Skip to content
Open-Source Registry

cargo / turbo-surf-deno-crypto / 0.273.0

turbo-surf-deno-crypto 0.273.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
933
operations
152K
packages
289
compiler runs
249
connections
3
build time
2m 49s
job time
2m 49s
capture
1.1 MB
records
224K
bytes / record
5.0

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 8953a2c7-48a7-4ab1-bdee-8e942e875030 · built 2026-10-21 · complete View on crates.io

Graph

object-provenance · high · in libdeno_crypto.rlib
3

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

2
  • Uncompiled library linked
    librusty_v8.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    turbo-surf-v8 150.4.0 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/turbo-surf/turbo-surf/target/release/gn_out/obj/librusty_v8.awritten by build_script_build-d850ddbf09ed55af
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · turbo-surf

Witness chain

  1. /home/runner/.gitconfig
    source
  2. /home/runner/.cargo/registry/src/index.crates.io-f7c75c5af8568ae3/turbo-surf-v8-150.4.0/tools/download_file.pyvia /home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo fetch --locked
  3. /home/runner/work/turbo-surf/turbo-surf/target/release/gn_out/obj/librusty_v8.tmpvia python3 ./tools/download_file.py --url https://github.com/denoland/rusty_v8/releases/download/v150.4.0/librusty_v8_simdutf_release_x86_64-unknown-linux-gnu.a.gz
  4. /home/runner/work/turbo-surf/turbo-surf/target/release/gn_out/obj/librusty_v8.avia /home/runner/work/turbo-surf/turbo-surf/target/release/build/turbo-surf-v8-d850ddbf09ed55af/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/turbo-surf/turbo-surf/target/release/build/turbo-surf-v8-d850ddbf09ed55af/build_script_build-d850ddbf09ed55af, which downloaded from github.com, release-assets.githubusercontent.com

    • Written without a recorded source compilation

      Written by build_script_build-d850ddbf09ed55af without a recorded source compilation

    • Asked for by the build's own declaration

      turbo-surf-v8 asked the linker for it: static rusty_v8 (target/release/build/turbo-surf-v8-ed9490d0e1390d53/output)

    subject
  5. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/turbo-surf/turbo-surf/target/release/build/turbo-surf-v8-d850ddbf09ed55af/build_script_build-d850ddbf09ed55af, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-d850ddbf09ed55af without a recorded source compilation
  • turbo-surf-v8 asked the linker for it: static rusty_v8 (target/release/build/turbo-surf-v8-ed9490d0e1390d53/output)

In libdeno_crypto.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/turbo-surf/turbo-surf/target/release/build/turbo-surf-v8-d850ddbf09ed55af/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2501
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2501
  3. build-script-build/home/runner/work/turbo-surf/turbo-surf/target/release/build/turbo-surf-v8-d850ddbf09ed55af/build-script-build5119

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
turbo-surf-v8 150.4.0
Destination
github.com:443, release-assets.githubusercontent.com:443
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by python3.14

    subject github.com:443

    by python3 ./tools/download_file.py --url https://github.com/denoland/rusty_v8/releases/download/v150.4.0/librusty_v8_simdutf_release_x86_64-unknown-linux-gnu.a.gz…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by python3.14

    subject release-assets.githubusercontent.com:443

    by python3 ./tools/download_file.py --url https://github.com/denoland/rusty_v8/releases/download/v150.4.0/librusty_v8_simdutf_release_x86_64-unknown-linux-gnu.a.gz…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/turbo-surf/turbo-surf/target/release/build/turbo-surf-v8-d850ddbf09ed55af/build_script_build-d850ddbf09ed55af

  5. Tool commandsupport

    Command: python3 ./tools/download_file.py --url https://github.com/denoland/rusty_v8/releases/download/v150.4.0/librusty_v8_simdutf_release_x86_64-unknown-linux-gnu.a.gz…

    by python3 ./tools/download_file.py --url https://github.com/denoland/rusty_v8/releases/download/v150.4.0/librusty_v8_simdutf_release_x86_64-unknown-linux-gnu.a.gz…

What came before it

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›python3

Ran
python3 ./tools/download_file.py --url https://github.com/denoland/rusty_v8/releases/download/v150.4.0/librusty_v8_simdutf_release_x86_64-unknown-linux-gnu.a.gz…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2501
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2501
  3. build-script-build/home/runner/work/turbo-surf/turbo-surf/target/release/build/turbo-surf-v8-d850ddbf09ed55af/build-script-build5119
  4. python3python3 ./tools/download_file.py --url https://github.com/denoland/rusty_v8/releases/download/v150.4.0/librusty_v8_simdutf_release_x86_64-unknown-linux-gnu.a.gz…5122

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of turbo-surf-v8 · python3.14 · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of turbo-surf-v8 · python3.14 · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (turbo-surf) via crates.io · 21,234 files · went into an output ecosystem
Dependencies314Build behaviour
adler22.0.1
aead0.5.2
aes0.8.3
aes-gcm0.10.3
aes-kw0.2.1
aho-corasick1.1.5
anyhow1.0.104build script
argon20.6.0
autocfg1.5.1
aws-lc-rs1.18.2build script
aws-lc-sys0.40.0build scriptprebuilt objects
aws-lc-sys0.46.0build scriptprebuilt objects
base16ct0.2.0
base16ct1.0.0
base640.22.1
base64-simd0.8.0
base64ct1.8.3
bindgen0.70.1build script
bindgen0.72.1build script
bit-set0.8.0
bit-vec0.8.0
bitflags2.13.2
bitvec1.1.1
blake20.11.0
block-buffer0.10.4
block-buffer0.12.1
block-padding0.3.3
boxed_error0.2.3proc macro
bumpalo3.20.3
bytes1.12.1
calendrical_calculations0.2.4
cbc0.1.2
cc1.9.0
cexpr0.6.0
cfg-if1.0.5
cipher0.4.4
clang-sys1.9.1build script
cmake0.1.58
cmov0.5.4
const-oid0.10.2
const-oid0.9.6
cooked-waker5.0.0
core_maths0.1.1
cpubits0.1.1
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.3build script
crunchy0.2.4build script
crypto-bigint0.5.5
crypto-bigint0.7.5
crypto-common0.1.7
crypto-common0.2.2
ctr0.9.2
ctutils0.4.3
curve25519-dalek4.1.3build script
curve25519-dalek-derive0.1.1proc macro
data-encoding2.11.1
debugid0.8.0
deno_crypto_provider0.53.0
deno_error0.7.1
deno_error_macro0.7.1proc macro
deno_ops0.288.0proc macro
deno_path_util0.6.4
deno_unsync0.4.4
der0.7.10
der0.8.2
digest0.10.7
digest0.11.3
diplomat0.16.1proc macro
diplomat-runtime0.16.1
diplomat_core0.16.1
displaydoc0.2.7proc macro
dunce1.0.5
ecdsa0.16.9
ed4480.5.0
ed448-goldilocks0.14.0-pre.15
either1.19.0
elliptic-curve0.13.8
elliptic-curve0.14.1
equivalent1.0.3
errno0.3.14
ff0.13.1
ff0.14.0
fiat-crypto0.2.9
find-msvc-tools0.1.15
fips2030.4.3
fips2050.4.1
foldhash0.2.0
form_urlencoded1.2.2
fs_extra1.3.0
fslock0.2.1
funty2.0.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-executor0.3.34
futures-io0.3.34
futures-macro0.3.34proc macro
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.4.3build script
ghash0.5.1
glob0.3.4
group0.13.0
group0.14.0
gzip-header1.1.0
hash2curve0.14.0
hashbrown0.17.1
heck0.5.0
hkdf0.12.4
hmac0.12.1
home0.5.12
hybrid-array0.4.15
icu_calendar2.3.0
icu_calendar_data2.3.0build script
icu_collections2.3.0
icu_locale_core2.3.0
icu_locale_fallback2.3.0
icu_locale_fallback_data2.3.0build script
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
if_chain1.0.3
indexmap2.14.2
inout0.1.4
inventory0.3.25
itertools0.13.0
itoa1.0.18
ixdtf0.6.6
jobserver0.1.35
js-sys0.3.106
keccak0.1.6
keccak0.2.2
lazy_static1.5.1
ld-linux-x86-64.so.2system library
libc0.2.191build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.8.9
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
linux-raw-sys0.4.15
litemap0.8.3
lock_api0.4.14
log0.4.34
memchr2.8.3
minimal-lexical0.2.1
miniz_oxide0.8.9
mio1.2.4
nom7.1.3
num-bigint0.4.8
num-bigint-dig0.8.6build script
num-integer0.1.47
num-iter0.1.46
num-traits0.2.19build script
ocb30.1.0
once_cell1.21.4
opaque-debug0.3.1
outref0.5.2
p2560.13.2
p3840.13.1
p5210.13.3
parking_lot0.12.5
parking_lot_core0.9.12build script
password-hash0.6.1
paste1.0.15build scriptproc macro
pem-rfc74680.7.0
percent-encoding2.3.2
phc0.6.1
pin-project1.1.13
pin-project-internal1.1.13proc macro
pin-project-lite0.2.17
pkcs10.7.5
pkcs80.10.2
pkcs80.11.0
pkg-config0.3.34
polyval0.6.2
potential_utf0.1.6
ppv-lite860.2.21
prettyplease0.2.37build script
primeorder0.13.6
proc-macro21.0.107build script
quote1.0.47build script
r-efi6.0.0
radium0.7.0build script
rand0.8.5
rand_chacha0.3.1
rand_core0.10.1
rand_core0.6.4
redox_syscall0.5.18
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
resb0.1.2
rfc69790.4.0
rsa0.9.10
rustc-hash1.1.0
rustc-hash2.1.3
rustc_version0.4.1
rustix0.38.44build script
rustversion1.0.23build script, not runproc macro
scopeguard1.2.0
sec10.7.3
sec10.8.1
semver1.0.28
serde1.0.229build script
serde_bytes0.11.19
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.154build script
serdect0.2.0
serdect0.4.3
sha10.10.7
sha20.10.9
sha30.10.9
shake0.1.0
shlex1.3.0
shlex2.0.1
signal-hook-registry1.4.8
signature2.2.0
signature3.0.0
slab0.4.12
smallvec1.16.3
socket20.6.5
sourcemap9.3.2
spin0.9.9
spki0.7.3
spki0.8.1
sponge-cursor0.1.0
stable_deref_trait1.2.1
static_assertions1.1.0
strck1.0.0
stringcase0.4.0
strum0.27.2
strum_macros0.27.2proc macro
subtle2.6.1
syn2.0.119
syn3.0.9
syn-match0.3.1proc macro
synstructure0.14.0
sys_traits0.1.29
sys_traits_macros0.1.0proc macro
tap1.0.1
temporal_capi0.2.6
temporal_rs0.2.6
thiserror2.0.21build script
thiserror-impl2.0.21proc macro
timezone_provider0.2.6
tiny-keccak2.0.2build script
tinystr0.8.4
tokio1.54.0
tokio-macros2.7.2proc macro
turbo-surf-deno-core0.412.0
turbo-surf-deno-v80.4.0
turbo-surf-serde-v80.321.0
turbo-surf-v8150.4.0build scriptnetworkgithub.com, release-assets.githubusercontent.com
typenum1.20.1
unicode-id-start1.5.0
unicode-ident1.0.27
universal-hash0.5.1
untrusted0.7.1
url2.5.8
utf8_iter1.0.4
uuid1.28.0
v8x149.4.0-rc.4build script
version_check0.9.5
vsimd0.8.0
wasi0.11.1+wasi-snapshot-preview1
wasm-bindgen0.2.129build script, not run
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
wasm_dep_analyzer0.4.0
which6.0.3
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-link0.2.1
windows-sys0.59.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winsafe0.0.19
writeable0.6.4
wyz0.5.1
x25519-dalek2.0.1
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.63build script
zerocopy-derive0.8.63proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zeroize_derive1.5.0proc macro
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zmij1.0.23build script
zoneinfo640.3.0
Versions1RiskVulnsPublished
0.273.0highnone1d ago

Raw data

capture
1.1 MB
records
224,028
bytes per record
5.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-21 · run 8953a2c7-48a7-4ab1-bdee-8e942e875030

analysis 0.1.0 · 2026-10-21 · bee3716 · graph v2