Skip to content
Open-Source Registry

cargo / spa12f

spa12f 0.1.1

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured 1 detection
processes
255
operations
80K
packages
221
compiler runs
1
connections
3
job time
7m 33s
capture
687 KB
records
121K
bytes / record
5.7

nothing

Build behaviourits build script reached 104.21.54.91, eu.i.posthog.comconnected outside crates.iocompiled C/C++

19 downloads · MIT · published 2026-10-14 · crates.io
Reviewed by Bitbison: deceptiveBuild script sends the build machine's network, operating system and IP address to PostHog in an obfuscated fashion.

Graph

egress · medium · in spa12f
2

Checks

12 of 14 clear Network activity Build-time dependency advisories
Build behavior▲✓✓✓✓✓✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

1
  • Build script reached 104.21.54.91 +1
    spa12f 0.1.1 › 104.21.54.91:80, eu.i.posthog.com:443
    medium

Detection

mediumwitnessed

Build script reached 104.21.54.91 +1

Unexpected network connection

Subject
spa12f 0.1.1
Destination
104.21.54.91:80, eu.i.posthog.com:443
Reaches
spa12f-0c4219e609259837member
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to 104.21.54.91:80, opened by build_script_build-ea8b34c7020c2801

    subject 104.21.54.91:80

    by /home/runner/work/spa12f/spa12f/target/release/build/spa12f-ea8b34c7020c2801/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to eu.i.posthog.com:443, opened by build_script_build-ea8b34c7020c2801

    subject eu.i.posthog.com:443

    by /home/runner/work/spa12f/spa12f/target/release/build/spa12f-ea8b34c7020c2801/build-script-build

  3. What a build script's fetch becamesupport

    nothing came down that the build kept

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/spa12f/spa12f/target/release/build/spa12f-ea8b34c7020c2801/build_script_build-ea8b34c7020c2801

In spa12f

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/spa12f/spa12f/target/release/build/spa12f-ea8b34c7020c2801/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2452
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2452
  3. build-script-build/home/runner/work/spa12f/spa12f/target/release/build/spa12f-ea8b34c7020c2801/build-script-build5345

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • eu.i.posthog.com:443 spa12f's own build code · build_script_build-ea8b34c7020c2801 · Amazon.com, Inc. undeclared
  • 104.21.54.91:80 spa12f's own build code · build_script_build-ea8b34c7020c2801 · Cloudflare, Inc. undeclared
  • static.crates.io:8080 the package manager · cargo (spa12f) via crates.io · 13,944 files · went into an output ecosystem
Dependencies224Build behaviour
ld-linux-x86-64.so.2system library
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
adler22.0.1
aho-corasick1.1.5
android_system_properties0.1.6
async-compression0.4.50
atomic-waker1.1.2
autocfg1.5.1
aws-lc-rs1.18.2build script
aws-lc-sys0.46.0build scriptprebuilt objects
base640.23.1
bitflags2.13.2
block-buffer0.12.1
block20.6.2
bumpalo3.20.3
bytes1.12.1
cc1.8.0
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
chrono0.4.45
cmake0.1.58
combine4.6.8
compression-codecs0.4.45
compression-core0.4.33
const-oid0.10.2
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.3.1
crc32fast1.5.2build script
crypto-common0.2.2
darling0.20.11
darling_core0.20.11
darling_macro0.20.11proc macro
derive_builder0.20.2
derive_builder_core0.20.2
derive_builder_macro0.20.2proc macro
digest0.11.3
dispatch20.3.1
displaydoc0.2.7proc macro
dunce1.0.5
find-msvc-tools0.1.14
flate21.1.10
fnv1.0.7
form_urlencoded1.2.2
fs_extra1.3.0
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
getrandom0.2.17
getrandom0.4.3build script
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hybrid-array0.4.15
hyper1.12.0
hyper-rustls0.27.10
hyper-util0.1.21
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
ipnet2.12.2
itoa1.0.18
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
jobserver0.1.35
js-sys0.3.106
libc0.2.190build script
litemap0.8.3
log0.4.34
lru-slab0.1.3
memchr2.8.3
miniz_oxide0.9.1
mio1.2.4
nix0.31.3build script
num-traits0.2.19build script
objc20.6.5build script, not run
objc2-cloud-kit0.3.2
objc2-core-data0.3.2
objc2-core-foundation0.3.2
objc2-core-graphics0.3.2
objc2-core-image0.3.2
objc2-core-location0.3.2
objc2-core-text0.3.2
objc2-encode4.1.0
objc2-foundation0.3.2
objc2-io-surface0.3.2
objc2-quartz-core0.3.2
objc2-ui-kit0.3.2
objc2-user-notifications0.3.2
once_cell1.21.4
openssl-probe0.2.1
os_info3.15.0
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
posthog-rs0.27.0
potential_utf0.1.6
proc-macro21.0.107build script
quinn0.11.12build script, not run
quinn-proto0.11.19
quinn-udp0.5.16build script, not run
quote1.0.47build script
r-efi6.0.0
rand0.10.3
rand_core0.10.1
rand_pcg0.10.2
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.13.5
ring0.17.14build script, not runprebuilt objects
rustc-hash2.1.3
rustc_version0.4.1
rustls0.23.45build script
rustls-native-certs0.8.5
rustls-pki-types1.15.1
rustls-platform-verifier0.7.1
rustls-platform-verifier-android0.2.0
rustls-webpki0.103.15
rustversion1.0.23build script, not runproc macro
same-file1.0.6
schannel0.1.29
security-framework3.7.0
security-framework-sys2.17.0
semver1.0.28
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.154build script
sha10.11.0
shlex2.0.1
simd-adler320.3.10
simd_cesu81.2.0
simdutf80.1.5
slab0.4.12
smallvec1.16.3
socket20.6.5
stable_deref_trait1.2.1
strsim0.11.1
subtle2.6.1
syn2.0.119
syn3.0.9
sync_wrapper1.0.2
synstructure0.14.0
thiserror2.0.21build script, not run
thiserror-impl2.0.21proc macro
tinystr0.8.4
tinyvec1.13.3
tokio1.53.3
tokio-rustls0.26.6
tokio-util0.7.20
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicode-ident1.0.27
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
uuid1.28.0
walkdir2.5.0
want0.3.2
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.129build script, not run
wasm-bindgen-futures0.4.79
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
web-sys0.3.106
web-time1.1.0
webpki-root-certs1.0.9
winapi-util0.1.11
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
writeable0.6.4
yoke0.8.3
yoke-derive0.8.4proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.8
zmij1.0.23build script

Raw data

capture
687 KB
records
120,964
bytes per record
5.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-15 · run d06868c8-ceb5-4be5-a96c-97e7876f4ef9

analysis 0.1.0 · 2026-10-15 · 20a5b2e · graph v2

spa12f reports the build machine to PostHog and hides it

deceptiveCovers 0.1.1Reviewed by BitbisonUpdated 2026-10-15

Build script sends the build machine's network, operating system and IP address to PostHog in an obfuscated fashion.

What the build script does

The spa12f 0.1.1 build script runs whenever the crate is compiled. Decoded, it does two things.

  1. It connects to ifconfig.co at the hard-coded address 104.21.54.91 on port 80 and requests /asn, which returns the network the build machine is on.
  2. It sends that network, the build machine's operating system and its public IP address to PostHog (eu.i.posthog.com), under the project key phc_SoIaZtaoqPQ70D5hx6DR1wtiLT60mtN7frYmUspcjjD.

The script writes the ifconfig.co request and the PostHog key as sequences of numbers, so neither reads as what it is in the source. That is why the review concludes deceptive: the crate hides what it does. crates.io's usage policy does not allow code that uses obfuscation to hide or mask functionality.

What it does not do

The build script does not read or send credentials or files. The rest of the crate is a "Hello, world!" program.

Where it reaches

spa12f is a library, so any crate that depends on it runs this build script on every build. At the time of this review no crate depended on it. spa102 0.1.1, from the same owner, carries the same build script.

Reporting

Bitbison reported both crates to crates.io on 2026-10-15 at 14:18 UTC. crates.io acknowledged the report at 15:20 UTC and, at 15:45 UTC, confirmed it, locked the owner's account and deleted the spa12f and spa102 crates.

Indicators

hosts
ifconfig.coeu.i.posthog.com
addresses
104.21.54.91:80
requests
GET /asn
keys
phc_SoIaZtaoqPQ70D5hx6DR1wtiLT60mtN7frYmUspcjjD

Examined

0.1.1
sha256:c857e6ab00a87ece95a715591b2a78e3de7b36cc037047213ad93df51947d4b2

Links