Skip to content
Open-Source Registry

cargo / zng-view-prebuilt / 0.25.1

zng-view-prebuilt 0.25.1

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured 2 detections
processes
484
operations
27K
packages
154
compiler runs
129
connections
3
job time
1m 23s
capture
336 KB
records
47K
bytes / record
7.1

Build behaviourits build script reached github.com, release-assets.githubusercontent.comits build script ran curlundeclared fetchlinked a downloaded binaryfetched outside crates.io

run 92a93f67-6d33-4dd1-8338-b01043a7e60e · built 2026-10-13 · complete

Artifact

file · retained · product · graph v2
1

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Build code opened a network connection
    zng-view-prebuilt 0.25.1 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libzng_view.x86_64-unknown-linux-gnu.so › github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build code opened a network connection

Unexpected network connection

Subject
zng-view-prebuilt 0.25.1
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl --location --fail --silent --show-error --create-dirs --output /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl --location --fail --silent --show-error --create-dirs --output /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.…

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-3351e4f5f349e2d5/build_script_build-3351e4f5f349e2d5

  4. Tool commandsupport

    Command: curl --location --fail --silent --show-error --create-dirs --output /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.…

    by curl --location --fail --silent --show-error --create-dirs --output /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.…

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl --location --fail --silent --show-error --create-dirs --output /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2468
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2468
  3. build-script-build/home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-3351e4f5f349e2d5/build-script-build4236
  4. curlcurl --location --fail --silent --show-error --create-dirs --output /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.…4244

Remediation

Review the process and its owning build step. Remove unnecessary requests; move required downloads to a declared dependency-fetch step.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.1/libzng_view.x86_64-unknown-linux-gnu.sowritten by tar
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · zng

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-3351e4f5f349e2d5/build_script_build-3351e4f5f349e2d5, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.1/libzng_view.x86_64-unknown-linux-gnu.so

  2. Written from a pipecause

    Written by tar from a pipe without a recorded source compilation

    subject /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.1/libzng_view.x86_64-unknown-linux-gnu.so

    by tar -xf /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.1/libzng_view.x86_64-unknown-linux-gnu.so.tar.gz -C /home/ru…

Processes

build-test

cargo›cargo›build-script-build›tar

Ran
tar -xf /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.1/libzng_view.x86_64-unknown-linux-gnu.so.tar.gz -C /home/ru…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2468
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2468
  3. build-script-build/home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-3351e4f5f349e2d5/build-script-build4236
  4. tartar -xf /home/runner/work/zng/zng/target/release/build/zng-view-prebuilt-4ef5f593efd45fc3/out/v0.25.1/libzng_view.x86_64-unknown-linux-gnu.so.tar.gz -C /home/ru…4250

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

3 peers
  • github.com:443 zng-view-prebuilt's own build code · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 zng-view-prebuilt's own build code · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (zng) via crates.io · 7,429 files · went into an output ecosystem
Dependencies156Build behaviour
async-channel2.5.0
async-fs2.2.0
async-io2.6.0build script
async-lock3.4.2
async-process2.5.0
async-signal0.2.14
async-task4.7.1
atomic-waker1.1.2
autocfg1.5.1
base16ct1.0.0
bitflags2.13.2
block-buffer0.12.1
blocking1.7.0
bumpalo3.20.3
bytemuck1.25.2
bytemuck_derive1.12.1proc macro
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
cobs0.3.0
concurrent-queue2.5.0
console_error_panic_hook0.1.7
cpufeatures0.3.1
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crypto-common0.2.2
digest0.11.3
directories6.0.0
dirs-sys0.5.0
displaydoc0.2.7proc macro
dunce1.0.5
either1.19.0
embedded-io0.4.0
embedded-io0.6.1
equivalent1.0.2
errno0.3.14
euclid0.22.14
event-listener5.4.2
event-listener-strategy0.5.4
fastrand2.5.0
filetime0.2.29
flume0.12.0
futures-core0.3.34
futures-io0.3.34
futures-lite2.6.1
futures-sink0.3.34
futures-task0.3.34
futures-timer3.0.4
futures-util0.3.34
getrandom0.4.3build script
hashbrown0.17.1
hermit-abi0.5.3
home0.5.12
hybrid-array0.4.15
indexmap2.14.2
js-sys0.3.106
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libgcc_s.so.1system library
libloading0.9.0
libm.so.6system library
libmvec.so.1system library
libredox0.1.25
linkme0.3.37build script
linkme-impl0.3.37build scriptproc macro
linux-raw-sys0.12.1
lock_api0.4.14
log0.4.34
num-traits0.2.19build script
once_cell1.21.4
option-ext0.2.0
parking2.2.1
parking_lot0.12.5
parking_lot_core0.9.12build script
pastey0.2.3proc macro
pin-project-lite0.2.17
piper0.2.5
polling3.11.0
postcard1.1.3
pretty-type-name1.0.1
proc-macro21.0.107build script
quote1.0.47build script
r-efi6.0.0
rand0.10.3
rand_core0.10.1
rayon1.12.0
rayon-core1.13.0build script
redox_syscall0.5.18
redox_users0.5.3
rustc-hash2.1.3
rustix1.1.5build script
rustversion1.0.23build script, not runproc macro
scopeguard1.2.0
self_cell1.3.0
semver1.0.28
serde1.0.229build script
serde_bytes0.11.19
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_spanned1.1.2
serde_variant0.1.3
sha20.11.1
signal-hook-registry1.4.8
slab0.4.12
smallbox0.8.8build script
smallvec1.16.3
spin0.9.9
syn2.0.119
syn3.0.9
tar0.4.46
tempfile3.27.0
thiserror2.0.21build script
thiserror-impl2.0.21proc macro
tinystr0.8.4
toml1.1.8+spec-1.1.0
toml_datetime1.1.2+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
toml_writer1.1.3+spec-1.1.0
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
tracing-shared0.2.0
typenum1.20.1
unic-langid0.9.6
unic-langid-impl0.9.6
unicode-ident1.0.27
wasm-bindgen0.2.129build script, not run
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
web-sys0.3.106
web-time1.1.0
windows-link0.2.1
windows-sys0.61.2
winnow1.0.4
xattr1.6.1
zerofrom0.1.8
zerovec0.11.8
zng-app-context0.15.0
zng-clone-move0.4.0
zng-env0.13.0
zng-env-proc-macros0.7.0proc macro
zng-handle0.4.1
zng-state-map0.11.1
zng-task0.16.0build script
zng-task-proc-macros0.4.1proc macro
zng-time0.12.0
zng-tp-licenses0.11.0
zng-txt0.6.0
zng-unique-id0.12.1
zng-unit0.7.1
zng-var0.16.0
zng-var-proc-macros0.5.1proc macro
zng-view-api0.23.0build script

Raw data

capture
336 KB
records
47,101
bytes per record
7.1

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-13 · run 92a93f67-6d33-4dd1-8338-b01043a7e60e

analysis 0.1.0 · 2026-10-13 · bb263c9 · graph v2