Skip to content
Open-Source Registry

cargo / litert-lm-edge / 0.2.6

litert-lm-edge 0.2.6

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
491
operations
17K
packages
44
compiler runs
19
connections
3
job time
29s
capture
237 KB
records
31K
bytes / record
7.7

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.io

run ca829397-f6d7-4dfc-be3e-b7def48f2c4b · built 2026-10-17 · complete View on crates.io

Graph

egress · medium · in liblitert_lm_edge.rlib
2

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    liblitert_lm_c_api.so › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    litert-lm-edge-sys 0.2.6 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.linux-x86_64-2962/linux-x86_64/liblitert_lm_c_api.sowritten by build_script_build-f28dd00f8cad2ef3
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · litert-lm-edge-rs

Witness chain

  1. /home/runner/.gitconfig
    source
  2. /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/litert-lm-edge-sys-0.2.6/runtime-checksums.txtvia /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo fetch --locked
  3. /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.linux-x86_64-2962/linux-x86_64/liblitert_lm_c_api.sovia /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f28dd00f8cad2ef3/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f28dd00f8cad2ef3/build_script_build-f28dd00f8cad2ef3, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build_script_build-f28dd00f8cad2ef3 without a recorded source compilation

    subject
  4. multimodal_generate-0f3ab57f467da5balinked
    artifact
  5. stream_generate-99d9868323682798linked
    artifact
  6. engine_config-5bad0df63b6c66adlinked
    artifact
  7. embedding_generate-bef1fed6b1b3a68dlinked
    artifact
  8. simple_generate-c9744c583f3be688linked
    artifact
  9. conversation_multimodal-d40abe3cfcf883d8linked
    artifact
  10. conversation_tools-9c2bc0db84bb5396linked
    artifact
  11. raw_conversation_json-b6014b81ffc424b5linked
    artifact
  12. embedding_multimodal-e3cbebebd438fcablinked
    artifact
  13. litert_lm_edge-fdabcf7a974db398linked
    artifact

Evidence

  • written under the build script at /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f28dd00f8cad2ef3/build_script_build-f28dd00f8cad2ef3, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-f28dd00f8cad2ef3 without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f28dd00f8cad2ef3/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f28dd00f8cad2ef3/build-script-build2962

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
litert-lm-edge-sys 0.2.6
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2962…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2962…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f28dd00f8cad2ef3/build_script_build-f28dd00f8cad2ef3

  5. Tool commandsupport

    Command: curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2962…

    by curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2962…

In liblitert_lm_edge.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2962…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2479
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2479
  3. build-script-build/home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/release/build/litert-lm-edge-sys-f28dd00f8cad2ef3/build-script-build2962
  4. curlcurl --fail --location --silent --show-error --output /home/runner/work/litert-lm-edge-rs/litert-lm-edge-rs/target/litert-lm-runtime/.download-linux-x86_64-2962…2963

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of litert-lm-edge-sys · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of litert-lm-edge-sys · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (litert-lm-edge-rs) via crates.io · 6,133 files · went into an output ecosystem
Dependencies44Build behaviour
adler22.0.1
base640.22.1
bitflags2.11.1
block-buffer0.10.4
cfg-if1.0.4
cpufeatures0.2.17
crc32fast1.5.0build script
crypto-common0.1.7
digest0.10.7
errno0.3.14
filetime0.2.29
flate21.1.9
generic-array0.14.7build script
itoa1.0.18
ld-linux-x86-64.so.2system library
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
litert-lm-edge-sys0.2.6build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
memchr2.8.0
miniz_oxide0.8.9
proc-macro21.0.106build script
quote1.0.45build script
rustix1.1.4build script
serde1.0.228build script
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.149build script
sha20.10.9
simd-adler320.3.9
syn2.0.117
tar0.4.46
thiserror2.0.18build script
thiserror-impl2.0.18proc macro
typenum1.20.0
unicode-ident1.0.24
version_check0.9.5
windows-link0.2.1
windows-sys0.61.2
xattr1.6.1
zmij1.0.21build script
Versions5RiskVulnsPublished
0.2.4not analyzed2026-09-22
0.2.3not analyzed2026-09-22
0.2.2not analyzed2026-09-22
0.2.1not analyzed2026-09-22
0.2.6highnone

Raw data

capture
237 KB
records
30,789
bytes per record
7.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run ca829397-f6d7-4dfc-be3e-b7def48f2c4b

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2