Skip to content
Open-Source Registry

cargo / freya-terminal / 0.5.0-beta.12

freya-terminal 0.5.0-beta.12

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
353
operations
60K
packages
285
compiler runs
196
connections
3
job time
3m 05s
capture
785 KB
records
110K
bytes / record
7.1

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 610fe4a3-5892-4332-bd2c-c5daf5ddd184 · built 2026-10-18 · complete View on crates.io

Graph

object-provenance · high · in libfreya_terminal.rlib
18

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

17
  • Uncompiled library linked
    libskia-bindings.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskia.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskparagraph.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskresources.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskshaper.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskunicode_core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskunicode_icu.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libsvg.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskia-bindings.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskia.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskparagraph.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskresources.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskshaper.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskunicode_core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskunicode_icu.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libsvg.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    freya-skia-bindings 0.104.0 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskia-bindings.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskia-bindings.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skia-bindings (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skia-bindings (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskia.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskia.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skia (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skia (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskparagraph.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskparagraph.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skparagraph (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skparagraph (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskresources.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskresources.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skresources (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skresources (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskshaper.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskshaper.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skshaper (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skshaper (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskunicode_core.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskunicode_core.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skunicode_core (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skunicode_core (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskunicode_icu.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libskunicode_icu.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skunicode_icu (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skunicode_icu (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libsvg.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/skia/libsvg.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static svg (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static svg (target/release/build/freya-skia-bindings-57fa75829fa4e0e2/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskia-bindings.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskia-bindings.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skia-bindings (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skia-bindings (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskia.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskia.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skia (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skia (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskparagraph.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskparagraph.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skparagraph (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skparagraph (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskresources.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskresources.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skresources (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skresources (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskshaper.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskshaper.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skshaper (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skshaper (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskunicode_core.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskunicode_core.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skunicode_core (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skunicode_core (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskunicode_icu.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libskunicode_icu.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static skunicode_icu (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static skunicode_icu (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libsvg.awritten by build_script_build-2f4cbf518a365c2d
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · freya

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-746613b43b596b9d2114-x86_64-unknown-linux-gnu-jpegd-jpege-svg-textlayout-webpd-webpe.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/.cache/skia-binaries-7466
  3. /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-e740e4771638871a/out/skia/libsvg.avia /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      freya-skia-bindings asked the linker for it: static svg (target/release/build/freya-skia-bindings-e740e4771638871a/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build_script_build-2f4cbf518a365c2d, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-2f4cbf518a365c2d from a pipe without a recorded source compilation
  • freya-skia-bindings asked the linker for it: static svg (target/release/build/freya-skia-bindings-e740e4771638871a/output)

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast5606
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast5606
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-2f4cbf518a365c2d/build-script-build6166

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
freya-skia-bindings 0.104.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466…

  3. What a build script's fetch becamesupport

    2 files came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build

  5. Tool commandsupport

    Command: curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466…

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466…

In libfreya_terminal.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2481
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2481
  3. build-script-build/home/runner/work/freya/freya/target/release/build/freya-skia-bindings-873d73918c5d472f/build-script-build4145
  4. curlcurl -L -f -sS -C - --create-dirs --output /home/runner/work/freya/freya/target/release/build/freya-skia-bindings-57fa75829fa4e0e2/out/.cache/skia-binaries-7466…4152

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of freya-skia-bindings · curl · GitHub, Inc. · 2 files undeclared
  • release-assets.githubusercontent.com:443 build code of freya-skia-bindings · curl · Fastly, Inc. · 2 files undeclared
  • static.crates.io:8080 the package manager · cargo (freya) via crates.io · 18,675 files · went into an output ecosystem
Dependencies309Build behaviour
accesskit0.25.1
adler22.0.1
aho-corasick1.1.5
android-build0.1.4
anyhow1.0.104build script
async-broadcast0.7.2
async-channel2.5.0
async-executor1.14.0
async-io2.6.0build script
async-lock3.4.2
async-process2.5.0
async-recursion1.1.1proc macro
async-signal0.2.14
async-task4.7.1
async-trait0.1.91proc macro
atomic-waker1.1.2
autocfg1.5.1
base640.23.1
beul1.0.0
bindgen0.73.2build script
bitflags1.3.2
bitflags2.13.1
block20.5.1
block20.6.2
blocking1.6.2
bumpalo3.20.3
bytes1.12.1
calloop0.14.4
calloop-wayland-source0.4.1
cc1.4.1
cexpr0.6.0
cfg-if1.0.4
cfg_aliases0.1.1
clang-sys1.9.1build script
clipboard-win5.4.1
combine4.6.7
concurrent-queue2.5.0
copypasta0.10.2
corcovado0.5.26
crc32fast1.5.0build script
crossbeam-utils0.8.22build script
cursor-icon1.2.0
dirs6.0.0
dirs-sys0.5.0
dispatch20.3.1
dlib0.5.3
downcast-rs1.2.1
easer0.3.0
either1.17.0
endi1.1.1
enumflags20.7.12
enumflags2_derive0.7.12proc macro
equivalent1.0.2
errno0.3.14
error-code3.3.2
euclid0.22.14
event-listener5.4.2
event-listener-strategy0.5.4
fastrand2.5.0
filedescriptor0.8.3
filetime0.2.29
find-msvc-tools0.1.10
flate21.1.9
freya-animation0.5.0-beta.12
freya-clipboard0.5.0-beta.12
freya-components0.5.0-beta.12
freya-core0.5.0-beta.12
freya-edit0.5.0-beta.12
freya-engine0.5.0-beta.12
freya-sdk0.5.0-beta.12
freya-skia-bindings0.104.0build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl, git
freya-skia-safe0.104.0
freya-skia-svg-macros0.104.0proc macro
freya-testing0.5.0-beta.12
futures-channel0.3.33
futures-core0.3.33
futures-io0.3.33
futures-lite2.6.1
futures-macro0.3.33proc macro
futures-task0.3.33
futures-util0.3.33
generational-box0.7.10
gethostname1.1.0
getrandom0.2.17
getrandom0.3.4build script, not run
glob0.3.4
hashbrown0.16.1
hashbrown0.17.1
heck0.5.0
hermit-abi0.5.2
hex0.4.3
hotpath0.28.0build script
hotpath-macros0.28.0proc macro
indexmap2.14.0
itertools0.14.0
itoa1.0.18
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
js-sys0.3.103
keyboard-types0.8.3
lazy_static1.5.0
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
libredox0.1.19
linkify0.11.0
linux-raw-sys0.12.1
lock_api0.4.14
log0.4.33
memchr2.8.3
memmap20.9.11
memoffset0.9.1build script, not run
minimal-lexical0.2.1
miniz_oxide0.8.9
miow0.5.0
miow0.6.1
mundy0.2.3build script
ndk-context0.1.1
nix0.28.0build script
nom7.1.3
num-traits0.2.19build script
objc-sys0.3.5build script, not run
objc20.5.2
objc20.6.5build script, not run
objc2-app-kit0.2.2
objc2-app-kit0.3.2
objc2-cloud-kit0.3.2
objc2-core-data0.2.2
objc2-core-data0.3.2
objc2-core-foundation0.3.2
objc2-core-graphics0.3.2
objc2-core-image0.2.2
objc2-core-image0.3.2
objc2-core-text0.3.2
objc2-core-video0.3.2
objc2-encode4.1.0
objc2-foundation0.2.2
objc2-foundation0.3.2
objc2-io-surface0.3.2
objc2-metal0.2.2
objc2-quartz-core0.2.2
objc2-quartz-core0.3.2
once_cell1.21.4
option-ext0.2.0
ordered-stream0.2.0
parking2.2.1
parking_lot0.12.5
parking_lot_core0.9.12build script
paste1.0.15build scriptproc macro
pathgraph0.5.0-beta.12
percent-encoding2.3.2
phf0.13.1
phf_shared0.13.1
pin-project-lite0.2.17
piper0.2.5
pkg-config0.3.33
polling3.11.0
portable-pty0.9.0
prettyplease0.3.0build script
proc-macro-crate3.5.0
proc-macro21.0.107build script
quick-xml0.41.0
quote1.0.47build script
r-efi5.3.0
ragnarok0.5.0-beta.12
redox_syscall0.5.18
redox_users0.5.2
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
rio-grapheme-width0.5.26
rio-graphics0.5.26
rio-unicode0.5.26
rio-vt0.5.26
ropey1.6.1
rustc-hash2.1.3
rustc_version0.4.1
rustix1.1.4build script
rustversion1.0.23build script, not runproc macro
same-file1.0.6
scoped-tls1.0.1
scopeguard1.2.0
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
serde_repr0.1.21proc macro
serde_spanned1.1.1
serial20.2.38
shared_library0.1.9
shell-words1.1.1
shlex2.0.1
signal-hook0.4.4build script
signal-hook-registry1.4.8
simd-adler320.3.10
simd_cesu81.2.0
simdutf0.7.0build script
simdutf80.1.5
siphasher1.0.3
slab0.4.12
smallvec1.16.3
smithay-client-toolkit0.20.0build script
smithay-clipboard0.7.3
str_indices0.4.4
syn2.0.119
syn3.0.3
tar0.4.46
teletypewriter0.5.26
tempfile3.27.0
thiserror1.0.69build script
thiserror2.0.19build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.19proc macro
tiny-cache0.5.0-beta.12
tiny-notify0.5.0-beta.12
toml1.1.4+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_edit0.25.13+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
torin0.5.0-beta.12
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
ucd-trie0.1.7
uds_windows1.2.1
unicode-ident1.0.24
unicode-segmentation1.13.3
uuid1.24.0
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-futures0.4.76
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
wayland-backend0.3.16build script
wayland-client0.31.15build script
wayland-csd-frame0.3.0
wayland-cursor0.31.14
wayland-protocols0.32.13
wayland-protocols-experimental20250721.0.1
wayland-protocols-misc0.3.12
wayland-protocols-wlr0.3.12
wayland-scanner0.31.11proc macro
wayland-sys0.31.11build script
web-sys0.3.103
web-time1.1.0
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows0.62.2
windows-collections0.3.2
windows-core0.62.2
windows-future0.3.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-numerics0.3.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.42.0
windows-sys0.52.0
windows-sys0.59.0
windows-sys0.61.2
windows-targets0.52.6
windows-threading0.2.1
windows_aarch64_gnullvm0.42.2build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.42.2build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.42.2build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.42.2build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.42.2build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.42.2build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.42.2build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.4
winreg0.10.1build script, not run
wit-bindgen0.57.1build script, not runprebuilt objects
x11-clipboard0.9.3
x11rb0.13.2
x11rb-protocol0.13.2
xattr1.6.1
xcursor0.3.11
xkeysym0.2.1
zbus5.19.0
zbus_macros5.19.0proc macro
zbus_names4.3.4
zcheapstr1.1.0
zmij1.0.23build script
zvariant5.15.0
zvariant_derive5.15.0proc macro
zvariant_utils4.2.0
Versions37RiskVulnsPublished
0.5.0-rc.107d ago
0.5.0-beta.118d ago
0.5.0-beta.99d ago
0.5.0-rc.9not analyzed2026-10-04
0.5.0-rc.8not analyzed2026-09-29
0.5.0-rc.7not analyzed2026-09-21
0.5.0-rc.6not analyzed2026-09-13
0.5.0-rc.5not analyzed2026-09-07
0.4.3not analyzed2026-08-30
0.5.0-rc.4not analyzed2026-08-23
0.5.0-rc.3not analyzed2026-08-16
0.5.0-rc.2not analyzed2026-08-09
0.4.1not analyzed2026-08-02
0.5.0-rc.1not analyzed2026-08-02
0.4.0not analyzed2026-07-16
0.4.0-rc.24not analyzed2026-07-06
0.4.0-rc.23not analyzed2026-06-09
0.4.0-rc.22not analyzed2026-06-01
0.4.0-rc.21not analyzed2026-05-28
0.4.0-rc.20not analyzed2026-05-27
0.4.0-rc.19not analyzed2026-04-23
0.4.0-rc.18not analyzed2026-04-11
0.4.0-rc.17not analyzed2026-04-03
0.4.0-rc.16not analyzed2026-03-26
0.4.0-rc.15not analyzed2026-03-21
0.4.0-rc.14not analyzed2026-03-16
0.4.0-rc.13not analyzed2026-03-08
0.4.0-rc.12not analyzed2026-03-05
0.4.0-rc.11not analyzed2026-03-01
0.4.0-rc.10not analyzed2026-02-24
0.4.0-rc.9not analyzed2026-02-16
0.4.0-rc.8not analyzed2026-02-15
0.4.0-rc.7not analyzed2026-02-07
0.4.0-rc.6not analyzed2026-01-25
0.4.0-rc.5not analyzed2026-01-23
0.4.0-rc.4not analyzed2026-01-21
0.5.0-beta.12highnone

Raw data

capture
785 KB
records
109,854
bytes per record
7.1

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-18 · run 610fe4a3-5892-4332-bd2c-c5daf5ddd184

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2