Skip to content
Open-Source Registry

cargo / piper-phonemize-sys / 1.5.4

piper-phonemize-sys 1.5.4

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
307
operations
18K
packages
85
compiler runs
173
connections
3
job time
16s
capture
226 KB
records
31K
bytes / record
7.2

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 908b6eb0-d554-4cb7-84cc-d09374fde935 · built 2026-10-12 · complete View on crates.io

Artifact

file · retained · product · graph v2
1

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

4
  • Build code opened a network connection
    piper-phonemize-sys 1.5.4 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libespeak-ng.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libpiper_phonemize_core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libucd.a › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build code opened a network connection

Unexpected network connection

Subject
piper-phonemize-sys 1.5.4
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · piper-phonemize-sys

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-a8105f3b4ffe7309

    subject github.com:443

    by /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-a8105f3b4ffe7309

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build_script_build-a8105f3b4ffe7309

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2456
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2456
  3. build-script-build/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build3429

Remediation

Review the process and its owning build step. Remove unnecessary requests; move required downloads to a declared dependency-fetch step.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libespeak-ng.awritten by build_script_build-a8105f3b4ffe7309
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · piper-phonemize-sys

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build_script_build-a8105f3b4ffe7309, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libespeak-ng.a

  2. Written from a pipecause

    Written by build_script_build-a8105f3b4ffe7309 from a network connection without a recorded source compilation

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libespeak-ng.a

    by /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build

  3. Asked for by the build's own declarationsupport

    piper-phonemize-sys asked the linker for it: static espeak-ng (target/release/build/piper-phonemize-sys-0e4ba43804e9bc04/output)

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libespeak-ng.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2456
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2456
  3. build-script-build/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build3429

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libpiper_phonemize_core.awritten by build_script_build-a8105f3b4ffe7309
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · piper-phonemize-sys

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build_script_build-a8105f3b4ffe7309, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libpiper_phonemize_core.a

  2. Written from a pipecause

    Written by build_script_build-a8105f3b4ffe7309 from a network connection without a recorded source compilation

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libpiper_phonemize_core.a

    by /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build

  3. Asked for by the build's own declarationsupport

    piper-phonemize-sys asked the linker for it: static piper_phonemize_core (target/release/build/piper-phonemize-sys-0e4ba43804e9bc04/output)

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libpiper_phonemize_core.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2456
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2456
  3. build-script-build/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build3429

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libucd.awritten by build_script_build-a8105f3b4ffe7309
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · piper-phonemize-sys

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build_script_build-a8105f3b4ffe7309, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libucd.a

  2. Written from a pipecause

    Written by build_script_build-a8105f3b4ffe7309 from a network connection without a recorded source compilation

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libucd.a

    by /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build

  3. Asked for by the build's own declarationsupport

    piper-phonemize-sys asked the linker for it: static ucd (target/release/build/piper-phonemize-sys-0e4ba43804e9bc04/output)

    subject /home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.4-linux-x64-static-lib/lib/libucd.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2456
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2456
  3. build-script-build/home/runner/work/piper-phonemize-sys/piper-phonemize-sys/target/release/build/piper-phonemize-sys-a8105f3b4ffe7309/build-script-build3429

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 piper-phonemize-sys's own build code · build_script_build-a8105f3b4ffe7309 (piper-phonemize-sys) · GitHub, Inc. · 9 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 piper-phonemize-sys's own build code · build_script_build-a8105f3b4ffe7309 (piper-phonemize-sys) · Fastly, Inc. · 9 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (piper-phonemize-sys) via crates.io · 4,522 files · went into an output ecosystem
Dependencies88Build behaviour
adler22.0.1
base640.22.1
bitflags2.13.1
bzip20.4.4
bzip2-sys0.1.13+1.0.8build script
cc1.3.0
cfg-if1.0.4
crc32fast1.5.0build script
displaydoc0.2.6proc macro
errno0.3.14
filetime0.2.29
find-msvc-tools0.1.9
flate21.1.9
form_urlencoded1.2.2
getrandom0.2.17
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
ld-linux-x86-64.so.2system library
libc0.2.187build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
litemap0.8.2
log0.4.33
miniz_oxide0.8.9
once_cell1.21.4
percent-encoding2.3.2
pkg-config0.3.33
potential_utf0.1.5
proc-macro21.0.107build script
quote1.0.47build script
ring0.17.14build scriptprebuilt objects
rustix1.1.4build script
rustls0.23.42build script
rustls-pki-types1.15.0
rustls-webpki0.103.13
serde1.0.229build script, not run
serde_core1.0.229build script, not run
serde_derive1.0.229proc macro
shlex2.0.1
simd-adler320.3.10
smallvec1.15.2
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.2
synstructure0.13.2
tar0.4.46
tinystr0.8.3
unicode-ident1.0.24
untrusted0.9.0
ureq2.12.1
url2.5.8
utf8_iter1.0.4
wasi0.11.1+wasi-snapshot-preview1
webpki-roots0.26.11
webpki-roots1.0.9
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.3
xattr1.6.1
yoke0.8.3
yoke-derive0.8.2proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
Versions25RiskVulnsPublished
1.5.75d ago
1.5.65d ago
1.5.56d ago
1.5.47d ago
1.5.38d ago
1.5.2not analyzed10d ago
1.5.1not analyzed10d ago
1.5.0not analyzed11d ago
1.4.13not analyzed12d ago
1.4.12not analyzed2026-09-26
1.4.11not analyzed2026-08-24
1.4.9not analyzed2026-08-21
1.4.8not analyzed2026-08-20
0.3.6not analyzed2026-07-22
0.3.5not analyzed2026-07-22
0.3.4not analyzed2026-07-22
0.3.3not analyzed2026-07-22
0.3.2not analyzed2026-07-22
0.3.1not analyzed2026-07-22
0.3.0not analyzed2026-07-22
0.2.0not analyzed2026-07-21
0.1.3not analyzed2026-07-21
0.1.1not analyzed2026-07-21
0.1.0not analyzed2026-07-21
1.5.8highnone

Raw data

capture
226 KB
records
31,293
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-12 · run 908b6eb0-d554-4cb7-84cc-d09374fde935

analysis 0.1.0 · 2026-10-11 · d6246d3 · graph v2