Skip to content
Open-Source Registry

Incidents / cargo/time-sync / 0.2.4

cargo/time-sync 0.2.4

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean RiskcriticalVulnsnone
processes
107
operations
1.8K
packages
5
compiler runs
2
connections
1
capture
47 KB
records
3.9K
bytes / record
12.0

Build behaviourconnected outside the registry

run time-sync-0.2.4 · built 2026-10-15 · complete

Graph

secret-exfil · critical · in time_sync_demo
3

Checks

9 of 14 clear · 3 not checked Network activity Sensitive data access and transfer
Build behavior▲▲✓✓✓✓✓✓
Supply chain○○○✓✓
Pipeline✓

Detections

2
  • Credential store contents reached a network peer
    3.166.192.53:80 › 3.166.192.53:80
    critical
  • Build script reached 3.166.192.53
    time-sync 0.2.4 › 3.166.192.53:80
    medium

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
3.166.192.53:80
Destination
3.166.192.53:80
Jobs
build
Rule
secret-exfil · time-sync-0.2.4

Witness chain

  1. /home/bb/work/time-sync-0.2.4/.env
    source
  2. 3.166.192.53:80via /home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build
    • Sensitive-file read linked to a network connectionfrom /home/bb/work/time-sync-0.2.4/.env

      Credential store contents linked to this connection through build-time code: /home/bb/work/time-sync-0.2.4/.env

    sink
  3. time_sync_demo-bcd94760e7a49833build
    artifact

Evidence

  • Credential store contents linked to this connection through build-time code: /home/bb/work/time-sync-0.2.4/.env

In time_sync_demo

Loading the graph

Processes

build

systemd›sshd:›sshd-session:›…›cargo›build-script-build

Ran
/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build
Invoked by
/usr/lib/systemd/systemd
Lineage · 11 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups997
  3. sshd-session:sshd-session: bb [priv]2074
  4. sshd-session:sshd-session: bb@notty2129
  5. sudosudo2130
  6. shsh2132
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build2163
  8. shsh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build2164
  9. python3python3 scenario.py --variant build2165
  10. cargocargo build --features build-calibration --target-dir /home/bb/work/time-sync-0.2.4/target/build -p time-sync-demo2166
  11. build-script-build/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build2260

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

mediumwitnessed

Build script reached 3.166.192.53

Unexpected network connection

Subject
time-sync 0.2.4
Destination
3.166.192.53:80
Reaches
time_sync_demo-bcd94760e7a49833member
Jobs
build
Rule
egress · time-sync-0.2.4

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to 3.166.192.53:80, opened by build_script_build-bdcdb4cd82b77c46

    subject 3.166.192.53:80

    by /home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build

  2. What a build script's fetch becamesupport

    nothing came down that the build kept

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build_script_build-bdcdb4cd82b77c46

In time_sync_demo

Loading the graph

Processes

build

systemd›sshd:›sshd-session:›…›cargo›build-script-build

Ran
/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build
Invoked by
/usr/lib/systemd/systemd
Lineage · 11 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups997
  3. sshd-session:sshd-session: bb [priv]2074
  4. sshd-session:sshd-session: bb@notty2129
  5. sudosudo2130
  6. shsh2132
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build2163
  8. shsh -c cd '/home/bb/work/time-sync-0.2.4' && HOME='/home/bb/work' python3 scenario.py --variant build2164
  9. python3python3 scenario.py --variant build2165
  10. cargocargo build --features build-calibration --target-dir /home/bb/work/time-sync-0.2.4/target/build -p time-sync-demo2166
  11. build-script-build/home/bb/work/time-sync-0.2.4/target/build/debug/build/time-sync-bdcdb4cd82b77c46/build-script-build2260

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

1 peers
  • 3.166.192.53:80 cargo/time-sync's own build code · build_script_build-bdcdb4cd82b77c46 (time-sync-0.2.4) undeclared
Dependencies7Build behaviour
ld-linux-x86-64.so.2system library
libc.so.6system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
time-sync0.2.4build scriptnetwork3.166.192.53
time-sync-demo0.1.0
Versions1RiskVulnsPublished
0.2.4criticalnone

Raw data

capture
47 KB
records
3,902
bytes per record
12.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build success · Generated 2026-10-15 · run time-sync-0.2.4

analysis 0.1.0+gba4904b311dc.dirty · graph v2