Skip to content
Open-Source Registry

cargo / ferroui-browser / 0.1.0-preview.4

ferroui-browser 0.1.0-preview.4

bitbison: no public build not built
processes
404
operations
49K
packages
395
compiler runs
15
connections
3
job time
20m 17s
capture
792 KB
records
93K
bytes / record
8.5

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 3618cad3-0d51-44a4-b8ab-5f77f04b3f87 · built 2026-10-17 · complete View on crates.io

This release did not build; nothing below stands for the package.

Graph

egress · medium
5

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

3
  • Uncompiled library linked
    libskia-bindings.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskia.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    skia-bindings 0.153.3 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/skia/libskia-bindings.awritten by build_script_build-f8c374b8cda0c073
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · FerroUI

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-ganesh-gl-jpegd-jpege-pdf-vulkan.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043
  3. /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/skia/libskia-bindings.avia /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build_script_build-f8c374b8cda0c073, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-f8c374b8cda0c073 from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      skia-bindings asked the linker for it: static skia-bindings (target/release/build/skia-bindings-e20d0f0ad3c0afdb/output)

    subject

Evidence

  • written under the build script at /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build_script_build-f8c374b8cda0c073, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-f8c374b8cda0c073 from a pipe without a recorded source compilation
  • skia-bindings asked the linker for it: static skia-bindings (target/release/build/skia-bindings-e20d0f0ad3c0afdb/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build-script-build3683

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/skia/libskia.awritten by build_script_build-f8c374b8cda0c073
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · FerroUI

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-ganesh-gl-jpegd-jpege-pdf-vulkan.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043
  3. /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/skia/libskia.avia /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build_script_build-f8c374b8cda0c073, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-f8c374b8cda0c073 from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      skia-bindings asked the linker for it: static skia (target/release/build/skia-bindings-e20d0f0ad3c0afdb/output)

    subject

Evidence

  • written under the build script at /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build_script_build-f8c374b8cda0c073, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-f8c374b8cda0c073 from a pipe without a recorded source compilation
  • skia-bindings asked the linker for it: static skia (target/release/build/skia-bindings-e20d0f0ad3c0afdb/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build-script-build3683

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
skia-bindings 0.153.3
Destination
github.com:443, release-assets.githubusercontent.com:443
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build_script_build-f8c374b8cda0c073

  5. Tool commandsupport

    Command: curl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043…

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-f8c374b8cda0c073/build-script-build3683
  4. curlcurl -L -f -sS -C - --create-dirs --output /home/runner/work/FerroUI/FerroUI/target/release/build/skia-bindings-e20d0f0ad3c0afdb/out/.cache/skia-binaries-b7f043…3688

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of skia-bindings · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of skia-bindings · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (FerroUI) via crates.io · 18,180 files · went into an output ecosystem
Dependencies409Build behaviour
adler22.0.1
aho-corasick1.1.5
arrayvec0.7.8
ash0.38.0+1.3.281build script
autocfg1.5.1
bindgen0.72.1build script
bitflags2.13.2
bumpalo3.20.3
cc1.6.0
cexpr0.6.0
cfg-if1.0.5
clang-sys1.9.1build script
crc32fast1.5.2build script
deranged0.5.8
either1.18.0
equivalent1.0.2
errno0.3.14
ferroui-base0.1.0-preview.4build script
ferroui-build0.1.0-preview.4
ferroui-build-scan0.1.0-preview.4
ferroui-controls0.1.0-preview.4build script
ferroui-dialogs0.1.0-preview.4build script, not run
ferroui-fonts-inter0.1.0-preview.4
ferroui-harfbuzz0.1.0-preview.4
ferroui-markup0.1.0-preview.4
ferroui-markup-xaml0.1.0-preview.4build script
ferroui-markup-xaml-loader0.1.0-preview.4
ferroui-metal0.1.0-preview.4
ferroui-opengl0.1.0-preview.4build script
ferroui-remote-protocol0.1.0-preview.4
ferroui-skia0.1.0-preview.4build script
ferroui-themes-fluent0.1.0-preview.4build script, not run
ferroui-vulkan0.1.0-preview.4
filetime0.2.29
find-msvc-tools0.1.14
flate21.1.10
glob0.3.4
harfbuzz-sys0.8.0build script
hashbrown0.17.1
heck0.5.0
indexmap2.14.2
itertools0.13.0
itoa1.0.18
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
log0.4.34
memchr2.8.3
minimal-lexical0.2.1
miniz_oxide0.9.1
nom7.1.3
num-conv0.2.2
num-traits0.2.19build script
objc2-core-foundation0.3.2
objc2-io-kit0.3.2
once_cell1.21.4
paste1.0.15build scriptproc macro
pkg-config0.3.34
powerfmt0.2.0
prettyplease0.2.37build script
proc-macro21.0.107build script
quote1.0.47build script
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
roxmltree0.20.0
rust_decimal1.43.0build script
rustc-hash2.1.3
rustix1.1.5build script
rustversion1.0.23build scriptproc macro
serde1.0.229build script, not run
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_spanned1.1.1
shlex1.3.0
shlex2.0.1
simd-adler320.3.10
skia-bindings0.153.3build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl, git
skia-safe0.153.3
syn2.0.119
syn3.0.6
sysinfo0.37.2
tar0.4.46
time0.3.55
time-core0.1.9
toml1.1.6+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
unicode-ident1.0.26
wasm-bindgen0.2.129build script
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build scriptruns toolsgit
windows0.61.3
windows-collections0.2.0
windows-core0.61.2
windows-future0.2.1
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.1.3
windows-link0.2.1
windows-numerics0.2.0
windows-result0.3.4
windows-strings0.4.2
windows-sys0.61.2
windows-threading0.1.0
winnow1.0.4
xamlx0.1.0-preview.4
xattr1.6.1
zlib-rs0.6.8
zmij1.0.23build script
@esbuild/aix-ppc640.25.10
@esbuild/android-arm0.25.10
@esbuild/android-arm640.25.10
@esbuild/android-x640.25.10
@esbuild/darwin-arm640.25.10
@esbuild/darwin-x640.25.10
@esbuild/freebsd-arm640.25.10
@esbuild/freebsd-x640.25.10
@esbuild/linux-arm0.25.10
@esbuild/linux-arm640.25.10
@esbuild/linux-ia320.25.10
@esbuild/linux-loong640.25.10
@esbuild/linux-mips64el0.25.10
@esbuild/linux-ppc640.25.10
@esbuild/linux-riscv640.25.10
@esbuild/linux-s390x0.25.10
@esbuild/linux-x640.25.10
@esbuild/netbsd-arm640.25.10
@esbuild/netbsd-x640.25.10
@esbuild/openbsd-arm640.25.10
@esbuild/openbsd-x640.25.10
@esbuild/openharmony-arm640.25.10
@esbuild/sunos-x640.25.10
@esbuild/win32-arm640.25.10
@esbuild/win32-ia320.25.10
@esbuild/win32-x640.25.10
@eslint-community/eslint-utils4.10.1
@eslint-community/regexpp4.12.2
@eslint/eslintrc2.1.4
@eslint/js8.57.1
@humanwhocodes/config-array0.13.0
@humanwhocodes/module-importer1.0.1
@humanwhocodes/object-schema2.0.3
@nodelib/fs.scandir2.1.5
@nodelib/fs.stat2.0.5
@nodelib/fs.walk1.2.8
@rtsao/scc1.1.0
@types/json-schema7.0.15
@types/json50.0.29
@types/semver7.8.0
@typescript-eslint/eslint-plugin5.62.0
@typescript-eslint/parser5.62.0
@typescript-eslint/scope-manager5.62.0
@typescript-eslint/type-utils5.62.0
@typescript-eslint/types5.62.0
@typescript-eslint/typescript-estree5.62.0
@typescript-eslint/utils5.62.0
@typescript-eslint/visitor-keys5.62.0
@ungap/structured-clone1.4.0
acorn8.19.0
acorn-jsx5.3.2
ajv6.15.0
ansi-regex5.0.1
ansi-styles4.3.0
argparse2.0.1
array-buffer-byte-length1.0.2
array-includes3.2.0
array-union2.1.0
array.prototype.findlastindex1.2.6
array.prototype.flat1.3.3
array.prototype.flatmap1.3.3
arraybuffer.prototype.slice1.0.4
async-function1.0.0
available-typed-arrays1.0.7
balanced-match1.0.2
brace-expansion1.1.21
braces3.0.3
builtins5.1.0
call-bind1.0.9
call-bind-apply-helpers1.0.2
call-bound1.0.4
callsites3.1.0
chalk4.1.2
color-convert2.0.1
color-name1.1.4
concat-map0.0.1
cross-spawn7.0.6
data-view-buffer1.0.2
data-view-byte-length1.0.2
data-view-byte-offset1.0.1
debug3.2.7
debug4.4.3
deep-is0.1.4
define-data-property1.1.4
define-properties1.2.1
dir-glob3.0.1
doctrine2.1.0
doctrine3.0.0
dunder-proto1.0.1
es-abstract1.24.2
es-abstract-get1.0.0
es-define-property1.0.1
es-errors1.3.0
es-object-atoms1.1.2
es-set-tostringtag2.1.0
es-shim-unscopables1.1.0
es-to-primitive1.3.4
esbuild0.25.10
escape-string-regexp4.0.0
eslint8.57.1
eslint-config-standard17.0.0
eslint-config-standard-with-typescript23.0.0
eslint-import-resolver-node0.3.10
eslint-module-utils2.14.0
eslint-plugin-es4.1.0
eslint-plugin-import2.32.0
eslint-plugin-n15.7.0
eslint-plugin-promise6.6.0
eslint-scope5.1.1
eslint-scope7.2.2
eslint-utils2.1.0
eslint-utils3.0.0
eslint-visitor-keys1.3.0
eslint-visitor-keys2.1.0
eslint-visitor-keys3.4.3
espree9.6.1
esquery1.7.0
esrecurse4.3.0
estraverse4.3.0
estraverse5.3.0
esutils2.0.3
fast-deep-equal3.1.3
fast-glob3.3.3
fast-json-stable-stringify2.1.0
fast-levenshtein2.0.6
fastq1.20.3
ferroui.browser
fetch-blob3.2.0
file-entry-cache6.0.1
fill-range7.1.1
find-up5.0.0
flat-cache3.2.0
flatted3.4.4
for-each0.3.5
fs.realpath1.0.0
function-bind1.1.2
function.prototype.name1.2.0
functions-have-names1.2.3
generator-function2.0.1
get-intrinsic1.3.0
get-proto1.0.1
get-symbol-description1.1.0
glob7.2.3
glob-parent5.1.2
glob-parent6.0.2
globals13.24.0
globalthis1.0.4
globby11.1.0
gopd1.2.0
graphemer1.4.0
has-bigints1.1.0
has-flag4.0.0
has-property-descriptors1.0.2
has-proto1.2.0
has-symbols1.1.0
has-tostringtag1.0.2
hasown2.0.4
ignore5.3.2
import-fresh3.3.1
imurmurhash0.1.4
inflight1.0.6
inherits2.0.4
internal-slot1.1.0
is-array-buffer3.0.5
is-async-function2.1.1
is-bigint1.1.0
is-boolean-object1.2.2
is-callable1.2.7
is-core-module2.17.0
is-data-view1.0.2
is-date-object1.1.0
is-document.all1.0.0
is-extglob2.1.1
is-finalizationregistry1.1.1
is-generator-function1.1.2
is-glob4.0.3
is-map2.0.3
is-negative-zero2.0.3
is-number7.0.0
is-number-object1.1.1
is-path-inside3.0.3
is-regex1.2.1
is-set2.0.3
is-shared-array-buffer1.0.4
is-string1.1.1
is-symbol1.1.1
is-typed-array1.1.15
is-weakmap2.0.2
is-weakref1.1.1
is-weakset2.0.4
isarray2.0.5
isexe2.0.0
js-yaml4.3.2
json-buffer3.0.1
json-schema-traverse0.4.1
json-stable-stringify-without-jsonify1.0.1
json51.0.2
keyv4.5.4
levn0.4.1
locate-path6.0.0
lodash.merge4.6.2
math-intrinsics1.1.0
merge21.4.1
micromatch4.0.8
minimatch3.1.5
minimist1.2.8
ms2.1.3
native-file-system-adapter3.0.0
natural-compare1.4.0
natural-compare-lite1.4.1
node-domexception1.0.0
node-exports-info1.6.2
object-inspect1.13.4
object-keys1.1.1
object.assign4.1.7
object.entries1.1.9
object.fromentries2.0.8
object.groupby1.0.3
object.values1.2.1
once1.4.0
optionator0.9.4
own-keys1.0.2
p-limit3.1.0
p-locate5.0.0
parent-module1.0.1
path-exists4.0.0
path-is-absolute1.0.1
path-key3.1.1
path-parse1.0.7
path-type4.0.0
picomatch2.3.2
possible-typed-array-names1.1.0
prelude-ls1.2.1
punycode2.3.1
queue-microtask1.2.3
reflect.getprototypeof1.0.10
regexp.prototype.flags1.5.4
regexpp3.2.0
resolve1.22.12
resolve2.0.0-next.7
resolve-from4.0.0
reusify1.1.0
rimraf3.0.2
run-parallel1.2.0
safe-array-concat1.1.4
safe-push-apply1.0.0
safe-regex-test1.1.0
semver6.3.1
semver7.8.5
set-function-length1.2.2
set-function-name2.0.2
set-proto1.0.0
shebang-command2.0.0
shebang-regex3.0.0
side-channel1.1.1
side-channel-list1.0.1
side-channel-map1.0.1
side-channel-weakmap1.0.2
slash3.0.0
stop-iteration-iterator1.1.0
string.prototype.trim1.2.11
string.prototype.trimend1.0.10
string.prototype.trimstart1.0.8
strip-ansi6.0.1
strip-bom3.0.0
strip-json-comments3.1.1
supports-color7.2.0
supports-preserve-symlinks-flag1.0.0
text-table0.2.0
to-regex-range5.0.1
tsconfig-paths3.15.0
tslib1.14.1
tsutils3.21.0
type-check0.4.0
type-fest0.20.2
typed-array-buffer1.0.3
typed-array-byte-length1.0.3
typed-array-byte-offset1.0.5
typed-array-length1.0.8
typescript5.8.3
unbox-primitive1.1.0
uri-js4.4.1
web-streams-polyfill3.3.3
which2.0.2
which-boxed-primitive1.1.1
which-builtin-type1.2.1
which-collection1.0.2
which-typed-array1.1.24
word-wrap1.2.5
wrappy1.0.2
yocto-queue0.1.0
Versions4RiskVulnsPublished
0.1.0-preview.4did not build1d ago
0.1.0-preview.3not analyzed2d ago
0.1.0-preview.2not analyzed2d ago
0.1.0-preview.1not analyzed3d ago

Raw data

capture
792 KB
records
92,746
bytes per record
8.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test failure · Generated 2026-10-17 · run 3618cad3-0d51-44a4-b8ab-5f77f04b3f87

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2