Skip to content
Open-Source Registry

cargo / buf-toolchain / 1.74.0-rc.1

buf-toolchain 1.74.0-rc.1

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskmediumVulnsnone
processes
269
operations
28K
packages
109
compiler runs
211
connections
3
job time
1m 05s
capture
339 KB
records
50K
bytes / record
6.7

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetched outside crates.iocompiled C/C++

run ffcf3925-a41b-477c-90d7-f92863b19695 · built 2026-10-20 · complete View on crates.io

Graph

egress · medium · in validate_cargo_buf_toolchain
3

Checks

13 of 14 clear Network activity
Build behavior▲✓✓✓✓✓✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

1
  • Build script reached github.com +1
    buf-toolchain 1.74.0-rc.1 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
buf-toolchain 1.74.0-rc.1
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
validate_cargo_buf_toolchain-a52ed1f3d83c73ebmember
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build-script-build

    subject github.com:443

    by /home/runner/work/buf-rs/buf-rs/target/release/build/buf-toolchain-6c3e7d68b0be91dd/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build-script-build

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/buf-rs/buf-rs/target/release/build/buf-toolchain-6c3e7d68b0be91dd/build-script-build

  3. What a build script's fetch becamesupport

    6 files came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/buf-rs/buf-rs/target/release/build/buf-toolchain-6c3e7d68b0be91dd/build-script-build

In validate_cargo_buf_toolchain

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/buf-rs/buf-rs/target/release/build/buf-toolchain-6c3e7d68b0be91dd/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2467
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2467
  3. build-script-build/home/runner/work/buf-rs/buf-rs/target/release/build/buf-toolchain-6c3e7d68b0be91dd/build-script-build4475

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 buf-toolchain's own build code · build-script-build · GitHub, Inc. · 6 files undeclared
  • release-assets.githubusercontent.com:443 buf-toolchain's own build code · build-script-build · Fastly, Inc. · 6 files undeclared
  • static.crates.io:8080 the package manager · cargo (buf-rs) via crates.io · 6,362 files · went into an output ecosystem
Dependencies110Build behaviour
aho-corasick1.1.5
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
base640.23.1
block-buffer0.12.1
bytes1.12.1
cfg-if1.0.5
clap4.6.7
clap_builder4.6.7
clap_lex1.1.1
colorchoice1.0.5
const-oid0.10.2
cpufeatures0.3.1
crc32fast1.5.2build script
crypto-common0.2.2
digest0.11.3
equivalent1.0.3
flate21.1.10
getrandom0.2.17
hashbrown0.17.1
hex0.4.3
http1.5.0
httparse1.10.1build script
hybrid-array0.4.15
indexmap2.14.2
is_terminal_polyfill1.70.2
itoa1.0.18
ld-linux-x86-64.so.2system library
libc0.2.191build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
log0.4.34
memchr2.8.3
minisign-verify0.2.5
miniz_oxide0.9.1
noyalib0.0.58build script
percent-encoding2.3.2
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.3
rustls0.23.46build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
ryu1.0.23
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_ignored0.1.14
serde_json1.0.154build script
sha20.11.1
simd-adler320.3.10
smallvec1.16.3
strsim0.11.1
subtle2.6.1
typenum1.20.1
untrusted0.9.0
ureq3.4.2
ureq-proto0.6.5
utf8-zero0.8.1
utf8parse0.2.2
webpki-roots1.0.10
zeroize1.9.1
zmij1.0.23build script
adler22.0.1
libm0.2.16build script
once_cell1.21.4
anstyle-wincon3.0.11
bitflags2.13.2
cc1.9.0
clap_derive4.6.7proc macro
errno0.3.14
filetime0.2.29
find-msvc-tools0.1.15
heck0.5.0
linux-raw-sys0.12.1
once_cell_polyfill1.70.2
proc-macro21.0.107build script
quote1.0.47build script
rustix1.1.5build script
serde_derive1.0.229proc macro
serde_spanned1.1.2
shlex2.0.1
syn3.0.9
tar0.4.46
toml1.1.8+spec-1.1.0
toml_datetime1.1.2+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
unicode-ident1.0.27
wasi0.11.1+wasi-snapshot-preview1
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.4
xattr1.6.1
zlib-rs0.6.8
Versions39RiskVulnsPublished
1.73.0not analyzed2026-09-21
1.73.0-rc.4not analyzed2026-09-21
1.73.0-rc.3not analyzed2026-09-17
1.73.0-dev.35245318169not analyzed2026-09-17
1.73.0-rc.2not analyzed2026-09-17
1.73.0-dev.35188969967not analyzed2026-09-17
1.73.0-dev.35187061296not analyzed2026-09-17
1.73.0-dev.35185609959not analyzed2026-09-17
1.73.0-dev.35176957884not analyzed2026-09-17
1.73.0-rc.1not analyzed2026-09-16
1.73.0-dev.35161218354not analyzed2026-09-16
1.73.0-dev.35160188908not analyzed2026-09-16
1.73.0-dev.35157490857not analyzed2026-09-16
1.72.0-hotfix.2not analyzed2026-08-25
1.72.0-hotfix.1not analyzed2026-08-19
1.72.0-dev.32286346260not analyzed2026-08-19
1.72.0not analyzed2026-08-10
1.72.0-rc.1not analyzed2026-08-10
1.71.0not analyzed2026-08-10
1.71.0-rc.1not analyzed2026-08-10
1.70.0-hotfix.1not analyzed2026-06-11
1.70.0not analyzed2026-05-28
1.70.0-rc.3not analyzed2026-05-28
1.70.0-rc.2not analyzed2026-05-28
1.70.0-rc.1not analyzed2026-05-28
1.69.0not analyzed2026-05-12
1.69.0-rc.1not analyzed2026-05-12
1.60.0not analyzed2026-05-11
1.60.0-rc.1not analyzed2026-05-11
1.69.0-dev.25644499279not analyzed2026-05-11
1.41.0-dev.25636424869not analyzed2026-05-10
1.41.0-dev.25636102430not analyzed2026-05-10
1.41.0-rc.1not analyzed2026-05-10
1.41.0-dev.25631722424not analyzed2026-05-10
1.40.0not analyzed2026-05-10
1.40.0-rc.1not analyzed2026-05-10
1.40.0-test.25621408293yankednot analyzed2026-05-10
1.40.0-test.25621170766yankednot analyzed2026-05-10
1.74.0-rc.1mediumnone

Raw data

capture
339 KB
records
50,336
bytes per record
6.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-20 · run ffcf3925-a41b-477c-90d7-f92863b19695

analysis 0.1.0 · 2026-10-19 · 10ce9f4 · graph v2