Skip to content
Open-Source Registry

cargo / cccc

cccc 0.4.33

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnscritical
processes
419
operations
155K
packages
426
compiler runs
4,791
connections
3
build time
17m 40s
job time
17m 40s
capture
1.6 MB
records
256K
bytes / record
6.2

Collaborative multi-agent control plane and CLI

154 downloads · published 2026-08-05 · source agentsaiautomationcollaborationmcp View on crates.io
Reviewed by Bitbison: unverified-downloadCompiling cccc fetches prebuilt sherpa-onnx speech libraries from a GitHub release and links them, checking only a pinned SHA-256 and no signature.

Graph

egress · high
5

Checks

12 of 17 clear Network activity Data flow analysis +3 more
Build behavior▲✓✓✓✓✓✓✓▲✓✓
Supply chain▲▲▲✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    cccc-pair-sherpa-onnx-sys 1.13.4-cccc.1 › github.com:443, release-assets.githubusercontent.com:443
    high
  • 13 uncompiled libraries linked
    cccc-pair-sherpa-onnx-sys 1.13.4-cccc.1 › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
cccc-pair-sherpa-onnx-sys 1.13.4-cccc.1
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
ccccdmembercccc-38a01703c7609876membercccc-38a01703c7609876membercccc-38a01703c7609876membercccc-804a692d0b06ed77membercccc-804a692d0b06ed77member
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl --fail --location --silent --show-error --connect-timeout 30 --output /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/.sherpa-onnx-v1.13.4-linux-x6…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl --fail --location --silent --show-error --connect-timeout 30 --output /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/.sherpa-onnx-v1.13.4-linux-x6…

  3. What a build script's fetch becamesupport

    1 file came down, reaching 393 more; the build compiled or linked libespeak-ng.a, libsherpa-onnx-kaldifst-core.a, libsherpa-onnx-fst.a +10 more

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  5. Tool commandsupport

    Command: curl --fail --location --silent --show-error --connect-timeout 30 --output /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/.sherpa-onnx-v1.13.4-linux-x6…

    by curl --fail --location --silent --show-error --connect-timeout 30 --output /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/.sherpa-onnx-v1.13.4-linux-x6…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl --fail --location --silent --show-error --connect-timeout 30 --output /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/.sherpa-onnx-v1.13.4-linux-x6…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics1341
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics1341
  3. build-script-build/home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build8093
  4. curlcurl --fail --location --silent --show-error --connect-timeout 30 --output /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/.sherpa-onnx-v1.13.4-linux-x6…8094

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

13 uncompiled libraries linked

Object file origin needs review

Subject
cccc-pair-sherpa-onnx-sys 1.13.4-cccc.1
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · cccc

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib.tar.bz2via curl --fail --location --silent --show-error --connect-timeout 30 --output /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/.sherpa-onnx-v1.13.4-linux-x6
  3. /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libespeak-ng.avia /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build-script-build without a recorded source compilation

    • Asked for by the build's own declaration

      cccc-pair-sherpa-onnx-sys asked the linker for it: static espeak-ng (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject
  4. cccc-38a01703c7609876member
    artifact
  5. cccc-38a01703c7609876member
    artifact
  6. cccc-38a01703c7609876member
    artifact

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkaldi-decoder-core.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  2. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkaldi-decoder-core.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  3. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkaldi-native-fbank-core.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  4. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkaldi-native-fbank-core.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  5. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkissfft-float.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  6. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkissfft-float.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  7. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libonnxruntime.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  8. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libonnxruntime.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  9. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libpiper_phonemize.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  10. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libpiper_phonemize.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  11. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-c-api.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  12. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-c-api.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  13. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-core.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  14. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-core.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  15. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-fst.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  16. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-fst.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  17. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-fstfar.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  18. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-fstfar.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  19. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-kaldifst-core.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  20. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-kaldifst-core.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  21. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libssentencepiece_core.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  22. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libssentencepiece_core.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  23. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libucd.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  24. Written without a recorded source compilationcause

    Written by build-script-build without a recorded source compilation

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libucd.a

    by /home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build

  25. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static kaldi-decoder-core (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkaldi-decoder-core.a

  26. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static kaldi-native-fbank-core (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkaldi-native-fbank-core.a

  27. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static kissfft-float (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libkissfft-float.a

  28. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static onnxruntime (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libonnxruntime.a

  29. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static piper_phonemize (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libpiper_phonemize.a

  30. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static sherpa-onnx-c-api (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-c-api.a

  31. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static sherpa-onnx-core (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-core.a

  32. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static sherpa-onnx-fst (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-fst.a

  33. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static sherpa-onnx-fstfar (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-fstfar.a

  34. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static sherpa-onnx-kaldifst-core (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libsherpa-onnx-kaldifst-core.a

  35. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static ssentencepiece_core (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libssentencepiece_core.a

  36. Asked for by the build's own declarationsupport

    cccc-pair-sherpa-onnx-sys asked the linker for it: static ucd (target/release/build/cccc-pair-sherpa-onnx-sys-99d72b17cfc03f92/output)

    subject /home/runner/work/cccc/cccc/target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libucd.a

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics1341
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics1341
  3. build-script-build/home/runner/work/cccc/cccc/target/release/build/cccc-pair-sherpa-onnx-sys-1116d259c2fe0fa7/build-script-build8093

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of cccc-pair-sherpa-onnx-sys · curl · Microsoft Corporation · 1 file · went into an output undeclared
  • release-assets.githubusercontent.com:443 build code of cccc-pair-sherpa-onnx-sys · curl · Fastly, Inc. · 1 file · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (cccc) via crates.io · 27,685 files · went into an output ecosystem
Vulnerabilities24FixSeverity
Dependencies
zip 2.4.2>=9.0.5
CVE-2026-115905zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEcritical
CVE-2026-115909zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extractionhigh
RUSTSEC-2026-0367Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalationhigh
RUSTSEC-2026-0368zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directoryhigh
RUSTSEC-2026-0369ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targethigh
CVE-2026-115906zip: AES Entry HMAC Authentication Bypass on Premature EOFmedium
h2 0.4.15>=0.4.16
RUSTSEC-2026-0258h2 unbounded empty DATA frameshigh
rustls-webpki 0.102.8, 0.103.9>=0.103.16
CVE-2026-111943Important: ignition security updatehigh
CVE-2026-93599rustls-webpki: Denial of service via panic on malformed CRL BIT STRINGhigh
CVE-2026-93602webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicmedium
CVE-2026-93600webpki: Name constraints for URI names were incorrectly acceptedlow
CVE-2026-93601webpki: Name constraints were accepted for certificates asserting a wildcard namelow
rustls 0.23.37, 0.22.4>=0.23.46
GHSA-2mjx-qc3c-rqvcRustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundariesmedium
GHSA-c8m5-c952-6cm4Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKsmedium
GHSA-h2v8-394m-p7vvRustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.low
GHSA-w44r-93j7-qv28rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 sharelow
tokio 1.52.3>=1.53.3
RUSTSEC-2026-0386`AsyncFd::new` and related constructors violate I/O safetylow
unsafe-libyaml 0.2.11none published
RUSTSEC-2024-0449unsafe-libyaml is unmaintainedlow
quinn-proto 0.11.14 only with feature>=0.11.18
CVE-2026-25800Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassemblyhigh
RUSTSEC-2026-0338Remote peer can panic quinn-proto with zero-length STREAM frames during unordered readshigh
RUSTSEC-2026-0339Unbounded growth of pending connection ID retirements in quinn-protohigh
RUSTSEC-2026-0340Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabledhigh
RUSTSEC-2026-0342Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-protohigh
proc-macro-error2 2.0.1 buildnone published
RUSTSEC-2026-0173proc-macro-error2 is unmaintainedinfo

Dependencies

476
Dependencies476Build behaviour
aes0.8.4
aho-corasick1.1.4
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
anyhow1.0.103build script
arrayvec0.7.8
async-compression0.4.42
async-stream0.3.6
async-tungstenite0.32.1
atomic-waker1.1.2
aws-lc-rs1.17.1build script
aws-lc-sys0.42.0build scriptprebuilt objects
axum0.8.9
axum-core0.5.6
base640.22.1
bitflags2.13.0
block-buffer0.10.4
block-buffer0.12.1
block-padding0.3.3
bumpalo3.20.3
bytemuck1.25.1
byteorder1.5.0
bytes1.12.1
bzip20.6.1
cbc0.1.2
cccc-pair-client0.4.33
cccc-pair-contracts0.4.33
cccc-pair-core0.4.33
cccc-pair-daemon0.4.33
cccc-pair-mcp0.4.33
cccc-pair-notebooklm0.4.33
cccc-pair-runtime0.4.33
cccc-pair-sherpa-onnx1.13.4-cccc.1
cccc-pair-sherpa-onnx-sys1.13.4-cccc.1build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
cccc-pair-web0.4.33-compat.2build script
cfg-if1.0.4
chromiumoxide0.8.0
chromiumoxide_cdp0.8.0
chromiumoxide_types0.8.0
chrono0.4.45
chrono-tz0.10.4build script
cipher0.4.4
clap4.6.1
clap_builder4.6.0
clap_lex1.1.0
colorchoice1.0.5
colored3.1.1
compression-codecs0.4.38
compression-core0.4.32
const-oid0.10.2
cookie0.18.1build script
cpufeatures0.2.17
cpufeatures0.3.0
crc32fast1.5.0build script
cron0.15.0
crossbeam-utils0.8.22build script
crypto-common0.1.7
crypto-common0.2.2
curve25519-dalek4.1.3build script
dashmap6.2.1
data-encoding2.11.0
deranged0.5.8
derive_more1.0.0
digest0.10.7
digest0.11.3
dingtalk-stream0.1.7
directories6.0.0
dirs-sys0.5.0
downcast-rs1.2.1
dptree0.5.1
dunce1.0.5
ecb0.1.2
ed255192.2.3
ed25519-dalek2.2.0
either1.16.0
encoding_rs0.8.35
equivalent1.0.2
erasable1.3.0build script
errno0.3.14
fastrand2.4.1
filedescriptor0.8.3
filetime0.2.29
flate21.1.9
fnv1.0.7
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
fs20.4.3
futures0.3.32
futures-channel0.3.32
futures-core0.3.32
futures-executor0.3.32
futures-io0.3.32
futures-sink0.3.32
futures-task0.3.32
futures-timer3.0.4
futures-util0.3.32
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
h20.4.15
hashbrown0.14.5
hashbrown0.17.1
hound3.5.1
http1.4.2
http-body1.0.1
http-body-util0.1.3
http-range-header0.4.2
httparse1.10.1build script
httpdate1.0.3
hybrid-array0.4.13
hyper1.10.1
hyper-rustls0.27.7
hyper-util0.1.20
iana-time-zone0.1.65
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
indexmap2.14.0
inotify0.11.4
inotify-sys0.1.8build script
inout0.1.4
ipnet2.12.0
is_terminal_polyfill1.70.2
itoa1.0.18
lark-channel0.4.0
ld-linux-x86-64.so.2system library
libbz2-rs-sys0.2.5
libbz2.so.1system library
libc0.2.186build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
libssl.so.3system library
linux-raw-sys0.12.1
litemap0.8.2
lock_api0.4.14
log0.4.33
matchit0.8.4
md-50.10.6
memchr2.8.3
mime0.3.17
mime_guess2.0.5build script
miniz_oxide0.8.9
mio1.2.1
multer3.1.0build script
native-tls0.2.18build script
nix0.28.0build script
notify8.2.0
notify-types2.1.0
num-conv0.2.2
num-traits0.2.19build script
once_cell1.21.4
openssl0.10.81build script
openssl-probe0.2.1
openssl-sys0.9.117build script
option-ext0.2.0
parking_lot0.12.5
parking_lot_core0.9.12build script
percent-encoding2.3.2
phf0.12.1
phf_shared0.12.1
pin-project1.1.13
pin-project-lite0.2.17
portable-pty0.9.0
potential_utf0.1.5
powerfmt0.2.0
ppv-lite860.2.21
prost0.13.5
psm0.1.31build scriptprebuilt objects
rand0.8.7
rand0.9.5
rand_chacha0.3.1
rand_chacha0.9.0
rand_core0.6.4
rand_core0.9.5
rc-box1.3.0
regex1.13.0
regex-automata0.4.15
regex-syntax0.8.11
reqwest0.12.28
reqwest0.13.4
rgb0.8.53
ring0.17.14build scriptprebuilt objects
rust-embed8.12.0
rust-embed-utils8.12.0
rustix1.1.4build script
rustls0.22.4build script
rustls0.23.37build script
rustls-native-certs0.8.4
rustls-pki-types1.14.0
rustls-platform-verifier0.7.0
rustls-webpki0.102.8
rustls-webpki0.103.9
ryu1.0.23
same-file1.0.6
scopeguard1.2.0
secrecy0.8.0
semver1.0.28
serde1.0.228build script
serde_core1.0.228build script
serde_cow0.1.2
serde_json1.0.150build script
serde_path_to_error0.1.20
serde_urlencoded0.7.1
serde_with3.21.0
serde_yaml0.9.34+deprecated
serenity0.12.5build script
serial20.2.37
sha10.10.7
sha20.10.9
sha20.11.0
shell-words1.1.1
signal-hook-registry1.4.8
signature2.2.0
simd-adler320.3.9
siphasher1.0.3
slab0.4.12
smallvec1.15.2
socket20.6.4
spin0.9.9
stable_deref_trait1.2.1
stacker0.1.24build script
strsim0.11.1
subtle2.6.1
sync_wrapper1.0.2
take_mut0.2.2
takecell0.1.1
tar0.4.46
teloxide0.17.0
teloxide-core0.13.0
tempfile3.27.0
thiserror1.0.69build script
thiserror2.0.18build script
time0.3.53
time-core0.1.9
tinystr0.8.3
tokio1.52.3
tokio-native-tls0.3.1
tokio-rustls0.25.0
tokio-rustls0.26.4
tokio-stream0.1.18
tokio-tungstenite0.21.0
tokio-tungstenite0.26.2
tokio-tungstenite0.28.0
tokio-tungstenite0.29.0
tokio-util0.7.18
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
tungstenite0.21.0
tungstenite0.26.2
tungstenite0.28.0
tungstenite0.29.0
typemap_rev0.3.0
typenum1.20.1
unicase2.9.0
unicode-width0.2.2
unsafe-libyaml0.2.11
untrusted0.7.1
untrusted0.9.0
url2.5.8
urlencoding2.1.3
utf-80.7.6
utf8_iter1.0.4
utf8parse0.2.2
uuid1.23.5
walkdir2.5.0
want0.3.1
webpki-roots0.26.11
webpki-roots1.0.6
weixin-agent0.2.0
which8.0.4
winnow0.6.26
writeable0.6.3
xattr1.6.1
yoke0.8.3
zerocopy0.8.54build script
zerofrom0.1.8
zeroize1.8.2
zerotrie0.2.4
zerovec0.11.6
zip2.4.2build script
zmij1.0.23build script
zopfli0.8.3
adler22.0.1
chromiumoxide_pdl0.8.0
heck0.4.1
lazy_static1.5.0
matchers0.2.0
nu-ansi-term0.50.3
proc-macro21.0.106build script
quote1.0.46build script
sharded-slab0.1.7
thread_local1.1.10
tracing-log0.2.0
tracing-subscriber0.3.23
unicode-ident1.0.24
android_system_properties0.1.5
anstyle-wincon3.0.11
aquamarine0.6.0proc macro
ar_archive_writer0.5.2
arbitrary1.4.2
async-stream-impl0.3.6proc macro
async-trait0.1.89proc macro
autocfg1.5.1
base64ct1.8.3
bitflags1.3.2
bs580.5.1
bzip20.4.4
bzip2-sys0.1.13+1.0.8build script
cc1.2.67
cfg_aliases0.1.1
cfg_aliases0.2.1
clap_derive4.6.1proc macro
cmake0.1.58
combine4.6.7
const-oid0.9.6
core-foundation0.10.1
core-foundation0.9.4
core-foundation-sys0.8.7
curve25519-dalek-derive0.1.1proc macro
darling0.23.0
darling_core0.23.0
darling_macro0.23.0proc macro
der0.7.10
derive_arbitrary1.4.2proc macro
derive_more-impl1.0.0proc macro
dirs6.0.0
displaydoc0.2.6proc macro
dyn-clone1.0.20
fiat-crypto0.2.9
find-msvc-tools0.1.9
fs_extra1.3.0
fsevent-sys4.1.0
futures-macro0.3.32proc macro
hashbrown0.12.3
heck0.5.0
hex0.4.3
iana-time-zone-haiku0.1.2build script, not run
ident_case1.0.1
include_dir0.7.4
include_dir_macros0.7.4proc macro
indexmap1.9.3build script, not run
itertools0.10.5
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
jobserver0.1.35
js-sys0.3.103
kqueue1.2.0
kqueue-sys1.1.2
libredox0.1.18
lru-slab0.1.2
object0.37.3build script
once_cell_polyfill1.70.2
openssl-macros0.1.1proc macro
pin-project-internal1.1.13proc macro
pkcs80.10.2
pkg-config0.3.33
proc-macro-error-attr22.0.0proc macro
proc-macro-error22.0.1
prost-derive0.13.5proc macro
quinn0.11.9build script, not run
quinn-proto0.11.14
quinn-udp0.5.14build script, not run
r-efi5.3.0
r-efi6.0.0
redox_syscall0.5.18
redox_users0.5.2
ref-cast1.0.25build script, not run
ref-cast-impl1.0.25proc macro
rust-embed-impl8.12.0proc macro
rustc-hash2.1.2
rustc_version0.4.1
rustls-platform-verifier-android0.1.1
rustversion1.0.23build script, not runproc macro
schannel0.1.29
schemars0.9.0
schemars1.2.1
security-framework3.7.0
security-framework-sys2.17.0
serde_derive1.0.228proc macro
serde_repr0.1.20proc macro
serde_with_macros3.21.0proc macro
shared_library0.1.9
shellexpand3.1.2
shlex2.0.1
simd_cesu81.2.0
simdutf80.1.5
spki0.7.3
syn2.0.118
synstructure0.13.2
system-configuration0.7.0
system-configuration-sys0.6.0build script, not run
thiserror-impl1.0.69proc macro
thiserror-impl2.0.18proc macro
time-macros0.2.31proc macro
tinyvec1.10.0
tinyvec_macros0.1.1
tokio-macros2.7.0proc macro
tracing-attributes0.1.31proc macro
unicode-xid0.2.6
ureq2.12.1
valuable0.1.1build script, not run
vcpkg0.2.15prebuilt objects
version_check0.9.5
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-futures0.4.76
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
wasm-streams0.4.2
wasm-streams0.5.0
web-sys0.3.103
web-time1.1.0
webpki-root-certs1.0.8
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.1.3
windows-link0.2.1
windows-registry0.5.3
windows-result0.3.4
windows-result0.4.1
windows-strings0.4.2
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.52.6
windows-targets0.53.5
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
winreg0.10.1build script, not run
wit-bindgen0.57.1build script, not runprebuilt objects
yoke-derive0.8.2proc macro
zerocopy-derive0.8.54proc macro
zerofrom-derive0.1.7proc macro
zerovec-derive0.11.3proc macro

Versions6

Raw data

capture
1.6 MB
records
256,439
bytes per record
6.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test failure · Generated 2026-11-06 · run 80f74806-78e4-480c-a64d-389bd75e0f88

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2

Bitbison's review

cccc downloads prebuilt sherpa-onnx native libraries when compiled without verifying a signature

Conclusion
unverified-download
Covers
0.4.33
Reviewed by
Bitbison
Updated
2026-11-06

Compiling cccc fetches prebuilt sherpa-onnx speech libraries from a GitHub release and links them, checking only a pinned SHA-256 and no signature.

Indicators

hosts
github.comrelease-assets.githubusercontent.com
files
target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib.tar.bz2target/sherpa-onnx-prebuilt/sherpa-onnx-v1.13.4-linux-x64-static-lib/lib/libespeak-ng.a
processes
curl

What was examined

0.4.33
sha256:f715a6947f9fb58fc2a24c21e8c009cf5178e4382a3ccf35d1813f5e7f3f263c

Links