Skip to content
Open-Source Registry

cargo / truffle-sidecar / 0.7.17

truffle-sidecar 0.7.17

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskmediumVulnsnone
processes
163
operations
19K
packages
93
compiler runs
1
connections
3
job time
35s
capture
257 KB
records
35K
bytes / record
7.4

Build behaviourits build script reached github.com, release-assets.githubusercontent.comundeclared fetchfetched outside crates.iocompiled C/C++

run c1ec8156-7b2a-4d22-aa6d-0dd9df9f8704 · built 2026-10-15 · complete View on crates.io

Graph

egress · medium · in libtruffle_sidecar.rlib
2

Checks

12 of 14 clear Network activity Build-time dependency advisories
Build behavior▲✓✓✓✓✓✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

1
  • Build script reached github.com +1
    truffle-sidecar 0.7.17 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
truffle-sidecar 0.7.17
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-3c0a748f3c2c922b

    subject github.com:443

    by /home/runner/work/truffle/truffle/target/release/build/truffle-sidecar-3c0a748f3c2c922b/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-3c0a748f3c2c922b

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/truffle/truffle/target/release/build/truffle-sidecar-3c0a748f3c2c922b/build-script-build

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/truffle/truffle/target/release/build/truffle-sidecar-3c0a748f3c2c922b/build_script_build-3c0a748f3c2c922b

In libtruffle_sidecar.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/truffle/truffle/target/release/build/truffle-sidecar-3c0a748f3c2c922b/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/truffle/truffle/target/release/build/truffle-sidecar-3c0a748f3c2c922b/build-script-build3122

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 truffle-sidecar's own build code · build_script_build-3c0a748f3c2c922b · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 truffle-sidecar's own build code · build_script_build-3c0a748f3c2c922b · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (truffle) via crates.io · 6,011 files · went into an output ecosystem
Dependencies96Build behaviour
adler22.0.1
anyhow1.0.102build script, not run
base640.22.1
bitflags2.11.0
block-buffer0.12.0
bytes1.11.1
cc1.2.56
cfg-if1.0.4
const-oid0.10.2
cpufeatures0.3.0
crc32fast1.5.0build script
crypto-common0.2.1
digest0.11.2
equivalent1.0.2
errno0.3.14
fastrand2.3.0
find-msvc-tools0.1.9
flate21.1.9
foldhash0.1.5
getrandom0.2.17
getrandom0.4.2build script
hashbrown0.15.5
hashbrown0.16.1
heck0.5.0
http1.4.0
httparse1.10.1build script
hybrid-array0.4.10
id-arena2.3.0
indexmap2.13.0
itoa1.0.17
ld-linux-x86-64.so.2system library
leb128fmt0.1.0
libc0.2.186build script
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.12.1
log0.4.29
memchr2.8.0
miniz_oxide0.8.9
once_cell1.21.3
percent-encoding2.3.2
prettyplease0.2.37build script, not run
proc-macro21.0.106build script, not run
quote1.0.45build script, not run
r-efi6.0.0
ring0.17.14build scriptprebuilt objects
rustix1.1.4build script
rustls0.23.46build script
rustls-pki-types1.14.0
rustls-webpki0.103.15
semver1.0.27
serde1.0.228build script, not run
serde_core1.0.228build script
serde_derive1.0.228proc macro
serde_json1.0.149build script
sha20.11.0
shlex1.3.0
simd-adler320.3.8
subtle2.6.1
syn2.0.117
tempfile3.27.0
typenum1.19.0build script
unicode-ident1.0.24
unicode-xid0.2.6
untrusted0.9.0
ureq3.3.0
ureq-proto0.6.0
utf8-zero0.8.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.2+wasi-0.2.9
wasip30.4.0+wasi-0.3.0-rc-2026-01-06
wasm-encoder0.244.0
wasm-metadata0.244.0
wasmparser0.244.0
webpki-roots1.0.6
windows-sys0.52.0
windows-sys0.59.0
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.51.0build script, not runprebuilt objects
wit-bindgen-core0.51.0
wit-bindgen-rust0.51.0build script, not run
wit-bindgen-rust-macro0.51.0build script, not runproc macro
wit-component0.244.0
wit-parser0.244.0
zeroize1.8.2
zmij1.0.21build script
Versions41RiskVulnsPublished
0.7.174d ago
0.7.16did not build8d ago
0.7.15did not build8d ago
0.7.14not analyzed2026-09-16
0.7.13not analyzed2026-09-06
0.7.12not analyzed2026-08-03
0.7.11not analyzed2026-07-28
0.7.9not analyzed2026-07-28
0.7.8not analyzed2026-07-27
0.7.7not analyzed2026-07-26
0.7.6not analyzed2026-07-24
0.7.5not analyzed2026-07-24
0.7.3not analyzed2026-07-16
0.7.2not analyzed2026-07-16
0.7.1not analyzed2026-07-13
0.7.0not analyzed2026-07-11
0.6.0not analyzed2026-07-10
0.5.1not analyzed2026-07-09
0.4.9not analyzed2026-07-08
0.4.8not analyzed2026-07-07
0.4.7not analyzed2026-07-03
0.4.6not analyzed2026-04-22
0.4.5not analyzed2026-04-14
0.4.4not analyzed2026-04-14
0.4.3not analyzed2026-04-12
0.4.2not analyzed2026-04-12
0.4.1not analyzed2026-04-11
0.4.0not analyzed2026-04-11
0.3.25not analyzed2026-04-10
0.3.24not analyzed2026-04-10
0.3.23not analyzed2026-04-10
0.3.22not analyzed2026-04-10
0.3.21not analyzed2026-04-10
0.3.20not analyzed2026-04-10
0.3.19not analyzed2026-04-10
0.3.18not analyzed2026-04-10
0.3.17not analyzed2026-03-31
0.3.16not analyzed2026-03-31
0.3.12not analyzed2026-03-30
0.3.2not analyzed2026-03-29
0.7.19mediumnone

Raw data

capture
257 KB
records
34,597
bytes per record
7.4

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-15 · run c1ec8156-7b2a-4d22-aa6d-0dd9df9f8704

analysis 0.1.0 · 2026-10-15 · 244c7b2 · graph v2