Cargo · crates.io

bv-builder

Rs Build Time Network: HTTP / TCP network call inside build.rs — downloads at compile time.

Why PkgRadar flagged 0.1.40

Severity	Signal	Evidence
high	Rs Build Time Network	HTTP / TCP network call inside build.rs — downloads at compile time. · bv-builder-0.1.40/src/build.rs
high	Rs Build Time Env Token Read	Reads CI/CD secret env vars (AWS / GitHub / GitLab / Cargo / NPM tokens) at build time. · bv-builder-0.1.40/src/build.rs

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.1.40`	High risk	100	2026-06-07
`0.1.39`	High risk	100	2026-06-07
`0.1.38`	High risk	100	2026-05-30
`0.1.37`	High risk	100	2026-05-30

Related campaigns

Block this in CI

PkgRadar gates bv-builder (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem cargo [email protected]