Skip to content
Open-Source Registry

cargo / bombadil-uv-bin

bombadil-uv-bin 0.5.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
285
operations
21K
packages
110
compiler runs
172
connections
3
build time
32s
job time
32s
capture
271 KB
records
37K
bytes / record
7.3

Fetches and embeds a pinned uv binary at build time, for Bombadil.

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

142 downloads · Apache-2.0 · source · home page guipythonuvvenvvirtualenv View on crates.io

Graph

egress · high · in libbombadil_uv_bin.rlib
4

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

3
  • Build script fetched what the build compiled, linked or ran
    bombadil-uv-bin 0.5.0 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Downloaded file compiled into the artifact
    just › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    uv › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
bombadil-uv-bin 0.5.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · bombadil

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-0c481e1287a9a0ba

    subject github.com:443

    by /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-0c481e1287a9a0ba

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build

  3. What a build script's fetch becamesupport

    2 files came down; the build compiled or linked uv, just

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build_script_build-0c481e1287a9a0ba

In libbombadil_uv_bin.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2469
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2469
  3. build-script-build/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build3627

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-19d001cf51bd2936/out/justwritten by build_script_build-0c481e1287a9a0ba
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · bombadil

Witness chain

  1. /home/runner/work/bombadil/bombadil/just-manifest.toml
    source
  2. /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-19d001cf51bd2936/out/justvia /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build_script_build-0c481e1287a9a0ba, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-0c481e1287a9a0ba from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build_script_build-0c481e1287a9a0ba, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-0c481e1287a9a0ba from a network connection without a recorded source compilation

In libbombadil_uv_bin.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2469
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2469
  3. build-script-build/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build3627

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-19d001cf51bd2936/out/uvwritten by build_script_build-0c481e1287a9a0ba
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · bombadil

Witness chain

  1. /home/runner/work/bombadil/bombadil/uv-manifest.toml
    source
  2. /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-19d001cf51bd2936/out/uvvia /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build_script_build-0c481e1287a9a0ba, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-0c481e1287a9a0ba from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build_script_build-0c481e1287a9a0ba, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-0c481e1287a9a0ba from a network connection without a recorded source compilation

In libbombadil_uv_bin.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2469
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2469
  3. build-script-build/home/runner/work/bombadil/bombadil/target/release/build/bombadil-uv-bin-0c481e1287a9a0ba/build-script-build3627

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 bombadil-uv-bin's own build code · build_script_build-0c481e1287a9a0ba (bombadil) · GitHub, Inc. · 2 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 bombadil-uv-bin's own build code · build_script_build-0c481e1287a9a0ba (bombadil) · Fastly, Inc. · 2 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (bombadil) via crates.io · 5,597 files · went into an output ecosystem
Dependencies113Build behaviour
adler22.0.1
base640.23.1
bitflags2.13.1
block-buffer0.12.1
bytes1.12.1
cc1.4.0
cfg-if1.0.4
cfg_aliases0.2.2
combine4.6.7
const-oid0.10.2
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.3.0
crc32fast1.5.0build script
crypto-common0.2.2
digest0.11.3
equivalent1.0.2
errno0.3.14
fastrand2.5.0
filetime0.2.29
find-msvc-tools0.1.9
flate21.1.10
getrandom0.2.17
getrandom0.4.3build script
hashbrown0.17.1
http1.5.0
httparse1.10.1build script
hybrid-array0.4.14
indexmap2.14.0
itoa1.0.18
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
log0.4.33
memchr2.8.3
miniz_oxide0.9.1
nix0.31.3build script, not run
once_cell1.21.4
openssl-probe0.2.1
percent-encoding2.3.2
proc-macro21.0.107build script
quote1.0.47build script
r-efi6.0.0
ring0.17.14build scriptprebuilt objects
rustc_version0.4.1
rustix1.1.4build script
rustls0.23.46build script
rustls-native-certs0.8.4
rustls-pki-types1.15.1
rustls-platform-verifier0.7.1
rustls-platform-verifier-android0.2.0
rustls-webpki0.103.15
same-file1.0.6
schannel0.1.29
security-framework3.7.0
security-framework-sys2.17.0
semver1.0.28
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_spanned1.1.1
sha20.11.1
shlex2.0.1
simd-adler320.3.10
simd_cesu81.2.0
simdutf80.1.5
subtle2.6.1
syn2.0.119
syn3.0.3
tar0.4.46
tempfile3.27.0
thiserror2.0.21build script
thiserror-impl2.0.21proc macro
toml1.1.6+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
typed-path0.12.3
typenum1.20.1
unicode-ident1.0.24
untrusted0.9.0
ureq3.4.2
ureq-proto0.6.4
utf8-zero0.8.1
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
webpki-root-certs1.0.9
webpki-roots1.0.9
winapi-util0.1.11
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.4
xattr1.6.1
zeroize1.9.0
zip9.0.3
zlib-rs0.6.8
Versions9RiskVulnsPublished
0.4.14d ago
0.4.04d ago
0.3.45d ago
0.3.36d ago
0.3.26d ago
0.2.2not analyzed2026-08-04
0.2.0not analyzed2026-08-04
0.1.0not analyzed2026-08-03
0.5.0highnone

Raw data

capture
271 KB
records
37,122
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-20 · run 966ebff8-6900-4535-a47f-573605bb374a

analysis 0.1.0 · 2026-10-19 · 10ce9f4 · graph v2