Skip to content
Open-Source Registry

cargo / egm96 / 0.3.2

egm96 0.3.2

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
275
operations
372K
packages
258
compiler runs
4,653
connections
2
job time
3m 29s
capture
1.8 MB
records
517K
bytes / record
3.6

Build behaviourits build script reached micahcc.github.ioundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 1f70b5ed-409c-48d2-b10b-f710c02fdd6d · built 2026-10-17 · complete View on crates.io

Graph

egress · high · in libegm96.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    egm96 0.3.2 › micahcc.github.io:443
    high
  • Downloaded file compiled into the artifact
    egm96-5.png › micahcc.github.io
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
egm96 0.3.2
Destination
micahcc.github.io:443
Reaches
Jobs
build-test
Rule
egress · egm96-rs

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to micahcc.github.io:443, opened by build_script_build-fd801f8d3b65934d

    subject micahcc.github.io:443

    by /home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build-script-build

  2. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked egm96-5.png

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build_script_build-fd801f8d3b65934d

In libegm96.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2469
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2469
  3. build-script-build/home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build-script-build15717

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-d93b26f2186d60eb/out/egm96-5.pngwritten by build_script_build-fd801f8d3b65934d
Destination
micahcc.github.io
Jobs
build-test
Rule
object-provenance · egm96-rs

Witness chain

  1. micahcc.github.io:443
    source
  2. /home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-d93b26f2186d60eb/out/egm96-5.pngvia /home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build-script-build
    • Object written under a build script that downloadedfrom micahcc.github.io

      written under the build script at /home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build_script_build-fd801f8d3b65934d, which downloaded from micahcc.github.io

    • Obfuscated toolchain bypass

      Written by build_script_build-fd801f8d3b65934d from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build_script_build-fd801f8d3b65934d, which downloaded from micahcc.github.io
  • Written by build_script_build-fd801f8d3b65934d from a network connection without a recorded source compilation

In libegm96.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2469
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2469
  3. build-script-build/home/runner/work/egm96-rs/egm96-rs/target/release/build/egm96-fd801f8d3b65934d/build-script-build15717

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • micahcc.github.io:443 egm96's own build code · build_script_build-fd801f8d3b65934d (egm96-rs) · Fastly, Inc. · 1 file · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (egm96-rs) via crates.io · 21,644 files · went into an output ecosystem
Dependencies264Build behaviour
adler22.0.1
aho-corasick1.1.5
alloca0.4.0build script
anes0.1.6
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
anstyle-wincon3.0.11
atomic-waker1.1.2
autocfg1.5.1
aws-lc-rs1.18.1build script
aws-lc-sys0.45.0build scriptprebuilt objects
base640.22.1
bitflags1.3.2
bitflags2.13.1
bumpalo3.20.3
bytes1.12.1
cast0.3.0
cc1.4.5
cfg-if1.0.4
cfg_aliases0.2.2
chacha200.10.2
ciborium0.2.2
ciborium-io0.2.2
ciborium-ll0.2.2
clap4.6.6
clap_builder4.6.6
clap_lex1.1.0
cmake0.1.58
colorchoice1.0.5
combine4.6.8
core-foundation0.10.1
core-foundation0.9.4
core-foundation-sys0.8.7
core_detect1.0.0
cpufeatures0.3.1
crc32fast1.5.1build script
criterion0.8.2
criterion-plot0.8.2
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crunchy0.2.4build script, not run
defmt1.1.1build script, not run
defmt-macros1.1.1build script, not runproc macro
defmt-parser1.0.0
displaydoc0.2.7proc macro
dunce1.0.5
either1.18.0
encoding_rs0.8.40build script
env_filter2.0.0
env_logger0.11.11
equivalent1.0.2
errno0.3.14
fastrand2.5.0
fdeflate0.3.7
find-msvc-tools0.1.12
flate21.1.10
fnv1.0.7
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
fs_extra1.3.0
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
getrandom0.2.17
getrandom0.4.3build script, not run
h20.4.19
half2.7.1
hashbrown0.17.1
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.11.1
hyper-rustls0.27.9
hyper-tls0.6.0
hyper-util0.1.20
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
indexmap2.14.2
ipnet2.12.2
is_terminal_polyfill1.70.2
itertools0.13.0
itoa1.0.18
jiff0.2.35
jiff-core0.1.0
jiff-static0.2.35proc macro
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
jobserver0.1.35
js-sys0.3.105
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
litemap0.8.3
log0.4.34
lru-slab0.1.2
memchr2.8.3
mime0.3.17
miniz_oxide0.8.9
miniz_oxide0.9.1
mio1.2.3
multiversion0.8.0
multiversion-macros0.8.0proc macro
multiversion_no_op1.0.0proc macro
native-tls0.2.18build script
num-traits0.2.19build script
once_cell1.21.4
once_cell_polyfill1.70.2
oorandom11.1.5
openssl0.10.81build script
openssl-macros0.1.1proc macro
openssl-probe0.2.1
openssl-src300.6.1+3.6.3
openssl-sys0.9.117build script
page_size0.6.0
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
plotters0.3.7
plotters-backend0.3.7
plotters-svg0.3.7
png0.18.1
portable-atomic1.15.0build script, not run
portable-atomic-util0.2.8build script, not run
potential_utf0.1.6
proc-macro21.0.107build script
quinn0.11.11build script, not run
quinn-proto0.11.17
quinn-udp0.5.15build script, not run
quote1.0.47build script
r-efi6.0.0
rand0.10.2
rand_core0.10.1
rand_pcg0.10.2
rayon1.12.0
rayon-core1.13.0build script
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.13.4
ring0.17.14build script, not runprebuilt objects
rustc-hash2.1.3
rustc_version0.4.1
rustix1.1.4build script, not run
rustls0.23.44build script
rustls-native-certs0.8.4
rustls-pki-types1.15.1
rustls-platform-verifier0.7.0
rustls-platform-verifier-android0.1.1
rustls-webpki0.103.15
rustversion1.0.23build scriptproc macro
same-file1.0.6
schannel0.1.29
scopeguard1.2.0
security-framework3.7.0
security-framework-sys2.17.0
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
shlex2.0.1
simd-adler320.3.10
simd_cesu81.2.0
simdutf80.1.5
slab0.4.12
smallvec1.16.0
socket20.6.5
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.5
sync_wrapper1.0.2
synstructure0.13.2
system-configuration0.7.0
system-configuration-sys0.6.0build script, not run
target-features0.1.6build script
tempfile3.27.0
thiserror2.0.20build script, not run
thiserror-impl2.0.20proc macro
tinystr0.8.4
tinytemplate1.2.1
tinyvec1.13.2
tinyvec_macros0.1.1
tokio1.53.1
tokio-native-tls0.3.1
tokio-rustls0.26.5
tokio-util0.7.19
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
unicode-ident1.0.24
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
utf8parse0.2.2
vcpkg0.2.15prebuilt objects
walkdir2.5.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.128build script, not run
wasm-bindgen-futures0.4.78
wasm-bindgen-macro0.2.128proc macro
wasm-bindgen-macro-support0.2.128
wasm-bindgen-shared0.2.128build script, not run
web-sys0.3.105
web-time1.1.0
webpki-root-certs1.0.9
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-link0.2.1
windows-registry0.6.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.4
yoke0.8.3
yoke-derive0.8.2proc macro
zerocopy0.8.56build script
zerocopy-derive0.8.56proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.7
zmij1.0.23build script
Versions12RiskVulnsPublished
0.3.1not analyzed2026-09-13
0.3.0not analyzed2026-09-08
0.2.3not analyzed2025-05-30
0.2.2not analyzed2025-05-30
0.2.1not analyzed2025-05-27
0.1.6not analyzed2025-05-18
0.1.5not analyzed2025-05-17
0.1.4not analyzed2025-05-17
0.1.3not analyzed2025-05-17
0.1.2not analyzed2025-05-17
0.1.1not analyzed2025-05-17
0.3.2highnone

Raw data

capture
1.8 MB
records
516,568
bytes per record
3.6

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run 1f70b5ed-409c-48d2-b10b-f710c02fdd6d

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2