Skip to content
Open-Source Registry

cargo / markon-core

markon-core 0.15.29

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
1,002
operations
111K
packages
449
compiler runs
545
connections
3
job time
7m 25s
capture
1.4 MB
records
197K
bytes / record
7.0

markon core - Mark it on.

Build behaviourhas a build scriptundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

300 downloads · Apache-2.0 · source · home page · crates.io diagramgithubmarkdownpreviewtoc

Graph

object-provenance · high · in libmarkon_core.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    libgraphviz_api.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    graphviz-anywhere 0.2.6 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/libgraphviz_api.awritten by build_script_build-57a4d5ded5475dc4
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · markon

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v0.2.6/graphviz-native-linux-x86_64.tar.gzvia curl -sSfL --retry 3 --retry-delay 2 -o /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v
  3. pipevia gzip -d
  4. /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v0.2.6/lib/libgraphviz_api.avia tar -xzf /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v0.2.6/graphviz-native-linux-x86
  5. /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/libgraphviz_api.avia /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-57a4d5ded5475dc4/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-57a4d5ded5475dc4/build_script_build-57a4d5ded5475dc4, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypassfrom libgraphviz_api.aby tar

      copied input /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v0.2.6/lib/libgraphviz_api.a: Written by tar from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      graphviz-anywhere asked the linker for it: static graphviz_api (target/release/build/graphviz-anywhere-137d683c20d7d674/output)

    subject
  6. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-57a4d5ded5475dc4/build_script_build-57a4d5ded5475dc4, which downloaded from github.com, release-assets.githubusercontent.com
  • copied input /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v0.2.6/lib/libgraphviz_api.a: Written by tar from a pipe without a recorded source compilation
  • graphviz-anywhere asked the linker for it: static graphviz_api (target/release/build/graphviz-anywhere-137d683c20d7d674/output)

In libmarkon_core.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar -xzf /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v0.2.6/graphviz-native-linux-x86…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2455
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2455
  3. build-script-build/home/runner/work/markon/markon/target/release/build/graphviz-anywhere-57a4d5ded5475dc4/build-script-build6633
  4. tartar -xzf /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v0.2.6/graphviz-native-linux-x86…6647

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
graphviz-anywhere 0.2.6
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -sSfL --retry 3 --retry-delay 2 -o /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -sSfL --retry 3 --retry-delay 2 -o /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-57a4d5ded5475dc4/build_script_build-57a4d5ded5475dc4

  5. Tool commandsupport

    Command: curl -sSfL --retry 3 --retry-delay 2 -o /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v…

    by curl -sSfL --retry 3 --retry-delay 2 -o /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v…

In libmarkon_core.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSfL --retry 3 --retry-delay 2 -o /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2455
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2455
  3. build-script-build/home/runner/work/markon/markon/target/release/build/graphviz-anywhere-57a4d5ded5475dc4/build-script-build6633
  4. curlcurl -sSfL --retry 3 --retry-delay 2 -o /home/runner/work/markon/markon/target/release/build/graphviz-anywhere-137d683c20d7d674/out/graphviz-anywhere-prebuilt-v…6641

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of graphviz-anywhere · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of graphviz-anywhere · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (markon) via crates.io · 26,603 files · went into an output ecosystem
Dependencies500Build behaviour
adler22.0.1
adler321.2.0
aho-corasick1.1.4
allocator-api20.2.21
ambient-authority0.0.2
android_system_properties0.1.5
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
anstyle-wincon3.0.11
anyhow1.0.103build script
ar_archive_writer0.5.2
arc-swap1.9.2
argparse0.2.2
async-trait0.1.89proc macro
atomic-waker1.1.2
autocfg1.5.1
axum0.8.9
axum-core0.5.6
base320.5.1
base640.22.1
bincode1.3.3
bit-set0.8.0
bit-vec0.8.0
bitflags1.3.2
bitflags2.13.0
bitpacking0.9.3
block-buffer0.10.4
block-buffer0.12.1
bon3.9.3
bon-macros3.9.3proc macro
bstr1.12.3
bumpalo3.20.3
bytecount0.6.9
bytemuck1.25.1
byteorder1.5.0
byteorder-lite0.1.0
bytes1.12.1
cap-primitives4.0.2build script
cap-std4.0.2build script
cc1.2.67
cedarwood0.5.0
census0.4.2
cfg-if1.0.4
cfg_aliases0.2.1
chacha200.10.1
chrono0.4.45
chrono-tz0.9.0build script
chrono-tz-build0.3.0
colorchoice1.0.5
const-oid0.10.2
const_format0.2.36
const_format_proc_macros0.2.34proc macro
convert_case0.4.0
core-foundation-sys0.8.7
cpufeatures0.2.17
cpufeatures0.3.0
crc32fast1.5.0build script
crossbeam-channel0.5.16
crossbeam-deque0.8.7build script
crossbeam-epoch0.9.20build script
crossbeam-utils0.8.22build script
crunchy0.2.4build script
crypto-common0.1.7
crypto-common0.2.2
d2-little0.7.1-1
dagre0.1.1
darling0.23.0
darling_core0.23.0
darling_macro0.23.0proc macro
dary_heap0.3.9
data-encoding2.11.0
datasketches0.2.0
defmt1.1.1build script, not run
defmt-macros1.1.1build script, not runproc macro
defmt-parser1.0.0
deranged0.5.8
derivative2.2.0proc macro
derive_more0.99.20proc macro
deunicode1.6.2
digest0.10.7
digest0.11.3
dirs6.0.0
dirs-sys0.5.0
displaydoc0.2.6proc macro
doctest-file1.1.1proc macro
downcast-rs1.2.1
downcast-rs2.0.2
dunce1.0.5
either1.16.0
emojis0.7.2
encoding_rs0.8.35
encoding_rs_io0.1.7
entities1.0.1
env_filter2.0.0
env_logger0.11.11
equivalent1.0.2
erased-serde0.4.10build script
errno0.3.14
fallible-iterator0.3.0
fallible-streaming-iterator0.1.9
fancy-regex0.14.0
fastdivide0.4.2
fastrand2.4.1
filetime0.2.29
find-msvc-tools0.1.9
flate21.1.9
fnv1.0.7
foldhash0.1.5
foldhash0.2.0
form_urlencoded1.2.2
fs-set-times0.20.3
fs40.13.1
fsevent-sys4.1.0
futures0.3.32
futures-channel0.3.32
futures-core0.3.32
futures-executor0.3.32
futures-io0.3.32
futures-macro0.3.32proc macro
futures-sink0.3.32
futures-task0.3.32
futures-util0.3.32
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
globset0.4.18
globwalk0.9.1
graphviz-anywhere0.2.6build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
grep-matcher0.1.8
grep-regex0.1.14
grep-searcher0.1.16
hashbrown0.15.5
hashbrown0.16.1
hashbrown0.17.1
hashlink0.10.0
hmac0.12.1
html-escape0.2.14
htmlescape0.3.1
http1.4.2
http-body1.0.1
http-body-util0.1.3
http-range-header0.4.2
httparse1.10.1build script
httpdate1.0.3
humansize2.1.3
hybrid-array0.4.13
hyper1.10.1
hyper-rustls0.27.9
hyper-util0.1.20
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
if-addrs0.15.0
ignore0.4.28
image0.25.10
include-flate0.3.4
include-flate-codegen0.3.4proc macro
include-flate-compress0.3.4
indexmap2.14.0
inotify0.9.6
inotify-sys0.1.8build script
interprocess2.4.2
inventory0.3.24
io-extras0.19.0build script
io-lifetimes2.0.4build script
io-lifetimes3.0.1build script
ipnet2.12.0
is-docker0.2.0
is-wsl0.4.0
is_terminal_polyfill1.70.2
itertools0.14.0
itoa1.0.18
jieba-macros0.10.3proc macro
jieba-rs0.10.3
jiff0.2.32
jiff-static0.2.32proc macro
jobserver0.1.35
js-sys0.3.103
json50.4.1
konst0.2.20
konst_macro_rules0.2.19
kqueue1.2.0
kqueue-sys1.1.2
lazy_static1.5.0
ld-linux-x86-64.so.2system library
levenshtein_automata0.2.1
libc0.2.186build script
libc.so.6system library
libexpat.so.1system library
libflate2.3.0
libflate_lz772.3.0
libgcc_s.so.1system library
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
libredox0.1.18
libsqlite3-sys0.35.0build script
libstdc++.so.6system library
libyml0.0.5
libz.so.1system library
linked-hash-map0.5.6
linux-raw-sys0.12.1
litemap0.8.2
lock_api0.4.14
log0.4.33
lru0.16.4
lru-slab0.1.2
lz4_flex0.13.1
markdown1.0.0
markdown-it-rs-url0.1.0
matchit0.8.4
maybe-owned0.3.4
measure_time0.9.0
memchr2.8.3
memmap20.9.11
mermaid-little11.14.0-6
mime0.3.17
mime_guess2.0.5build script
minimal-lexical0.2.1
miniz_oxide0.8.9
mio0.8.11
mio1.2.1
moxcms0.8.1
murmurhash320.3.1
no_std_io20.9.4
nom7.1.3
notify6.1.1
num-conv0.2.2
num-traits0.2.19build script
object0.37.3build script
once_cell1.21.4
once_cell_polyfill1.70.2
oneshot0.1.13
onig6.5.3
onig_sys69.9.3build script
open5.4.0
option-ext0.2.0
ordered-float5.3.0
ownedbytes0.9.0
parking_lot0.12.5
parking_lot_core0.9.12build script
parse-zoneinfo0.3.1
percent-encoding2.3.2
pest2.8.7
pest_derive2.8.7proc macro
pest_generator2.8.7
pest_meta2.8.7
phf0.11.3
phf0.12.1
phf0.13.1
phf_codegen0.11.3
phf_codegen0.13.1
phf_generator0.11.3
phf_generator0.13.1
phf_shared0.11.3
phf_shared0.12.1
phf_shared0.13.1
pin-project-lite0.2.17
pkg-config0.3.33
plantuml-little1.2026.2-4
plist1.10.0
portable-atomic1.13.1build script, not run
portable-atomic-util0.2.7build script, not run
potential_utf0.1.5
powerfmt0.2.0
ppv-lite860.2.21
prettyplease0.2.37build script
proc-macro-error-attr33.0.2proc macro
proc-macro-error33.0.2
proc-macro21.0.106build script
psm0.1.31build scriptprebuilt objects
pxfm0.1.30
qrcode0.14.1
quick-xml0.41.0
quinn0.11.11build script, not run
quinn-proto0.11.16
quinn-udp0.5.15build script, not run
quote1.0.46build script
r-efi5.3.0
r-efi6.0.0
rand0.10.2
rand0.8.7
rand0.9.5
rand_chacha0.3.1
rand_chacha0.9.0
rand_core0.10.1
rand_core0.6.4
rand_core0.9.5
rand_pcg0.10.2
rayon1.12.0
rayon-core1.13.0build script
readonly0.2.13proc macro
recvmsg1.0.0
redox_syscall0.5.18
redox_users0.5.2
regex1.13.0
regex-automata0.4.15
regex-syntax0.8.11
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rle-decode-fast1.0.3
roxmltree0.20.0
rusqlite0.37.0
rust-embed8.12.0
rust-embed-impl8.12.0proc macro
rust-embed-utils8.12.0
rust-stemmers1.2.0
rustc-hash2.1.3
rustc_version0.4.1
rustix1.1.4build script
rustix-linux-procfs0.1.1
rustls0.23.41build script
rustls-pki-types1.15.0
rustls-webpki0.103.13
rustversion1.0.23build scriptproc macro
ryu1.0.23
same-file1.0.6
scopeguard1.2.0
semver1.0.28
serde1.0.228build script
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.150build script
serde_path_to_error0.1.20
serde_urlencoded0.7.1
serde_yml0.0.12build script
sha10.10.7
sha20.10.9
sha20.11.0
shlex2.0.1
signal-hook-registry1.4.8
simd-adler320.3.9
similar2.7.0
siphasher1.0.3
sketches-ddsketch0.4.1
slab0.4.12
slug0.1.6
smallvec1.15.2
socket20.6.4
stable_deref_trait1.2.1
stacker0.1.24build script
strsim0.11.1
subtle2.6.1
supramark-diagram0.1.6
supramark-diagram-core0.1.1
supramark-font-metrics0.1.1
supramark-markdown0.1.2
syn1.0.109build script
syn2.0.118
syn3.0.3
sync_wrapper1.0.2
synstructure0.13.2
syntect5.3.0
sys-locale0.3.2
tantivy0.26.1
tantivy-bitpacker0.10.0
tantivy-columnar0.7.0
tantivy-common0.11.0
tantivy-fst0.5.0
tantivy-jieba0.20.0
tantivy-query-grammar0.26.0
tantivy-sstable0.7.0
tantivy-stacker0.7.0
tantivy-tokenizer-api0.7.0
tempfile3.27.0
tera1.20.1
thiserror1.0.69build script
thiserror2.0.18build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.18proc macro
time0.3.53
time-core0.1.9
time-macros0.2.31proc macro
tinystr0.8.3
tinyvec1.12.0
tinyvec_macros0.1.1
tokio1.52.3
tokio-macros2.7.0proc macro
tokio-rustls0.26.4
tokio-stream0.1.18
tokio-tungstenite0.29.0
tokio-util0.7.20
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
ttf-parser0.21.1
tungstenite0.29.0
two-face0.5.1
typeid1.0.3build script
typenum1.20.1
typetag0.2.23build script
typetag-impl0.2.23proc macro
ucd-trie0.1.7
unicase2.9.0
unicode-general-category0.6.0build script
unicode-id0.3.6
unicode-ident1.0.24
unicode-segmentation1.13.3
unicode-width0.1.14
unicode-xid0.2.6
untrusted0.9.0
url2.5.8
urlencoding2.1.3
utf8-ranges1.0.5
utf8_iter1.0.4
utf8parse0.2.2
uuid1.23.5
vcpkg0.2.15prebuilt objects
version_check0.9.5
walkdir2.5.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-futures0.4.76
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
wasm-streams0.4.2
web-sys0.3.103
web-time1.1.0
webpki-roots1.0.8
widestring1.2.1
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.48.0
windows-sys0.52.0
windows-sys0.59.0
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.48.5
windows-targets0.52.6
windows-targets0.53.5
windows_aarch64_gnullvm0.48.5build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.48.5build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.48.5build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.48.5build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.48.5build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.48.5build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
winx0.36.4
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.3
yaml-rust0.4.5
yoke0.8.3
yoke-derive0.8.2proc macro
zerocopy0.8.54build script
zerocopy-derive0.8.54proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
zip0.6.6
zmij1.0.22build script
zstd0.13.3
zstd-safe7.2.4build script
zstd-sys2.0.16+zstd.1.5.7build script

Raw data

capture
1.4 MB
records
197,378
bytes per record
7.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-14 · run 5025d36e-da9f-4f81-8653-33b0af80491e

analysis 0.1.0 · 2026-10-14 · efb1d7d · graph v2