Skip to content
Open-Source Registry

cargo / litert-lm-edge-sys

litert-lm-edge-sys 0.2.6

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
267
operations
8.3K
packages
29
compiler runs
1
connections
3
job time
18s
capture
138 KB
records
16K
bytes / record
8.8

Raw FFI bindings for the LiteRT-LM C API.

Build behaviourits build script reached github.com, release-assets.githubusercontent.comits build script ran curlundeclared fetchlinked a downloaded binaryfetched outside crates.io

85 downloads · Apache-2.0 · source View on crates.io

Graph

egress · medium · in liblitert_lm_edge_sys.rlib
2

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    liblitert_lm_c_api.so › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    litert-lm-edge-sys 0.2.6 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.linux-x86_64-2758/linux-x86_64/liblitert_lm_c_api.sowritten by build_script_build-f5851eec97890359
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · litert-lm-edge-rs

Witness chain

  1. /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/runtime-checksums.txt
    source
  2. /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.linux-x86_64-2758/linux-x86_64/liblitert_lm_c_api.sovia /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f5851eec97890359/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f5851eec97890359/build_script_build-f5851eec97890359, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build_script_build-f5851eec97890359 without a recorded source compilation

    subject
  3. litert_lm_edge_sys-7f6336c6ae8709d1linked
    artifact

Evidence

  • written under the build script at /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f5851eec97890359/build_script_build-f5851eec97890359, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-f5851eec97890359 without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f5851eec97890359/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2474
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2474
  3. build-script-build/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f5851eec97890359/build-script-build2758

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
litert-lm-edge-sys 0.2.6
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2758…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2758…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f5851eec97890359/build_script_build-f5851eec97890359

  5. Tool commandsupport

    Command: curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2758…

    by curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2758…

In liblitert_lm_edge_sys.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2758…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2474
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2474
  3. build-script-build/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f5851eec97890359/build-script-build2758
  4. curlcurl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2758…2761

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 litert-lm-edge-sys's own build code · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 litert-lm-edge-sys's own build code · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (litert-lm-edge-rs) via crates.io · 2,978 files · went into an output ecosystem
Dependencies29Build behaviour
adler22.0.1
bitflags2.11.1
block-buffer0.10.4
cfg-if1.0.4
cpufeatures0.2.17
crc32fast1.5.0build script
crypto-common0.1.7
digest0.10.7
errno0.3.14
filetime0.2.29
flate21.1.9
generic-array0.14.7build script
ld-linux-x86-64.so.2system library
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
miniz_oxide0.8.9
rustix1.1.4build script
sha20.10.9
simd-adler320.3.9
tar0.4.46
typenum1.20.0
version_check0.9.5
windows-link0.2.1
windows-sys0.61.2
xattr1.6.1
Versions5RiskVulnsPublished
0.2.4not analyzed2026-09-22
0.2.3not analyzed2026-09-22
0.2.2not analyzed2026-09-22
0.2.1not analyzed2026-09-22
0.2.6highnone

Raw data

capture
138 KB
records
15,796
bytes per record
8.8

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run c69aa751-a21a-4c71-88c2-67e5b163714d

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2