Skip to content
Open-Source Registry

cargo / ll-core / 0.2.1

ll-core 0.2.1

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
481
operations
35K
packages
156
compiler runs
113
connections
5
job time
2m 04s
capture
463 KB
records
63K
bytes / record
7.3

Build behaviourits build script reached huggingface.co, us.aws.cdn.hf.coits build script ran curlundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 31edb768-555d-4870-8754-3b06fe6502d6 · built 2026-10-17 · complete View on crates.io

Graph

egress · high · in libll_core.rlib
4

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

3
  • Build script fetched what the build compiled, linked or ran
    ll-core 0.2.1 › huggingface.co:443, us.aws.cdn.hf.co:443
    high
  • Downloaded file compiled into the artifact
    reranker.onnx › huggingface.co, us.aws.cdn.hf.co
    high
  • Downloaded file compiled into the artifact
    reranker_tokenizer.json › huggingface.co, us.aws.cdn.hf.co
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
ll-core 0.2.1
Destination
huggingface.co:443, us.aws.cdn.hf.co:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to huggingface.co:443, opened by curl

    subject huggingface.co:443

    by curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…

  2. Connection outside the process’s allowed destinationscause

    connection to us.aws.cdn.hf.co:443, opened by curl

    subject us.aws.cdn.hf.co:443

    by curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…

  3. What a build script's fetch becamesupport

    2 files came down; the build compiled or linked reranker.onnx, reranker_tokenizer.json

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build

  5. Tool commandsupport

    Command: curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…

    by curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…

In libll_core.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2542
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2542
  3. build-script-build/home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build4326
  4. curlcurl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…4327

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.onnxwritten by curl
Destination
huggingface.co, us.aws.cdn.hf.co
Jobs
build-test
Rule
object-provenance · learning-loop

Witness chain

  1. huggingface.co:443
    source
  2. /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.onnxvia curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov
    • Object written under a build script that downloadedfrom huggingface.co · us.aws.cdn.hf.coby build-script-build

      written under the build script at /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build, which downloaded from huggingface.co, us.aws.cdn.hf.co

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build, which downloaded from huggingface.co, us.aws.cdn.hf.co
  • Written by curl from a network connection without a recorded source compilation

In libll_core.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2542
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2542
  3. build-script-build/home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build4326
  4. curlcurl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker.download.tmp https://huggingface.co/Xenov…4327

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker_tokenizer.jsonwritten by curl
Destination
huggingface.co, us.aws.cdn.hf.co
Jobs
build-test
Rule
object-provenance · learning-loop

Witness chain

  1. huggingface.co:443
    source
  2. /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker_tokenizer.jsonvia curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker_tokenizer.download.tmp https://huggingfac
    • Object written under a build script that downloadedfrom huggingface.co · us.aws.cdn.hf.coby build-script-build

      written under the build script at /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build, which downloaded from huggingface.co, us.aws.cdn.hf.co

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build, which downloaded from huggingface.co, us.aws.cdn.hf.co
  • Written by curl from a network connection without a recorded source compilation

In libll_core.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker_tokenizer.download.tmp https://huggingfac…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2542
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2542
  3. build-script-build/home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-3f895760d61d804c/build-script-build4326
  4. curlcurl -fsSL -o /home/runner/work/learning-loop/learning-loop/target/release/build/ll-core-6eeee4053f217354/out/reranker_tokenizer.download.tmp https://huggingfac…4341

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

5 peers
  • huggingface.co:443 ll-core's own build code · curl · Amazon.com, Inc. · 2 files · went into an output undeclared
  • us.aws.cdn.hf.co:443 ll-core's own build code · curl · Amazon.com, Inc. · 1 file · went into an output undeclared
  • github.com:443 ll-core's own build code · curl via GitHub release download profile (curl → github.com, github.com URL in command line) · GitHub, Inc. · 1 file documented
  • release-assets.githubusercontent.com:443 ll-core's own build code · curl via GitHub release download profile (curl → release-assets.githubusercontent.com, github.com URL in command line) · Fastly, Inc. · 1 file documented
  • static.crates.io:8080 the package manager · cargo (learning-loop) via crates.io · 12,428 files · went into an output ecosystem
Dependencies164Build behaviour
ahash0.8.12build script
aho-corasick1.1.4
anyhow1.0.104build script
autocfg1.5.0
base640.13.1
bit-set0.8.0
bit-vec0.8.0
bitflags2.11.0
block-buffer0.10.4
bumpalo3.20.2
castaway0.2.4
cc1.2.58
cfg-if1.0.4
compact_str0.9.0
cpufeatures0.2.17
crossbeam-deque0.8.6
crossbeam-epoch0.9.20build script
crossbeam-utils0.8.21build script
crypto-common0.1.7
darling0.20.11
darling_core0.20.11
darling_macro0.20.11proc macro
dary_heap0.3.8
derive_builder0.20.2
derive_builder_core0.20.2
derive_builder_macro0.20.2proc macro
digest0.10.7
dirs-next2.0.0
dirs-sys-next0.1.2
either1.15.0
equivalent1.0.2
errno0.3.14
esaxx-rs0.1.10build script
fallible-iterator0.3.0
fallible-streaming-iterator0.1.9
fancy-regex0.14.0
fastrand2.3.0
find-msvc-tools0.1.9
fnv1.0.7
foldhash0.1.5
foldhash0.2.0
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.2build script
hashbrown0.15.5
hashbrown0.16.1
hashbrown0.17.1
hashlink0.12.2
heck0.5.0
hex0.4.3
id-arena2.3.0
ident_case1.0.1
indexmap2.13.0
itertools0.14.0
itoa1.0.18
js-sys0.3.98
ld-linux-x86-64.so.2system library
leb128fmt0.1.0
libc0.2.183build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.9.0
libm.so.6system library
libmvec.so.1system library
libredox0.1.15
libsqlite3-sys0.38.2build script
linux-raw-sys0.12.1
log0.4.29
macro_rules_attribute0.2.2
macro_rules_attribute-proc_macro0.2.2proc macro
matrixmultiply0.3.10build script
memchr2.8.0
minimal-lexical0.2.1
monostate0.1.18
monostate-impl0.1.18proc macro
ndarray0.17.2
nom7.1.3
num-complex0.4.6
num-integer0.1.46
num-traits0.2.19build script
once_cell1.21.4
ort2.0.0-rc.12
ort-sys2.0.0-rc.12build script
paste1.0.15build scriptproc macro
pin-project-lite0.2.17
pkg-config0.3.32
portable-atomic1.13.1build script, not run
portable-atomic-util0.2.6build script, not run
ppv-lite860.2.21
prettyplease0.2.37build script, not run
proc-macro21.0.106build script
quote1.0.45build script
r-efi5.3.0
r-efi6.0.0
rand0.9.2
rand_chacha0.9.0
rand_core0.9.5
rawpointer0.2.1
rayon1.11.0
rayon-cond0.4.0
rayon-core1.13.0build script
redox_users0.4.6
regex1.12.3
regex-automata0.4.14
regex-syntax0.8.10
rsqlite-vfs0.1.1
rusqlite0.40.2
rustix1.1.4build script
rustversion1.0.22build scriptproc macro
ryu1.0.23
semver1.0.27
serde1.0.228build script
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.149build script
sha20.10.9
shlex1.3.0
smallvec1.15.1
spm_precompiled0.1.4
sqlite-wasm-rs0.5.5build script, not run
static_assertions1.1.0
strsim0.11.1
syn2.0.117
tempfile3.27.0
thiserror1.0.69build script
thiserror2.0.18build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.18proc macro
tokenizers0.21.4
tracing0.1.44
tracing-core0.1.36
typenum1.19.0build script
unicode-ident1.0.24
unicode-normalization-alignments0.1.12
unicode-segmentation1.13.2
unicode-xid0.2.6
unicode_categories0.1.1
vcpkg0.2.15prebuilt objects
version_check0.9.5
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.2+wasi-0.2.9
wasip30.4.0+wasi-0.3.0-rc-2026-01-06
wasm-bindgen0.2.121build script, not run
wasm-bindgen-macro0.2.121proc macro
wasm-bindgen-macro-support0.2.121
wasm-bindgen-shared0.2.121build script, not run
wasm-encoder0.244.0
wasm-metadata0.244.0
wasmparser0.244.0
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-link0.2.1
windows-sys0.61.2
wit-bindgen0.51.0build script, not runprebuilt objects
wit-bindgen-core0.51.0
wit-bindgen-rust0.51.0build script, not run
wit-bindgen-rust-macro0.51.0build script, not runproc macro
wit-component0.244.0
wit-parser0.244.0
zerocopy0.8.48build script
zerocopy-derive0.8.48proc macro
zmij1.0.21build script
Versions8RiskVulnsPublished
0.1.6not analyzed2026-06-25
0.1.5not analyzed2026-06-24
0.1.4not analyzed2026-05-11
0.1.3not analyzed2026-04-12
0.1.2yankednot analyzed2026-04-12
0.1.1yankednot analyzed2026-04-12
0.1.0yankednot analyzed2026-04-12
0.2.1highnone

Raw data

capture
463 KB
records
63,313
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run 31edb768-555d-4870-8754-3b06fe6502d6

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2