Skip to content
Open-Source Registry

cargo / uzor-fonts

uzor-fonts 1.5.5

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
175
operations
2.0K
packages
5
compiler runs
1
connections
2
job time
6s
capture
47 KB
records
4.0K
bytes / record
11.7

Bundled font assets for uzor (Roboto, JetBrainsMono, NotoEmoji, NotoColorEmoji, etc.)

Build behaviourits build script reached github.com, release-assets.githubusercontent.comits build script ran curlundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.io

4,439 downloads · Apache-2.0 OR MIT · source · home page assetsembeddedfontsrenderingui View on crates.io

Graph

egress · high · in libuzor_fonts.rlib
6

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

5
  • Build script fetched what the build compiled, linked or ran
    uzor-fonts 1.5.5 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Downloaded file compiled into the artifact
    NotoColorEmoji.ttf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansArabic-Regular.ttf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansCJKsc-Regular.otf › github.com, release-assets.githubusercontent.com
    high
  • Downloaded file compiled into the artifact
    NotoSansDevanagari-Regular.ttf › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
uzor-fonts 1.5.5
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…

  3. What a build script's fetch becamesupport

    4 files came down; the build compiled or linked NotoColorEmoji.ttf, NotoSansCJKsc-Regular.otf, NotoSansArabic-Regular.ttf +1 more

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798

  5. Tool commandsupport

    Command: curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…

    by curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…

In libuzor_fonts.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2519
  3. build-script-build/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build-script-build2506
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…2509

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoColorEmoji.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · uzor

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoColorEmoji.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libuzor_fonts.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2519
  3. build-script-build/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build-script-build2506
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…2509

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoSansArabic-Regular.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · uzor

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoSansArabic-Regular.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libuzor_fonts.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2519
  3. build-script-build/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build-script-build2506
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…2515

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoSansCJKsc-Regular.otfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · uzor

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoSansCJKsc-Regular.otfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libuzor_fonts.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2519
  3. build-script-build/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build-script-build2506
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…2512

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Downloaded file compiled into the artifact

Object file origin needs review

Subject
/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoSansDevanagari-Regular.ttfwritten by curl
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · uzor

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46e4/out/NotoSansDevanagari-Regular.ttfvia curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.comby build-script-build

      written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by curl from a network connection without a recorded source compilation

    subject
  3. member
    artifact

Evidence

  • written under the build script at /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build_script_build-360be9c0891b2798, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by curl from a network connection without a recorded source compilation

In libuzor_fonts.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2476
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2519
  3. build-script-build/home/runner/work/uzor/uzor/target/release/build/uzor-fonts-360be9c0891b2798/build-script-build2506
  4. curlcurl -sSL --fail --retry 6 --retry-delay 3 --retry-all-errors --connect-timeout 30 -o /home/runner/work/uzor/uzor/target/release/build/uzor-fonts-fff9de67fd6c46…2518

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

2 peers
  • github.com:443 uzor-fonts's own build code · curl · GitHub, Inc. · 4 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 uzor-fonts's own build code · curl · Fastly, Inc. · 4 files · went into an output undeclared
Dependencies5Build behaviour
ld-linux-x86-64.so.2system library
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
Versions41RiskVulnsPublished
1.5.4not analyzed13d ago
1.5.3not analyzed2026-10-03
1.5.2not analyzed2026-09-23
1.5.1not analyzed2026-08-17
1.5.0not analyzed2026-08-17
1.4.16not analyzed2026-07-07
1.4.15not analyzed2026-06-20
1.4.14not analyzed2026-06-20
1.4.13not analyzed2026-06-13
1.4.12not analyzed2026-06-12
1.4.11not analyzed2026-06-10
1.4.10not analyzed2026-06-09
1.4.9not analyzed2026-06-09
1.4.8not analyzed2026-06-09
1.4.7not analyzed2026-06-09
1.4.6not analyzed2026-06-04
1.4.5not analyzed2026-06-04
1.4.4not analyzed2026-06-03
1.4.3not analyzed2026-06-03
1.4.2not analyzed2026-06-03
1.4.1not analyzed2026-06-03
1.4.0not analyzed2026-06-03
1.3.7not analyzed2026-06-02
1.3.6not analyzed2026-05-31
1.3.5not analyzed2026-05-29
1.3.4not analyzed2026-05-29
1.3.3not analyzed2026-05-28
1.3.2not analyzed2026-05-19
1.3.1not analyzed2026-05-16
1.3.0not analyzed2026-05-16
1.2.2not analyzed2026-05-09
1.2.1not analyzed2026-05-09
1.2.0not analyzed2026-05-04
1.1.8not analyzed2026-04-29
1.1.7not analyzed2026-04-29
1.1.6not analyzed2026-04-27
1.1.5not analyzed2026-04-26
1.1.4not analyzed2026-04-26
1.0.1not analyzed2026-04-07
1.0.0not analyzed2026-04-07
1.5.5highnone

Raw data

capture
47 KB
records
4,036
bytes per record
11.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-16 · run bb8fa719-e3b8-4f36-8c63-430dfec9589b

analysis 0.1.0 · 2026-10-16 · 7160958 · graph v2