Skip to content
Open-Source Registry

cargo / shiguredo_webrtc / 0.156.1-canary.0

shiguredo_webrtc 0.156.1-canary.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
322
operations
8.4K
packages
37
compiler runs
33
connections
3
job time
31s
capture
126 KB
records
16K
bytes / record
8.1

Build behaviourits build script reached github.com, release-assets.githubusercontent.comits build script ran curlundeclared fetchlinked a downloaded binaryfetched outside crates.io

run a045622f-9c32-4a0b-92a8-65127f67539f · built 2026-10-11 · complete

Artifact

file · retained · product · graph v2
1

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    libwebrtc_c.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    shiguredo_webrtc 0.156.1-canary.0 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/lib/libwebrtc_c.awritten by build_script_build-0613b7d7d0de9fbd
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · webrtc-rs

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-0613b7d7d0de9fbd/build_script_build-0613b7d7d0de9fbd, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/lib/libwebrtc_c.a

  2. Written from a pipecause

    copied input /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt/lib/libwebrtc_c.a: Written by tar from a pipe without a recorded source compilation

    subject /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/lib/libwebrtc_c.asource /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt/lib/libwebrtc_c.a

    by tar xf /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz -C /home/runner/work/webrtc-rs/webrtc-rs…

  3. Asked for by the build's own declarationsupport

    shiguredo_webrtc asked the linker for it: static webrtc_c (target/release/build/shiguredo_webrtc-a5a27837c558a290/output)

    subject /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/lib/libwebrtc_c.a

  4. Build script fetched what its crate documents it fetchessupport

    shiguredo_webrtc's build script fetches a prebuilt libwebrtc from github.com, release-assets.githubusercontent.com: shiguredo's webrtc crate downloads shiguredo-webrtc-build's prebuilt from its GitHub release (observed on the registry, 2026-10-06)

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar xf /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz -C /home/runner/work/webrtc-rs/webrtc-rs…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2447
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2447
  3. build-script-build/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-0613b7d7d0de9fbd/build-script-build2946
  4. tartar xf /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz -C /home/runner/work/webrtc-rs/webrtc-rs…2954

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
shiguredo_webrtc 0.156.1-canary.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz https://github.com/shigu…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz https://github.com/shigu…

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-0613b7d7d0de9fbd/build_script_build-0613b7d7d0de9fbd

  4. Build script fetched what its crate documents it fetchessupport

    shiguredo_webrtc's build script fetches a prebuilt libwebrtc from github.com, release-assets.githubusercontent.com: shiguredo's webrtc crate downloads shiguredo-webrtc-build's prebuilt from its GitHub release (observed on the registry, 2026-10-06)

  5. Tool commandsupport

    Command: curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz https://github.com/shigu…

    by curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz https://github.com/shigu…

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz https://github.com/shigu…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2447
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2447
  3. build-script-build/home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-0613b7d7d0de9fbd/build-script-build2946
  4. curlcurl -fSL --retry 3 -o /home/runner/work/webrtc-rs/webrtc-rs/target/release/build/shiguredo_webrtc-a5a27837c558a290/out/prebuilt.tar.gz https://github.com/shigu…2949

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Network

3 peers
  • github.com:443 shiguredo_webrtc's own build code · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 shiguredo_webrtc's own build code · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (webrtc-rs) via crates.io · 1,695 files · went into an output ecosystem
Dependencies38Build behaviour
aho-corasick1.1.5
bindgen0.72.1build script
bitflags2.13.1
cc1.4.5
cexpr0.6.0
cfg-if1.0.4
clang-sys1.9.1build script
cmake0.1.58
either1.18.0
find-msvc-tools0.1.12
glob0.3.4
itertools0.13.0
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm.so.6system library
libmvec.so.1system library
log0.4.34
memchr2.8.3
minimal-lexical0.2.1
nojson0.3.15
nom7.1.3
prettyplease0.2.37build script
proc-macro21.0.107build script
quote1.0.47build script
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
rustc-hash2.1.3
shiguredo_cmake4.4.0build script
shiguredo_toml2026.2.0
shlex1.3.0
shlex2.0.1
syn2.0.119
unicode-ident1.0.24
windows-link0.2.1

Raw data

capture
126 KB
records
15,503
bytes per record
8.1

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-11 · run a045622f-9c32-4a0b-92a8-65127f67539f

analysis 0.1.0 · 2026-10-10 · ce2b8d5 · graph v2