Skip to content
Open-Source Registry

cargo / heif-rs

heif-rs 26.10.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
316
operations
33K
packages
161
compiler runs
227
connections
3
job time
1m 31s
capture
387 KB
records
57K
bytes / record
6.7

Encode and decode HEIF/HEIC images with x265 and libde265, via statically-linked libheif.

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

1,796 downloads · Apache-2.0 · source · home page encodingheicheifhevcimage View on crates.io

Graph

egress · high · in libheif.rlib
5

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

4
  • Build script fetched what the build compiled, linked or ran
    heif-rs 26.10.0 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libde265.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libheif.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libx265.a › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
heif-rs 26.10.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · heif-rs

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build-script-build

    subject github.com:443

    by /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build-script-build

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build

  3. What a build script's fetch becamesupport

    36 files came down; the build compiled or linked libde265.a, libheif.a, libx265.a +1 more

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build

In libheif.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build4639

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-6400049a01bf41f7/out/binaries-heif-26.10.0/lib/libde265.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · heif-rs

Witness chain

  1. /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-6400049a01bf41f7/out/binaries-heif-26.10.0/lib/libde265.avia /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      heif-rs asked the linker for it: static de265 (target/release/build/heif-rs-6400049a01bf41f7/output)

    source
  2. member
    artifact

Evidence

  • written under the build script at /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • heif-rs asked the linker for it: static de265 (target/release/build/heif-rs-6400049a01bf41f7/output)

In libheif.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build4639

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-6400049a01bf41f7/out/binaries-heif-26.10.0/lib/libheif.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · heif-rs

Witness chain

  1. /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-6400049a01bf41f7/out/binaries-heif-26.10.0/lib/libheif.avia /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      heif-rs asked the linker for it: static heif (target/release/build/heif-rs-6400049a01bf41f7/output)

    source
  2. member
    artifact

Evidence

  • written under the build script at /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • heif-rs asked the linker for it: static heif (target/release/build/heif-rs-6400049a01bf41f7/output)

In libheif.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build4639

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-6400049a01bf41f7/out/binaries-heif-26.10.0/lib/libx265.awritten by build-script-build
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · heif-rs

Witness chain

  1. /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-6400049a01bf41f7/out/binaries-heif-26.10.0/lib/libx265.avia /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build-script-build from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      heif-rs asked the linker for it: static x265 (target/release/build/heif-rs-6400049a01bf41f7/output)

    source
  2. member
    artifact

Evidence

  • written under the build script at /home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build-script-build from a network connection without a recorded source compilation
  • heif-rs asked the linker for it: static x265 (target/release/build/heif-rs-6400049a01bf41f7/output)

In libheif.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/heif-rs/heif-rs/target/release/build/heif-rs-1afb99741ff87e42/build-script-build4639

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 heif-rs's own build code · build-script-build (heif-rs) · GitHub, Inc. · 36 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 heif-rs's own build code · build-script-build (heif-rs) · Fastly, Inc. · 36 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (heif-rs) via crates.io · 7,082 files · went into an output ecosystem
Dependencies165Build behaviour
adler22.0.1
aho-corasick1.1.4
aligned0.4.3
aligned-vec0.6.4
anyhow1.0.102build script
arbitrary1.4.2
arg_enum_proc_macro0.3.4proc macro
arrayvec0.7.7
as-slice0.2.1
autocfg1.5.1
av-scenechange0.14.1build script
av1-grain0.2.5
avif-serialize0.8.9
base640.22.1
bindgen0.72.1build script
bit_field0.10.3
bitflags2.13.0
bitstream-io4.10.0
built0.8.1
bumpalo3.20.3
bytemuck1.25.0
byteorder-lite0.1.0
bytes1.12.0
cc1.2.65
cexpr0.6.0
cfg-if1.0.4
clang-sys1.8.1build script
color_quant1.1.0
crc32fast1.5.0build script
crossbeam-deque0.8.6
crossbeam-epoch0.9.18
crossbeam-utils0.8.21build script
crunchy0.2.4build script, not run
either1.16.0
equator0.4.2
equator-macro0.4.2proc macro
equivalent1.0.2
exr1.74.0
fax0.2.7
fdeflate0.3.7
find-msvc-tools0.1.9
flate21.1.9
getrandom0.2.17
getrandom0.3.4build script, not run
gif0.14.2
glob0.3.3
half2.7.1
hashbrown0.17.1
http1.4.2
httparse1.10.1build script
image0.25.10
image-webp0.2.4
imgref1.12.2
indexmap2.14.0
interpolate_name0.2.4proc macro
itertools0.13.0
itertools0.14.0
itoa1.0.18
jobserver0.1.34
ld-linux-x86-64.so.2system library
lebe0.5.3
libc0.2.186build script
libc.so.6system library
libfuzzer-sys0.4.13build script, not run
libgcc_s.so.1system library
libloading0.8.9
libm.so.6system library
libmvec.so.1system library
log0.4.33
loop90.1.5
maybe-rayon0.1.1
memchr2.8.2
minimal-lexical0.2.1
miniz_oxide0.8.9
moxcms0.8.1
new_debug_unreachable1.0.6
no_std_io20.9.4
nom7.1.3
nom8.0.0
noop_proc_macro0.3.0proc macro
num-bigint0.4.6
num-derive0.4.2proc macro
num-integer0.1.46
num-rational0.4.2
num-traits0.2.19build script
once_cell1.21.4
paste1.0.15build scriptproc macro
pastey0.1.1proc macro
percent-encoding2.3.2
png0.18.1
ppv-lite860.2.21
prettyplease0.2.37build script
proc-macro21.0.106build script
profiling1.0.18
profiling-procmacros1.0.18proc macro
pxfm0.1.29
qoi0.4.1
quick-error2.0.1
quote1.0.45build script
r-efi5.3.0
rand0.9.4
rand_chacha0.9.0
rand_core0.9.5
rav1e0.8.1build script
ravif0.13.0
rayon1.12.0
rayon-core1.13.0build script
regex1.12.4
regex-automata0.4.14
regex-syntax0.8.11
rgb0.8.53
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.2
rustls0.23.40build script
rustls-pki-types1.14.1
rustls-webpki0.103.13
rustversion1.0.22build script, not runproc macro
shlex1.3.0
shlex2.0.1
simd-adler320.3.9
simd_helpers0.1.0proc macro
smallvec1.15.2
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.118
thiserror2.0.18build script
thiserror-impl2.0.18proc macro
tiff0.11.3
typed-path0.12.3
unicode-ident1.0.24
untrusted0.9.0
ureq3.3.0
ureq-proto0.6.0
utf8-zero0.8.1
v_frame0.3.9
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.125build script, not run
wasm-bindgen-macro0.2.125proc macro
wasm-bindgen-macro-support0.2.125
wasm-bindgen-shared0.2.125build script, not run
webpki-roots1.0.8
weezl0.1.12
windows-link0.2.1
windows-sys0.52.0
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
y4m0.8.0
zerocopy0.8.52build script
zerocopy-derive0.8.52proc macro
zeroize1.9.0
zip8.6.0
zlib-rs0.6.3
zopfli0.8.3
zune-core0.5.1
zune-inflate0.2.54
zune-jpeg0.5.15
Versions4RiskVulnsPublished
26.7.0not analyzed2026-07-03
26.6.1not analyzed2026-06-26
26.6.0not analyzed2026-06-21
26.10.0highnone

Raw data

capture
387 KB
records
57,401
bytes per record
6.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-15 · run 05a0e7cd-d38e-46ea-bd2b-f102c7da647b

analysis 0.1.0 · 2026-10-15 · 20a5b2e · graph v2