Skip to content
Open-Source Registry

cargo / tracel-llvm-bundler / 23.1.0-4

tracel-llvm-bundler 23.1.0-4

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskmediumVulnsnone
processes
413
operations
49K
packages
89
compiler runs
29
connections
3
job time
1m 15s
capture
375 KB
records
72K
bytes / record
5.2

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetched outside crates.iocompiled C/C++

run 9ccad472-7e9a-4480-b641-d493c0ae95d6 · built 2026-10-19 · complete View on crates.io

Graph

egress · medium · in libtracel_llvm_bundler.rlib
2

Checks

12 of 14 clear Network activity Build-time dependency advisories
Build behavior▲✓✓✓✓✓✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

1
  • Build script reached github.com +1
    tracel-llvm-bundler 23.1.0-4 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
tracel-llvm-bundler 23.1.0-4
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-e6a98c7f565cbdff

    subject github.com:443

    by /home/runner/work/tracel-llvm/tracel-llvm/target/release/build/tracel-llvm-bundler-e6a98c7f565cbdff/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-e6a98c7f565cbdff

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/tracel-llvm/tracel-llvm/target/release/build/tracel-llvm-bundler-e6a98c7f565cbdff/build-script-build

  3. What a build script's fetch becamesupport

    2548 files came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/tracel-llvm/tracel-llvm/target/release/build/tracel-llvm-bundler-e6a98c7f565cbdff/build_script_build-e6a98c7f565cbdff

  5. Build script fetched what its crate documents it fetchessupport

    tracel-llvm-bundler's build script fetches a prebuilt LLVM bundle from github.com, release-assets.githubusercontent.com: tracel's bundler fetches its LLVM build from GitHub releases

In libtracel_llvm_bundler.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/tracel-llvm/tracel-llvm/target/release/build/tracel-llvm-bundler-e6a98c7f565cbdff/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2478
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2478
  3. build-script-build/home/runner/work/tracel-llvm/tracel-llvm/target/release/build/tracel-llvm-bundler-e6a98c7f565cbdff/build-script-build3996

Remediation

The crate's build script reached the network at compile time, outside the registry's checksums. Build it from what the registry ships (the crate's own environment variable or from-source feature), or record the download as accepted once it is reviewed.

Network

3 peers
  • github.com:443 tracel-llvm-bundler's own build code · build_script_build-e6a98c7f565cbdff · GitHub, Inc. · 2,548 files undeclared
  • release-assets.githubusercontent.com:443 tracel-llvm-bundler's own build code · build_script_build-e6a98c7f565cbdff · Fastly, Inc. · 2,548 files undeclared
  • static.crates.io:8080 the package manager · cargo (tracel-llvm) via crates.io · 5,179 files · went into an output ecosystem
Dependencies104Build behaviour
anyhow1.0.99build script
base640.23.1
bitflags2.9.4
block-buffer0.10.4
bytes1.10.1
cc1.2.37
cfg-if1.0.3
constcat0.6.1
cpufeatures0.2.17
crypto-common0.1.6
digest0.10.7
dirs6.0.0
dirs-sys0.5.0
errno0.3.13
filetime0.2.26
find-msvc-tools0.1.1
fnv1.0.7
generic-array0.14.7build script
getrandom0.2.16
getrandom0.3.3build script, not run
hermit-abi0.5.2
http1.3.1
httparse1.10.1build script
itoa1.0.15
jobserver0.1.34
ld-linux-x86-64.so.2system library
libc0.2.175build script
libc.so.6system library
libgcc_s.so.1system library
liblzma0.4.4
liblzma-sys0.4.4build script
libm.so.6system library
libmvec.so.1system library
libredox0.1.9
linux-raw-sys0.9.4
log0.4.28
memchr2.8.3
num_cpus1.17.0
once_cell1.21.3
option-ext0.2.0
percent-encoding2.3.2
pkg-config0.3.32
proc-macro21.0.101build script
quote1.0.40
r-efi5.3.0
redox_syscall0.5.17
redox_users0.5.2
ring0.17.14build scriptprebuilt objects
rustix1.0.8build script
rustls0.23.31build script
rustls-pki-types1.12.0
rustls-webpki0.103.4
same-file1.0.6
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.151build script
sha20.10.9
shlex1.3.0
subtle2.6.1
syn2.0.106
syn3.0.4
tar0.4.44
thiserror2.0.16build script, not run
thiserror-impl2.0.16proc macro
typenum1.18.0build script
unicode-ident1.0.18
untrusted0.9.0
ureq3.4.0
ureq-proto0.6.1
utf8-zero0.8.1
version_check0.9.5
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
wasi0.14.3+wasi-0.2.4
webpki-roots1.0.2
winapi-util0.1.11
windows-link0.1.3
windows-link0.2.0
windows-sys0.52.0
windows-sys0.60.2
windows-sys0.61.0
windows-targets0.52.6
windows-targets0.53.3
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_gnullvm0.53.0build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.53.0build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnu0.53.0build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.53.0build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_i686_msvc0.53.0build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.53.0build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.53.0build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.53.0build script, not runprebuilt objects
wit-bindgen0.45.1build script, not runprebuilt objects
xattr1.5.1
zeroize1.8.1
zmij1.0.23build script
Versions15RiskVulnsPublished
23.1.0-3not analyzed2026-09-21
23.1.0-1not analyzed2026-09-21
22.1.4-6not analyzed2026-08-25
22.1.4-5not analyzed2026-07-28
22.1.4-3not analyzed2026-05-14
22.1.4-2not analyzed2026-05-14
22.1.4-1not analyzed2026-05-04
20.1.4-7not analyzed2026-01-30
20.1.4-6not analyzed2026-01-13
20.1.4-5not analyzed2025-09-25
20.1.4-4not analyzed2025-09-24
20.1.4-3not analyzed2025-09-24
20.1.4-2not analyzed2025-09-23
20.1.4-1not analyzed2025-09-19
23.1.0-4mediumnone

Raw data

capture
375 KB
records
71,793
bytes per record
5.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-19 · run 9ccad472-7e9a-4480-b641-d493c0ae95d6

analysis 0.1.0 · 2026-10-19 · 10ce9f4 · graph v2