Skip to content
Open-Source Registry

cargo / piper-phonemize / 1.5.5

piper-phonemize 1.5.5

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured 4 detections
processes
300
operations
20K
packages
89
compiler runs
184
connections
3
job time
25s
capture
246 KB
records
36K
bytes / record
6.9

Build behaviourhas a build scriptundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 9ed6d1dd-2f64-46d4-8610-03163a8e989f · built 2026-10-13 · complete

Artifact

file · retained · product · graph v2
1

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

4
  • Build code opened a network connection
    piper-phonemize-sys 1.5.5 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libespeak-ng.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libpiper_phonemize_core.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libucd.a › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build code opened a network connection

Unexpected network connection

Subject
piper-phonemize-sys 1.5.5
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · piper-phonemize

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-6b3fef1ec514dd8f

    subject github.com:443

    by /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-6b3fef1ec514dd8f

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build_script_build-6b3fef1ec514dd8f

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2453
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2453
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build3611

Remediation

Review the process and its owning build step. Remove unnecessary requests; move required downloads to a declared dependency-fetch step.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libespeak-ng.awritten by build_script_build-6b3fef1ec514dd8f
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · piper-phonemize

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build_script_build-6b3fef1ec514dd8f, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libespeak-ng.a

  2. Written from a pipecause

    Written by build_script_build-6b3fef1ec514dd8f from a network connection without a recorded source compilation

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libespeak-ng.a

    by /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build

  3. Asked for by the build's own declarationsupport

    piper-phonemize-sys asked the linker for it: static espeak-ng (target/release/build/piper-phonemize-sys-b16705adc459184f/output)

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libespeak-ng.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2453
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2453
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build3611

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libpiper_phonemize_core.awritten by build_script_build-6b3fef1ec514dd8f
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · piper-phonemize

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build_script_build-6b3fef1ec514dd8f, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libpiper_phonemize_core.a

  2. Written from a pipecause

    Written by build_script_build-6b3fef1ec514dd8f from a network connection without a recorded source compilation

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libpiper_phonemize_core.a

    by /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build

  3. Asked for by the build's own declarationsupport

    piper-phonemize-sys asked the linker for it: static piper_phonemize_core (target/release/build/piper-phonemize-sys-b16705adc459184f/output)

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libpiper_phonemize_core.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2453
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2453
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build3611

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libucd.awritten by build_script_build-6b3fef1ec514dd8f
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · piper-phonemize

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build_script_build-6b3fef1ec514dd8f, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libucd.a

  2. Written from a pipecause

    Written by build_script_build-6b3fef1ec514dd8f from a network connection without a recorded source compilation

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libucd.a

    by /home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build

  3. Asked for by the build's own declarationsupport

    piper-phonemize-sys asked the linker for it: static ucd (target/release/build/piper-phonemize-sys-b16705adc459184f/output)

    subject /home/runner/work/piper-phonemize/piper-phonemize/target/piper-phonemize-prebuilt/piper-phonemize-v1.5.5-linux-x64-static-lib/lib/libucd.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2453
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2453
  3. build-script-build/home/runner/work/piper-phonemize/piper-phonemize/target/release/build/piper-phonemize-sys-6b3fef1ec514dd8f/build-script-build3611

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of piper-phonemize-sys · build_script_build-6b3fef1ec514dd8f (piper-phonemize) · GitHub, Inc. · 9 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 build code of piper-phonemize-sys · build_script_build-6b3fef1ec514dd8f (piper-phonemize) · Fastly, Inc. · 9 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (piper-phonemize) via crates.io · 4,594 files · went into an output ecosystem
Dependencies92Build behaviour
adler22.0.1
base640.22.1
bitflags2.13.1
bzip20.4.4
bzip2-sys0.1.13+1.0.8build script
cc1.3.0
cfg-if1.0.4
crc32fast1.5.0build script
displaydoc0.2.6proc macro
errno0.3.14
filetime0.2.29
find-msvc-tools0.1.9
flate21.1.9
form_urlencoded1.2.2
getrandom0.2.17
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script
icu_properties2.2.0
icu_properties_data2.2.0build script
icu_provider2.2.0
idna1.1.0
idna_adapter1.2.2
ld-linux-x86-64.so.2system library
libc0.2.187build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
litemap0.8.2
log0.4.33
miniz_oxide0.8.9
once_cell1.21.4
percent-encoding2.3.2
piper-phonemize-sys1.5.5build scriptnetworkgithub.com, release-assets.githubusercontent.com
pkg-config0.3.33
potential_utf0.1.5
proc-macro21.0.107build script
quote1.0.47build script
ring0.17.14build scriptprebuilt objects
rustix1.1.4build script
rustls0.23.42build script
rustls-pki-types1.15.0
rustls-webpki0.103.13
same-file1.0.6
serde1.0.229build script, not run
serde_core1.0.229build script, not run
serde_derive1.0.229proc macro
shlex2.0.1
simd-adler320.3.10
smallvec1.15.2
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.2
synstructure0.13.2
tar0.4.46
tinystr0.8.3
unicode-ident1.0.24
untrusted0.9.0
ureq2.12.1
url2.5.8
utf8_iter1.0.4
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
webpki-roots0.26.11
webpki-roots1.0.9
winapi-util0.1.11
windows-link0.2.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.3
xattr1.6.1
yoke0.8.3
yoke-derive0.8.2proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro

Raw data

capture
246 KB
records
35,524
bytes per record
6.9

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-13 · run 9ed6d1dd-2f64-46d4-8610-03163a8e989f

analysis 0.1.0 · 2026-10-11 · d6246d3 · graph v2