Skip to content
Open-Source Registry

cargo / reqrio / 0.4.0-alpha5

reqrio 0.4.0-alpha5

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
333
operations
9.9K
packages
24
compiler runs
35
connections
2
job time
41s
capture
143 KB
records
18K
bytes / record
7.8

Build behaviourundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.io

run 7a712330-8e18-4303-89b3-45bf85f26e19 · built 2026-10-17 · complete View on crates.io

Graph

egress · high · in libreqrio.rlib
4

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    reqtls 0.4.0-alpha5 › ms.xllgl.top:8080
    high
  • Uncompiled library linked
    libbcz.so › ms.xllgl.top
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
reqtls 0.4.0-alpha5
Destination
ms.xllgl.top:8080
Reaches
Jobs
build-test
Rule
egress · reqrio

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to ms.xllgl.top:8080, opened by build-script-mod

    subject ms.xllgl.top:8080

    by /home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod

  2. What a build script's fetch becamesupport

    5 files came down; the build compiled or linked libbcz.so

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod

In libreqrio.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-mod

Ran
/home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2486
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2486
  3. build-script-mod/home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod2620

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/reqrio/reqrio/target/release/reqrio/libbcz.sowritten by build-script-mod
Destination
ms.xllgl.top
Jobs
build-test
Rule
object-provenance · reqrio

Witness chain

  1. /home/runner/work/reqrio/reqrio/target/release/reqrio/libbcz.sovia /home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod
    • Object written under a build script that downloadedfrom ms.xllgl.top

      written under the build script at /home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod, which downloaded from ms.xllgl.top

    • Obfuscated toolchain bypass

      Written by build-script-mod from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      reqtls asked the linker for it: dynamic bcz (target/release/build/reqtls-84b530da1ca2f809/output)

    source
  2. member
    artifact

Evidence

  • written under the build script at /home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod, which downloaded from ms.xllgl.top
  • Written by build-script-mod from a network connection without a recorded source compilation
  • reqtls asked the linker for it: dynamic bcz (target/release/build/reqtls-84b530da1ca2f809/output)

In libreqrio.so

Loading the graph

Processes

build-test

cargo›cargo›build-script-mod

Ran
/home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2486
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2486
  3. build-script-mod/home/runner/work/reqrio/reqrio/target/release/build/reqtls-106d548d2a1087d8/build-script-mod2620

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • ms.xllgl.top:8080 build code of reqtls · build-script-mod (reqrio) · Shenzhen Tencent Computer Systems Company Limited · 5 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (reqrio) via crates.io · 2,630 files · went into an output ecosystem
Dependencies24Build behaviour
bytemuck1.25.0
equivalent1.0.2
hashbrown0.16.1
hex0.4.3
indexmap2.13.0
itoa1.0.17
ld-linux-x86-64.so.2system library
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
memchr2.7.6
proc-macro21.0.104build script, not run
quote1.0.42build script, not run
reqrio-json0.1.13
reqtls0.4.0-alpha5build scriptnetworkms.xllgl.top
serde1.0.228build script
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.149build script
syn2.0.111
unicode-ident1.0.22
urlencoding2.1.3
zmij1.0.0
Versions50RiskVulnsPublished
0.4.0-alpha3not analyzed2026-10-02
0.4.0-alpha2not analyzed2026-09-30
0.4.0-alpha1yankednot analyzed2026-09-24
0.3.1not analyzed2026-07-22
0.3.0not analyzed2026-06-30
0.3.0-rc4not analyzed2026-06-29
0.3.0-rc3not analyzed2026-06-26
0.3.0-rc2not analyzed2026-06-22
0.3.0-rc1not analyzed2026-06-20
0.3.0-beta1not analyzed2026-06-18
0.3.0-alpha4not analyzed2026-06-13
0.3.0-alpha3not analyzed2026-05-20
0.3.0-alpha2not analyzed2026-05-19
0.3.0-alpha1not analyzed2026-05-12
0.2.0not analyzed2026-03-31
0.2.0-beta2not analyzed2026-03-26
0.2.0-beta1not analyzed2026-03-23
0.2.0-alpha4not analyzed2026-03-18
0.2.0-alpha3not analyzed2026-03-16
0.2.0-alpha2not analyzed2026-03-14
0.2.0-alpha1not analyzed2026-03-09
0.1.5not analyzed2026-03-07
0.1.4not analyzed2026-03-06
0.1.3not analyzed2026-03-01
0.1.2not analyzed2026-02-27
0.1.1not analyzed2026-02-23
0.1.0not analyzed2026-02-14
0.1.0-rc1not analyzed2026-02-13
0.1.0-alpha1not analyzed2026-02-11
0.0.20not analyzed2026-02-10
0.0.19not analyzed2026-02-07
0.0.18not analyzed2026-02-03
0.0.17not analyzed2026-02-02
0.0.16not analyzed2026-01-26
0.0.15not analyzed2026-01-25
0.0.14not analyzed2026-01-12
0.0.13not analyzed2026-01-10
0.0.12not analyzed2026-01-09
0.0.11not analyzed2026-01-05
0.0.10not analyzed2026-01-03
0.0.9not analyzed2026-01-01
0.0.8not analyzed2025-12-31
0.0.7not analyzed2025-12-30
0.0.6not analyzed2025-12-27
0.0.5not analyzed2025-12-24
0.0.4not analyzed2025-12-23
0.0.3not analyzed2025-12-22
0.0.2not analyzed2025-12-22
0.0.1not analyzed2025-12-21
0.4.0-alpha5highnone

Raw data

capture
143 KB
records
18,286
bytes per record
7.8

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-17 · run 7a712330-8e18-4303-89b3-45bf85f26e19

analysis 0.1.0 · 2026-10-16 · e987d53 · graph v2