Skip to content
Open-Source Registry

cargo / hatchery-arcade-preview / 0.2.6

hatchery-arcade-preview 0.2.6

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured 5 detections3 vulnerabilities
processes
247
operations
38K
packages
169
compiler runs
146
connections
3
job time
1m 52s
capture
507 KB
records
70K
bytes / record
7.3

Build behaviourundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.io

run c4b9935d-8b82-4b62-8bf1-e13f0186f075 · built 2026-10-14 · complete

Artifact

binary · retained · product · graph v2
1

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓▲✓✓
Pipeline✓

Detections

5
  • Build script fetched what the build compiled, linked or ran
    uzor-fonts 1.5.2 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Downloaded file compiled into the artifact
    NotoColorEmoji.ttf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansArabic-Regular.ttf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansCJKsc-Regular.otf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansDevanagari-Regular.ttf › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
uzor-fonts 1.5.2
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
hatchery_arcade_preview-6506e6005d5f155dmember
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…

  3. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked NotoColorEmoji.ttf

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build

  5. Tool commandsupport

    Command: curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2458
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2458
  3. build-script-build/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build3826
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…3831

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoColorEmoji.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · hatchery-arcade-preview

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoColorEmoji.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. hatchery_arcade_preview-6506e6005d5f155dmember
    artifact

Evidence

  • written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2458
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2458
  3. build-script-build/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build3826
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…3831

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoSansArabic-Regular.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · hatchery-arcade-preview

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoSansArabic-Regular.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. hatchery_arcade_preview-6506e6005d5f155dmember
    artifact

Evidence

  • written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2458
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2458
  3. build-script-build/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build3826
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…3844

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoSansCJKsc-Regular.otfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · hatchery-arcade-preview

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoSansCJKsc-Regular.otfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. hatchery_arcade_preview-6506e6005d5f155dmember
    artifact

Evidence

  • written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2458
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2458
  3. build-script-build/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build3826
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…3833

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoSansDevanagari-Regular.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · hatchery-arcade-preview

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-89597ab368edb378/out/NotoSansDevanagari-Regular.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. hatchery_arcade_preview-6506e6005d5f155dmember
    artifact

Evidence

  • written under the build script at /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2458
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2458
  3. build-script-build/home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/release/build/uzor-fonts-844d40fe979d3fa2/build-script-build3826
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/hatchery-arcade-preview/hatchery-arcade-preview/target/r…3849

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of uzor-fonts · curl · GitHub, Inc. · 1 file · went into an output undeclared
  • release-assets.githubusercontent.com:443 build code of uzor-fonts · curl · Fastly, Inc. · 1 file · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (hatchery-arcade-preview) via crates.io · 12,242 files · went into an output ecosystem
Dependencies176Build behaviour
ab_glyph0.2.32
ab_glyph_rasterizer0.1.10
arrayvec0.7.6
bincode1.3.3
bitflags2.11.0
bitvec1.1.1
bumpalo3.20.2
bytemuck1.25.2
byteorder-lite0.1.0
castaway0.2.4
cfg-if1.0.4
color0.3.3
compact_str0.8.2
cosmic-text0.12.1
crc32fast1.5.2build script
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crossterm0.28.1
either1.18.0
errno0.3.14
fastrand2.5.0
fdeflate0.3.7
flate21.1.10
font-types0.7.3
fontconfig-parser0.5.8
fontdb0.16.2
funty2.0.0
hatchery-arcade-engine0.1.0
hatchery-arcade-pet-bastion0.1.0
hatchery-arcade-pet-bastion-render0.1.0
hatchery-arcade-sweep0.1.0
hypher0.1.8
icy_sixel0.6.0
image0.25.10
itoa1.0.18
kurbo0.13.1
ld-linux-x86-64.so.2system library
libc0.2.183build script
libc.so.6system library
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
linebender_resource_handle0.1.1
linux-raw-sys0.4.15
lock_api0.4.14
log0.4.29
memchr2.8.0
memmap20.9.11
metrics0.24.6
miniz_oxide0.9.1
mio1.2.0
moxcms0.8.1
multiversion0.8.0
num-traits0.2.19build script
ordered-float5.5.0
owned_ttf_parser0.25.1
palette0.7.7
palette_math0.7.7
parking_lot0.12.5
parking_lot_core0.9.12build script
peniko0.6.1
png0.18.1
polycool0.4.0
pxfm0.1.30
quantette0.6.0
radium0.7.0build script
rand0.10.3
rand_core0.10.1
rand_xoshiro0.8.1
rangemap1.8.0
rapidhash4.5.1
rayon1.12.0
rayon-core1.13.0build script
read-fonts0.22.7
ref-cast1.0.27build script
roxmltree0.20.0
rustc-hash1.1.0
rustix0.38.44build script
rustybuzz0.14.1
ryu1.0.23
safe_arch1.2.0
scopeguard1.2.0
self_cell1.3.0
serde1.0.228build script
serde_core1.0.228build script
serde_json1.0.149build script
signal-hook0.3.18build script
signal-hook-mio0.2.5
signal-hook-registry1.4.8
simd-adler320.3.10
skrifa0.22.3
slotmap1.1.1build script
smallvec1.15.1
static_assertions1.1.0
swash0.1.19
sys-locale0.3.2
tap1.0.1
target-features0.1.6build script
thiserror1.0.69build script
thiserror2.0.18build script
tinyvec1.13.3
ttf-parser0.20.0
ttf-parser0.21.1
ttf-parser0.25.1
unicode-bidi0.3.18
unicode-bidi-mirroring0.2.0
unicode-ccc0.2.0
unicode-linebreak0.1.5
unicode-properties0.1.4
unicode-script0.5.8
unicode-segmentation1.13.3
unicode-width0.2.2
uzor1.5.2
uzor-fonts1.5.2build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
uzor-text1.5.2
uzor-tui1.5.2
uzor-urx-core1.5.2
uzor-urx-cpu1.5.2
uzor-urx-image1.5.2
vt1000.16.2
vte0.15.0
wide1.7.1
wyz0.5.1
yazi0.1.6
zeno0.2.3
zmij1.0.21build script
adler22.0.1
ahash0.8.12build script
const-random0.1.18
miniz_oxide0.8.9
once_cell1.21.4
zerocopy0.8.48build script
autocfg1.5.0
by_address1.2.1
bytemuck_derive1.12.1proc macro
const-random-macro0.1.16proc macro
crossterm_winapi0.9.1
crunchy0.2.4build script
euclid0.22.14
getrandom0.2.17
multiversion-macros0.8.0proc macro
palette_derive0.7.7proc macro
portable-atomic1.15.0build script, not run
proc-macro21.0.106build script
quote1.0.45build script
redox_syscall0.5.18
ref-cast-impl1.0.27proc macro
rustversion1.0.22build scriptproc macro
serde_derive1.0.228proc macro
syn2.0.117
syn3.0.6
thiserror-impl1.0.69proc macro
thiserror-impl2.0.18proc macro
tiny-keccak2.0.2build script
unicode-ident1.0.24
version_check0.9.5
wasi0.11.1+wasi-snapshot-preview1
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-link0.2.1
windows-sys0.59.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
zerocopy-derive0.8.48proc macro
zlib-rs0.6.8
Vulnerabilities3PackageVersionFixSeverityTitleReach
RUSTSEC-2025-0141bincode1.3.3none publishedlowBincode is unmaintainedretained
RUSTSEC-2026-0206rustybuzz0.14.1none publishedlow`rustybuzz` is unmaintainedretained
RUSTSEC-2026-0192ttf-parser0.20.0, 0.21.1, 0.25.1none publishedlow`ttf-parser` is unmaintainedretained

Raw data

capture
507 KB
records
69,786
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-14 · run c4b9935d-8b82-4b62-8bf1-e13f0186f075

analysis 0.1.0 · 2026-10-14 · afb437c · graph v2