Skip to content
Open-Source Registry

cargo / lspkl / 0.1.0

lspkl 0.1.0

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnshigh
processes
643
operations
80K
packages
268
compiler runs
875
connections
2
job time
4m 03s
capture
825 KB
records
134K
bytes / record
6.1

Build behaviourundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 0ad9fb7d-abcf-4d48-873b-972f770ebb6b · built 2026-10-16 · complete View on crates.io

Graph

egress · high · in liblspkl.rlib
26

Checks

10 of 14 clear Network activity Data flow analysis +2 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain▲▲✓✓✓
Pipeline✓

Detections

24
  • Build script fetched what the build compiled, linked or ran
    lspkl-stdlib 0.1.0 › codeload.github.com:443
    high
  • Downloaded file compiled into the artifact
    Benchmark.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    Command.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    DocPackageInfo.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    DocsiteInfo.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    EvaluatorSettings.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    Project.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    analyze.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    base.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    json.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    jsonnet.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    math.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    pklbinary.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    platform.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    protobuf.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    ref.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    reflect.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    release.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    semver.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    settings.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    shell.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    test.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    xml.pkl › codeload.github.com
    high
  • Downloaded file compiled into the artifact
    yaml.pkl › codeload.github.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
lspkl-stdlib 0.1.0
Destination
codeload.github.com:443
Reaches
Jobs
build-test
Rule
egress · lspkl

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to codeload.github.com:443, opened by build_script_build-832fa27a5daa2f02

    subject codeload.github.com:443

    by /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build

  2. What a build script's fetch becamesupport

    25 files came down; the build compiled or linked Benchmark.pkl, Command.pkl, DocPackageInfo.pkl +21 more

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/Benchmark.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/Benchmark.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/Command.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/Command.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/DocPackageInfo.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/DocPackageInfo.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/DocsiteInfo.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/DocsiteInfo.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/EvaluatorSettings.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/EvaluatorSettings.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/Project.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/Project.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/analyze.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/analyze.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/base.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/base.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/json.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/json.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/jsonnet.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/jsonnet.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/math.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/math.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/pklbinary.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/pklbinary.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/platform.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/platform.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/protobuf.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/protobuf.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/ref.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/ref.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/reflect.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/reflect.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/release.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/release.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/semver.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/semver.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/settings.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/settings.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/shell.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/shell.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/test.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/test.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/xml.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/xml.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/yaml.pklwritten by build_script_build-832fa27a5daa2f02
Destination
codeload.github.com
Jobs
build-test
Rule
object-provenance · lspkl

Witness chain

  1. /usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt
    source
  2. /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-9475b76a56860da6/out/stdlib/yaml.pklvia /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
    • Object written under a build script that downloadedfrom codeload.github.com

      written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com

    • Obfuscated toolchain bypass

      Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

    subject
  3. member
    artifact
  4. member
    artifact

Evidence

  • written under the build script at /home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build_script_build-832fa27a5daa2f02, which downloaded from codeload.github.com
  • Written by build_script_build-832fa27a5daa2f02 from a network connection without a recorded source compilation

In liblspkl.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2460
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2460
  3. build-script-build/home/runner/work/lspkl/lspkl/target/release/build/lspkl-stdlib-832fa27a5daa2f02/build-script-build5610

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • codeload.github.com:443 build code of lspkl-stdlib · build_script_build-832fa27a5daa2f02 (lspkl) · GitHub, Inc. · 25 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (lspkl) via crates.io · 14,528 files · went into an output ecosystem
Vulnerabilities4PackageFixSeverity
RUSTSEC-2026-0346rustls 0.23.45>=0.23.46high
RUSTSEC-2026-0347rustls 0.23.45>=0.23.46high
RUSTSEC-2026-0348rustls 0.23.45>=0.23.46high
RUSTSEC-2026-0349rustls 0.23.45>=0.23.46high
Dependencies278Build behaviour
aho-corasick1.1.4
allocator-api20.2.21
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
atomic-waker1.1.2
base640.22.1
base640.23.1
bitflags1.3.2
bitflags2.11.1
block-buffer0.10.4
borrow-or-share0.2.4
boxcar0.2.14
bstr1.13.1
bumpalo3.20.3
bytes1.11.1
cfg-if1.0.4
clap4.6.1
clap_builder4.6.0
clap_lex1.1.0
colorchoice1.0.5
cpufeatures0.2.17
crc32fast1.5.2build script
crossbeam-channel0.5.17
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-queue0.3.14
crossbeam-utils0.8.21build script
crypto-common0.1.7
digest0.10.7
either1.19.0
equivalent1.0.2
errno0.3.14
fastrand2.4.1
flate21.1.10
fluent-uri0.1.4
fluent-uri0.4.1
foldhash0.2.0
form_urlencoded1.2.2
futures-channel0.3.32
futures-core0.3.32
futures-io0.3.32
futures-sink0.3.32
futures-task0.3.32
futures-util0.3.32
generic-array0.14.7build script
getrandom0.2.17
getrandom0.4.2build script
globset0.4.19
hashbrown0.17.0
hashlink0.12.2
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.12.0
hyper-rustls0.27.10
hyper-util0.1.21
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
indexmap2.14.0
intrusive-collections0.10.3
inventory0.3.25
ipnet2.12.2
is_terminal_polyfill1.70.2
itoa1.0.18
la-arena0.3.1
lazy_static1.5.0
ld-linux-x86-64.so.2system library
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
line-index0.1.2
linux-raw-sys0.12.1
litemap0.8.2
lock_api0.4.14
log0.4.29
lsp-server0.10.0
lsp-types0.97.0
lspkl-db0.1.0
lspkl-diagnostics0.1.0
lspkl-features0.1.0
lspkl-project0.1.0
lspkl-stdlib0.1.0build scriptnetworkcodeload.github.com
lspkl-syntax0.1.0build script
lspkl-types0.1.0
lspkl-vfs0.1.0
matchers0.2.0
memchr2.8.0
miniz_oxide0.9.1
mio1.2.0
nohash-hasher0.2.0
nu-ansi-term0.50.3
once_cell1.21.4
openssl-probe0.2.1
parking_lot0.12.5
parking_lot_core0.9.12build script
percent-encoding2.3.2
pin-project-lite0.2.17
portable-atomic1.15.0build script
potential_utf0.1.5
rayon1.12.0
rayon-core1.13.0build script
ref-cast1.0.25build script
regex1.12.3
regex-automata0.4.14
regex-syntax0.8.10
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.3
rustix1.1.4build script
rustls0.23.45build script
rustls-native-certs0.8.4
rustls-pki-types1.15.1
rustls-webpki0.103.15
ryu1.0.23
salsa0.28.5
salsa-macro-rules0.28.5
scopeguard1.2.0
semver1.0.28
serde1.0.228build script
serde_core1.0.228build script
serde_json1.0.149build script
serde_urlencoded0.7.1
sha20.10.9
sharded-slab0.1.7
signal-hook-registry1.4.8
simd-adler320.3.10
slab0.4.12
smallvec1.15.1
socket20.6.3
stable_deref_trait1.2.1
streaming-iterator0.1.9
strsim0.11.1
subtle2.6.1
sync_wrapper1.0.2
tempfile3.27.0
text-size1.1.1
thin-vec0.2.21
thiserror2.0.18build script
thread_local1.1.9
tinystr0.8.3
tokio1.52.1
tokio-rustls0.26.6
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
tracing-log0.2.0
tracing-subscriber0.3.23
tree-sitter0.25.10build script
tree-sitter-language0.1.7build script
try-lock0.2.5
typeid1.0.3build script
typenum1.20.1
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
utf8parse0.2.2
want0.3.2
webpki-roots1.0.9
writeable0.6.3
yoke0.8.2
zerofrom0.1.8
zeroize1.9.1
zerotrie0.2.4
zerovec0.11.6
zip2.4.2build script
zmij1.0.21build script
zopfli0.8.3
adler22.0.1
unicode-ident1.0.24
anstyle-wincon3.0.11
anyhow1.0.102build script, not run
arbitrary1.5.0
cc1.2.61
cfg_aliases0.2.2
chacha200.10.2
clap_derive4.6.1proc macro
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.3.1
deranged0.5.8
derive_arbitrary1.5.0proc macro
displaydoc0.2.5proc macro
find-msvc-tools0.1.9
foldhash0.1.5
hashbrown0.15.5
heck0.5.0
id-arena2.3.0
js-sys0.3.106
leb128fmt0.1.0
lru-slab0.1.3
num-conv0.2.2
once_cell_polyfill1.70.2
pem3.0.6
powerfmt0.2.1
prettyplease0.2.37build script, not run
proc-macro21.0.106build script
quinn0.11.12build script, not run
quinn-proto0.11.19
quinn-udp0.5.16build script, not run
quote1.0.45build script
r-efi6.0.0
rand0.10.3
rand_core0.10.1
rand_pcg0.10.2
rcgen0.13.2
redox_syscall0.5.18
ref-cast-impl1.0.25proc macro
rustversion1.0.23build script, not runproc macro
salsa-macros0.28.5proc macro
schannel0.1.29
security-framework3.7.0
security-framework-sys2.17.0
serde_derive1.0.228proc macro
serde_repr0.1.20proc macro
shlex1.3.0
syn2.0.117
syn3.0.7
synstructure0.13.2
thiserror-impl2.0.18proc macro
time0.3.55
time-core0.1.9
tinyvec1.13.3
tokio-macros2.7.0proc macro
tracing-attributes0.1.31proc macro
unicode-xid0.2.6
valuable0.1.1build script, not run
version_check0.9.5
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.3+wasi-0.2.9
wasip30.4.0+wasi-0.3.0-rc-2026-01-06
wasm-bindgen0.2.129build script, not run
wasm-bindgen-futures0.4.79
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
wasm-encoder0.244.0
wasm-metadata0.244.0
wasmparser0.244.0
web-sys0.3.106
web-time1.1.0
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.51.0build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
wit-bindgen-core0.51.0
wit-bindgen-rust0.51.0build script, not run
wit-bindgen-rust-macro0.51.0build script, not runproc macro
wit-component0.244.0
wit-parser0.244.0
yasna0.5.2
yoke-derive0.8.2proc macro
zerofrom-derive0.1.7proc macro
zerovec-derive0.11.3proc macro
Versions1RiskVulnsPublished
0.1.0highhigh4d ago

Raw data

capture
825 KB
records
134,408
bytes per record
6.1

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-16 · run 0ad9fb7d-abcf-4d48-873b-972f770ebb6b

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2