Skip to content
Open-Source Registry

cargo / muna

muna 0.0.30

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
319
operations
37K
packages
170
compiler runs
113
connections
2
build time
1m 50s
job time
1m 50s
capture
463 KB
records
66K
bytes / record
7.0

Run prediction functions in your Rust apps.

Build behaviourits build script reached cdn.fxn.aiundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

636 downloads · Apache-2.0 · source · home page aiinferencemachine-learningprediction View on crates.io

Graph

egress · high · in libmuna.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    muna 0.0.30 › cdn.fxn.ai:443
    high
  • Uncompiled library linked
    libFunction.so › cdn.fxn.ai
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
muna 0.0.30
Destination
cdn.fxn.ai:443
Reaches
Jobs
build-test
Rule
egress · muna-rs

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to cdn.fxn.ai:443, opened by build_script_build-33029e70b1420890

    subject cdn.fxn.ai:443

    by /home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build-script-build

  2. What a build script's fetch becamesupport

    2 files came down; the build compiled or linked libFunction.so

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build_script_build-33029e70b1420890

In libmuna.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2497
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2497
  3. build-script-build/home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build-script-build4683

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/muna-rs/muna-rs/target/release/build/muna-147f0eb7e8c7343d/out/libFunction.sowritten by build_script_build-33029e70b1420890
Destination
cdn.fxn.ai
Jobs
build-test
Rule
object-provenance · muna-rs

Witness chain

  1. /home/runner/work/muna-rs/muna-rs/Cargo.toml
    source
  2. /home/runner/work/muna-rs/muna-rs/target/release/build/muna-147f0eb7e8c7343d/out/libFunction.sovia /home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build-script-build
    • Object written under a build script that downloadedfrom cdn.fxn.ai

      written under the build script at /home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build_script_build-33029e70b1420890, which downloaded from cdn.fxn.ai

    • Obfuscated toolchain bypass

      Written by build_script_build-33029e70b1420890 from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      muna asked the linker for it: dynamic Function (target/release/build/muna-147f0eb7e8c7343d/output)

    subject
  3. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build_script_build-33029e70b1420890, which downloaded from cdn.fxn.ai
  • Written by build_script_build-33029e70b1420890 from a network connection without a recorded source compilation
  • muna asked the linker for it: dynamic Function (target/release/build/muna-147f0eb7e8c7343d/output)

In libmuna.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2497
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2497
  3. build-script-build/home/runner/work/muna-rs/muna-rs/target/release/build/muna-33029e70b1420890/build-script-build4683

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • cdn.fxn.ai:443 muna's own build code · build_script_build-33029e70b1420890 (muna-rs) · Amazon.com, Inc. · 2 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (muna-rs) via crates.io · 9,401 files · went into an output ecosystem
Dependencies184Build behaviour
adler22.0.1
async-stream0.3.6
async-stream-impl0.3.6proc macro
async-trait0.1.92proc macro
atomic-waker1.1.2
base640.22.1
bitflags2.11.0
block-buffer0.10.4
bumpalo3.20.2
bytes1.11.1
cc1.2.57
cfg-if1.0.4
cfg_aliases0.2.1
chacha200.10.1
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.2.17
cpufeatures0.3.0
crc32fast1.5.0build script
crypto-common0.1.7
digest0.10.7
displaydoc0.2.5proc macro
dotenvy0.15.7
equivalent1.0.2
find-msvc-tools0.1.9
flate21.1.9
form_urlencoded1.2.2
futures-channel0.3.32
futures-core0.3.32
futures-io0.3.32
futures-macro0.3.32proc macro
futures-sink0.3.32
futures-task0.3.32
futures-util0.3.32
generic-array0.14.7build script
getrandom0.2.17
getrandom0.4.3build script, not run
hashbrown0.17.1
home0.5.12
http1.4.0
http-body1.0.1
http-body-util0.1.3
httparse1.10.1build script
hyper1.8.1
hyper-rustls0.27.7
hyper-util0.1.20
icu_collections2.1.1
icu_locale_core2.1.1
icu_normalizer2.1.1
icu_normalizer_data2.1.1build script
icu_properties2.1.2
icu_properties_data2.1.2build script
icu_provider2.1.1
idna1.1.0
idna_adapter1.2.1
indexmap2.14.2
ipnet2.12.0
iri-string0.7.10
itoa1.0.17
js-sys0.3.91
ld-linux-x86-64.so.2system library
libc0.2.183build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
litemap0.8.1
log0.4.29
lru-slab0.1.2
memchr2.8.0
miniz_oxide0.8.9
mio1.1.1
once_cell1.21.4
openssl-probe0.2.1
percent-encoding2.3.2
pin-project-lite0.2.17
pin-utils0.1.0
potential_utf0.1.4
proc-macro21.0.106build script
quinn0.11.9build script, not run
quinn-proto0.11.16
quinn-udp0.5.14build script, not run
quote1.0.45build script
r-efi6.0.0
rand0.10.2
rand_core0.10.1
rand_pcg0.10.2
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.1
rustls0.23.37build script
rustls-native-certs0.8.3
rustls-pki-types1.14.0
rustls-webpki0.103.13
rustversion1.0.22build script, not runproc macro
ryu1.0.23
schannel0.1.29
security-framework3.7.0
security-framework-sys2.17.0
serde1.0.228build script
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.149build script
serde_urlencoded0.7.1
sha20.10.9
shlex1.3.0
simd-adler320.3.8
slab0.4.12
smallvec1.15.1
socket20.6.3
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.117
syn3.0.3
sync_wrapper1.0.2
synstructure0.13.2
thiserror2.0.18build script
thiserror-impl2.0.18proc macro
tinystr0.8.2
tinyvec1.10.0
tinyvec_macros0.1.1
tokio1.50.0
tokio-macros2.6.1proc macro
tokio-rustls0.26.4
tokio-util0.7.18
tower0.5.3
tower-http0.6.8
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicode-ident1.0.24
untrusted0.9.0
ureq3.2.0
ureq-proto0.5.3
url2.5.8
utf-80.7.6
utf8_iter1.0.4
version_check0.9.5
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.114build script, not run
wasm-bindgen-futures0.4.64
wasm-bindgen-macro0.2.114proc macro
wasm-bindgen-macro-support0.2.114
wasm-bindgen-shared0.2.114build script, not run
wasm-streams0.4.2
web-sys0.3.91
web-time1.1.0
webpki-roots1.0.6
windows-link0.2.1
windows-sys0.52.0
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.52.6
windows-targets0.53.5
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
writeable0.6.2
yoke0.8.1
yoke-derive0.8.1proc macro
zerofrom0.1.6
zerofrom-derive0.1.6proc macro
zeroize1.8.2
zerotrie0.2.3
zerovec0.11.5
zerovec-derive0.11.2proc macro
zmij1.0.21build script
Versions30RiskVulnsPublished
0.0.29not analyzed2026-09-29
0.0.28not analyzed2026-09-26
0.0.27not analyzed2026-09-24
0.0.26not analyzed2026-09-18
0.0.25not analyzed2026-09-17
0.0.24not analyzed2026-09-17
0.0.23not analyzed2026-09-16
0.0.22not analyzed2026-09-15
0.0.21not analyzed2026-09-09
0.0.20not analyzed2026-09-05
0.0.19not analyzed2026-09-03
0.0.18not analyzed2026-09-01
0.0.17not analyzed2026-08-23
0.0.16not analyzed2026-08-20
0.0.15not analyzed2026-08-19
0.0.14not analyzed2026-08-15
0.0.13not analyzed2026-07-15
0.0.12not analyzed2026-06-17
0.0.11not analyzed2026-06-15
0.0.10not analyzed2026-06-15
0.0.9not analyzed2026-03-31
0.0.8not analyzed2026-03-26
0.0.7not analyzed2026-03-24
0.0.6not analyzed2026-03-24
0.0.5not analyzed2026-03-16
0.0.4not analyzed2026-03-16
0.0.3not analyzed2026-03-15
0.0.2not analyzed2026-03-15
0.0.1not analyzed2026-03-15
0.0.30highnone

Raw data

capture
463 KB
records
66,414
bytes per record
7.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-20 · run 0fd3600b-cc90-46c9-af01-9dc364581ce3

analysis 0.1.0 · 2026-10-19 · 10ce9f4 · graph v2