Skip to content
Open-Source Registry

cargo / car-vision / 0.58.0

car-vision 0.58.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
266
operations
51K
packages
223
compiler runs
128
connections
2
job time
2m 31s
capture
682 KB
records
94K
bytes / record
7.3

Build behaviourhas a build scriptfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 90ba34f4-4cef-4179-aabe-d7921429dd98 · built 2026-10-15 · complete

Graph

egress · medium · in libcar_vision.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Build script reached cdn.pyke.io
    ort-sys 2.0.0-rc.10 › cdn.pyke.io:443
    medium
  • Prebuilt library downloaded by a build script from its documented source
    libonnxruntime.a › cdn.pyke.io
    medium

Detection

mediumwitnessed

Build script reached cdn.pyke.io

Unexpected network connection

Subject
ort-sys 2.0.0-rc.10
Destination
cdn.pyke.io:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to cdn.pyke.io:443, opened by build-script-build

    subject cdn.pyke.io:443

    by /home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build

  2. What a build script's fetch becamesupport

    2 files came down; the build compiled or linked libonnxruntime.a

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build

  4. Build script fetched what its crate documents it fetchessupport

    ort-sys's build script fetches a prebuilt ONNX Runtime from cdn.pyke.io: ort's default `download-binaries` feature fetches pyke's prebuilt from its CDN

In libcar_vision.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2517
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2517
  3. build-script-build/home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build4622

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Detection

mediumwitnessed

Prebuilt library downloaded by a build script from its documented source

Object file origin needs review

Subject
/home/runner/.cache/ort.pyke.io/dfbin/x86_64-unknown-linux-gnu/ED1716DE95974BF47AB0223CA33734A0B5A5D09A181225D0E8ED62D070AEA893/onnxruntime/lib/libonnxruntime.awritten by build-script-build
Destination
cdn.pyke.io
Jobs
build-test
Rule
object-provenance

Witness chain

  1. cdn.pyke.io:443
    source
  2. /home/runner/.cache/ort.pyke.io/dfbin/x86_64-unknown-linux-gnu/ED1716DE95974BF47AB0223CA33734A0B5A5D09A181225D0E8ED62D070AEA893/onnxruntime/lib/libonnxruntime.avia /home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build
    • Object written under a build script that downloadedfrom cdn.pyke.io

      written under the build script at /home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build, which downloaded from cdn.pyke.io

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      ort-sys asked the linker for it: static onnxruntime (target/release/build/ort-sys-4ca8ef67efd1d950/output)

    subject
  3. dependency
    artifact

Evidence

  1. Build script fetched what its crate documents it fetchessupport

    ort-sys's build script fetches a prebuilt ONNX Runtime from cdn.pyke.io: ort's default `download-binaries` feature fetches pyke's prebuilt from its CDN

In libcar_vision.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2517
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2517
  3. build-script-build/home/runner/work/car/car/target/release/build/ort-sys-72db4a234d4b8d4d/build-script-build4622

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • cdn.pyke.io:443 build code of ort-sys · build-script-build · Cloudflare, Inc. · 2 files · went into an output documented
  • static.crates.io:8080 the package manager · cargo (car) via crates.io · 16,864 files · went into an output ecosystem
Dependencies232Build behaviour
adler22.0.1
atomic-waker1.1.2
autocfg1.5.1
base640.22.1
base640.23.1
base64ct1.8.3
bitflags2.13.1
block-buffer0.10.4
bumpalo3.20.3
bytemuck1.25.2
byteorder1.5.0
byteorder-lite0.1.0
bytes1.12.1
cc1.4.4
cfg-if1.0.4
cfg_aliases0.2.2
chacha200.10.2
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.1build script
crypto-common0.1.7
der0.8.1
digest0.10.7
dirs6.0.0
dirs-sys0.5.0
displaydoc0.2.7proc macro
errno0.3.14
fastrand2.5.0
fdeflate0.3.7
filetime0.2.29
find-msvc-tools0.1.11
flate21.1.10
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script, not run
getrandom0.4.3build script, not run
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.11.1
hyper-rustls0.27.9
hyper-util0.1.20
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
image0.25.10
image-webp0.2.4
ipnet2.12.1
itoa1.0.18
js-sys0.3.104
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
libredox0.1.21
libssl.so.3system library
linux-raw-sys0.12.1
litemap0.8.3
lock_api0.4.14
log0.4.34
lru-slab0.1.2
matrixmultiply0.3.11build script
memchr2.8.3
miniz_oxide0.8.9
miniz_oxide0.9.1
mio1.2.2
moxcms0.8.1
native-tls0.2.18build script
ndarray0.16.1
num-complex0.4.6
num-integer0.1.47
num-traits0.2.19build script
once_cell1.21.4
openssl0.10.81build script
openssl-macros0.1.1proc macro
openssl-probe0.2.1
openssl-sys0.9.117build script
option-ext0.2.0
ort2.0.0-rc.10
ort-sys2.0.0-rc.10build scriptnetworkcdn.pyke.io
parking_lot0.12.5
parking_lot_core0.9.12build script
pem-rfc74681.0.0
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
png0.18.1
portable-atomic1.15.0build script, not run
portable-atomic-util0.2.7build script, not run
potential_utf0.1.6
proc-macro21.0.107build script
pxfm0.1.30
quick-error2.0.1
quinn0.11.11build script, not run
quinn-proto0.11.17
quinn-udp0.5.15build script, not run
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
rand0.10.2
rand_core0.10.1
rand_pcg0.10.2
rawpointer0.2.1
redox_syscall0.5.18
redox_users0.5.2
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.3
rustix1.1.4build script
rustls0.23.46build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
rustversion1.0.23build script, not runproc macro
ryu1.0.23
schannel0.1.29
scopeguard1.2.0
security-framework3.7.0
security-framework-sys2.17.0
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_urlencoded0.7.1
sha20.10.9
shlex2.0.1
signal-hook-registry1.4.8
simd-adler320.3.10
slab0.4.12
smallvec1.15.2
smallvec2.0.0-alpha.10
socket20.6.5
socks0.3.4
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.4
sync_wrapper1.0.2
synstructure0.13.2
tar0.4.46
tempfile3.27.0
thiserror2.0.20build script
thiserror-impl2.0.20proc macro
tinystr0.8.4
tinyvec1.12.0
tinyvec_macros0.1.1
tokio1.53.1
tokio-macros2.7.2proc macro
tokio-rustls0.26.4
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicode-ident1.0.24
untrusted0.9.0
ureq3.4.0
ureq-proto0.6.1
url2.5.8
utf8-zero0.8.1
utf8_iter1.0.4
vcpkg0.2.15prebuilt objects
version_check0.9.5
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.127build script, not run
wasm-bindgen-futures0.4.77
wasm-bindgen-macro0.2.127proc macro
wasm-bindgen-macro-support0.2.127
wasm-bindgen-shared0.2.127build script, not run
web-sys0.3.104
web-time1.1.0
webpki-root-certs1.0.9
webpki-roots1.0.9
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows0.54.0
windows-core0.54.0
windows-link0.2.1
windows-result0.1.2
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
xattr1.6.1
yoke0.8.3
yoke-derive0.8.2proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.7
zmij1.0.23build script
zune-core0.5.3
zune-jpeg0.5.15

Raw data

capture
682 KB
records
93,578
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-15 · run 90ba34f4-4cef-4179-aabe-d7921429dd98

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2