Skip to content
Open-Source Registry

cargo / mozjs / 0.26.9

mozjs 0.26.9

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
559
operations
66K
packages
210
compiler runs
113
connections
3
job time
1m 33s
capture
842 KB
records
116K
bytes / record
7.2

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run bfe5dc8e-e23a-40e4-8d66-dbc1077d059e · built 2026-10-16 · complete View on crates.io

Graph

object-provenance · high · in libmozjs.rlib
5

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

4
  • Uncompiled library linked
    libjs_static.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libjsapi.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libjsglue.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    mozjs_sys 153.4.0-1 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/build/js/src/build/libjs_static.awritten by build_script_build-a1093f6d9ebe70d5
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · mozjs

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gzvia curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s
  3. /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/build/js/src/build/libjs_static.avia /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build_script_build-a1093f6d9ebe70d5, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build_script_build-a1093f6d9ebe70d5 without a recorded source compilation

    • Asked for by the build's own declaration

      mozjs_sys asked the linker for it: static js_static (target/release/build/mozjs_sys-96104d04c0b73614/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build_script_build-a1093f6d9ebe70d5, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-a1093f6d9ebe70d5 without a recorded source compilation
  • mozjs_sys asked the linker for it: static js_static (target/release/build/mozjs_sys-96104d04c0b73614/output)

In libmozjs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2478
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2478
  3. build-script-build/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build4764

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/build/libjsapi.awritten by build_script_build-a1093f6d9ebe70d5
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · mozjs

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gzvia curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s
  3. /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/build/libjsapi.avia /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build_script_build-a1093f6d9ebe70d5, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build_script_build-a1093f6d9ebe70d5 without a recorded source compilation

    • Asked for by the build's own declaration

      mozjs_sys asked the linker for it: static jsapi (target/release/build/mozjs_sys-96104d04c0b73614/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build_script_build-a1093f6d9ebe70d5, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-a1093f6d9ebe70d5 without a recorded source compilation
  • mozjs_sys asked the linker for it: static jsapi (target/release/build/mozjs_sys-96104d04c0b73614/output)

In libmozjs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2478
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2478
  3. build-script-build/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build4764

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/build/libjsglue.awritten by build_script_build-a1093f6d9ebe70d5
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · mozjs

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gzvia curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s
  3. /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/build/libjsglue.avia /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build_script_build-a1093f6d9ebe70d5, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build_script_build-a1093f6d9ebe70d5 without a recorded source compilation

    • Asked for by the build's own declaration

      mozjs_sys asked the linker for it: static jsglue (target/release/build/mozjs_sys-96104d04c0b73614/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build_script_build-a1093f6d9ebe70d5, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-a1093f6d9ebe70d5 without a recorded source compilation
  • mozjs_sys asked the linker for it: static jsglue (target/release/build/mozjs_sys-96104d04c0b73614/output)

In libmozjs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2478
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2478
  3. build-script-build/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build4764

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
mozjs_sys 153.4.0-1
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build_script_build-a1093f6d9ebe70d5

  5. Tool commandsupport

    Command: curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s…

    by curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s…

In libmozjs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2478
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2478
  3. build-script-build/home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-a1093f6d9ebe70d5/build-script-build4764
  4. curlcurl -L -f -s -o /home/runner/work/mozjs/mozjs/target/release/build/mozjs_sys-96104d04c0b73614/out/libmozjs-x86_64-unknown-linux-gnu.tar.gz https://github.com/s…4779

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of mozjs_sys · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of mozjs_sys · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (mozjs) via crates.io · 25,684 files · went into an output ecosystem
Dependencies214Build behaviour
adler22.0.1
aho-corasick1.1.5
anes0.1.6
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
anstyle-wincon3.0.11
arraystring0.3.0
arrayvec0.7.8
autocfg1.5.1
bindgen0.72.1build script
bitflags2.13.2
bumpalo3.20.3
calendrical_calculations0.2.4
cast0.3.0
cbindgen0.29.4build script
cc1.8.0
cexpr0.6.0
cfg-if1.0.5
ciborium0.2.2
ciborium-io0.2.2
ciborium-ll0.2.2
clang-sys1.9.1build script
clap4.6.7
clap_builder4.6.7
clap_lex1.1.1
colorchoice1.0.5
core_detect1.0.0
core_maths0.1.1
crc32fast1.5.2build script
criterion0.6.0
criterion-plot0.5.0
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crunchy0.2.4build script, not run
diplomat0.14.0proc macro
diplomat-runtime0.14.0
diplomat_core0.14.0
displaydoc0.2.7proc macro
either1.19.0
encoding_c0.9.8build script
encoding_c_mem0.2.6build script
encoding_rs0.8.42build script
equivalent1.0.3
errno0.3.14
fastrand2.5.0
filetime0.2.29
find-msvc-tools0.1.14
fixed_decimal0.7.2
flate21.1.10
futures-core0.3.34
futures-task0.3.34
futures-util0.3.34
getrandom0.4.3build script
glob0.3.4
half2.7.1
hashbrown0.17.1
heck0.5.0
icu_calendar2.1.1
icu_calendar_data2.1.1build script
icu_capi2.1.2
icu_casemap2.1.1
icu_casemap_data2.1.1build script
icu_collator2.1.2
icu_collator_data2.1.1build script, not run
icu_collections2.1.1
icu_datetime2.1.1
icu_datetime_data2.1.2build script, not run
icu_decimal2.1.1
icu_decimal_data2.1.1build script, not run
icu_experimental0.4.0
icu_experimental_data0.4.1build script, not run
icu_list2.1.1
icu_list_data2.1.1build script, not run
icu_locale2.1.1
icu_locale_core2.3.0
icu_locale_data2.1.2build script
icu_normalizer2.1.1
icu_normalizer_data2.1.1build script, not run
icu_pattern0.4.2
icu_plurals2.1.1
icu_plurals_data2.1.1build script, not run
icu_properties2.1.2
icu_properties_data2.1.2build script
icu_provider2.3.1
icu_provider_adapters2.1.1
icu_segmenter2.1.2
icu_segmenter_data2.1.1build script
icu_time2.1.1
icu_time_data2.1.1build script
indexmap2.14.2
is_terminal_polyfill1.70.2
itertools0.10.5
itertools0.13.0
itoa1.0.18
ixdtf0.6.6
js-sys0.3.106
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
libz-sys1.1.30build script
linux-raw-sys0.12.1
litemap0.8.3
log0.4.34
memchr2.8.3
minimal-lexical0.2.1
miniz_oxide0.9.1
mozjs_collator_glue153.4.0build script
mozjs_icu_collator153.4.0
mozjs_icu_collator_data153.4.0build script
mozjs_icu_collections153.4.0
mozjs_icu_normalizer153.4.0
mozjs_icu_normalizer_data153.4.0build script
mozjs_locale_glue153.4.0build scriptnetworkstatic.crates.io
mozjs_normalizer_glue153.4.0build scriptnetworkstatic.crates.io
mozjs_properties_glue153.4.0build scriptnetworkstatic.crates.io
mozjs_sys153.4.0-1build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
mozjs_unicode_bidi_ffi153.4.0build script
mozjs_utf16_iter153.4.0
mozjs_utf8_iter153.4.0
multiversion0.9.0
multiversion-macros0.9.0proc macro
multiversion_no_op1.0.0proc macro
nom7.1.3
num-bigint0.4.8
num-integer0.1.47
num-rational0.4.2
num-traits0.2.19build script
once_cell1.21.4
once_cell_polyfill1.70.2
oorandom11.1.5
pin-project-lite0.2.17
pkg-config0.3.34
plotters0.3.7
plotters-backend0.3.7
plotters-svg0.3.7
potential_utf0.1.6
proc-macro21.0.107build script
quote1.0.47build script
r-efi6.0.0
rayon1.12.0
rayon-core1.13.0build script
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
rustc-hash2.1.3
rustix1.1.5build script
rustversion1.0.23build scriptproc macro
same-file1.0.6
scopeguard1.2.0
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.154build script
serde_spanned1.1.2
shlex1.3.0
shlex2.0.1
simd-adler320.3.10
simdutf80.1.5
slab0.4.12
smallvec1.16.3
stable_deref_trait1.2.1
strck1.0.0
strsim0.11.1
syn2.0.119
syn3.0.9
synstructure0.14.0
tar0.4.46
tempfile3.27.0
tinystr0.8.4
tinytemplate1.2.1
toml0.9.12+spec-1.1.0
toml_datetime0.7.5+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
toml_writer1.1.3+spec-1.1.0
typenum1.20.1
unicode-bidi0.3.18
unicode-ident1.0.27
utf16_iter1.0.5
utf8_iter1.0.4
utf8parse0.2.2
vcpkg0.2.15prebuilt objects
walkdir2.5.0
wasm-bindgen0.2.129build script, not run
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
web-sys0.3.106
winapi-util0.1.11
windows-link0.2.1
windows-sys0.61.2
winnow0.7.15
winnow1.0.4
write161.0.0
writeable0.6.4
xattr1.6.1
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.63build script
zerocopy-derive0.8.63proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.8
zmij1.0.23build script
Versions90RiskVulnsPublished
0.26.811d ago
0.26.7not analyzed2026-10-02
0.15.20not analyzed2026-09-30
0.15.19not analyzed2026-09-29
0.26.6not analyzed2026-09-29
0.26.5not analyzed2026-09-28
0.26.4not analyzed2026-09-25
0.26.3not analyzed2026-09-21
0.26.2not analyzed2026-09-21
0.26.1not analyzed2026-09-13
0.26.0not analyzed2026-09-06
0.25.0not analyzed2026-08-30
0.24.0not analyzed2026-08-29
0.23.1not analyzed2026-08-24
0.23.0not analyzed2026-08-22
0.22.0not analyzed2026-08-21
0.15.18not analyzed2026-08-20
0.21.6not analyzed2026-08-20
0.21.5not analyzed2026-08-18
0.21.4not analyzed2026-08-12
0.21.3not analyzed2026-08-11
0.21.2not analyzed2026-08-08
0.21.1not analyzed2026-08-07
0.21.0not analyzed2026-07-31
0.20.1not analyzed2026-07-22
0.20.0not analyzed2026-07-19
0.19.0not analyzed2026-07-15
0.18.3not analyzed2026-07-14
0.18.2not analyzed2026-07-10
0.18.1not analyzed2026-07-10
0.15.16not analyzed2026-07-02
0.18.0not analyzed2026-07-02
0.17.1not analyzed2026-07-02
0.17.0not analyzed2026-06-30
0.15.15not analyzed2026-06-27
0.16.4not analyzed2026-06-17
0.16.3not analyzed2026-06-16
0.16.2not analyzed2026-06-12
0.16.1not analyzed2026-06-11
0.16.0not analyzed2026-06-06
0.15.14not analyzed2026-05-05
0.15.13not analyzed2026-05-01
0.15.12not analyzed2026-04-25
0.15.11not analyzed2026-04-25
0.15.10not analyzed2026-04-24
0.15.9not analyzed2026-04-22
0.15.8not analyzed2026-04-08
0.15.7not analyzed2026-03-24
0.15.6not analyzed2026-03-10
0.15.5not analyzed2026-03-09
0.15.4not analyzed2026-03-01
0.15.3not analyzed2026-03-01
0.15.2not analyzed2026-02-25
0.15.1not analyzed2026-02-25
0.15.0not analyzed2026-02-02
0.14.8not analyzed2026-01-18
0.14.7not analyzed2026-01-18
0.14.6not analyzed2026-01-17
0.14.5not analyzed2026-01-05
0.14.4not analyzed2025-12-28
0.14.3not analyzed2025-12-18
0.14.2not analyzed2025-12-01
0.10.1not analyzed2019-03-25
0.10.0not analyzed2019-01-14
0.9.5not analyzed2018-11-15
0.9.4not analyzed2018-11-08
0.9.3not analyzed2018-10-18
0.9.2not analyzed2018-09-25
0.9.1not analyzed2018-09-07
0.9.0not analyzed2018-08-24
0.8.0not analyzed2018-08-16
0.7.2not analyzed2018-08-09
0.7.1not analyzed2018-05-30
0.7.0not analyzed2018-05-23
0.6.1not analyzed2018-05-14
0.6.0not analyzed2018-03-28
0.5.0not analyzed2018-03-26
0.4.2not analyzed2018-03-26
0.4.1not analyzed2018-03-24
0.4.0not analyzed2018-03-23
0.3.1not analyzed2018-03-22
0.3.0not analyzed2018-03-18
0.2.0not analyzed2018-03-14
0.1.14not analyzed2018-03-13
0.1.11not analyzed2018-01-22
0.1.10not analyzed2018-01-05
0.1.9not analyzed2017-12-05
0.1.8not analyzed2017-11-10
0.1.7not analyzed2017-11-08
0.26.9highnone

Raw data

capture
842 KB
records
116,367
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-16 · run bfe5dc8e-e23a-40e4-8d66-dbc1077d059e

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2