transformer0.5.0
hyperchad_transformer_models0.5.0
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
image0.25.10
indexmap2.14.2
itertools0.14.0
itoa1.0.18
js-sys0.3.106
jsonschema0.47.0
jsonschema-regex0.47.0
lazy_static1.5.1
ld-linux-x86-64.so.2system library
leb128fmt0.1.0
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
libyaml-rs0.3.0
linked-hash-map0.5.6
linux-raw-sys0.12.1
litemap0.8.3
litrs1.0.0
lock_api0.4.14
log0.4.34
mach20.6.0
matchers0.2.0
memchr2.8.3
memfd0.6.6
memmap20.9.11
micromap0.3.0
miniz_oxide0.8.9
miniz_oxide0.9.1
mio1.2.4
moosicbox_arb0.5.0
moosicbox_assert0.5.0
moosicbox_env_utils0.5.0
moosicbox_logging0.5.0
moxcms0.8.1
nu-ansi-term0.50.3
num0.4.3
num-bigint0.4.8
num-cmp0.1.0
num-complex0.4.6
num-conv0.2.2
num-integer0.1.47
num-iter0.1.46
num-rational0.4.2
num-traits0.2.19build script
object0.40.0
once_cell1.21.4
onig6.5.3
onig_sys69.9.3build script
outref0.5.2
owned_ttf_parser0.25.1
parking_lot0.12.5
parking_lot_core0.9.12build script
paste1.0.15build scriptproc macro
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
plist1.10.1
png0.18.1
postcard1.1.3
potential_utf0.1.6
powerfmt0.2.0
ppv-lite860.2.21
proc-macro-crate3.5.0
proc-macro21.0.107build script
proptest1.11.0
pulldown-cmark0.13.4build script
pulley-interpreter49.0.3
pulley-macros49.0.3proc macro
pxfm0.1.30
quick-xml0.42.0
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
rand0.9.5
rand_chacha0.9.0
rand_core0.9.5
rand_xorshift0.4.0
redox_syscall0.5.18
ref-cast1.0.27build script
ref-cast-impl1.0.27proc macro
referencing0.47.0
regalloc20.15.2
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
roxmltree0.20.0
roxmltree0.21.1
rustc-demangle0.1.28
rustc-hash2.1.3
rustix1.1.5build script
rustversion1.0.23build scriptproc macro
ryu1.0.23
same-file1.0.6
schemars1.2.2
schemars_derive1.2.2proc macro
scoped-tls1.0.1
scopeguard1.2.0
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_derive_internals0.30.0
serde_json1.0.151build script
serde_spanned1.1.1
sha20.10.9
sha20.11.0
sharded-slab0.1.7
shlex2.0.1
signal-hook0.3.18build script
signal-hook-mio0.2.5
signal-hook-registry1.4.8
simd-adler320.3.10
slab0.4.12
slotmap1.1.1build script
smallvec1.16.2
spin0.9.9
stable_deref_trait1.2.1
strum0.26.3
strum0.28.0
strum_macros0.26.4proc macro
strum_macros0.28.0proc macro
switchy0.5.0
switchy_async0.5.0
switchy_async_macros0.5.0proc macro
switchy_env0.5.0
switchy_fs0.5.0
switchy_time0.5.0
syn2.0.119
syn3.0.6
synstructure0.14.0
syntect5.3.0
target-lexicon0.13.5build script
termcolor1.4.1
thiserror1.0.69build script
thiserror2.0.21build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.21proc macro
thread_local1.1.10
time0.3.55
time-core0.1.9
time-macros0.2.32proc macro
tinystr0.8.4
tinyvec1.13.3
tokio1.53.2
tokio-macros2.7.2proc macro
tokio-util0.7.19
toml1.1.6+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_edit0.25.15+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
tracing-log0.2.0
tracing-subscriber0.3.23
ttf-parser0.25.1
two-face0.5.2+bat-0.26.1
typenum1.20.1
unarray0.1.4
unicase2.9.0
unicode-general-category1.1.0build script
unicode-ident1.0.26
unicode-segmentation1.13.3
unicode-width0.2.2
url2.5.8
utf8_iter1.0.4
uuid1.27.0
uuid-simd0.8.0
valuable0.1.1build script, not run
version_check0.9.5
vsimd0.8.0
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.129build script, not run
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
wasm-encoder0.258.3
wasmparser0.258.3
wasmprinter0.258.3
wasmtime49.0.3build script
wasmtime-environ49.0.3
wasmtime-internal-component-util49.0.3
wasmtime-internal-core49.0.3build script
wasmtime-internal-cranelift49.0.3build script
wasmtime-internal-fiber49.0.3build script, not run
wasmtime-internal-jit-debug49.0.3build script, not run
wasmtime-internal-jit-icache-coherence49.0.3
wasmtime-internal-unwinder49.0.3build script
wasmtime-internal-versioned-export-macros49.0.3proc macro
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-link0.2.1
windows-sys0.61.2
winnow1.0.4
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
yaml-rust0.4.5
yaml_serde0.10.7
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.59build script
zerocopy-derive0.8.59proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.8
zmij1.0.23build script
mermaid-rs-renderer
Versions1RiskVulnsPublished
0.0.1-alpha.0did not build2d ago

Raw data

capture
983 KB
records
132,240
bytes per record
7.4

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test failure · Generated 2026-10-19 · run c4fea7ab-0208-4fd8-9207-5bfe73052c90

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2