Skip to content
Open-Source Registry

cargo / meshlib

meshlib 3.1.4-554

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
526
operations
19K
packages
66
compiler runs
1
connections
3
job time
1m 41s
capture
218 KB
records
37K
bytes / record
6.0

Rust bindings for MeshLib, the 3D mesh processing library: booleans, offsets, decimation, registration, voxels

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

40 downloads · published 2026-10-16 · source · home page 3dbooleangeometrymeshstl View on crates.io

Graph

egress · high · in libmeshlib.rlib
2

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

3
  • Build script fetched what the build compiled, linked or ran
    meshlib 3.1.4-554 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libMeshLibC2.so › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libMeshLibC2Cuda.so › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
meshlib 3.1.4-554
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · MeshLib

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-c9935f05b13bf27e

    subject github.com:443

    by /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-c9935f05b13bf27e

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build

  3. What a build script's fetch becamesupport

    52 files came down; the build compiled or linked libMeshLibC2.so, libMeshLibC2Cuda.so

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build_script_build-c9935f05b13bf27e

In libmeshlib.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2476
  3. build-script-build/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build3146

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-ac96762652c15067/out/lib/libMeshLibC2.sowritten by build_script_build-c9935f05b13bf27e
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · MeshLib

Witness chain

  1. /home/runner/work/MeshLib/MeshLib/native.txt
    source
  2. /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-ac96762652c15067/out/lib/libMeshLibC2.sovia /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build_script_build-c9935f05b13bf27e, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-c9935f05b13bf27e from a network connection without a recorded source compilation

    subject
  3. meshlib-679546077c791d04linked
    artifact

Evidence

  • written under the build script at /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build_script_build-c9935f05b13bf27e, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-c9935f05b13bf27e from a network connection without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2476
  3. build-script-build/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build3146

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-ac96762652c15067/out/lib/libMeshLibC2Cuda.sowritten by build_script_build-c9935f05b13bf27e
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · MeshLib

Witness chain

  1. /home/runner/work/MeshLib/MeshLib/native.txt
    source
  2. /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-ac96762652c15067/out/lib/libMeshLibC2Cuda.sovia /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build_script_build-c9935f05b13bf27e, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-c9935f05b13bf27e from a network connection without a recorded source compilation

    subject
  3. meshlib-679546077c791d04linked
    artifact

Evidence

  • written under the build script at /home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build_script_build-c9935f05b13bf27e, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-c9935f05b13bf27e from a network connection without a recorded source compilation

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2476
  3. build-script-build/home/runner/work/MeshLib/MeshLib/target/release/build/meshlib-c9935f05b13bf27e/build-script-build3146

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 meshlib's own build code · build_script_build-c9935f05b13bf27e (MeshLib) · GitHub, Inc. · 52 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 meshlib's own build code · build_script_build-c9935f05b13bf27e (MeshLib) · Fastly, Inc. · 52 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (MeshLib) via crates.io · 2,989 files · went into an output ecosystem
Dependencies66Build behaviour
adler22.0.1
base640.23.1
bitflags2.13.2
block-buffer0.12.1
bumpalo3.20.3
bytes1.12.1
cc1.8.0
cfg-if1.0.5
cfg_aliases0.2.2
const-oid0.10.2
cpufeatures0.3.1
crc32fast1.5.2build script
crypto-common0.2.2
digest0.11.3
equivalent1.0.3
find-msvc-tools0.1.14
flate21.1.10
getrandom0.2.17
hashbrown0.17.1
http1.5.0
httparse1.10.1build script
hybrid-array0.4.15
indexmap2.14.2
itoa1.0.18
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
log0.4.34
memchr2.8.3
miniz_oxide0.9.1
nix0.31.3build script, not run
once_cell1.21.4
percent-encoding2.3.2
ring0.17.14build scriptprebuilt objects
rustls0.23.46build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
sha20.11.1
shlex2.0.1
simd-adler320.3.10
subtle2.6.1
typed-path0.12.3
typenum1.20.1
untrusted0.9.0
ureq3.4.2
ureq-proto0.6.4
utf8-zero0.8.1
wasi0.11.1+wasi-snapshot-preview1
webpki-roots1.0.9
windows-sys0.52.0
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
zeroize1.9.1
zip9.0.4
zlib-rs0.6.8
zopfli0.8.4
Versions3RiskVulnsPublished
3.1.4-554highnone1d ago
3.1.4-542not analyzed2d ago
3.1.40540yankednot analyzed2d ago

Raw data

capture
218 KB
records
36,615
bytes per record
6.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run a92ce063-efd9-4d50-88dd-2666b213457c

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2