Skip to content
Open-Source Registry

cargo / piper-phonemize / 1.5.7

piper-phonemize 1.5.7

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
546
operations
20K
packages
89
compiler runs
184
connections
3
job time
24s
capture
245 KB
records
35K
bytes / record
7.0

Build behaviourhas a build scriptundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 56fac03d-ce2f-45dd-a269-411ab02c5cdd · built 2026-10-16 · complete View on crates.io

Graph

egress · high · in libpiper_phonemize.rlib
6

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

5
  • Build script fetched what the build compiled, linked or ran
    piper-phonemize-sys 1.5.7 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libespeak-ng.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libpiper_phonemize_core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libucd.a › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    espeak-ng-data.tar.bz2 › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
piper-phonemize-sys 1.5.7
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · piper-phonemize

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-5427992bba5c897e

    subject github.com:443

    by /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-5427992bba5c897e

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build

  3. What a build script's fetch becamesupport

    9 files came down; the build compiled or linked libpiper_phonemize_core.a, libespeak-ng.a, libucd.a +1 more

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e

In libpiper_phonemize.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2502
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2502
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build3630

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.7-linux-x64-static-lib/lib/libespeak-ng.awritten by build_script_build-5427992bba5c897e
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · piper-phonemize

Witness chain

  1. /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.7-linux-x64-static-lib/lib/libespeak-ng.avia /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      piper-phonemize-sys asked the linker for it: static espeak-ng (target/release/build/piper-phonemize-sys-d193804031320478/output)

    source
  2. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation
  • piper-phonemize-sys asked the linker for it: static espeak-ng (target/release/build/piper-phonemize-sys-d193804031320478/output)

In libpiper_phonemize.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2502
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2502
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build3630

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.7-linux-x64-static-lib/lib/libpiper_phonemize_core.awritten by build_script_build-5427992bba5c897e
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · piper-phonemize

Witness chain

  1. /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.7-linux-x64-static-lib/lib/libpiper_phonemize_core.avia /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      piper-phonemize-sys asked the linker for it: static piper_phonemize_core (target/release/build/piper-phonemize-sys-d193804031320478/output)

    source
  2. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation
  • piper-phonemize-sys asked the linker for it: static piper_phonemize_core (target/release/build/piper-phonemize-sys-d193804031320478/output)

In libpiper_phonemize.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2502
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2502
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build3630

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.7-linux-x64-static-lib/lib/libucd.awritten by build_script_build-5427992bba5c897e
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · piper-phonemize

Witness chain

  1. /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.7-linux-x64-static-lib/lib/libucd.avia /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      piper-phonemize-sys asked the linker for it: static ucd (target/release/build/piper-phonemize-sys-d193804031320478/output)

    source
  2. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation
  • piper-phonemize-sys asked the linker for it: static ucd (target/release/build/piper-phonemize-sys-d193804031320478/output)

In libpiper_phonemize.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2502
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2502
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build3630

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-d193804031320478/out/espeak-ng-data.tar.bz2written by build_script_build-5427992bba5c897e
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · piper-phonemize

Witness chain

  1. /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-d193804031320478/out/espeak-ng-data.tar.bz2via /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation

    source
  2. member
    artifact

Evidence

  • written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build_script_build-5427992bba5c897e, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-5427992bba5c897e from a network connection without a recorded source compilation

In libpiper_phonemize.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2502
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2502
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-5427992bba5c897e/build-script-build3630

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of piper-phonemize-sys · build_script_build-5427992bba5c897e (piper-phonemize) · GitHub, Inc. · 9 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 build code of piper-phonemize-sys · build_script_build-5427992bba5c897e (piper-phonemize) · Fastly, Inc. · 9 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (piper-phonemize) via crates.io · 4,594 files · went into an output ecosystem
Dependencies92Build behaviour
adler22.0.1
base640.22.1
bitflags2.13.1
bzip20.4.4
bzip2-sys0.1.13+1.0.8build script
cc1.3.0
cfg-if1.0.4
crc32fast1.5.0build script
displaydoc0.2.6proc macro
errno0.3.14
filetime0.2.29
find-msvc-tools0.1.9
flate21.1.9
form_urlencoded1.2.2
getrandom0.2.17
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
ld-linux-x86-64.so.2system library
libc0.2.187build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
litemap0.8.2
log0.4.33
miniz_oxide0.8.9
once_cell1.21.4
percent-encoding2.3.2
piper-phonemize-sys1.5.7build scriptnetworkgithub.com, release-assets.githubusercontent.com
pkg-config0.3.33
potential_utf0.1.5
proc-macro21.0.107build script
quote1.0.47build script
ring0.17.14build scriptprebuilt objects
rustix1.1.4build script
rustls0.23.42build script
rustls-pki-types1.15.0
rustls-webpki0.103.13
same-file1.0.6
serde1.0.229build script, not run
serde_core1.0.229build script, not run
serde_derive1.0.229proc macro
shlex2.0.1
simd-adler320.3.10
smallvec1.15.2
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.2
synstructure0.13.2
tar0.4.46
tinystr0.8.3
unicode-ident1.0.24
untrusted0.9.0
ureq2.12.1
url2.5.8
utf8_iter1.0.4
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
webpki-roots0.26.11
webpki-roots1.0.9
winapi-util0.1.11
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.3
xattr1.6.1
yoke0.8.3
yoke-derive0.8.2proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
Versions22RiskVulnsPublished
1.5.55d ago
1.5.46d ago
1.5.36d ago
1.5.2not analyzed8d ago
1.5.1not analyzed8d ago
1.5.0not analyzed10d ago
1.4.13not analyzed10d ago
1.4.12not analyzed2026-09-26
1.4.11not analyzed2026-08-24
1.4.9not analyzed2026-08-21
1.4.8not analyzed2026-08-20
0.3.6not analyzed2026-07-22
0.3.5not analyzed2026-07-22
0.3.4not analyzed2026-07-22
0.3.3not analyzed2026-07-22
0.3.2not analyzed2026-07-22
0.3.1not analyzed2026-07-22
0.2.0not analyzed2026-07-21
0.1.3not analyzed2026-07-21
0.1.1not analyzed2026-07-21
0.1.0not analyzed2026-07-21
1.5.7highnone

Raw data

capture
245 KB
records
35,176
bytes per record
7.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-16 · run 56fac03d-ce2f-45dd-a269-411ab02c5cdd

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2