Skip to content
Open-Source Registry

cargo / reactor-webrtc / 0.23.0

reactor-webrtc 0.23.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
640
operations
77K
packages
20
compiler runs
13
connections
3
job time
31s
capture
1.3 MB
records
149K
bytes / record
9.0

Build behaviourhas a build scriptlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run f3ce561b-bd29-4155-8e7d-a0bef522a494 · built 2026-10-14 · complete

Graph

egress · medium · in libreactor_webrtc.rlib
2

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Build script reached github.com +1
    reactor-webrtc-sys 0.23.0 › github.com:443, release-assets.githubusercontent.com:443
    medium
  • 3 prebuilt libraries downloaded by a build script from its documented source
    reactor-webrtc-sys 0.23.0 › github.com, release-assets.githubusercontent.com
    medium

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
reactor-webrtc-sys 0.23.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.sha256 https://git…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.sha256 https://git…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build_script_build-162702ae1067a3b2

  5. Build script fetched what its crate documents it fetchessupport

    reactor-webrtc-sys's build script fetches a prebuilt libwebrtc from github.com, release-assets.githubusercontent.com: reactor-webrtc-sys's build.rs curls a prebuilt libwebrtc from its GitHub release (observed on the registry, 2026-10-06)

  6. Tool commandsupport

    Command: curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.sha256 https://git…

    by curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.sha256 https://git…

In libreactor_webrtc.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.sha256 https://git…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2456
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2456
  3. build-script-build/home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build-script-build2675
  4. curlcurl -fsSL --retry 3 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.sha256 https://git…2678

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Detection

mediumwitnessed

3 prebuilt libraries downloaded by a build script from its documented source

Object file origin needs review

Subject
reactor-webrtc-sys 0.23.0
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · reactor-webrtc

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.tar.zstvia curl -fSL --retry 3 --retry-delay 2 -o /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.tar
  3. /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/libwebrtc/lib/libc++.avia tar -xf /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.tar.zst -C /home/runner/work/react
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/libwebrtc/lib/libc++.a: written under the build script at /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build_script_build-162702ae1067a3b2, which downloaded from github.com, release-assets.githubusercontent.com

    subject

Evidence

  1. Object written under a build script that downloadedcause

    /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/libwebrtc/lib/libc++abi.a: written under the build script at /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build_script_build-162702ae1067a3b2, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/libwebrtc/lib/libc++abi.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build-script-build

  2. Object written under a build script that downloadedcause

    /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/libwebrtc/lib/libwebrtc.a: written under the build script at /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build_script_build-162702ae1067a3b2, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/libwebrtc/lib/libwebrtc.asource github.comsource release-assets.githubusercontent.com

    by /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build-script-build

  3. Build script fetched what its crate documents it fetchessupport

    reactor-webrtc-sys's build script fetches a prebuilt libwebrtc from github.com, release-assets.githubusercontent.com: reactor-webrtc-sys's build.rs curls a prebuilt libwebrtc from its GitHub release (observed on the registry, 2026-10-06)

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar -xf /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.tar.zst -C /home/runner/work/react…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2456
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2456
  3. build-script-build/home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-162702ae1067a3b2/build-script-build2675
  4. tartar -xf /home/runner/work/reactor-webrtc/reactor-webrtc/target/release/build/reactor-webrtc-sys-5cdf9864c72240f2/out/prebuilt.tar.zst -C /home/runner/work/react…2705

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 build code of reactor-webrtc-sys · curl · GitHub, Inc. · 1 file documented
  • release-assets.githubusercontent.com:443 build code of reactor-webrtc-sys · curl · Fastly, Inc. · 1 file documented
  • static.crates.io:8080 the package manager · cargo (reactor-webrtc) via crates.io · 4,164 files · went into an output ecosystem
Dependencies20Build behaviour
anyhow1.0.104build script
bytes1.12.1
cc1.8.0
either1.19.0
find-msvc-tools0.1.14
itertools0.14.0
ld-linux-x86-64.so.2system library
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
proc-macro21.0.107build script
prost0.13.5
prost-derive0.13.5proc macro
quote1.0.47build script
reactor-webrtc-dc-chunking0.23.0
reactor-webrtc-sys0.23.0build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl
shlex2.0.1
syn2.0.119
unicode-ident1.0.27

Raw data

capture
1.3 MB
records
149,476
bytes per record
9.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-14 · run f3ce561b-bd29-4155-8e7d-a0bef522a494

analysis 0.1.0 · 2026-10-14 · efb1d7d · graph v2