Skip to content
Open-Source Registry

cargo / ipx-cli / 1.0.4

ipx-cli 1.0.4

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
142
operations
15K
packages
77
compiler runs
147
connections
3
job time
31s
capture
193 KB
records
26K
bytes / record
7.4

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run bbb08205-d253-41a7-8367-f16d1d92398e · built 2026-10-18 · complete View on crates.io

Graph

egress · high · in ipx
4

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

3
  • Build script fetched what the build compiled, linked or ran
    ipx-cli 1.0.4 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Downloaded file compiled into the artifact
    ipx.bin › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    ipx.sha256 › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
ipx-cli 1.0.4
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
ipx-d9488f6f16896995build
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-ba546fa01c957bcd

    subject github.com:443

    by /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-ba546fa01c957bcd

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build

  3. What a build script's fetch becamesupport

    2 files came down; the build compiled or linked ipx.bin, ipx.sha256

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build_script_build-ba546fa01c957bcd

In ipx

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2467
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2467
  3. build-script-build/home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build3312

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/cli/cli/target/release/build/ipx-cli-40dcbcffc2dfd3c5/out/ipx.binwritten by build_script_build-ba546fa01c957bcd
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · cli

Witness chain

  1. /home/runner/work/cli/cli/target/release/build/ipx-cli-40dcbcffc2dfd3c5/out/ipx.binvia /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build_script_build-ba546fa01c957bcd, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-ba546fa01c957bcd from a network connection without a recorded source compilation

    source
  2. ipx-d9488f6f16896995member
    artifact

Evidence

  • written under the build script at /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build_script_build-ba546fa01c957bcd, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-ba546fa01c957bcd from a network connection without a recorded source compilation

In ipx

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2467
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2467
  3. build-script-build/home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build3312

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/cli/cli/target/release/build/ipx-cli-40dcbcffc2dfd3c5/out/ipx.sha256written by build_script_build-ba546fa01c957bcd
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · cli

Witness chain

  1. /home/runner/work/cli/cli/target/release/build/ipx-cli-40dcbcffc2dfd3c5/out/ipx.sha256via /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build_script_build-ba546fa01c957bcd, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-ba546fa01c957bcd from a network connection without a recorded source compilation

    source
  2. ipx-d9488f6f16896995member
    artifact

Evidence

  • written under the build script at /home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build_script_build-ba546fa01c957bcd, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-ba546fa01c957bcd from a network connection without a recorded source compilation

In ipx

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2467
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2467
  3. build-script-build/home/runner/work/cli/cli/target/release/build/ipx-cli-ba546fa01c957bcd/build-script-build3312

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 ipx-cli's own build code · build_script_build-ba546fa01c957bcd · GitHub, Inc. · 2 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 ipx-cli's own build code · build_script_build-ba546fa01c957bcd · Fastly, Inc. · 2 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (cli) via crates.io · 3,137 files · went into an output ecosystem
Dependencies78Build behaviour
base640.22.1
block-buffer0.10.4
cc1.8.0
cfg-if1.0.5
cpufeatures0.2.17
crypto-common0.1.7
digest0.10.7
displaydoc0.2.7proc macro
find-msvc-tools0.1.14
form_urlencoded1.2.2
generic-array0.14.7build script
getrandom0.2.17
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
litemap0.8.3
log0.4.34
once_cell1.21.4
percent-encoding2.3.2
potential_utf0.1.6
proc-macro21.0.107build script
quote1.0.47build script
ring0.17.14build scriptprebuilt objects
rustls0.23.46build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
sha20.10.9
shlex2.0.1
smallvec1.16.3
stable_deref_trait1.2.1
subtle2.6.1
syn3.0.9
synstructure0.14.0
tinystr0.8.4
typenum1.20.1
unicode-ident1.0.27
untrusted0.9.0
ureq2.12.1
url2.5.8
utf8_iter1.0.4
webpki-roots0.26.11
webpki-roots1.0.9
writeable0.6.4
yoke0.8.3
yoke-derive0.8.4proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
serde1.0.229build script, not run
serde_core1.0.229build script, not run
serde_derive1.0.229proc macro
version_check0.9.5
wasi0.11.1+wasi-snapshot-preview1
windows-sys0.52.0
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
Versions5RiskVulnsPublished
1.0.4highnone1d ago
1.0.3not analyzed1d ago
1.0.2not analyzed1d ago
1.0.1not analyzed1d ago
1.0.0not analyzed1d ago

Raw data

capture
193 KB
records
26,143
bytes per record
7.4

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-18 · run bbb08205-d253-41a7-8367-f16d1d92398e

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2