Skip to content
Open-Source Registry

cargo / bmux_presenter_plugin / 0.0.1-alpha.4

bmux_presenter_plugin 0.0.1-alpha.4

bitbison: no public build not built
processes
444
operations
85K
packages
385
compiler runs
279
connections
2
job time
5m 02s
capture
1.2 MB
records
156K
bytes / record
7.5

Build behaviourundeclared fetchfetch went into the outputread credentialsfetched outside crates.iocompiled C/C++

run 59f7f09d-4531-4490-af7d-071767c72e67 · built 2026-10-18 · complete View on crates.io

This release did not build; nothing below stands for the package.

Graph

secret-exfil · critical
15

Checks

11 of 14 clear Network activity Sensitive data access and transfer +1 more
Build behavior▲▲✓✓✓✓✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

3
  • Credential store contents reached a network peer
    static.crates.io:8080 › static.crates.io:8080
    critical
  • Credential store read by build-time code
    bmux_mermaid_render 0.0.1-alpha.4
    high
  • Build script fetched what the build compiled, linked or ran
    bmux_mermaid_render 0.0.1-alpha.4 › github.com:443
    high

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
static.crates.io:8080
Destination
static.crates.io:8080
Jobs
build-test
Rule
secret-exfil · bmux

Witness chain

  1. /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config
    source
  2. static.crates.io:8080via /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

      Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2477
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2477
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-98bdee6ce44c27c0/build-script-build8149
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…8150

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Credential store read by build-time code

Subject
bmux_mermaid_render 0.0.1-alpha.4
Jobs
build-test
Rule
credential-read · bmux

Evidence

  1. Credential store read by build-time codecause

    Credential store read by build-time code that does not own it: /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    source /home/runner/.cargo/git/checkouts/mermaid-rs-renderer-354b99861d3bc8af/7c06c9a/.git/config

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2477
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2477
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-98bdee6ce44c27c0/build-script-build8149
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…8150

Remediation

Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
bmux_mermaid_render 0.0.1-alpha.4
Destination
github.com:443
Jobs
build-test
Rule
egress · bmux

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by cargo

    subject github.com:443

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

  2. What a build script's fetch becamesupport

    2316 files came down; the build compiled or linked memchr.rs, mod.rs, default_rank.rs +61 more

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-98bdee6ce44c27c0/build-script-build

  4. Tool commandsupport

    Command: /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›cargo

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2477
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2477
  3. build-script-build/home/runner/work/bmux/bmux/target/release/build/bmux_mermaid_render-98bdee6ce44c27c0/build-script-build8149
  4. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --manifest-path Cargo.toml --target wasm32-unknown-unknown --release --locked --…8150

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Network

2 peers
  • github.com:443 build code of bmux_mermaid_render · cargo (bmux) · GitHub, Inc. · 2,316 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (bmux) via crates.io · 24,757 files · went into an output ecosystem
Dependencies407Build behaviour
ab_glyph0.2.32
ab_glyph_rasterizer0.1.10
addr2line0.26.1
adler22.0.1
aho-corasick1.1.4
allocator-api20.2.21
anyhow1.0.104build script
arbitrary1.5.0
arrayref0.3.9
arrayvec0.7.8
async-trait0.1.92proc macro
atomic-waker1.1.2
autocfg1.5.1
base640.22.1
base640.23.1
bincode1.3.3
bit-set0.8.0
bit-vec0.8.0
bitflags2.13.0
block-buffer0.10.4
block-buffer0.12.1
bmux_attach_image_protocol0.0.1-alpha.4
bmux_attach_layout_protocol0.0.1-alpha.4
bmux_broadcast_plugin_api0.0.1-alpha.4
bmux_client0.0.1-alpha.4
bmux_codec0.0.1-alpha.4
bmux_config0.0.1-alpha.4
bmux_config_doc0.0.1-alpha.4
bmux_config_doc_derive0.0.1-alpha.4proc macro
bmux_event_models0.0.1-alpha.4
bmux_fonts0.0.1-alpha.4
bmux_image0.0.1-alpha.4
bmux_ipc0.0.1-alpha.4
bmux_keybind0.0.1-alpha.4
bmux_keyboard0.0.1-alpha.4
bmux_markdown0.0.1-alpha.4
bmux_mermaid_render0.0.1-alpha.4build scriptnetworkruns toolsgithub.com, static.crates.io, git
bmux_perf_telemetry0.0.1-alpha.4
bmux_playbook0.0.1-alpha.4
bmux_playbook_plugin_api0.0.1-alpha.4
bmux_plugin_runtime0.0.1-alpha.4
bmux_plugin_schema0.0.1-alpha.4
bmux_plugin_schema_macros0.0.1-alpha.4proc macro
bmux_plugin_sdk0.0.1-alpha.4
bmux_presenter0.0.1-alpha.4
bmux_presenter_plugin_api0.0.1-alpha.4
bmux_presenter_runtime0.0.1-alpha.4
bmux_scene_protocol0.0.1-alpha.4
bmux_slots0.0.1-alpha.4
bmux_syntax_render0.0.1-alpha.4
bmux_terminal_grid0.0.1-alpha.4
bmux_text_edit0.0.1-alpha.4
bmux_tui0.0.1-alpha.4
bmux_tui_components0.0.1-alpha.4
bmux_tui_runtime0.0.1-alpha.4
bmux_web_host0.0.1-alpha.4build script, not run
bmux_web_renderer0.0.1-alpha.4
bumpalo3.20.3
bytemuck1.25.0
bytemuck_derive1.12.1proc macro
byteorder-lite0.1.0
bytes1.12.1
cc1.2.66
cfg-if1.0.4
cobs0.3.0
color-hex0.2.0proc macro
color_quant1.1.0
colored3.1.1
cpp_demangle0.5.1build script, not run
cpufeatures0.2.17
cpufeatures0.3.0
cranelift-assembler-x640.136.3build script
cranelift-assembler-x64-meta0.136.3
cranelift-bforest0.136.3
cranelift-bitset0.136.3
cranelift-codegen0.136.3build scriptruns toolsgit
cranelift-codegen-meta0.136.3
cranelift-codegen-shared0.136.3
cranelift-control0.136.3
cranelift-entity0.136.3
cranelift-frontend0.136.3
cranelift-isle0.136.3build script
cranelift-native0.136.3
cranelift-srcgen0.136.3
crc32fast1.5.0build script
crossterm0.29.0
crypto-common0.1.7
crypto-common0.2.2
data-url0.3.2
deranged0.5.8
digest0.10.7
digest0.11.3
displaydoc0.2.6proc macro
document-features0.2.12proc macro
either1.16.0
embedded-io0.4.0
embedded-io0.6.1
equivalent1.0.2
errno0.3.14
euclid0.22.14
fancy-regex0.16.2
fastrand2.3.0
fdeflate0.3.7
find-msvc-tools0.1.9
flate21.1.9
float-cmp0.9.0
flume0.12.0
fnv1.0.7
foldhash0.2.0
font-types0.12.7
fontconfig-parser0.5.8
fontdb0.24.0
form_urlencoded1.2.2
free_log_client0.5.0
free_log_models0.2.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-executor0.3.34
futures-io0.3.34
futures-macro0.3.34proc macro
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
gif0.14.2
gimli0.33.0
harfrust0.12.0
hashbrown0.16.1
hashbrown0.17.1
heck0.5.0
html-escape0.2.14
http1.4.2
http-body1.0.1
http-body-util0.1.3
httparse1.10.1build script
hybrid-array0.4.13
hyper1.10.1
hyper-util0.1.20
hyperchad_actions0.5.0
hyperchad_color0.5.0
hyperchad_docs_config0.5.0
hyperchad_markdown0.5.0
hyperchad_transformer0.5.0
hyperchad_transformer_models0.5.0
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
image0.25.10
image-webp0.2.4
imagesize0.15.0
indexmap2.14.0
ipnet2.12.0
itertools0.14.0
itoa1.0.18
js-sys0.3.103
kurbo0.13.1
lazy_static1.5.0
ld-linux-x86-64.so.2system library
leb128fmt0.1.0
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
libyaml-rs0.3.0
linked-hash-map0.5.6
linux-raw-sys0.12.1
litemap0.8.2
litrs1.0.0
lock_api0.4.14
log0.4.33
mach20.6.0
matchers0.2.0
memchr2.8.2
memfd0.6.6
memmap20.9.11
miniz_oxide0.8.9
mio1.2.1
moosicbox_arb0.5.0
moosicbox_assert0.5.0
moosicbox_env_utils0.5.0
moosicbox_logging0.5.0
moxcms0.8.1
nu-ansi-term0.50.3
num-conv0.2.2
num-traits0.2.19build script
object0.40.0
once_cell1.21.4
onig6.5.3
onig_sys69.9.3build script
owned_ttf_parser0.25.1
parking_lot0.12.5
parking_lot_core0.9.12build script
paste1.0.15build scriptproc macro
percent-encoding2.3.2
pico-args0.5.0
pin-project-lite0.2.17
pkg-config0.3.33
plist1.10.0
png0.18.1
polycool0.4.0
postcard1.1.3
potential_utf0.1.5
powerfmt0.2.0
ppv-lite860.2.21
proc-macro21.0.107build script
proptest1.11.0
pulldown-cmark0.13.4build script
pulley-interpreter49.0.3
pulley-macros49.0.3proc macro
pxfm0.1.30
quick-error2.0.1
quick-xml0.41.0
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
rand0.8.5
rand0.9.4
rand_chacha0.3.1
rand_chacha0.9.0
rand_core0.6.4
rand_core0.9.5
rand_xorshift0.4.0
read-fonts0.41.0
redox_syscall0.5.18
regalloc20.15.2
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.13.4
resvg0.48.1
rgb0.8.53
ring0.17.14build scriptprebuilt objects
roxmltree0.20.0
roxmltree0.21.1
rustc-demangle0.1.28
rustc-hash2.1.3
rustix1.1.4build script
rustls0.23.46build script
rustls-pemfile2.2.0
rustls-pki-types1.15.0
rustls-webpki0.103.15
rustversion1.0.23build scriptproc macro
ryu1.0.23
same-file1.0.6
scoped-tls1.0.1
scopeguard1.2.0
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_spanned1.1.1
sha20.10.9
sha20.11.0
sharded-slab0.1.7
shlex2.0.1
signal-hook0.3.18build script
signal-hook-mio0.2.5
signal-hook-registry1.4.8
simd-adler320.3.9
simplecss0.2.2
siphasher1.0.3
skrifa0.44.0
slab0.4.12
slotmap1.1.1build script
smallvec1.15.2
socket20.6.4
spin0.9.8
stable_deref_trait1.2.1
strict-num0.1.1
strum0.26.3
strum0.28.0
strum_macros0.26.4proc macro
strum_macros0.28.0proc macro
subtle2.6.1
svgtypes0.16.1
switchy0.5.0
switchy_async0.5.0
switchy_env0.5.0
switchy_fs0.5.0
switchy_random0.5.0
switchy_time0.5.0
syn2.0.119
syn3.0.3
sync_wrapper1.0.2
synstructure0.13.2
syntect5.3.0
target-lexicon0.13.5build script
tempfile3.27.0
termcolor1.4.1
thiserror1.0.69build script
thiserror2.0.20build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.20proc macro
thread_local1.1.9
time0.3.55
time-core0.1.9
time-macros0.2.32proc macro
tiny-skia0.12.0
tiny-skia-path0.12.0
tinystr0.8.3
tinyvec1.11.0
tinyvec_macros0.1.1
tokio1.53.1
tokio-macros2.7.0proc macro
tokio-rustls0.26.4
tokio-util0.7.19
toml1.1.4+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
tracing-log0.2.0
tracing-subscriber0.3.23
try-lock0.2.5
ttf-parser0.25.1
two-face0.5.2+bat-0.26.1
typenum1.20.1
unarray0.1.4
unicase2.9.0
unicode-bidi0.3.18
unicode-ident1.0.24
unicode-script0.5.8
unicode-segmentation1.13.3
unicode-vo0.1.0
unicode-width0.2.2
untrusted0.9.0
url2.5.8
usvg0.48.1
utf8_iter1.0.4
uuid1.26.1
valuable0.1.1build script, not run
version_check0.9.5
walkdir2.5.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-futures0.4.76
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
wasm-encoder0.258.3
wasmparser0.258.3
wasmprinter0.258.3
wasmtime49.0.3build script
wasmtime-environ49.0.3
wasmtime-internal-component-util49.0.3
wasmtime-internal-core49.0.3build script
wasmtime-internal-cranelift49.0.3build script
wasmtime-internal-fiber49.0.3build script, not run
wasmtime-internal-jit-debug49.0.3build script, not run
wasmtime-internal-jit-icache-coherence49.0.3
wasmtime-internal-unwinder49.0.3build script
wasmtime-internal-versioned-export-macros49.0.3proc macro
web-sys0.3.103
weezl0.1.12
winapi-util0.1.11
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.3
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.3
xmlwriter0.1.0
yaml-rust0.4.5
yaml_serde0.10.7
yoke0.8.3
yoke-derive0.8.2proc macro
zerocopy0.8.53build script
zerocopy-derive0.8.53proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.1
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
zmij1.0.21build script
zune-core0.5.1
zune-jpeg0.5.15
mermaid-rs-renderer
Versions2RiskVulnsPublished
0.0.1-alpha.4did not build1d ago
0.0.1-alpha.3not analyzed1d ago

Raw data

capture
1.2 MB
records
155,753
bytes per record
7.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test failure · Generated 2026-10-18 · run 59f7f09d-4531-4490-af7d-071767c72e67

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2