Skip to content
Open-Source Registry

cargo / bmux_mermaid_render / 0.0.1-alpha.4

bmux_mermaid_render 0.0.1-alpha.4

bitbison: no public build not built
processes
305
operations
35K
packages
119
compiler runs
31
connections
2
job time
4m 04s
capture
443 KB
records
64K
bytes / record
6.9

Build behaviourits build script reached github.com, static.crates.ioits build script ran gitundeclared fetchfetch went into the outputfetched outside crates.iocompiled C/C++

run 5b8524b6-0fbe-4d2c-9d14-d1f5a57be382 · built 2026-10-18 · complete View on crates.io

This release did not build; nothing below stands for the package.

Graph

secret-exfil · critical
9

Checks

11 of 14 clear Network activity Sensitive data access and transfer +1 more
Build behavior▲▲✓✓✓✓✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Credential store contents reached a network peer
    static.crates.io:8080 › static.crates.io:8080
    critical
  • Build script fetched what the build compiled, linked or ran
    bmux_mermaid_render 0.0.1-alpha.4 › github.com:443
    high

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
static.crates.io:8080
Destination
static.crates.io:8080
Jobs
build-test
Rule
secret-exfil · bmux

Witness chain

  1. /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config
    source
  2. static.crates.io:8080via /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

      Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast4313
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast4313
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-772aeaaca4a3992d/build-script-build4949
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…4950

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
bmux_mermaid_render 0.0.1-alpha.4
Destination
github.com:443
Jobs
build-test
Rule
egress · bmux

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by cargo

    subject github.com:443

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

  2. What a build script's fetch becamesupport

    2294 files came down; the build compiled or linked lib.rs, tables.rs, attr.rs +42 more

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-772aeaaca4a3992d/build_script_build-772aeaaca4a3992d

  4. Tool commandsupport

    Command: /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast4313
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast4313
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-772aeaaca4a3992d/build-script-build4949
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…4950

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Network

2 peers
  • github.com:443 bmux_mermaid_render's own build code · cargo (bmux) · GitHub, Inc. · 2,294 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (bmux) via crates.io · 7,962 files · went into an output ecosystem
Dependencies124Build behaviour
ab_glyph0.2.32
ab_glyph_rasterizer0.1.10
addr2line0.26.1
allocator-api20.2.21
anyhow1.0.104build script
arbitrary1.5.0
async-trait0.1.92proc macro
bitflags2.13.2
block-buffer0.10.4
bmux_fonts0.0.1-alpha.4
bumpalo3.20.3
cc1.8.0
cfg-if1.0.5
cobs0.3.0
cpp_demangle0.5.1build script, not run
cpufeatures0.2.17
cranelift-assembler-x640.136.3build script
cranelift-assembler-x64-meta0.136.3
cranelift-bforest0.136.3
cranelift-bitset0.136.3
cranelift-codegen0.136.3build scriptruns toolsgit
cranelift-codegen-meta0.136.3
cranelift-codegen-shared0.136.3
cranelift-control0.136.3
cranelift-entity0.136.3
cranelift-frontend0.136.3
cranelift-isle0.136.3build script
cranelift-native0.136.3
cranelift-srcgen0.136.3
crc32fast1.5.2build script
crypto-common0.1.7
digest0.10.7
either1.19.0
embedded-io0.4.0
embedded-io0.6.1
equivalent1.0.3
errno0.3.14
find-msvc-tools0.1.14
fnv1.0.7
foldhash0.2.0
fontconfig-parser0.5.8
fontdb0.24.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
gimli0.33.0
hashbrown0.16.1
hashbrown0.17.1
heck0.5.0
indexmap2.14.2
itertools0.14.0
ld-linux-x86-64.so.2system library
leb128fmt0.1.0
libc0.2.191build script
libc.so.6system library
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
log0.4.34
mach20.6.0
memchr2.8.3
memfd0.6.6
memmap20.9.11
object0.40.0
once_cell1.21.4
owned_ttf_parser0.25.1
pin-project-lite0.2.17
postcard1.1.3
proc-macro21.0.107build script
pulley-interpreter49.0.3
pulley-macros49.0.3proc macro
quote1.0.47build script
regalloc20.15.2
roxmltree0.20.0
roxmltree0.21.1
rustc-demangle0.1.28
rustc-hash2.1.3
rustix1.1.5build script
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
sha20.10.9
shlex2.0.1
slab0.4.12
slotmap1.1.1build script
smallvec1.16.3
stable_deref_trait1.2.1
syn2.0.119
syn3.0.9
target-lexicon0.13.5build script
termcolor1.4.1
thiserror2.0.21build script
thiserror-impl2.0.21proc macro
tinyvec1.13.3
tokio1.53.3
ttf-parser0.25.1
typenum1.20.1
unicode-ident1.0.27
version_check0.9.5
wasm-encoder0.258.3
wasmparser0.258.3
wasmprinter0.258.3
wasmtime49.0.3build script
wasmtime-environ49.0.3
wasmtime-internal-component-util49.0.3
wasmtime-internal-core49.0.3build script
wasmtime-internal-cranelift49.0.3build script
wasmtime-internal-fiber49.0.3build script, not run
wasmtime-internal-jit-debug49.0.3build script, not run
wasmtime-internal-jit-icache-coherence49.0.3
wasmtime-internal-unwinder49.0.3build script
wasmtime-internal-versioned-export-macros49.0.3proc macro
winapi-util0.1.11
windows-link0.2.1
windows-sys0.61.2
mermaid-rs-renderer
Versions2RiskVulnsPublished
0.0.1-alpha.4did not build1d ago
0.0.1-alpha.3not analyzed1d ago

Raw data

capture
443 KB
records
64,424
bytes per record
6.9

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test failure · Generated 2026-10-18 · run 5b8524b6-0fbe-4d2c-9d14-d1f5a57be382

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2