Skip to content
Open-Source Registry

cargo / purl_validator / 1.16.181

purl_validator 1.16.181

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskmediumVulnsnone
processes
286
operations
26K
packages
144
compiler runs
101
connections
2
job time
40s
capture
364 KB
records
48K
bytes / record
7.5

Build behaviourits build script reached raw.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.io

run e7dbd21e-95fa-4d2b-892c-5aeaead18846 · built 2026-10-16 · complete View on crates.io

Graph

egress · medium · in libpurl_validator.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Build script reached raw.githubusercontent.com
    purl_validator 1.16.181 › raw.githubusercontent.com:443
    medium
  • Downloaded file compiled into the artifact from its documented source
    purls.fst › raw.githubusercontent.com
    medium

Detection

mediumwitnessed

Build script reached raw.githubusercontent.com

Unexpected network connection

Subject
purl_validator 1.16.181
Destination
raw.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to raw.githubusercontent.com:443, opened by build_script_build-40b96ae9c9877753

    subject raw.githubusercontent.com:443

    by /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build-script-build

  2. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked purls.fst

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build_script_build-40b96ae9c9877753

  4. Build script fetched what its crate documents it fetchessupport

    purl_validator's build script fetches the purl type definitions from raw.githubusercontent.com: purl_validator's build.rs fetches the purl spec's type definitions from GitHub (observed on the registry, 2026-10-06)

In libpurl_validator.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2469
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2469
  3. build-script-build/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build-script-build3733

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Detection

mediumwitnessed

Downloaded file compiled into the artifact from its documented source

Object file origin needs review

Subject
/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-957eb205f91c18de/out/purls.fstwritten by build_script_build-40b96ae9c9877753
Destination
raw.githubusercontent.com
Jobs
build-test
Rule
object-provenance · purl-validator.rs

Witness chain

  1. raw.githubusercontent.com:443
    source
  2. /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-957eb205f91c18de/out/purls.fstvia /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build-script-build
    • Object written under a build script that downloadedfrom raw.githubusercontent.com

      written under the build script at /home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build_script_build-40b96ae9c9877753, which downloaded from raw.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-40b96ae9c9877753 from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  1. Build script fetched what its crate documents it fetchessupport

    purl_validator's build script fetches the purl type definitions from raw.githubusercontent.com: purl_validator's build.rs fetches the purl spec's type definitions from GitHub (observed on the registry, 2026-10-06)

In libpurl_validator.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2469
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2469
  3. build-script-build/home/runner/work/purl-validator.rs/purl-validator.rs/target/release/build/purl_validator-40b96ae9c9877753/build-script-build3733

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • raw.githubusercontent.com:443 purl_validator's own build code · build_script_build-40b96ae9c9877753 · Fastly, Inc. · 1 file · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (purl-validator.rs) via crates.io · 9,696 files · went into an output ecosystem
Dependencies166Build behaviour
base640.21.7
bitflags1.3.2
bitflags2.10.0
bumpalo3.19.1
bytes1.11.0
cc1.2.50
cfg-if1.0.4
core-foundation0.9.4
core-foundation-sys0.8.7
displaydoc0.2.5proc macro
encoding_rs0.8.35
equivalent1.0.2
errno0.3.14
fastrand2.3.0
find-msvc-tools0.1.5
fnv1.0.7
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
fst0.4.7build script
futures-channel0.3.31
futures-core0.3.31
futures-io0.3.31
futures-sink0.3.31
futures-task0.3.31
futures-util0.3.31
getrandom0.3.4build script, not run
h20.3.27
hashbrown0.16.1
http0.2.12
http-body0.4.6
httparse1.10.1build script
httpdate1.0.3
hyper0.14.32
hyper-tls0.5.0
icu_collections2.1.1
icu_locale_core2.1.1
icu_normalizer2.1.1
icu_normalizer_data2.1.1build script
icu_properties2.1.2
icu_properties_data2.1.2build script
icu_provider2.1.1
idna1.1.0
idna_adapter1.2.1
indexmap2.12.1
ipnet2.11.0
itoa1.0.16
js-sys0.3.83
ld-linux-x86-64.so.2system library
libc0.2.177build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
libssl.so.3system library
linux-raw-sys0.11.0
litemap0.8.1
log0.4.29
memchr2.7.6
mime0.3.17
mio1.1.0
native-tls0.2.14build script
once_cell1.21.3
openssl0.10.75build script
openssl-macros0.1.1proc macro
openssl-probe0.1.6
openssl-sys0.9.111build script
packageurl0.6.0
percent-encoding2.3.2
pin-project-lite0.2.16
pin-utils0.1.0
pkg-config0.3.32
potential_utf0.1.4
proc-macro21.0.103build script
quote1.0.42build script
r-efi5.3.0
reqwest0.11.27
rustix1.1.2build script, not run
rustls-pemfile1.0.4
rustversion1.0.22build script, not runproc macro
ryu1.0.21
schannel0.1.28
security-framework2.11.1
security-framework-sys2.15.0
serde1.0.228build script
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.145build script, not run
serde_urlencoded0.7.1
shlex1.3.0
slab0.4.11
smallvec1.15.1
socket20.5.10
socket20.6.1
stable_deref_trait1.2.1
syn2.0.111
sync_wrapper0.1.2
synstructure0.13.2
system-configuration0.5.1
system-configuration-sys0.5.0build script, not run
tempfile3.23.0
thiserror2.0.18build script
thiserror-impl2.0.18proc macro
tinystr0.8.2
tokio1.48.0
tokio-native-tls0.3.1
tokio-util0.7.17
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
unicode-ident1.0.22
url2.5.7
utf8_iter1.0.4
vcpkg0.2.15prebuilt objects
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.1+wasi-0.2.4
wasm-bindgen0.2.106build script, not run
wasm-bindgen-futures0.4.56
wasm-bindgen-macro0.2.106proc macro
wasm-bindgen-macro-support0.2.106
wasm-bindgen-shared0.2.106build script, not run
web-sys0.3.83
windows-link0.2.1
windows-sys0.48.0
windows-sys0.52.0
windows-sys0.60.2
windows-sys0.61.2
windows-targets0.48.5
windows-targets0.52.6
windows-targets0.53.5
windows_aarch64_gnullvm0.48.5build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.1build script, not runprebuilt objects
windows_aarch64_msvc0.48.5build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.1build script, not runprebuilt objects
windows_i686_gnu0.48.5build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.1build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.1build script, not runprebuilt objects
windows_i686_msvc0.48.5build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.1build script, not runprebuilt objects
windows_x86_64_gnu0.48.5build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.1build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.1build script, not runprebuilt objects
windows_x86_64_msvc0.48.5build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.1build script, not runprebuilt objects
winreg0.50.0
wit-bindgen0.46.0build script, not runprebuilt objects
writeable0.6.2
yoke0.8.1
yoke-derive0.8.1proc macro
zerofrom0.1.6
zerofrom-derive0.1.6proc macro
zerotrie0.2.3
zerovec0.11.5
zerovec-derive0.11.2proc macro
Versions254RiskVulnsPublished
1.16.1803d ago
1.16.1794d ago
1.16.1785d ago
1.16.1776d ago
1.16.1767d ago
1.16.1758d ago
1.16.174not analyzed9d ago
1.16.173not analyzed10d ago
1.16.17211d ago
1.16.17112d ago
1.16.170not analyzed13d ago
1.16.169not analyzed2026-10-04
1.16.168not analyzed2026-10-03
1.16.167not analyzed2026-10-02
1.16.166not analyzed2026-10-01
1.16.165not analyzed2026-09-30
1.16.164not analyzed2026-09-29
1.16.163not analyzed2026-09-28
1.16.162not analyzed2026-09-27
1.16.161not analyzed2026-09-26
1.16.160not analyzed2026-09-25
1.16.159not analyzed2026-09-24
1.16.158not analyzed2026-09-23
1.16.157not analyzed2026-09-22
1.16.156not analyzed2026-09-21
1.16.155not analyzed2026-09-20
1.16.154not analyzed2026-09-19
1.16.153not analyzed2026-09-18
1.16.152not analyzed2026-09-17
1.16.151not analyzed2026-09-16
1.16.150not analyzed2026-09-15
1.16.149not analyzed2026-09-14
1.16.148not analyzed2026-09-13
1.16.147not analyzed2026-09-12
1.16.146not analyzed2026-09-11
1.16.145not analyzed2026-09-10
1.16.144not analyzed2026-09-09
1.16.143not analyzed2026-09-08
1.16.142not analyzed2026-09-07
1.16.141not analyzed2026-09-06
1.16.140not analyzed2026-09-05
1.16.139not analyzed2026-09-04
1.16.138not analyzed2026-09-03
1.16.137not analyzed2026-09-02
1.16.136not analyzed2026-09-01
1.16.135not analyzed2026-08-31
1.16.134not analyzed2026-08-30
1.16.133not analyzed2026-08-29
1.16.132not analyzed2026-08-28
1.16.131not analyzed2026-08-27
1.16.130not analyzed2026-08-26
1.16.129not analyzed2026-08-25
1.16.128not analyzed2026-08-24
1.16.127not analyzed2026-08-23
1.16.126not analyzed2026-08-22
1.16.125not analyzed2026-08-21
1.16.124not analyzed2026-08-20
1.16.123not analyzed2026-08-19
1.16.122not analyzed2026-08-17
1.16.121not analyzed2026-08-16
1.16.120not analyzed2026-08-15
1.16.119not analyzed2026-08-14
1.16.118not analyzed2026-08-13
1.16.117not analyzed2026-08-12
1.16.116not analyzed2026-08-11
1.16.115not analyzed2026-08-10
1.16.113not analyzed2026-08-08
1.16.112not analyzed2026-08-07
1.16.111not analyzed2026-08-06
1.16.110not analyzed2026-08-05
1.16.109not analyzed2026-08-04
1.16.108not analyzed2026-08-03
1.16.107not analyzed2026-08-02
1.16.106not analyzed2026-08-01
1.16.105not analyzed2026-07-31
1.16.104not analyzed2026-07-30
1.16.103not analyzed2026-07-29
1.16.102not analyzed2026-07-28
1.16.101not analyzed2026-07-27
1.16.100not analyzed2026-07-26
1.16.99not analyzed2026-07-25
1.16.98not analyzed2026-07-24
1.16.97not analyzed2026-07-23
1.16.96not analyzed2026-07-22
1.16.95not analyzed2026-07-21
1.16.94not analyzed2026-07-20
1.16.93not analyzed2026-07-19
1.16.92not analyzed2026-07-18
1.16.91not analyzed2026-07-17
1.16.90not analyzed2026-07-16
1.16.89not analyzed2026-07-15
1.16.88not analyzed2026-07-14
1.16.87not analyzed2026-07-13
1.16.86not analyzed2026-07-12
1.16.85not analyzed2026-07-11
1.16.84not analyzed2026-07-10
1.16.83not analyzed2026-07-09
1.16.82not analyzed2026-07-08
1.16.81not analyzed2026-07-07
1.16.80not analyzed2026-07-06
1.16.79not analyzed2026-07-05
1.16.78not analyzed2026-07-04
1.16.77not analyzed2026-07-03
1.16.76not analyzed2026-07-02
1.16.75not analyzed2026-07-01
1.16.74not analyzed2026-06-30
1.16.73not analyzed2026-06-29
1.16.72not analyzed2026-06-28
1.16.71not analyzed2026-06-27
1.16.70not analyzed2026-06-26
1.16.69not analyzed2026-06-25
1.16.68not analyzed2026-06-24
1.16.67not analyzed2026-06-23
1.16.66not analyzed2026-06-22
1.16.65not analyzed2026-06-21
1.16.64not analyzed2026-06-20
1.16.63not analyzed2026-06-19
1.16.62not analyzed2026-06-18
1.16.61not analyzed2026-06-17
1.16.60not analyzed2026-06-16
1.16.59not analyzed2026-06-15
1.16.58not analyzed2026-06-14
1.16.57not analyzed2026-06-13
1.16.56not analyzed2026-06-12
1.16.55not analyzed2026-06-11
1.16.54not analyzed2026-06-10
1.16.53not analyzed2026-06-09
1.16.52not analyzed2026-06-08
1.16.51not analyzed2026-06-07
1.16.50not analyzed2026-06-06
1.16.49not analyzed2026-06-05
1.16.48not analyzed2026-06-04
1.16.47not analyzed2026-05-20
1.16.46not analyzed2026-05-19
1.16.45not analyzed2026-05-18
1.16.44not analyzed2026-05-17
1.16.43not analyzed2026-05-16
1.16.42not analyzed2026-05-15
1.16.41not analyzed2026-05-14
1.16.40not analyzed2026-05-13
1.16.39not analyzed2026-05-12
1.16.38not analyzed2026-05-11
1.16.37not analyzed2026-05-10
1.16.36not analyzed2026-05-09
1.16.35not analyzed2026-05-08
1.16.34not analyzed2026-05-07
1.16.33not analyzed2026-05-06
1.16.32not analyzed2026-05-05
1.16.31not analyzed2026-05-04
1.16.30not analyzed2026-05-03
1.16.29not analyzed2026-05-02
1.16.28not analyzed2026-05-01
1.16.27not analyzed2026-04-30
1.16.26not analyzed2026-04-29
1.16.25not analyzed2026-04-28
1.16.24not analyzed2026-04-27
1.16.23not analyzed2026-04-26
1.16.22not analyzed2026-04-25
1.16.21not analyzed2026-04-24
1.16.20not analyzed2026-04-23
1.16.19not analyzed2026-04-22
1.16.18not analyzed2026-04-21
1.16.17not analyzed2026-04-20
1.16.16not analyzed2026-04-19
1.16.15not analyzed2026-04-18
1.16.14not analyzed2026-04-17
1.16.13not analyzed2026-04-16
1.16.12not analyzed2026-04-15
1.16.11not analyzed2026-04-14
1.16.10not analyzed2026-04-13
1.16.9not analyzed2026-04-12
1.16.8not analyzed2026-04-11
1.16.7not analyzed2026-04-10
1.16.6not analyzed2026-04-09
1.16.5not analyzed2026-04-08
1.16.4not analyzed2026-04-07
1.16.3not analyzed2026-04-06
1.16.2not analyzed2026-04-05
1.16.1not analyzed2026-04-04
1.16.0not analyzed2026-03-26
1.15.0not analyzed2026-03-25
1.14.0not analyzed2026-03-24
1.13.0not analyzed2026-03-23
1.12.0not analyzed2026-03-22
1.11.0not analyzed2026-03-21
1.10.0not analyzed2026-03-20
1.9.0not analyzed2026-03-19
1.8.0not analyzed2026-03-18
1.7.0not analyzed2026-03-17
1.6.0not analyzed2026-03-16
1.5.0not analyzed2026-03-15
1.4.0not analyzed2026-03-14
1.3.0not analyzed2026-03-13
1.2.0not analyzed2026-03-12
1.1.0not analyzed2026-03-11
1.0.0not analyzed2026-03-10
0.58.0not analyzed2026-03-10
0.57.0not analyzed2026-03-09
0.56.0not analyzed2026-03-08
0.55.0not analyzed2026-03-07
0.54.0not analyzed2026-03-06
0.53.0not analyzed2026-03-05
0.52.0not analyzed2026-03-04
0.51.0not analyzed2026-03-03
0.50.0not analyzed2026-03-02
0.49.0not analyzed2026-03-01
0.48.0not analyzed2026-02-28
0.47.0not analyzed2026-02-27
0.46.0not analyzed2026-02-26
0.45.0not analyzed2026-02-07
0.44.0not analyzed2026-02-06
0.43.0not analyzed2026-02-05
0.42.0not analyzed2026-02-04
0.41.0not analyzed2026-02-03
0.40.0not analyzed2026-02-02
0.39.0not analyzed2026-02-01
0.38.0not analyzed2026-01-31
0.37.0not analyzed2026-01-30
0.36.0not analyzed2026-01-29
0.35.0not analyzed2026-01-28
0.34.0not analyzed2026-01-27
0.33.0not analyzed2026-01-26
0.32.0not analyzed2026-01-25
0.31.0not analyzed2026-01-24
0.30.0not analyzed2026-01-23
0.29.0not analyzed2026-01-22
0.28.0not analyzed2026-01-21
0.27.0not analyzed2026-01-20
0.26.0not analyzed2026-01-19
0.25.0not analyzed2026-01-18
0.24.0not analyzed2026-01-17
0.23.0not analyzed2026-01-16
0.22.0not analyzed2026-01-15
0.21.0not analyzed2026-01-14
0.20.0not analyzed2026-01-13
0.19.0not analyzed2026-01-12
0.18.0not analyzed2026-01-11
0.17.0not analyzed2026-01-10
0.16.0not analyzed2026-01-09
0.15.0not analyzed2026-01-08
0.14.0not analyzed2026-01-07
0.13.0not analyzed2026-01-06
0.12.0not analyzed2026-01-05
0.11.0not analyzed2026-01-04
0.10.0not analyzed2026-01-03
0.9.0not analyzed2026-01-02
0.8.0not analyzed2026-01-01
0.7.0not analyzed2025-12-31
0.5.0not analyzed2025-12-29
0.4.0not analyzed2025-12-28
0.3.0not analyzed2025-12-27
0.2.0not analyzed2025-12-26
0.1.0not analyzed2025-11-12
1.16.181mediumnone

Raw data

capture
364 KB
records
48,212
bytes per record
7.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-16 · run e7dbd21e-95fa-4d2b-892c-5aeaead18846

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2