Skip to content
Open-Source Registry

cargo / shiguredo_webrtc / 0.154.1-canary.5

shiguredo_webrtc 0.154.1-canary.5

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
316
operations
8.3K
packages
37
compiler runs
33
connections
4
job time
31s

Build behaviournot recorded for this run

run 987e6167-df4f-4d24-8699-810aa5ba8f3a · built 2026-10-06 · complete View on crates.io

Artifact

file · retained · product · graph v1
1

Checks

10 of 12 clear Network activity Object file origins
Build behavior▲✓✓✓▲✓✓
Supply chain✓✓✓
Pipeline✓✓

Detections

2
  • Build code opened a network connection
    shiguredo_webrtc 0.154.1-canary.5 › github.com:443
    high
  • Could not verify how this object file was built
    libwebrtc_c.a
    high

Detection

highwitnessed

Build code opened a network connection

Unexpected network connection

Subject
shiguredo_webrtc 0.154.1-canary.5
Destination
github.com:443
Jobs
build-test, build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/prebuilt.tar.gz https://github.com/shigu…

  2. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-88a6167e8c90a149/build_script_build-88a6167e8c90a149

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/prebuilt.tar.gz https://github.com/shigu…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2175
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2175
  3. build-script-build/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-88a6167e8c90a149/build-script-build2674
  4. curlcurl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/prebuilt.tar.gz https://github.com/shigu…2677

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/prebuilt.tar.gz https://github.com/shigu…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2175
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2175
  3. build-script-build/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-88a6167e8c90a149/build-script-build2674
  4. curlcurl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/prebuilt.tar.gz https://github.com/shigu…2677

Remediation

Review the process and its owning build step. Remove unnecessary requests; move required downloads to a declared dependency-fetch step.

Detection

highwitnessed

Could not verify how this object file was built

Object file origin needs review

Subject
/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/lib/libwebrtc_c.awritten by build_script_build-88a6167e8c90a149
Reaches
Jobs
build-test
Rule
object-provenance · webrtc-rs

Evidence

  1. Written from a pipecause

    Written by build_script_build-88a6167e8c90a149 from a pipe without a recorded source compilation

    subject /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/lib/libwebrtc_c.a

    by /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-88a6167e8c90a149/build-script-build

  2. Asked for by the build's own declarationsupport

    shiguredo_webrtc asked the linker for it: static webrtc_c (target/release/build/shiguredo_webrtc-01073c0561c54219/output)

    subject /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-01073c0561c54219/out/lib/libwebrtc_c.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-88a6167e8c90a149/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2175
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2175
  3. build-script-build/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-88a6167e8c90a149/build-script-build2674

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 curl · GitHub, Inc. flagged
  • release-assets.githubusercontent.com:443 curl · Fastly, Inc. flagged
  • static.crates.io:8080 cargo (webrtc-rs) via crates.io allowed
Dependencies38Build behaviour
aho-corasick1.1.5
bindgen0.72.1
bitflags2.13.1
cc1.4.5
cexpr0.6.0
cfg-if1.0.4
clang-sys1.9.1
cmake0.1.58
either1.18.0
find-msvc-tools0.1.12
glob0.3.4
itertools0.13.0
ld-linux-x86-64.so.2
libc0.2.189
libc.so.6
libgcc_s.so.1
libloading0.8.9
libm.so.6
libmvec.so.1
log0.4.34
memchr2.8.3
minimal-lexical0.2.1
nojson0.3.15
nom7.1.3
prettyplease0.2.37
proc-macro21.0.107
quote1.0.47
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
rustc-hash2.1.3
shiguredo_cmake4.4.0
shiguredo_toml2026.2.0
shlex1.3.0
shlex2.0.1
syn2.0.119
unicode-ident1.0.24
windows-link0.2.1
Versions70RiskVulnsPublished
0.156.1-canary.06d ago
0.156.07d ago
0.155.010d ago
0.154.110d ago
0.154.1-canary.511d ago
0.154.1-canary.4not analyzed12d ago
0.154.1-canary.3not analyzed2026-10-03
0.154.1-canary.2not analyzed2026-09-28
0.154.1-canary.1not analyzed2026-09-19
0.154.1-canary.0not analyzed2026-09-19
0.154.0not analyzed2026-09-10
0.153.1not analyzed2026-09-09
0.153.0yankednot analyzed2026-09-09
0.152.1not analyzed2026-09-09
0.152.1-canary.3not analyzed2026-09-02
0.152.1-canary.2not analyzed2026-08-31
0.152.1-canary.1not analyzed2026-08-30
0.152.1-canary.0not analyzed2026-08-26
0.152.0not analyzed2026-08-25
0.151.0not analyzed2026-08-10
0.150.3not analyzed2026-07-20
0.150.2not analyzed2026-06-23
0.150.1not analyzed2026-06-12
0.150.0not analyzed2026-06-09
0.150.0-canary.0not analyzed2026-06-09
0.149.0not analyzed2026-06-04
0.149.0-canary.0not analyzed2026-06-04
0.148.1not analyzed2026-06-04
0.148.1-canary.3not analyzed2026-06-04
0.148.1-canary.2not analyzed2026-06-04
0.148.1-canary.1not analyzed2026-06-01
0.148.0not analyzed2026-05-16
0.147.2not analyzed2026-04-22
0.147.1not analyzed2026-04-20
0.147.1-canary.6not analyzed2026-04-19
0.147.1-canary.5not analyzed2026-04-13
0.147.1-canary.4not analyzed2026-04-11
0.147.1-canary.3not analyzed2026-04-08
0.147.1-canary.2not analyzed2026-04-04
0.147.1-canary.1not analyzed2026-04-04
0.147.1-canary.0not analyzed2026-04-02
0.147.0not analyzed2026-04-02
0.146.3not analyzed2026-04-02
0.146.3-canary.4not analyzed2026-04-02
0.146.3-canary.3not analyzed2026-04-01
0.146.3-canary.2not analyzed2026-03-31
0.146.3-canary.1not analyzed2026-03-30
0.146.3-canary.0not analyzed2026-03-29
0.146.2not analyzed2026-03-27
0.146.2-canary.5not analyzed2026-03-27
0.146.2-canary.3not analyzed2026-03-26
0.146.2-canary.2not analyzed2026-03-25
0.146.2-canary.1not analyzed2026-03-25
0.146.2-canary.0not analyzed2026-03-24
0.146.1not analyzed2026-03-24
0.146.1-canary.2not analyzed2026-03-21
0.146.1-canary.1not analyzed2026-03-19
0.146.1-canary.0not analyzed2026-03-19
0.146.0not analyzed2026-03-15
0.146.0-canary.5not analyzed2026-03-14
0.146.0-canary.4not analyzed2026-03-13
0.146.0-canary.3not analyzed2026-03-11
0.146.0-canary.2not analyzed2026-03-11
0.146.0-canary.1not analyzed2026-03-11
0.146.0-canary.0not analyzed2026-03-05
0.145.3-canary.1not analyzed2026-02-26
0.145.2not analyzed2026-02-26
0.145.1not analyzed2026-02-17
0.145.0not analyzed2026-02-12
0.156.1-canary.1mediumnone

Raw data

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-06 · run 987e6167-df4f-4d24-8699-810aa5ba8f3a

analysis 0.1.0 · 2026-10-05 · 8db20f3 · graph v1