Skip to content
Open-Source Registry

cargo / purl_validator / 1.16.180

purl_validator 1.16.180

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
276
operations
26K
packages
144
compiler runs
101
connections
2
job time
37s
capture
364 KB
records
48K
bytes / record
7.6

Build behaviourits build script reached raw.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.io

run 850428f1-d023-433d-a6b9-3f5ed55ec694 · built 2026-10-15 · complete

Graph

egress · medium · in libpurl_validator.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Build script reached raw.githubusercontent.com
    purl_validator 1.16.180 › raw.githubusercontent.com:443
    medium
  • Downloaded file compiled into the artifact from its documented source
    purls.fst › raw.githubusercontent.com
    medium

Detection

mediumwitnessed

Build script reached raw.githubusercontent.com

Unexpected network connection

Subject
purl_validator 1.16.180
Destination
raw.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to raw.githubusercontent.com:443, opened by build_script_build-dd2d17a602f6ed5f

    subject raw.githubusercontent.com:443

    by /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build-script-build

  2. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked purls.fst

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build_script_build-dd2d17a602f6ed5f

  4. Build script fetched what its crate documents it fetchessupport

    purl_validator's build script fetches the purl type definitions from raw.githubusercontent.com: purl_validator's build.rs fetches the purl spec's type definitions from GitHub (observed on the registry, 2026-10-06)

In libpurl_validator.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2478
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2478
  3. build-script-build/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build-script-build3740

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Detection

mediumwitnessed

Downloaded file compiled into the artifact from its documented source

Object file origin needs review

Subject
/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-5f4916fcaeb5b61d/out/purls.fstwritten by build_script_build-dd2d17a602f6ed5f
Destination
raw.githubusercontent.com
Jobs
build-test
Rule
object-provenance · purl-validator.rs

Witness chain

  1. raw.githubusercontent.com:443
    source
  2. /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-5f4916fcaeb5b61d/out/purls.fstvia /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build-script-build
    • Object written under a build script that downloadedfrom raw.githubusercontent.com

      written under the build script at /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build_script_build-dd2d17a602f6ed5f, which downloaded from raw.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-dd2d17a602f6ed5f from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  1. Build script fetched what its crate documents it fetchessupport

    purl_validator's build script fetches the purl type definitions from raw.githubusercontent.com: purl_validator's build.rs fetches the purl spec's type definitions from GitHub (observed on the registry, 2026-10-06)

In libpurl_validator.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2478
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2478
  3. build-script-build/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-dd2d17a602f6ed5f/build-script-build3740

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • raw.githubusercontent.com:443 purl_validator's own build code · build_script_build-dd2d17a602f6ed5f · Fastly, Inc. · 1 file · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (purl-validator.rs) via crates.io · 9,696 files · went into an output ecosystem
Dependencies166Build behaviour
base640.21.7
bitflags1.3.2
bitflags2.10.0
bumpalo3.19.1
bytes1.11.0
cc1.2.50
cfg-if1.0.4
core-foundation0.9.4
core-foundation-sys0.8.7
displaydoc0.2.5proc macro
encoding_rs0.8.35
equivalent1.0.2
errno0.3.14
fastrand2.3.0
find-msvc-tools0.1.5
fnv1.0.7
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
fst0.4.7build script
futures-channel0.3.31
futures-core0.3.31
futures-io0.3.31
futures-sink0.3.31
futures-task0.3.31
futures-util0.3.31
getrandom0.3.4build script, not run
h20.3.27
hashbrown0.16.1
http0.2.12
http-body0.4.6
httparse1.10.1build script
httpdate1.0.3
hyper0.14.32
hyper-tls0.5.0
icu_collections2.1.1
icu_locale_core2.1.1
icu_normalizer2.1.1
icu_normalizer_data2.1.1build script
icu_properties2.1.2
icu_properties_data2.1.2build script
icu_provider2.1.1
idna1.1.0
idna_adapter1.2.1
indexmap2.12.1
ipnet2.11.0
itoa1.0.16
js-sys0.3.83
ld-linux-x86-64.so.2system library
libc0.2.177build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
libssl.so.3system library
linux-raw-sys0.11.0
litemap0.8.1
log0.4.29
memchr2.7.6
mime0.3.17
mio1.1.0
native-tls0.2.14build script
once_cell1.21.3
openssl0.10.75build script
openssl-macros0.1.1proc macro
openssl-probe0.1.6
openssl-sys0.9.111build script
packageurl0.6.0
percent-encoding2.3.2
pin-project-lite0.2.16
pin-utils0.1.0
pkg-config0.3.32
potential_utf0.1.4
proc-macro21.0.103build script
quote1.0.42build script
r-efi5.3.0
reqwest0.11.27
rustix1.1.2build script, not run
rustls-pemfile1.0.4
rustversion1.0.22build script, not runproc macro
ryu1.0.21
schannel0.1.28
security-framework2.11.1
security-framework-sys2.15.0
serde1.0.228build script
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.145build script, not run
serde_urlencoded0.7.1
shlex1.3.0
slab0.4.11
smallvec1.15.1
socket20.5.10
socket20.6.1
stable_deref_trait1.2.1
syn2.0.111
sync_wrapper0.1.2
synstructure0.13.2
system-configuration0.5.1
system-configuration-sys0.5.0build script, not run
tempfile3.23.0
thiserror2.0.18build script
thiserror-impl2.0.18proc macro
tinystr0.8.2
tokio1.48.0
tokio-native-tls0.3.1
tokio-util0.7.17
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
unicode-ident1.0.22
url2.5.7
utf8_iter1.0.4
vcpkg0.2.15prebuilt objects
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.1+wasi-0.2.4
wasm-bindgen0.2.106build script, not run
wasm-bindgen-futures0.4.56
wasm-bindgen-macro0.2.106proc macro
wasm-bindgen-macro-support0.2.106
wasm-bindgen-shared0.2.106build script, not run
web-sys0.3.83
windows-link0.2.1
windows-sys0.48.0
windows-sys0.52.0
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.48.5
windows-targets0.52.6
windows-targets0.53.5
windows_aarch64_gnullvm0.48.5build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.48.5build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.48.5build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.48.5build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.48.5build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.48.5build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
winreg0.50.0
wit-bindgen0.46.0build script, not runprebuilt objects
writeable0.6.2
yoke0.8.1
yoke-derive0.8.1proc macro
zerofrom0.1.6
zerofrom-derive0.1.6proc macro
zerotrie0.2.3
zerovec0.11.5
zerovec-derive0.11.2proc macro

Raw data

capture
364 KB
records
48,179
bytes per record
7.6

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-15 · run 850428f1-d023-433d-a6b9-3f5ed55ec694

analysis 0.1.0 · 2026-10-14 · efb1d7d · graph v2