Skip to content
Open-Source Registry

cargo / kingfisher-rules / 2.0.0

kingfisher-rules 2.0.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
592
operations
121K
packages
363
compiler runs
181
connections
3
job time
3m 45s
capture
1.1 MB
records
192K
bytes / record
5.8

Build behaviourhas a build scriptundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 4edba3e0-ac00-4f41-8174-79b70dc4cc8e · built 2026-10-20 · complete View on crates.io

Graph

object-provenance · high · in libkingfisher_rules.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    libhs.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    kingfisher-vectorscan-sys 0.1.1 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-5b1ca7a8790dd7c1/out/prebuilt/lib/libhs.awritten by build_script_build-6c80400ff0d19f44
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · kingfisher

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-5b1ca7a8790dd7c1/out/vectorscan-0.1.1-x86_64-unknown-linux-gnu.tar.gzvia curl --fail --location --silent --show-error --proto =https --proto-redir =https --retry 3 --connect-timeout 20 --max-time 300 --max-filesize 134217728 --output
  3. /home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-5b1ca7a8790dd7c1/out/prebuilt/lib/libhs.avia /home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-6c80400ff0d19f44/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-6c80400ff0d19f44/build_script_build-6c80400ff0d19f44, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build_script_build-6c80400ff0d19f44 without a recorded source compilation

    • Asked for by the build's own declaration

      kingfisher-vectorscan-sys asked the linker for it: static hs (target/release/build/kingfisher-vectorscan-sys-5b1ca7a8790dd7c1/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-6c80400ff0d19f44/build_script_build-6c80400ff0d19f44, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-6c80400ff0d19f44 without a recorded source compilation
  • kingfisher-vectorscan-sys asked the linker for it: static hs (target/release/build/kingfisher-vectorscan-sys-5b1ca7a8790dd7c1/output)

In libkingfisher_rules.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-6c80400ff0d19f44/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2477
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2477
  3. build-script-build/home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-6c80400ff0d19f44/build-script-build6224

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
kingfisher-vectorscan-sys 0.1.1
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl --fail --location --silent --show-error --proto =https --proto-redir =https --retry 3 --connect-timeout 20 --max-time 300 --max-filesize 134217728 --output…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl --fail --location --silent --show-error --proto =https --proto-redir =https --retry 3 --connect-timeout 20 --max-time 300 --max-filesize 134217728 --output…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-6c80400ff0d19f44/build_script_build-6c80400ff0d19f44

  5. Tool commandsupport

    Command: curl --fail --location --silent --show-error --proto =https --proto-redir =https --retry 3 --connect-timeout 20 --max-time 300 --max-filesize 134217728 --output…

    by curl --fail --location --silent --show-error --proto =https --proto-redir =https --retry 3 --connect-timeout 20 --max-time 300 --max-filesize 134217728 --output…

In libkingfisher_rules.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl --fail --location --silent --show-error --proto =https --proto-redir =https --retry 3 --connect-timeout 20 --max-time 300 --max-filesize 134217728 --output…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2477
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2477
  3. build-script-build/home/runner/work/kingfisher/kingfisher/target/release/build/kingfisher-vectorscan-sys-6c80400ff0d19f44/build-script-build6224
  4. curlcurl --fail --location --silent --show-error --proto =https --proto-redir =https --retry 3 --connect-timeout 20 --max-time 300 --max-filesize 134217728 --output…6231

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of kingfisher-vectorscan-sys · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of kingfisher-vectorscan-sys · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (kingfisher) via crates.io · 20,624 files · went into an output ecosystem
Dependencies399Build behaviour
adler22.0.1
aho-corasick1.1.5
allocator-api20.2.21
android_system_properties0.1.6
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
anstyle-wincon3.0.11
anyhow1.0.104build script
anymap20.13.0
arbitrary1.5.0
arc-swap1.9.2
arrayvec0.7.8
autocfg1.5.1
aws-lc-rs1.18.2build script
aws-lc-sys0.46.0build scriptprebuilt objects
base320.5.1
base640.22.1
base640.23.1
base64ct1.8.3
bip392.2.2
bit-set0.11.1
bit-set0.8.0
bit-vec0.10.1
bit-vec0.8.0
bitcoin_hashes0.14.101
bitflags1.3.2
bitflags2.13.2
block-buffer0.10.4
block-buffer0.12.1
borsh1.8.1build script, not run
borsh-derive1.8.1proc macro
bstr1.13.1
bumpalo3.20.3
byteorder1.5.0
bytes1.12.1
cc1.8.0
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
chrono0.4.45
chrono-tz0.9.0build script
chrono-tz-build0.3.0
clap4.6.7
clap-cargo0.18.3
clap_builder4.6.7
clap_derive4.6.7proc macro
clap_lex1.1.1
clru0.6.3
cmake0.1.58
cmov0.5.4
colorchoice1.0.5
colored2.2.0
console0.16.6
const-oid0.10.2
const-oid0.9.6
core-foundation-sys0.8.7
core_detect1.0.0
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.2build script
crossbeam-channel0.5.17
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crypto-common0.1.7
crypto-common0.2.2
ctutils0.4.3
dashmap6.2.1
defmt0.3.100
defmt1.1.1build script, not run
defmt-macros1.1.1build script, not runproc macro
defmt-parser1.0.0
der0.7.10
deranged0.5.8
derive_arbitrary1.5.0proc macro
deunicode1.6.2
diff0.1.13
digest0.10.7
digest0.11.3
dunce1.0.5
dyn-clone1.0.20
either1.19.0
encode_unicode1.0.0
encoding_rs0.8.42build script
encoding_rs_io0.1.8
env_filter2.0.0
env_logger0.11.11
equivalent1.0.2
errno0.3.14
etcetera0.8.0
fancy-regex0.19.2
faster-hex0.10.1build script
fastrand2.5.0
filetime0.2.29
find-msvc-tools0.1.14
flate21.1.10
fnv1.0.7
foldhash0.2.0
foreign-types0.5.0
foreign-types-macros0.2.4proc macro
foreign-types-shared0.3.1
fs_extra1.3.0
futures-core0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.4.3build script
gix0.87.1
gix-actor0.42.0
gix-attributes0.35.0
gix-bitmap0.4.0
gix-chunk0.8.0
gix-command0.10.1
gix-commitgraph0.39.0
gix-config0.60.0
gix-config-value0.19.1
gix-credentials0.40.0
gix-date0.16.0
gix-diff0.67.1
gix-discover0.55.0
gix-error0.3.2
gix-features0.49.1
gix-filter0.34.0
gix-fs0.22.1
gix-glob0.27.1
gix-hash0.26.2
gix-hashtable0.16.0
gix-ignore0.22.1
gix-index0.55.0
gix-lock24.0.0
gix-macros0.1.6proc macro
gix-mailmap0.34.1
gix-note0.1.1
gix-object0.64.1
gix-odb0.84.0
gix-pack0.74.2
gix-packetline0.22.2
gix-path0.12.6
gix-prompt0.17.0
gix-protocol0.65.1
gix-quote0.8.0
gix-ref0.67.1
gix-refspec0.45.1
gix-revision0.49.1
gix-revwalk0.35.0
gix-sec0.14.2
gix-shallow0.13.0
gix-tempfile24.0.0
gix-trace0.1.21
gix-transport0.59.2
gix-traverse0.61.0
gix-url0.38.0
gix-utils0.3.6
gix-validate0.11.4
gix-worktree0.56.0
gix-worktree-stream0.36.1
gix-zlib0.1.0
globset0.4.20
globwalk0.9.1
grep-matcher0.1.9
grep-searcher0.1.17
hash320.3.1
hashbrown0.14.5
hashbrown0.16.1
hashbrown0.17.1
heapless0.8.0build script
heck0.5.0
hex0.4.3
hex-conservative0.2.3
hmac0.13.0
home0.5.12
humansize2.1.3
hybrid-array0.4.15
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
ignore0.4.33
indexmap2.14.2
is_terminal_polyfill1.70.2
itertools0.11.0
itertools0.14.0
itoa1.0.18
jiff0.2.38
jiff-core0.1.1
jiff-static0.2.38proc macro
jiff-tzdb0.1.9
jiff-tzdb-platform0.1.3
jobserver0.1.35
js-sys0.3.106
json50.4.1
kingfisher-core1.0.4
kingfisher-vectorscan0.1.1
kingfisher-vectorscan-sys0.1.1build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
kstring2.0.5
lazy_static1.5.1
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
liquid0.26.11
liquid-core0.26.11
liquid-derive0.26.10proc macro
liquid-lib0.26.11
lock_api0.4.14
log0.4.34
memchr2.8.3
memmap20.9.11
miniz_oxide0.9.1
multiversion_no_op1.0.0proc macro
nonempty0.12.0
num-bigint-dig0.8.6build script
num-conv0.2.2
num-format0.4.4
num-integer0.1.47
num-iter0.1.46
num-traits0.2.19build script
once_cell1.21.4
once_cell_polyfill1.70.2
parking_lot0.12.5
parking_lot_core0.9.12build script
parse-zoneinfo0.3.1
pem4.0.0
pem-rfc74680.7.0
percent-encoding2.3.2
pest2.9.3
pest_derive2.9.3proc macro
pest_generator2.9.3
pest_meta2.9.3
phf0.11.3
phf_codegen0.11.3
phf_generator0.11.3
phf_shared0.11.3
pin-project-lite0.2.17
pkcs10.7.5
pkcs80.10.2
pkg-config0.3.34
portable-atomic1.15.0build script, not run
portable-atomic-util0.2.8build script, not run
powerfmt0.2.1
ppv-lite860.2.21
pretty_assertions1.4.1
proc-macro-crate3.5.0
proc-macro21.0.107build script
prodash31.0.1
proptest1.12.0
psm0.1.24build scriptprebuilt objects
quick-error1.2.3
quote1.0.47build script
r-efi6.0.0
rand0.10.3
rand0.8.8
rand_chacha0.3.1
rand_core0.10.1
rand_core0.6.4
rand_xorshift0.5.0
rayon1.12.0
rayon-core1.13.0build script
redox_syscall0.5.18
ref-cast1.0.27build script
ref-cast-impl1.0.27proc macro
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
rsa0.9.10
rustc-hash2.1.3
rustix1.1.5build script
rustversion1.0.23build scriptproc macro
rusty-fork0.3.1
ryu1.0.23
same-file1.0.6
schemars1.2.2
schemars_derive1.2.2proc macro
scopeguard1.2.0
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_derive_internals0.30.0
serde_json1.0.154build script
serde_spanned0.6.9
serde_spanned1.1.2
serde_yaml0.9.34+deprecated
sha10.10.7
sha10.11.0
sha1-checked0.10.0
sha20.10.9
sha20.11.0
shlex2.0.1
signature2.2.0
simd-adler320.3.10
simdutf80.1.5
siphasher1.0.4
slab0.4.12
slug0.1.6
smallvec1.16.3
spin0.9.9
spki0.7.3
stable_deref_trait1.2.1
stacker0.1.25build script
static_assertions1.1.0
strsim0.11.1
subtle2.6.1
syn2.0.119
syn3.0.9
table_formatter0.6.1
tar0.4.46
tempfile3.27.0
tera1.20.1
term_size0.3.2
terminal_size0.4.4
thiserror1.0.69build script
thiserror2.0.21build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.21proc macro
thread_local1.1.10
tiktoken-rs0.12.1
time0.3.55
time-core0.1.9
time-macros0.2.32proc macro
tinyvec1.13.3
tokei14.0.0build script
toml0.8.23
toml1.1.8+spec-1.1.0
toml_datetime0.6.11
toml_datetime1.1.2+spec-1.1.0
toml_edit0.22.27
toml_edit0.25.17+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
toml_write0.1.2
toml_writer1.1.3+spec-1.1.0
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
typenum1.20.1
ucd-trie0.1.7
unarray0.1.4
unicode-bom2.0.3
unicode-ident1.0.27
unicode-normalization0.1.25
unicode-segmentation1.13.3
unicode-width0.2.2
unsafe-libyaml0.2.11
untrusted0.7.1
utf8parse0.2.2
uuid1.28.0
version_check0.9.5
wait-timeout0.2.1
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.129build script, not run
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.48.0
windows-sys0.59.0
windows-sys0.61.2
windows-targets0.48.5
windows-targets0.52.6
windows_aarch64_gnullvm0.48.5build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.48.5build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.48.5build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.48.5build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.48.5build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.48.5build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow0.7.15
winnow1.0.4
xattr1.6.1
xxhash-rust0.8.19
yansi1.0.1
zerocopy0.8.62build script
zerocopy-derive0.8.62proc macro
zeroize1.9.1
zeroize_derive1.5.0proc macro
zlib-rs0.6.8
zmij1.0.23build script
Versions6RiskVulnsPublished
1.2.17d ago
1.2.013d ago
1.1.0not analyzed2026-10-04
1.0.1not analyzed2026-10-02
1.0.0not analyzed2026-09-29
2.0.0highnone

Raw data

capture
1.1 MB
records
192,177
bytes per record
5.8

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-20 · run 4edba3e0-ac00-4f41-8174-79b70dc4cc8e

analysis 0.1.0 · 2026-10-19 · 10ce9f4 · graph v2