Skip to content
Open-Source Registry

cargo / dlens / 0.3.0

dlens 0.3.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
642
operations
87K
packages
314
compiler runs
240
connections
4
job time
5m 18s
capture
954 KB
records
146K
bytes / record
6.5

Build behaviourits build script reached huggingface.co, us.aws.cdn.hf.coundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run a64a4d0e-befd-4b0c-8788-fad5f3fa2048 · built 2026-10-17 · complete View on crates.io

Graph

egress · high · in libdlens.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    dlens 0.3.0 › huggingface.co:443, us.aws.cdn.hf.co:443
    high
  • Downloaded file compiled into the artifact
    model.onnx › huggingface.co, us.aws.cdn.hf.co
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
dlens 0.3.0
Destination
huggingface.co:443, us.aws.cdn.hf.co:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to huggingface.co:443, opened by build-script-build

    subject huggingface.co:443

    by /home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to us.aws.cdn.hf.co:443, opened by build-script-build

    subject us.aws.cdn.hf.co:443

    by /home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build

  3. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked model.onnx

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build

In libdlens.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2483
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2483
  3. build-script-build/home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build6434

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/dlens/dlens/target/release/build/dlens-35a9a017ef0644d0/out/model.onnxwritten by build-script-build
Destination
huggingface.co, us.aws.cdn.hf.co
Jobs
build-test
Rule
object-provenance · dlens

Witness chain

  1. huggingface.co:443
    source
  2. /home/runner/work/dlens/dlens/target/release/build/dlens-35a9a017ef0644d0/out/model.onnxvia /home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build
    • Object written under a build script that downloadedfrom huggingface.co · us.aws.cdn.hf.co

      written under the build script at /home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build, which downloaded from huggingface.co, us.aws.cdn.hf.co

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build, which downloaded from huggingface.co, us.aws.cdn.hf.co
  • Written by build-script-build from a network connection without a recorded source compilation

In libdlens.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2483
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2483
  3. build-script-build/home/runner/work/dlens/dlens/target/release/build/dlens-d420c4a4525f98d5/build-script-build6434

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

4 peers
  • huggingface.co:443 dlens's own build code · build-script-build · Amazon.com, Inc. · 1 file · went into an output undeclared
  • us.aws.cdn.hf.co:443 dlens's own build code · build-script-build · Amazon.com, Inc. · 1 file · went into an output undeclared
  • cdn.pyke.io:443 build code of ort-sys · build-script-main via accepted download (policy ccde352b-ab68-44a3-9448-3767958fbfdd: pkg:cargo/ort-sys, a prebuilt ONNX Runtime from cdn.pyke.io) · Cloudflare, Inc. · 1 file · went into an output accepted
  • static.crates.io:8080 the package manager · cargo (dlens) via crates.io · 20,240 files · went into an output ecosystem
Dependencies341Build behaviour
ahash0.8.12build script
aho-corasick1.1.5
allocator-api20.2.21
android_system_properties0.1.6
ar_archive_writer0.5.3
async-trait0.1.92proc macro
atoi2.0.0
atomic-waker1.1.2
autocfg1.5.1
base640.13.1
base640.22.1
base640.23.1
base64ct1.8.3
bitflags2.13.2
block-buffer0.10.4
bumpalo3.20.3
byteorder1.5.0
bytes1.12.1
castaway0.2.4
cc1.4.6
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
chrono0.4.45
compact_str0.9.1
const-oid0.9.6
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.2.17
cpufeatures0.3.1
crc3.4.0
crc-catalog2.5.0
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-queue0.3.14
crossbeam-utils0.8.23build script
crypto-common0.1.7
darling0.20.11
darling_core0.20.11
darling_macro0.20.11proc macro
dary_heap0.3.9
der0.7.10
der0.8.2
derive_builder0.20.2
derive_builder_core0.20.2
derive_builder_macro0.20.2proc macro
digest0.10.7
displaydoc0.2.7proc macro
dotenvy0.15.7
either1.18.0
equivalent1.0.2
errno0.3.14
esaxx-rs0.1.10build script
etcetera0.8.0
event-listener5.4.2
fastrand2.5.0
fernet0.2.2
find-msvc-tools0.1.12
flume0.11.1
fnv1.0.7
foldhash0.1.5
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
futures-channel0.3.34
futures-core0.3.34
futures-executor0.3.34
futures-intrusive0.5.0
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
hashbrown0.15.5
hashbrown0.17.1
hashlink0.10.0
heck0.5.0
hex0.4.3
hkdf0.12.4
hmac0.12.1
hmac-sha2561.1.14
home0.5.12
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.11.1
hyper-rustls0.27.10
hyper-util0.1.20
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
indexmap2.14.2
ipnet2.12.2
itertools0.14.0
itoa1.0.18
js-sys0.3.105
lazy_static1.5.0
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm0.2.16build script, not run
libm.so.6system library
libmvec.so.1system library
libredox0.1.24
libsqlite3-sys0.30.1build script, not run
libssl.so.3system library
linux-raw-sys0.12.1
litemap0.8.3
lock_api0.4.14
log0.4.34
lru-slab0.1.3
lzma-rust20.15.8
macro_rules_attribute0.2.3
macro_rules_attribute-proc_macro0.2.3proc macro
matrixmultiply0.3.11build script
md-50.10.6
memchr2.8.3
minimal-lexical0.2.1
mio1.2.3
monostate0.1.18
monostate-impl0.1.18proc macro
native-tls0.2.18build script
ndarray0.17.2
nom7.1.3
num-bigint-dig0.8.6build script, not run
num-complex0.4.6
num-integer0.1.47
num-iter0.1.46
num-traits0.2.19build script
object0.39.1build script
once_cell1.21.4
onig6.5.3
onig_sys69.9.3build script
openssl0.10.81build script
openssl-macros0.1.1proc macro
openssl-probe0.2.1
openssl-sys0.9.117build script
ort2.0.0-rc.13
ort-sys2.0.0-rc.13build scriptnetworkcdn.pyke.io
parking2.2.1
parking_lot0.12.5
parking_lot_core0.9.12build script
paste1.0.15build scriptproc macro
pastey0.2.3proc macro
pem-rfc74680.7.0
pem-rfc74681.0.0
percent-encoding2.3.2
pin-project-lite0.2.17
pkcs10.7.5
pkcs80.10.2
pkg-config0.3.34
plain0.2.3
portable-atomic1.15.0build script, not run
portable-atomic-util0.2.8build script, not run
potential_utf0.1.6
ppv-lite860.2.21
proc-macro21.0.107build script
psm0.1.32build scriptprebuilt objects
quinn0.11.12build script, not run
quinn-proto0.11.18
quinn-udp0.5.15build script, not run
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
rand0.10.3
rand0.8.8
rand0.9.5
rand_chacha0.3.1
rand_chacha0.9.0
rand_core0.10.1
rand_core0.6.4
rand_core0.9.5
rand_pcg0.10.2
rawpointer0.2.1
rayon1.12.0
rayon-cond0.4.0
rayon-core1.13.0build script
recursive0.1.1
recursive-proc-macro-impl0.1.1proc macro
redox_syscall0.5.18
redox_syscall0.9.4
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rsa0.9.10
rustc-hash2.1.3
rustix1.1.5build script, not run
rustls0.23.45build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
rustversion1.0.23build scriptproc macro
ryu1.0.23
schannel0.1.29
scopeguard1.2.0
security-framework3.7.0
security-framework-sys2.17.0
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_urlencoded0.7.1
sha10.10.7
sha20.10.9
shlex2.0.1
signature2.2.0
slab0.4.12
smallvec1.16.1
socket20.6.5
socks0.3.4
spin0.9.9
spki0.7.3
spm_precompiled0.1.4
sqlparser0.63.0
sqlparser_derive0.6.0proc macro
sqlx0.8.6
sqlx-core0.8.6
sqlx-macros0.8.6proc macro
sqlx-macros-core0.8.6
sqlx-mysql0.8.6
sqlx-postgres0.8.6
sqlx-sqlite0.8.6
stable_deref_trait1.2.1
stacker0.1.25build script
static_assertions1.1.0
stringprep0.1.5
strsim0.11.1
subtle2.6.1
syn2.0.119
syn3.0.6
sync_wrapper1.0.2
synstructure0.14.0
tempfile3.27.0
thiserror2.0.20build script
thiserror-impl2.0.20proc macro
tinystr0.8.4
tinyvec1.13.3
tokenizers0.21.4
tokio1.53.1
tokio-macros2.7.2proc macro
tokio-rustls0.26.5
tokio-stream0.1.19
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicode-bidi0.3.18
unicode-ident1.0.26
unicode-normalization0.1.25
unicode-normalization-alignments0.1.12
unicode-properties0.1.4
unicode-segmentation1.13.3
unicode_categories0.1.1
untrusted0.9.0
ureq3.4.2
ureq-proto0.6.4
url2.5.8
utf8-zero0.8.1
utf8_iter1.0.4
uuid1.26.1
vcpkg0.2.15prebuilt objects
version_check0.9.5
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasite0.1.0
wasm-bindgen0.2.128build script, not run
wasm-bindgen-futures0.4.78
wasm-bindgen-macro0.2.128proc macro
wasm-bindgen-macro-support0.2.128
wasm-bindgen-shared0.2.128build script, not run
web-sys0.3.105
web-time1.1.0
webpki-root-certs1.0.9
webpki-roots0.26.11
webpki-roots1.0.9
whoami1.6.1
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.48.0
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.48.5
windows-targets0.52.6
windows_aarch64_gnullvm0.48.5build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.48.5build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.48.5build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.48.5build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.48.5build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.48.5build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.57build script
zerocopy-derive0.8.57proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.0
zeroize_derive1.5.0proc macro
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zmij1.0.23build script
Versions3RiskVulnsPublished
0.2.0not analyzed9d ago
0.1.0yanked13d ago
0.3.0highnone

Raw data

capture
954 KB
records
145,926
bytes per record
6.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run a64a4d0e-befd-4b0c-8788-fad5f3fa2048

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2