Skip to content
Open-Source Registry

cargo / bmux_presenter / 0.0.1-alpha.4

bmux_presenter 0.0.1-alpha.4

bitbison: no public build not built
processes
319
operations
59K
packages
249
compiler runs
195
connections
2
job time
4m 33s
capture
770 KB
records
108K
bytes / record
7.1

Build behaviourundeclared fetchfetch went into the outputread credentialsfetched outside crates.iocompiled C/C++

run 3019a5a0-880e-4c85-9347-417e0ca9d76f · built 2026-10-18 · complete View on crates.io

This release did not build; nothing below stands for the package.

Graph

secret-exfil · critical
15

Checks

11 of 14 clear Network activity Sensitive data access and transfer +1 more
Build behavior▲▲✓✓✓✓✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

3
  • Credential store contents reached a network peer
    static.crates.io:8080 › static.crates.io:8080
    critical
  • Credential store read by build-time code
    bmux_mermaid_render 0.0.1-alpha.4
    high
  • Build script fetched what the build compiled, linked or ran
    bmux_mermaid_render 0.0.1-alpha.4 › github.com:443
    high

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
static.crates.io:8080
Destination
static.crates.io:8080
Jobs
build-test
Rule
secret-exfil · bmux

Witness chain

  1. /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config
    source
  2. static.crates.io:8080via /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

      Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast4849
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast4849
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-e652896c2ecd42a0/build-script-build6712
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…6713

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Credential store read by build-time code

Subject
bmux_mermaid_render 0.0.1-alpha.4
Jobs
build-test
Rule
credential-read · bmux

Evidence

  1. Credential store read by build-time codecause

    Credential store read by build-time code that does not own it: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    source /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast4849
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast4849
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-e652896c2ecd42a0/build-script-build6712
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…6713

Remediation

Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
bmux_mermaid_render 0.0.1-alpha.4
Destination
github.com:443
Jobs
build-test
Rule
egress · bmux

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by cargo

    subject github.com:443

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

  2. What a build script's fetch becamesupport

    2374 files came down; the build compiled or linked memchr.rs, mod.rs, default_rank.rs +61 more

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-e652896c2ecd42a0/build_script_build-e652896c2ecd42a0

  4. Tool commandsupport

    Command: /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 4 processes
  1. cargocargo test --release --locked --no-fail-fast4849
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast4849
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-e652896c2ecd42a0/build-script-build6712
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…6713

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Network

2 peers
  • github.com:443 build code of bmux_mermaid_render · cargo (bmux) · GitHub, Inc. · 2,374 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (bmux) via crates.io · 15,292 files · went into an output ecosystem
Dependencies263Build behaviour
ab_glyph0.2.32
ab_glyph_rasterizer0.1.10
addr2line0.26.1
adler22.0.1
aho-corasick1.1.4
allocator-api20.2.21
anyhow1.0.104build script
arbitrary1.5.0
async-trait0.1.92proc macro
autocfg1.5.1
base640.22.1
bincode1.3.3
bit-set0.8.0
bit-vec0.8.0
bitflags2.13.0
block-buffer0.10.4
block-buffer0.12.1
bmux_codec0.0.1-alpha.4
bmux_fonts0.0.1-alpha.4
bmux_keyboard0.0.1-alpha.4
bmux_markdown0.0.1-alpha.4
bmux_mermaid_render0.0.1-alpha.4build scriptnetworkruns toolsgithub.com, static.crates.io, git
bmux_syntax_render0.0.1-alpha.4
bmux_text_edit0.0.1-alpha.4
bmux_tui0.0.1-alpha.4
bmux_tui_components0.0.1-alpha.4
bmux_web_renderer0.0.1-alpha.4
bumpalo3.20.3
bytemuck1.25.0
byteorder-lite0.1.0
cc1.2.66
cfg-if1.0.4
cobs0.3.0
color-hex0.2.0proc macro
colored3.1.1
cpp_demangle0.5.1build script, not run
cpufeatures0.2.17
cpufeatures0.3.0
cranelift-assembler-x640.136.3build script
cranelift-assembler-x64-meta0.136.3
cranelift-bforest0.136.3
cranelift-bitset0.136.3
cranelift-codegen0.136.3build scriptruns toolsgit
cranelift-codegen-meta0.136.3
cranelift-codegen-shared0.136.3
cranelift-control0.136.3
cranelift-entity0.136.3
cranelift-frontend0.136.3
cranelift-isle0.136.3build script
cranelift-native0.136.3
cranelift-srcgen0.136.3
crc32fast1.5.0build script
crypto-common0.1.7
crypto-common0.2.2
deranged0.5.8
digest0.10.7
digest0.11.3
displaydoc0.2.6proc macro
either1.16.0
embedded-io0.4.0
embedded-io0.6.1
equivalent1.0.2
errno0.3.14
fancy-regex0.16.2
fdeflate0.3.7
find-msvc-tools0.1.9
flate21.1.9
fnv1.0.7
foldhash0.2.0
fontconfig-parser0.5.8
fontdb0.24.0
form_urlencoded1.2.2
free_log_client0.5.0
free_log_models0.2.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.3.4build script, not run
gimli0.33.0
hashbrown0.16.1
hashbrown0.17.1
heck0.5.0
html-escape0.2.14
hybrid-array0.4.13
hyperchad_actions0.5.0
hyperchad_color0.5.0
hyperchad_markdown0.5.0
hyperchad_transformer0.5.0
hyperchad_transformer_models0.5.0
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
image0.25.10
indexmap2.14.0
itertools0.14.0
itoa1.0.18
lazy_static1.5.0
ld-linux-x86-64.so.2system library
leb128fmt0.1.0
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
libyaml-rs0.3.0
linked-hash-map0.5.6
linux-raw-sys0.12.1
litemap0.8.2
log0.4.33
mach20.6.0
matchers0.2.0
memchr2.8.2
memfd0.6.6
memmap20.9.11
miniz_oxide0.8.9
moosicbox_arb0.5.0
moosicbox_assert0.5.0
moosicbox_env_utils0.5.0
moosicbox_logging0.5.0
moxcms0.8.1
nu-ansi-term0.50.3
num-conv0.2.2
num-traits0.2.19build script
object0.40.0
once_cell1.21.4
onig6.5.3
onig_sys69.9.3build script
owned_ttf_parser0.25.1
paste1.0.15build scriptproc macro
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.33
plist1.10.0
png0.18.1
postcard1.1.3
potential_utf0.1.5
powerfmt0.2.0
ppv-lite860.2.21
proc-macro21.0.107build script
proptest1.11.0
pulldown-cmark0.13.4build script
pulley-interpreter49.0.3
pulley-macros49.0.3proc macro
pxfm0.1.30
quick-xml0.41.0
quote1.0.47build script
r-efi5.3.0
rand0.9.4
rand_chacha0.9.0
rand_core0.9.5
rand_xorshift0.4.0
regalloc20.15.2
regex-automata0.4.18
regex-syntax0.8.11
roxmltree0.20.0
roxmltree0.21.1
rustc-demangle0.1.28
rustc-hash2.1.3
rustix1.1.4build script
rustversion1.0.23build scriptproc macro
ryu1.0.23
same-file1.0.6
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
sha20.10.9
sha20.11.0
sharded-slab0.1.7
shlex2.0.1
simd-adler320.3.9
slab0.4.12
slotmap1.1.1build script
smallvec1.15.2
stable_deref_trait1.2.1
strum0.26.3
strum0.28.0
strum_macros0.26.4proc macro
strum_macros0.28.0proc macro
switchy_env0.5.0
switchy_time0.5.0
syn2.0.119
syn3.0.3
synstructure0.13.2
syntect5.3.0
target-lexicon0.13.5build script
termcolor1.4.1
thiserror1.0.69build script
thiserror2.0.20build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.20proc macro
thread_local1.1.9
time0.3.55
time-core0.1.9
time-macros0.2.32proc macro
tinystr0.8.3
tinyvec1.11.0
tinyvec_macros0.1.1
tokio1.53.1
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
tracing-log0.2.0
tracing-subscriber0.3.23
ttf-parser0.25.1
two-face0.5.2+bat-0.26.1
typenum1.20.1
unarray0.1.4
unicase2.9.0
unicode-ident1.0.24
unicode-segmentation1.13.3
unicode-width0.2.2
url2.5.8
utf8_iter1.0.4
valuable0.1.1build script, not run
version_check0.9.5
walkdir2.5.0
wasip21.0.4+wasi-0.2.12
wasm-encoder0.258.3
wasmparser0.258.3
wasmprinter0.258.3
wasmtime49.0.3build script
wasmtime-environ49.0.3
wasmtime-internal-component-util49.0.3
wasmtime-internal-core49.0.3build script
wasmtime-internal-cranelift49.0.3build script
wasmtime-internal-fiber49.0.3build script, not run
wasmtime-internal-jit-debug49.0.3build script, not run
wasmtime-internal-jit-icache-coherence49.0.3
wasmtime-internal-unwinder49.0.3build script
wasmtime-internal-versioned-export-macros49.0.3proc macro
winapi-util0.1.11
windows-link0.2.1
windows-sys0.61.2
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.3
yaml-rust0.4.5
yaml_serde0.10.7
yoke0.8.3
yoke-derive0.8.2proc macro
zerocopy0.8.53build script, not run
zerocopy-derive0.8.53proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.1
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
zmij1.0.21build script
mermaid-rs-renderer
Versions2RiskVulnsPublished
0.0.1-alpha.4did not build23h ago
0.0.1-alpha.3not analyzed1d ago

Raw data

capture
770 KB
records
107,839
bytes per record
7.1

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test failure · Generated 2026-10-18 · run 3019a5a0-880e-4c85-9347-417e0ca9d76f

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2