Skip to content
Open-Source Registry

cargo / mylittlechart-updater / 0.5.656

mylittlechart-updater 0.5.656

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
476
operations
47K
packages
228
compiler runs
171
connections
3
job time
3m 20s
capture
626 KB
records
85K
bytes / record
7.3

Build behaviourhas a build scriptundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 7a9f8a98-f605-4f5f-856e-41ee50b482ff · built 2026-10-18 · complete View on crates.io

Graph

egress · high · in libmlc_updater.rlib
6

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

5
  • Build script fetched what the build compiled, linked or ran
    uzor-fonts 1.5.5 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Downloaded file compiled into the artifact
    NotoColorEmoji.ttf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansArabic-Regular.ttf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansCJKsc-Regular.otf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansDevanagari-Regular.ttf › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
uzor-fonts 1.5.5
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…

  3. What a build script's fetch becamesupport

    4 files came down; the build compiled or linked NotoColorEmoji.ttf, NotoSansCJKsc-Regular.otf, NotoSansArabic-Regular.ttf +1 more

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9

  5. Tool commandsupport

    Command: curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…

In libmlc_updater.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2475
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2475
  3. build-script-build/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build-script-build4732
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…4737

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoColorEmoji.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · mylittlechart

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoColorEmoji.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libmlc_updater.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2475
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2475
  3. build-script-build/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build-script-build4732
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…4737

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoSansArabic-Regular.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · mylittlechart

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoSansArabic-Regular.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libmlc_updater.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2475
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2475
  3. build-script-build/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build-script-build4732
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…4756

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoSansCJKsc-Regular.otfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · mylittlechart

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoSansCJKsc-Regular.otfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libmlc_updater.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2475
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2475
  3. build-script-build/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build-script-build4732
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…4753

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoSansDevanagari-Regular.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · mylittlechart

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-48df3169eaca427f/out/NotoSansDevanagari-Regular.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build_script_build-b7e64dbdb88206a9, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libmlc_updater.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2475
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2475
  3. build-script-build/home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fonts-b7e64dbdb88206a9/build-script-build4732
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/mylittlechart/mylittlechart/target/release/build/uzor-fo…4759

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of uzor-fonts · curl · GitHub, Inc. · 4 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 build code of uzor-fonts · curl · Fastly, Inc. · 4 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (mylittlechart) via crates.io · 13,236 files · went into an output ecosystem
Dependencies238Build behaviour
adler22.0.1
aead0.5.2
aes0.8.4
aes-gcm0.10.3
ahash0.8.12build script
arrayvec0.7.8
atomic-waker1.1.2
autocfg1.5.1
base640.22.1
base640.23.1
base64ct1.8.3
bitflags2.13.2
block-buffer0.10.4
bumpalo3.20.3
bytemuck1.25.2
byteorder-lite0.1.0
bytes1.12.1
cc1.8.0
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
cipher0.4.4
const-oid0.9.6
const-random0.1.18
const-random-macro0.1.16proc macro
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.2build script
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crunchy0.2.4build script
crypto-common0.1.7
ctr0.9.2
curve25519-dalek4.1.3build script
curve25519-dalek-derive0.1.1proc macro
der0.7.10
digdigdig3-core0.3.32
digest0.10.7
displaydoc0.2.7proc macro
ed255192.2.3
ed25519-dalek2.2.0
either1.19.0
errno0.3.14
fastrand2.5.0
fdeflate0.3.7
fiat-crypto0.2.9
find-msvc-tools0.1.14
flate21.1.10
form_urlencoded1.2.2
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-macro0.3.34proc macro
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.4.3build script
ghash0.5.1
heck0.5.0
hex0.4.3
hkdf0.12.4
hmac0.12.1
hostname0.4.2
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.12.0
hyper-rustls0.27.10
hyper-util0.1.21
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
image0.25.10
inout0.1.4
ipnet2.12.2
itoa1.0.18
js-sys0.3.106
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
litemap0.8.3
lock_api0.4.14
log0.4.34
lru-slab0.1.3
memchr2.8.3
mime0.3.17
mime_guess2.0.5build script
miniz_oxide0.8.9
miniz_oxide0.9.1
mio1.2.4
mli-contract-macros0.1.0proc macro
moxcms0.8.1
mylittlechart-alert-delivery0.5.656
mylittlechart-core0.5.656
mylittlechart-vault0.5.656
mylittleindicators0.2.1
num-traits0.2.19build script
once_cell1.21.4
opaque-debug0.3.1
parking_lot0.12.5
parking_lot_core0.9.12build script
password-hash0.5.0
pbkdf20.12.2
percent-encoding2.3.2
pin-project-lite0.2.17
pkcs80.10.2
png0.18.1
polyval0.6.2
potential_utf0.1.6
ppv-lite860.2.21
proc-macro21.0.107build script
pxfm0.1.30
quinn0.11.12build script, not run
quinn-proto0.11.19
quinn-udp0.5.16build script, not run
quote1.0.47build script
r-efi6.0.0
rand0.10.3
rand0.8.8
rand_chacha0.3.1
rand_core0.10.1
rand_core0.6.4
rand_pcg0.10.2
rayon1.12.0
rayon-core1.13.0build script
redox_syscall0.5.18
reqwest0.12.28
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.3
rustc_version0.4.1
rustls0.23.46build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
rustversion1.0.23build script, not runproc macro
ryu1.0.23
scopeguard1.2.0
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.154build script
serde_urlencoded0.7.1
sha20.10.9
shlex2.0.1
signal-hook-registry1.4.8
signature2.2.0
simd-adler320.3.10
slab0.4.12
slotmap1.1.1build script
smallvec1.16.3
socket20.6.5
spki0.7.3
stable_deref_trait1.2.1
strum0.27.2
strum_macros0.27.2proc macro
subtle2.6.1
syn2.0.119
syn3.0.9
sync_wrapper1.0.2
synstructure0.14.0
thiserror1.0.69build script
thiserror2.0.21build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.21proc macro
tiny-keccak2.0.2build script
tinystr0.8.4
tinyvec1.13.3
tokio1.53.3
tokio-macros2.7.2proc macro
tokio-rustls0.26.6
tokio-util0.7.20
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicase2.10.0
unicode-ident1.0.27
universal-hash0.5.1
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
uuid1.28.0
uzor1.5.3
uzor-fonts1.5.5build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
version_check0.9.5
want0.3.2
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.129build script, not run
wasm-bindgen-futures0.4.79
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
wasm-streams0.4.2
web-sys0.3.106
web-time1.1.0
webpki-roots1.0.9
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.4
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.63build script
zerocopy-derive0.8.63proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.8
zmij1.0.23build script
Versions1RiskVulnsPublished
0.5.656highnone1d ago

Raw data

capture
626 KB
records
85,440
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-18 · run 7a9f8a98-f605-4f5f-856e-41ee50b482ff

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2