Skip to content
Open-Source Registry

cargo / codebase-graph / 3.0.3

codebase-graph 3.0.3

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsmedium
processes
494
operations
154K
packages
126
compiler runs
258
connections
5
job time
6m 50s
capture
2.0 MB
records
270K
bytes / record
7.3

Build behaviourhas a build scriptundeclared fetchfetched outside crates.iocompiled C/C++

run e8dd6457-8384-4e05-a3b3-abf03f448388 · built 2026-10-17 · complete View on crates.io

Graph

egress · medium · in codebase-graph
4

Checks

9 of 14 clear Network activity Build file changes +3 more
Build behavior▲✓✓▲✓▲✓✓
Supply chain▲✓▲✓✓
Pipeline✓

Detections

3
  • Source rewritten from outside input
    lbug 0.19.0 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Build script reached api.github.com +2
    lbug 0.19.0 › api.github.com:443, github.com:443, release-assets.githubusercontent.com:443
    medium
  • Prebuilt object file from a dependency package
    liblbug.a
    info

Detection

highwitnessed

Source rewritten from outside input

Dependency source rewritten before compilation

Subject
lbug 0.19.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
dependency-source · codebaseGraph

Evidence

  1. Dependency source rewritten by build codecause

    Added .cache/lbug-prebuilt/latest/lib/lbug.h in lbug 0.19.0, then read by cc1plus

    subject /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lbug-prebuilt/latest/lib/lbug.h

    by tar xzf /tmp/tmp.xd92FR72c3/liblbug-static-linux-x86_64-compat.tar.gz -C /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lb…

  2. Dependency source rewritten by build codecause

    Added .cache/lbug-prebuilt/latest/lib/lbug.hpp in lbug 0.19.0, then read by cc1plus

    subject /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lbug-prebuilt/latest/lib/lbug.hpp

    by tar xzf /tmp/tmp.xd92FR72c3/liblbug-static-linux-x86_64-compat.tar.gz -C /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lb…

  3. Dependency source rewritten by build codecause

    Added .cache/lbug-prebuilt/latest/lib/liblbug.a in lbug 0.19.0, then read by rustc

    subject /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lbug-prebuilt/latest/lib/liblbug.a

    by tar xzf /tmp/tmp.xd92FR72c3/liblbug-static-linux-x86_64-compat.tar.gz -C /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lb…

  4. Rewrite input from outside the packagecause

    The writing build read bytes from github.com, which no policy covers

    source github.com:443

    by curl -fSL https://github.com/LadybugDB/ladybug/releases/download/v0.21.2/liblbug-static-linux-x86_64-compat.tar.gz -o /tmp/tmp.xd92FR72c3/liblbug-static-linux-x…

  5. Rewrite input from outside the packagecause

    The writing build read bytes from release-assets.githubusercontent.com, which no policy covers

    source release-assets.githubusercontent.com:443

    by curl -fSL https://github.com/LadybugDB/ladybug/releases/download/v0.21.2/liblbug-static-linux-x86_64-compat.tar.gz -o /tmp/tmp.xd92FR72c3/liblbug-static-linux-x…

Processes

build-test

cargo›cargo›build-script-build›sh›bash›tar

Ran
tar xzf /tmp/tmp.xd92FR72c3/liblbug-static-linux-x86_64-compat.tar.gz -C /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lb…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 6 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2486
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2486
  3. build-script-build/home/runner/work/codebaseGraph/codebaseGraph/target/release/build/lbug-dc8b0730e65682c2/build-script-build4021
  4. shsh /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/scripts/download_lbug.sh4022
  5. bashbash /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/scripts/download-liblbug.sh4026
  6. tartar xzf /tmp/tmp.xd92FR72c3/liblbug-static-linux-x86_64-compat.tar.gz -C /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lb…4055

Remediation

Compare the rewritten files with the published package, and find where the written bytes came from. Pin or replace the dependency until its build compiles what it published.

Detection

mediumwitnessed

Build script reached api.github.com +2

Unexpected network connection

Subject
lbug 0.19.0
Destination
api.github.com:443, github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to api.github.com:443, opened by curl

    subject api.github.com:443

    by curl -sS https://api.github.com/repos/LadybugDB/ladybug/releases/latest

  2. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -fSL https://github.com/LadybugDB/ladybug/releases/download/v0.21.2/liblbug-static-linux-x86_64-compat.tar.gz -o /tmp/tmp.xd92FR72c3/liblbug-static-linux-x…

  3. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -fSL https://github.com/LadybugDB/ladybug/releases/download/v0.21.2/liblbug-static-linux-x86_64-compat.tar.gz -o /tmp/tmp.xd92FR72c3/liblbug-static-linux-x…

  4. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  5. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/codebaseGraph/codebaseGraph/target/release/build/lbug-dc8b0730e65682c2/build-script-build

  6. Tool commandsupport

    Command: curl -sS https://api.github.com/repos/LadybugDB/ladybug/releases/latest

    by curl -sS https://api.github.com/repos/LadybugDB/ladybug/releases/latest

  7. Tool commandsupport

    Command: curl -fSL https://github.com/LadybugDB/ladybug/releases/download/v0.21.2/liblbug-static-linux-x86_64-compat.tar.gz -o /tmp/tmp.xd92FR72c3/liblbug-static-linux-x…

    by curl -fSL https://github.com/LadybugDB/ladybug/releases/download/v0.21.2/liblbug-static-linux-x86_64-compat.tar.gz -o /tmp/tmp.xd92FR72c3/liblbug-static-linux-x…

In codebase-graph

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›sh›bash›curl

Ran
curl -sS https://api.github.com/repos/LadybugDB/ladybug/releases/latest
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 6 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2486
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2486
  3. build-script-build/home/runner/work/codebaseGraph/codebaseGraph/target/release/build/lbug-dc8b0730e65682c2/build-script-build4021
  4. shsh /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/scripts/download_lbug.sh4022
  5. bashbash /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/scripts/download-liblbug.sh4026
  6. curlcurl -sS https://api.github.com/repos/LadybugDB/ladybug/releases/latest4040

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Detection

infoinferred

Prebuilt object file from a dependency package

Object file origin needs review

Subject
/home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lbug-prebuilt/latest/lib/liblbug.awritten by tar
Reaches
Jobs
build-test
Rule
object-provenance

Evidence

  1. Prebuilt object file from a dependency packagecause

    shipped inside a dependency package and read by rustc; not compiled in this build

    subject /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lbug-prebuilt/latest/lib/liblbug.a

    by /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/rustc --crate-name lbug --edition=2021 /home/runner/.cargo/registry/src/index.crates.io-f7c7…

  2. Asked for by the build's own declarationsupport

    lbug asked the linker for it: static lbug (target/release/build/lbug-3af391434b565325/output)

    subject /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/lbug-0.19.0/.cache/lbug-prebuilt/latest/lib/liblbug.a

In codebase-graph

Loading the graph

Processes

build-test

cargo›cargo›rustc

Ran
/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/rustc --crate-name lbug --edition=2021 /home/runner/.cargo/registry/src/index.crates.io-f7c7…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2486
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2486
  3. rustc/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/rustc --crate-name lbug --edition=2021 /home/runner/.cargo/registry/src/index.crates.io-f7c7…4399

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

5 peers
  • api.github.com:443 build code of lbug · curl · GitHub, Inc. undeclared
  • github.com:443 build code of lbug · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of lbug · curl · Fastly, Inc. · 1 file undeclared
  • extension.ladybugdb.com:443 codebase-graph's own build code · codebase_graph-d22b8bf72db9f439 (codebaseGraph) · Cloudflare, Inc. unjudged
  • static.crates.io:8080 the package manager · cargo (codebaseGraph) via crates.io · 11,186 files · went into an output ecosystem
Vulnerabilities2PackageFixSeverity
CVE-2026-25727time 0.3.36>=0.3.47medium
RUSTSEC-2026-0202cxx 1.0.138>=1.0.195low
Dependencies127Build behaviour
aho-corasick1.1.4
arrayvec0.7.6
bitflags2.13.0
block-buffer0.10.4
byteorder1.5.0
cfg-if1.0.4
cpufeatures0.2.17
crc3.4.0
crc-catalog2.5.0
crypto-common0.1.7
cty0.2.2
cxx1.0.138build script
deranged0.3.11
digest0.10.7
foldhash0.1.5
fs20.4.3
generic-array0.14.7build script
getrandom0.3.4build script
inotify0.11.2
inotify-sys0.1.5
itoa1.0.18
lbug0.19.0build scriptnetworkruns toolsprebuilt objectsapi.github.com, github.com, release-assets.githubusercontent.com, curl
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm.so.6system library
libmimalloc-sys0.1.49build script
libmvec.so.1system library
libssl.so.3system library
link-cplusplus1.0.12build script
log0.4.32
lzma-rs0.3.0
memchr2.8.2
mimalloc0.1.52
mio1.2.1
notify8.2.0
notify-types2.0.0
num-conv0.1.0
num-traits0.2.19build script
powerfmt0.2.0
regex1.12.4
regex-automata0.4.14
regex-syntax0.8.11
rust_decimal1.42.1build script
same-file1.0.6
serde1.0.228build script
serde_core1.0.228build script
serde_json1.0.150build script
sha20.10.9
streaming-iterator0.1.9
time0.3.36
time-core0.1.2
tree-sitter0.25.10build script
tree-sitter-c0.24.2build script
tree-sitter-cpp0.23.4build script
tree-sitter-css0.25.0build script
tree-sitter-fortran0.6.0build script
tree-sitter-go0.25.0build script
tree-sitter-html0.23.2build script
tree-sitter-javascript0.25.0build script
tree-sitter-language0.1.8build script
tree-sitter-python0.25.0build script
tree-sitter-rust0.24.2build script
tree-sitter-typescript0.23.2build script
typenum1.20.1
uuid1.18.1
walkdir2.5.0
zmij1.0.21build script
equivalent1.0.2
hashbrown0.15.5
indexmap2.7.1
unicode-ident1.0.24
autocfg1.5.1
bumpalo3.20.3
cc1.2.64
cmake0.1.58
codespan-reporting0.11.1
cxx-build1.0.138
cxxbridge-flags1.0.138
cxxbridge-macro1.0.138proc macro
find-msvc-tools0.1.9
fsevent-sys4.1.0
futures-core0.3.32
futures-task0.3.32
futures-util0.3.32
js-sys0.3.102
kqueue1.2.0
kqueue-sys1.1.2
once_cell1.21.4
pin-project-lite0.2.17
proc-macro21.0.106build script
quote1.0.45build script
r-efi5.3.0
rustversion1.0.22build scriptproc macro
scratch1.0.9build script
serde_derive1.0.228proc macro
shlex2.0.1
slab0.4.12
syn2.0.117
termcolor1.4.1
unicode-width0.1.14
version_check0.9.5
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.125build script, not run
wasm-bindgen-macro0.2.125proc macro
wasm-bindgen-macro-support0.2.125
wasm-bindgen-shared0.2.125build script, not run
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-link0.2.1
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.53.5
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
Versions20RiskVulnsPublished
3.0.2not analyzed2026-10-05
3.0.1not analyzed2026-09-25
3.0.0not analyzed2026-09-25
2.0.0not analyzed2026-09-24
1.8.1not analyzed2026-09-22
1.8.0not analyzed2026-09-22
1.7.1not analyzed2026-09-09
1.7.0not analyzed2026-08-26
1.6.0not analyzed2026-08-25
1.5.2not analyzed2026-08-25
1.5.1not analyzed2026-08-24
1.4.6not analyzed2026-08-18
1.4.5not analyzed2026-08-17
1.3.1not analyzed2026-08-11
1.3.0not analyzed2026-08-10
1.2.2not analyzed2026-08-07
1.2.1not analyzed2026-08-05
1.1.6not analyzed2026-06-23
1.1.5not analyzed2026-06-22
3.0.3highmedium

Raw data

capture
2.0 MB
records
270,188
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run e8dd6457-8384-4e05-a3b3-abf03f448388

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2