Skip to content
Open-Source Registry

cargo / bombadil

bombadil 0.4.0

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnslow
processes
418
operations
87K
packages
455
compiler runs
559
connections
3
job time
5m 28s
capture
1.2 MB
records
159K
bytes / record
7.5

A desktop keeper for uv virtual environments. Install this one: it brings the whole application.

Build behaviourundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

46 downloads · source · home page guipythonuvvenvvirtualenv View on crates.io

Graph

egress · high · in bombadil
3

Checks

10 of 14 clear Network activity Data flow analysis +2 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲▲✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    bombadil-uv-bin 0.4.0 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Downloaded file compiled into the artifact
    uv › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
bombadil-uv-bin 0.4.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
bombadil-2ba5f862ecacb866member
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-4ae6f22fa3cd68f7

    subject github.com:443

    by /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-4ae6f22fa3cd68f7

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build-script-build

  3. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked uv

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build_script_build-4ae6f22fa3cd68f7

In bombadil

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2475
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2475
  3. build-script-build/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build-script-build8496

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-e29763012bff74fc/out/uvwritten by build_script_build-4ae6f22fa3cd68f7
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · bombadil

Witness chain

  1. static.crates.io:8080
    source
  2. /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/bombadil-uv-bin-0.4.0/uv-manifest.tomlvia /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo fetch --locked
  3. /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-e29763012bff74fc/out/uvvia /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build_script_build-4ae6f22fa3cd68f7, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-4ae6f22fa3cd68f7 from a network connection without a recorded source compilation

    subject
  4. bombadil-2ba5f862ecacb866member
    artifact

Evidence

  • written under the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build_script_build-4ae6f22fa3cd68f7, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-4ae6f22fa3cd68f7 from a network connection without a recorded source compilation

In bombadil

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2475
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2475
  3. build-script-build/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-4ae6f22fa3cd68f7/build-script-build8496

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of bombadil-uv-bin · build_script_build-4ae6f22fa3cd68f7 · GitHub, Inc. · 1 file · went into an output undeclared
  • release-assets.githubusercontent.com:443 build code of bombadil-uv-bin · build_script_build-4ae6f22fa3cd68f7 · Fastly, Inc. · 1 file · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (bombadil) via crates.io · 25,430 files · went into an output ecosystem
Vulnerabilities4PackageFixSeverity
RUSTSEC-2026-0253lru 0.16.4>=0.18.2low
RUSTSEC-2026-0192ttf-parser 0.25.1none publishedlow
RUSTSEC-2026-0371zbus_names 4.3.4none publishedlow
RUSTSEC-2026-0370zvariant 5.13.1none publishedlow
Dependencies509Build behaviour
ab_glyph0.2.32
ab_glyph_rasterizer0.1.10
aes0.8.4
ahash0.8.12build script
arrayref0.3.9
arrayvec0.7.8
as-raw-xcb-connection1.0.1
ash0.38.0+1.3.281build script
async-broadcast0.7.2
async-channel2.5.0
async-executor1.14.0
async-io2.6.0build script
async-lock3.4.2
async-process2.5.0
async-signal0.2.14
async-task4.7.1
atomic-waker1.1.2
base640.23.1
bit-set0.8.0
bit-vec0.8.0
bitflags2.13.1
block-buffer0.10.4
block-buffer0.12.1
block-padding0.3.3
blocking1.6.2
bombadil-core0.4.0
bombadil-gui0.4.0
bombadil-uv-bin0.4.0build scriptnetworkgithub.com, release-assets.githubusercontent.com
bytemuck1.25.2
bytes1.12.1
calloop0.13.0
calloop0.14.4
calloop-wayland-source0.3.0
calloop-wayland-source0.4.1
cbc0.1.2
cfg-if1.0.4
cipher0.4.4
clipboard_wayland0.2.2
clipboard_x110.4.3
codespan-reporting0.12.0
concurrent-queue2.5.0
const-oid0.10.2
core_maths0.1.1
cosmic-text0.15.0
cpufeatures0.2.17
cpufeatures0.3.0
crc32fast1.5.0build script
crossbeam-utils0.8.22build script
cryoglyph0.1.0
crypto-common0.1.7
crypto-common0.2.2
ctor0.10.1
cursor-icon1.2.0
digest0.10.7
digest0.11.3
directories6.0.0
dirs-sys0.5.0
dlib0.5.3
downcast-rs1.2.1
dpi0.1.2
endi1.1.1
enumflags20.7.12
equivalent1.0.2
errno0.3.14
etagere0.2.15
euclid0.22.14
event-listener5.4.2
event-listener-strategy0.5.4
fastrand2.5.0
flate21.1.10
float_next_after1.0.0
foldhash0.1.5
foldhash0.2.0
font-types0.10.1
font-types0.12.1
fontconfig-parser0.5.8
fontdb0.23.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-executor0.3.34
futures-io0.3.34
futures-lite2.6.1
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
gethostname1.1.0
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
glam0.25.0
glow0.16.0
gpu-alloc0.6.2
gpu-alloc-types0.3.1
gpu-descriptor0.3.2
gpu-descriptor-types0.2.0
half2.7.1
harfrust0.3.2
hashbrown0.15.5
hashbrown0.16.1
hashbrown0.17.1
hex0.4.3
hexf-parse0.2.1
hkdf0.12.4
hmac0.12.1
http1.5.0
httparse1.10.1build script
hybrid-array0.4.14
iced0.14.0
iced_core0.14.0
iced_debug0.14.0
iced_futures0.14.0
iced_graphics0.14.0
iced_program0.14.0
iced_renderer0.14.0
iced_runtime0.14.0
iced_tiny_skia0.14.0
iced_wgpu0.14.0
iced_widget0.14.2
iced_winit0.14.0
indexmap2.14.0
inout0.1.4
itoa1.0.18
keyring4.2.0
keyring-core1.0.0
khronos-egl6.0.0build script
ksni0.3.6
kurbo0.10.4
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
lilt0.8.2
linebender_resource_handle0.1.1
linux-raw-sys0.12.1
linux-raw-sys0.4.15
lock_api0.4.14
log0.4.33
lru0.16.4
lyon1.0.19
lyon_algorithms1.0.21
lyon_geom1.0.19
lyon_path1.0.19
lyon_tessellation1.0.22
memchr2.8.3
memmap20.9.11
miniz_oxide0.9.1
mundy0.2.3build script
naga27.0.3build script
notify-rust4.17.0
num0.4.3
num-bigint0.4.8
num-complex0.4.6
num-integer0.1.46
num-iter0.1.46
num-rational0.4.2
num-traits0.2.19build script
once_cell1.21.4
openssl-probe0.2.1
option-ext0.2.0
ordered-float5.3.0
ordered-stream0.2.0
owned_ttf_parser0.25.1
parking2.2.1
parking_lot0.12.5
parking_lot_core0.9.12build script
percent-encoding2.3.2
pin-project-lite0.2.17
piper0.2.5
polling3.11.0
pollster0.4.0
proc-macro21.0.107build script
profiling1.0.18
quote1.0.47build script
rangemap1.7.1
raw-window-handle0.6.2
read-fonts0.35.0
read-fonts0.41.0
renderdoc-sys1.1.0
rfd0.17.2build script
ring0.17.14build scriptprebuilt objects
roxmltree0.20.0
rustc-hash1.1.0
rustc-hash2.1.3
rustix0.38.44build script
rustix1.1.4build script
rustls0.23.46build script
rustls-native-certs0.8.4
rustls-pki-types1.15.1
rustls-platform-verifier0.7.1
rustls-webpki0.103.15
scoped-tls1.0.1
scopeguard1.2.0
sctk-adwaita0.10.1
secret-service5.1.0
self_cell1.3.0
serde1.0.229build script
serde_core1.0.229build script
serde_json1.0.154build script
serde_spanned1.1.1
sha20.10.9
sha20.11.1
signal-hook-registry1.4.8
simd-adler320.3.10
skrifa0.37.0
skrifa0.44.0
slab0.4.12
slotmap1.1.1build script
smallvec1.15.2
smithay-client-toolkit0.19.2build script
smithay-client-toolkit0.20.0build script
smithay-clipboard0.7.3
smol_str0.2.2
softbuffer0.4.8
spirv0.3.0+sdk-1.3.268.0
static_assertions1.1.0
strict-num0.1.1
subtle2.6.1
svg_fmt0.4.5
swash0.2.10
syn2.0.119
sys-locale0.3.2
task-local0.1.1
tempfile3.27.0
thiserror1.0.69build script
thiserror2.0.21build script
tiny-skia0.11.4
tiny-skia-path0.11.4
tiny-xlib0.2.5build script
tinyvec1.12.0
tinyvec_macros0.1.1
toml1.1.6+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
tracing0.1.44
tracing-core0.1.36
ttf-parser0.25.1
typenum1.20.1
unicode-bidi0.3.18
unicode-ident1.0.24
unicode-linebreak0.1.5
unicode-script0.5.8
unicode-segmentation1.13.3
unicode-width0.2.2
untrusted0.9.0
ureq3.4.2
ureq-proto0.6.4
utf8-zero0.8.1
uuid1.26.1
wayland-backend0.3.16build script
wayland-client0.31.15build script
wayland-csd-frame0.3.0
wayland-cursor0.31.14
wayland-protocols0.32.13
wayland-protocols-experimental20250721.0.1
wayland-protocols-misc0.3.12
wayland-protocols-plasma0.3.12
wayland-protocols-wlr0.3.12
wayland-sys0.31.11build script
web-time1.1.0
webpki-roots1.0.9
wgpu27.0.1build script
wgpu-core27.0.3build script
wgpu-hal27.0.4build script
wgpu-types27.0.1
window_clipboard0.5.1
winit0.30.13build script
winnow1.0.4
x11-dl2.21.0build script
x11rb0.13.2
x11rb-protocol0.13.2
xcursor0.3.11
xkbcommon-dl0.4.2
xkeysym0.2.1
yazi0.2.1
zbus5.18.0
zbus-secret-service-keyring-store1.0.0
zbus_names4.3.4
zeno0.3.3
zerocopy0.8.55build script
zeroize1.9.0
zmij1.0.23build script
zvariant5.13.1
zvariant_utils3.5.0
adler22.0.1
guillotiere0.6.2
wgpu-core-deps-windows-linux-android27.0.0
aho-corasick1.1.4
android-activity0.6.1build script, not run
android-build0.1.4
android-properties0.2.2
android_system_properties0.1.5
apple-native-keyring-store1.0.1
async-recursion1.1.1proc macro
async-trait0.1.91proc macro
autocfg1.5.1
bitflags1.3.2
block0.1.6
block20.5.1
block20.6.2
bumpalo3.20.3
bytemuck_derive1.11.0proc macro
byteorder1.5.0
cc1.4.0
cfg_aliases0.2.2
clipboard-win5.4.1
clipboard_macos0.1.1
combine4.6.7
core-foundation0.10.1
core-foundation0.9.4
core-foundation-sys0.8.7
core-graphics0.23.2
core-graphics-types0.1.3
core-graphics-types0.2.0
crossbeam-channel0.5.16
crunchy0.2.4build script, not run
deranged0.5.9
dirs6.0.0
dispatch0.2.0
dispatch20.3.1
document-features0.2.12proc macro
dtor0.8.1
enumflags2_derive0.7.12proc macro
error-code3.3.2
fdeflate0.3.7
filetime0.2.29
find-msvc-tools0.1.9
foreign-types0.5.0
foreign-types-macros0.2.4proc macro
foreign-types-shared0.3.1
futures-macro0.3.34proc macro
gl_generator0.14.0
glutin_wgl_sys0.6.1build script, not run
gpu-allocator0.27.0
hermit-abi0.5.2
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.3.1build script, not run
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
jobserver0.1.35
js-sys0.3.103
keyboard-types0.7.0
khronos_api3.1.0build script, not run
libredox0.1.18
litrs1.0.0
mac-notification-sys0.6.15build script, not run
malloc_buf0.0.6
memoffset0.9.1build script, not run
metal0.32.0
miniz_oxide0.8.9
muda0.19.3
ndk0.9.0
ndk-context0.1.1
ndk-sys0.6.0+11769913
nix0.31.3build script, not run
num-conv0.2.2
num_enum0.7.6
num_enum_derive0.7.6proc macro
objc0.2.7
objc-sys0.3.5build script, not run
objc20.5.2
objc20.6.5build script, not run
objc2-app-kit0.2.2
objc2-app-kit0.3.2
objc2-cloud-kit0.2.2
objc2-cloud-kit0.3.2
objc2-contacts0.2.2
objc2-core-data0.2.2
objc2-core-data0.3.2
objc2-core-foundation0.3.2
objc2-core-graphics0.3.2
objc2-core-image0.2.2
objc2-core-image0.3.2
objc2-core-location0.2.2
objc2-core-text0.3.2
objc2-core-video0.3.2
objc2-encode4.1.0
objc2-foundation0.2.2
objc2-foundation0.3.2
objc2-io-surface0.3.2
objc2-link-presentation0.2.2
objc2-metal0.2.2
objc2-quartz-core0.2.2
objc2-quartz-core0.3.2
objc2-symbols0.2.2
objc2-ui-kit0.2.2
objc2-uniform-type-identifiers0.2.2
objc2-user-notifications0.2.2
orbclient0.3.55build script, not run
paste1.0.15build script, not runproc macro
pastey0.2.3proc macro
pin-project1.1.13
pin-project-internal1.1.13proc macro
pin-utils0.1.0
pkg-config0.3.33
plain0.2.3
png0.18.1
portable-atomic1.14.0build script, not run
portable-atomic-util0.2.7build script, not run
powerfmt0.2.1
presser0.3.1
proc-macro-crate3.5.0
quick-xml0.41.0
r-efi5.3.0
r-efi6.0.0
range-alloc0.1.5
redox_syscall0.4.1
redox_syscall0.5.18
redox_syscall0.9.1
redox_users0.5.2
regex1.13.1
regex-automata0.4.16
regex-syntax0.8.11
rustc_version0.4.1
rustls-platform-verifier-android0.2.0
rustversion1.0.23build script, not runproc macro
same-file1.0.6
schannel0.1.29
security-framework3.7.0
security-framework-sys2.17.0
semver1.0.28
serde_derive1.0.229proc macro
serde_repr0.1.21proc macro
shlex2.0.1
simd_cesu81.2.0
simdutf80.1.5
syn3.0.3
tar0.4.46
tauri-winrt-notification0.7.3
termcolor1.4.1
thiserror-impl1.0.69proc macro
thiserror-impl2.0.21proc macro
time0.3.55
time-core0.1.9
toml_edit0.25.13+spec-1.1.0
tracing-attributes0.1.31proc macro
tray-icon0.24.2
typed-path0.12.3
uds_windows1.2.1
version_check0.9.5
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-futures0.4.76
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
wasmtimer0.4.3
wayland-scanner0.31.11proc macro
web-sys0.3.103
webpki-root-certs1.0.9
wgpu-core-deps-apple27.0.0
wgpu-core-deps-emscripten27.0.0
winapi-util0.1.11
windows0.58.0
windows0.61.3
windows0.62.2
windows-collections0.2.0
windows-collections0.3.2
windows-core0.58.0
windows-core0.61.2
windows-core0.62.2
windows-future0.2.1
windows-future0.3.2
windows-implement0.58.0proc macro
windows-implement0.60.2proc macro
windows-interface0.58.0proc macro
windows-interface0.59.3proc macro
windows-link0.1.3
windows-link0.2.1
windows-native-keyring-store1.1.0
windows-numerics0.2.0
windows-numerics0.3.1
windows-result0.2.0
windows-result0.3.4
windows-result0.4.1
windows-strings0.1.0
windows-strings0.4.2
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows-threading0.1.0
windows-threading0.2.1
windows-version0.1.7
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
xattr1.6.1
xml-rs0.8.28
zbus_macros5.18.0proc macro
zerocopy-derive0.8.55proc macro
zip9.0.3
zlib-rs0.6.8
zvariant_derive5.13.1proc macro
Versions3RiskVulnsPublished
0.2.2not analyzed2026-08-04
0.2.0not analyzed2026-08-04
0.4.0highlow

Raw data

capture
1.2 MB
records
158,629
bytes per record
7.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run fca89fe0-00b2-47a0-9398-2acda977a996

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2