Skip to content
Open-Source Registry

cargo / zpl-rs

zpl-rs 0.1.9

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
607
operations
40K
packages
209
compiler runs
1
connections
4
job time
40s
capture
502 KB
records
69K
bytes / record
7.2

ZPL (Zebra Programming Language) rendering library - parse and render thermal label ZPL to images

Build behaviourits build script reached api.github.com, github.com, release-assets.githubusercontent.comundeclared fetchfetch went into the outputlinked a downloaded binaryfetched outside crates.iocompiled C/C++

711 downloads · MIT · source barcodelabelthermal-printerzebrazpl View on crates.io

Graph

egress · high · in libzpl_rs.rlib
3

Checks

12 of 14 clear Network activity Data flow analysis
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

2
  • Build script fetched what the build compiled, linked or ran
    zpl-rs 0.1.9 › api.github.com:443, github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libzpl.so › api.github.com, github.com, release-assets.githubusercontent.com
    high

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
zpl-rs 0.1.9
Destination
api.github.com:443, github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress · go-zpl

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to api.github.com:443, opened by build_script_build-1f1ed12445b00764

    subject api.github.com:443

    by /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build

  2. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by build_script_build-1f1ed12445b00764

    subject github.com:443

    by /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build

  3. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by build_script_build-1f1ed12445b00764

    subject release-assets.githubusercontent.com:443

    by /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build

  4. What a build script's fetch becamesupport

    2 files came down; the build compiled or linked libzpl.so

  5. Connection opened by a build script or child processsupport

    the opener is the build script at /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build_script_build-1f1ed12445b00764

In libzpl_rs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2459
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2459
  3. build-script-build/home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build4423

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-7d29df2569d60b11/out/lib/libzpl.sowritten by build_script_build-1f1ed12445b00764
Destination
api.github.com, github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · go-zpl

Witness chain

  1. api.github.com:443
    source
  2. /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-7d29df2569d60b11/out/lib/libzpl.sovia /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build
    • Object written under a build script that downloadedfrom api.github.com · github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build_script_build-1f1ed12445b00764, which downloaded from api.github.com, github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-1f1ed12445b00764 from a network connection without a recorded source compilation

    • Asked for by the build's own declaration

      zpl-rs asked the linker for it: dynamic zpl (target/release/build/zpl-rs-7d29df2569d60b11/output)

    subject
  3. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build_script_build-1f1ed12445b00764, which downloaded from api.github.com, github.com, release-assets.githubusercontent.com
  • Written by build_script_build-1f1ed12445b00764 from a network connection without a recorded source compilation
  • zpl-rs asked the linker for it: dynamic zpl (target/release/build/zpl-rs-7d29df2569d60b11/output)

In libzpl_rs.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2459
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2459
  3. build-script-build/home/runner/work/go-zpl/go-zpl/target/release/build/zpl-rs-1f1ed12445b00764/build-script-build4423

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Network

4 peers
  • api.github.com:443 zpl-rs's own build code · build_script_build-1f1ed12445b00764 (go-zpl) · GitHub, Inc. · 2 files · went into an output undeclared
  • github.com:443 zpl-rs's own build code · build_script_build-1f1ed12445b00764 (go-zpl) · GitHub, Inc. · 2 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 zpl-rs's own build code · build_script_build-1f1ed12445b00764 (go-zpl) · Fastly, Inc. · 2 files · went into an output undeclared
  • static.crates.io:8080 the package manager · cargo (go-zpl) via crates.io · 12,451 files · went into an output ecosystem
Dependencies216Build behaviour
adler22.0.1
aes0.8.4
arbitrary1.5.0
atomic-waker1.1.2
base640.22.1
base640.23.1
bitflags2.13.2
block-buffer0.10.4
bumpalo3.20.3
byteorder1.5.0
bytes1.12.1
bzip20.5.2
bzip2-sys0.1.13+1.0.8build script
cc1.8.0
cfg-if1.0.5
cipher0.4.4
constant_time_eq0.3.1
core-foundation0.10.1
core-foundation0.9.4
core-foundation-sys0.8.7
core_detect1.0.0
cpufeatures0.2.17
crc3.4.0
crc-catalog2.5.0
crc32fast1.5.2build script
crossbeam-utils0.8.23build script, not run
crypto-common0.1.7
deflate640.1.12
deranged0.5.9
derive_arbitrary1.5.0proc macro
digest0.10.7
displaydoc0.2.7proc macro
encoding_rs0.8.42build script
equivalent1.0.3
errno0.3.14
fastrand2.5.0
filetime0.2.29
find-msvc-tools0.1.14
flate21.1.10
fnv1.0.7
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
h20.4.20
hashbrown0.17.1
hmac0.12.1
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.12.0
hyper-rustls0.27.10
hyper-tls0.6.0
hyper-util0.1.21
icu_collections2.3.0
icu_locale_core2.3.0
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
idna1.1.0
idna_adapter1.2.2
indexmap2.14.2
inout0.1.4
ipnet2.12.2
itoa1.0.18
jobserver0.1.35
js-sys0.3.106
ld-linux-x86-64.so.2system library
libc0.2.190build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
liblzma.so.5system library
libm.so.6system library
libmvec.so.1system library
libssl.so.3system library
linux-raw-sys0.12.1
litemap0.8.3
log0.4.34
lzma-rs0.3.0
lzma-sys0.1.20build script
memchr2.8.3
mime0.3.17
miniz_oxide0.9.1
mio1.2.4
multiversion_no_op1.0.0proc macro
native-tls0.2.18build script
num-conv0.2.2
once_cell1.21.4
openssl0.10.81build script
openssl-macros0.1.1proc macro
openssl-probe0.2.1
openssl-sys0.9.117build script
pbkdf20.12.2
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
potential_utf0.1.6
powerfmt0.2.1
proc-macro21.0.107build script
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
reqwest0.12.28
ring0.17.14build script, not runprebuilt objects
rustix1.1.5build script
rustls0.23.46build script, not run
rustls-pki-types1.15.1
rustls-webpki0.103.15
rustversion1.0.23build scriptproc macro
ryu1.0.23
schannel0.1.29
scopeguard1.2.0
security-framework3.7.0
security-framework-sys2.17.0
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.154build script, not run
serde_urlencoded0.7.1
sha10.10.7
shlex2.0.1
simd-adler320.3.10
simdutf80.1.5
slab0.4.12
smallvec1.16.3
socket20.6.5
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.9
sync_wrapper1.0.2
synstructure0.14.0
system-configuration0.7.0
system-configuration-sys0.6.0build script, not run
tar0.4.46
tempfile3.27.0
thiserror2.0.21build script
thiserror-impl2.0.21proc macro
time0.3.55
time-core0.1.9
tinystr0.8.4
tokio1.53.3
tokio-native-tls0.3.1
tokio-rustls0.26.6
tokio-util0.7.20
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicode-ident1.0.27
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
vcpkg0.2.15prebuilt objects
version_check0.9.5
want0.3.2
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.129build script, not run
wasm-bindgen-futures0.4.79
wasm-bindgen-macro0.2.129proc macro
wasm-bindgen-macro-support0.2.129
wasm-bindgen-shared0.2.129build script, not run
web-sys0.3.106
windows-link0.2.1
windows-registry0.6.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
xattr1.6.1
xz20.1.7
yoke0.8.3
yoke-derive0.8.4proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zeroize_derive1.5.0proc macro
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zip2.4.2build script
zlib-rs0.6.8
zmij1.0.23build script, not run
zopfli0.8.4
zstd0.13.3
zstd-safe7.3.0build script
zstd-sys2.1.1+zstd.1.5.7build script
Versions7RiskVulnsPublished
0.1.8not analyzed2026-09-02
0.1.7not analyzed2026-07-24
0.1.6not analyzed2026-07-10
0.1.5not analyzed2026-06-17
0.1.4not analyzed2026-02-05
0.1.0not analyzed2026-02-05
0.1.9highnone

Raw data

capture
502 KB
records
69,262
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-15 · run 5444cdfc-abb6-49de-8a5e-9befabaa736c

analysis 0.1.0 · 2026-10-15 · 20a5b2e · graph v2