Skip to content
Open-Source Registry

cargo / buf-tools

buf-tools 1.74.0-rc.1

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskmediumVulnsnone
processes
161
operations
16K
packages
77
compiler runs
1
connections
3
job time
28s
capture
213 KB
records
29K
bytes / record
7.3

Official Buf CLI binaries from bufbuild/buf releases — fetched and verified at build time (see README).

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetched outside crates.iocompiled C/C++

4,414 downloads · MIT · source · home page bufcliprotobufprotocvendored View on crates.io

Graph

egress · medium · in libbuf_tools.rlib
2

Checks

13 of 14 clear Network activity
Build behavior▲✓✓✓✓✓✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

1
  • Build script reached github.com +1
    buf-tools 1.74.0-rc.1 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
buf-tools 1.74.0-rc.1
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · buf-rs

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-262ab167262098cc

    subject github.com:443

    by /home/runner/work/buf-rs/buf-rs/target/release/build/buf-tools-262ab167262098cc/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-262ab167262098cc

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/buf-rs/buf-rs/target/release/build/buf-tools-262ab167262098cc/build-script-build

  3. What a build script's fetch becamesupport

    6 files came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/buf-rs/buf-rs/target/release/build/buf-tools-262ab167262098cc/build_script_build-262ab167262098cc

In libbuf_tools.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/buf-rs/buf-rs/target/release/build/buf-tools-262ab167262098cc/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2474
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2474
  3. build-script-build/home/runner/work/buf-rs/buf-rs/target/release/build/buf-tools-262ab167262098cc/build-script-build3226

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 buf-tools's own build code · build_script_build-262ab167262098cc (buf-rs) · GitHub, Inc. · 6 files undeclared
  • release-assets.githubusercontent.com:443 buf-tools's own build code · build_script_build-262ab167262098cc (buf-rs) · Fastly, Inc. · 6 files undeclared
  • static.crates.io:8080 the package manager · cargo (buf-rs) via crates.io · 4,219 files · went into an output ecosystem
Dependencies78Build behaviour
adler22.0.1
base640.23.1
bitflags2.13.2
block-buffer0.12.1
bytes1.12.1
cc1.9.0
cfg-if1.0.5
const-oid0.10.2
cpufeatures0.3.1
crc32fast1.5.2build script
crypto-common0.2.2
digest0.11.3
errno0.3.14
filetime0.2.29
find-msvc-tools0.1.15
flate21.1.10
getrandom0.2.17
hex0.4.3
http1.5.0
httparse1.10.1build script
hybrid-array0.4.15
itoa1.0.18
ld-linux-x86-64.so.2system library
libc0.2.191build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
log0.4.34
minisign-verify0.2.5
miniz_oxide0.9.1
once_cell1.21.4
percent-encoding2.3.2
proc-macro21.0.107build script, not run
quote1.0.47build script, not run
ring0.17.14build scriptprebuilt objects
rustix1.1.5build script
rustls0.23.46build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
semver1.0.28
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_spanned1.1.2
sha20.11.1
shlex2.0.1
simd-adler320.3.10
subtle2.6.1
syn3.0.9
tar0.4.46
toml1.1.8+spec-1.1.0
toml_datetime1.1.2+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
typenum1.20.1
unicode-ident1.0.27
untrusted0.9.0
ureq3.4.2
ureq-proto0.6.5
utf8-zero0.8.1
wasi0.11.1+wasi-snapshot-preview1
webpki-roots1.0.10
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.4
xattr1.6.1
zeroize1.9.1
zlib-rs0.6.8
Versions39RiskVulnsPublished
1.73.0not analyzed2026-09-21
1.73.0-rc.4not analyzed2026-09-21
1.73.0-rc.3not analyzed2026-09-17
1.73.0-dev.35245318169not analyzed2026-09-17
1.73.0-rc.2not analyzed2026-09-17
1.73.0-dev.35188969967not analyzed2026-09-17
1.73.0-dev.35187061296not analyzed2026-09-17
1.73.0-dev.35185609959not analyzed2026-09-17
1.73.0-dev.35176957884not analyzed2026-09-17
1.73.0-rc.1not analyzed2026-09-16
1.73.0-dev.35161218354not analyzed2026-09-16
1.73.0-dev.35160188908not analyzed2026-09-16
1.73.0-dev.35157490857not analyzed2026-09-16
1.72.0-hotfix.2not analyzed2026-08-25
1.72.0-hotfix.1not analyzed2026-08-19
1.72.0-dev.32286346260not analyzed2026-08-19
1.72.0not analyzed2026-08-10
1.72.0-rc.1not analyzed2026-08-10
1.71.0not analyzed2026-08-10
1.71.0-rc.1not analyzed2026-08-10
1.70.0-hotfix.1not analyzed2026-06-11
1.70.0not analyzed2026-05-28
1.70.0-rc.3not analyzed2026-05-28
1.70.0-rc.2not analyzed2026-05-28
1.70.0-rc.1not analyzed2026-05-28
1.69.0not analyzed2026-05-12
1.69.0-rc.1not analyzed2026-05-12
1.60.0not analyzed2026-05-11
1.60.0-rc.1not analyzed2026-05-11
1.69.0-dev.25644499279not analyzed2026-05-11
1.41.0-dev.25636424869not analyzed2026-05-10
1.41.0-dev.25636102430not analyzed2026-05-10
1.41.0-rc.1not analyzed2026-05-10
1.41.0-dev.25631722424not analyzed2026-05-10
1.40.0not analyzed2026-05-10
1.40.0-rc.1not analyzed2026-05-10
1.40.0-test.25621408293yankednot analyzed2026-05-10
1.40.0-test.25621170766yankednot analyzed2026-05-10
1.74.0-rc.1mediumnone

Raw data

capture
213 KB
records
28,999
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-19 · run 6a294224-a19e-47b1-adf2-7177834424f8

analysis 0.1.0 · 2026-10-19 · 10ce9f4 · graph v2