Skip to content
Open-Source Registry

gem / strutil-core / 1.0.1

strutil-core 1.0.1

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
237
operations
25K
packages
2
compiler runs
0
connections
57
build time
1m 07s
job time
1m 07s
capture
398 KB
records
48K
bytes / record
8.3
run b1a2cee9-225b-45eb-a593-4fbff69ed0e0 · built 2026-11-01 · complete
Reviewed by Bitbison: maliciousInstalling strutil-core 1.0.1 downloads Bun and runs bundled JavaScript that reads 51 credential stores, harvests AWS, Azure, Google Cloud and GitHub secrets, sends them to paleasbest.top, installs a systemd user service and rewrites Cursor's MCP configuration. Same server as the pystr-codec worm.

Graph

credential-sweep · critical
9

Checks

10 of 14 clear Network activity Sensitive data access and transfer +2 more
Build behavior▲▲▲✓✓✓▲✓
Supply chain✓✓✓✓✓
Pipeline✓

Detections

13
  • Code this build ran read 51 credential stores it does not own, then connected to paleasbest.top
    bun › paleasbest.top:443, metadata.google.internal:80, graph.microsoft.com:443, api.github.com:443, gitlab.com:443, sts.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, ghcr.io:443
    critical
  • Credential store contents reached a network peer
    api.github.com:443 › api.github.com:443
    critical
  • Credential store contents reached a network peer
    gitlab.com:443 › gitlab.com:443
    critical
  • Credential store contents reached a network peer
    metadata.google.internal:80 › metadata.google.internal:80
    critical
  • Credential store contents reached a network peer
    ssm.us-east-1.amazonaws.com:443 › ssm.us-east-1.amazonaws.com:443
    critical
  • Credential store contents reached a network peer
    ssm.us-east-2.amazonaws.com:443 › ssm.us-east-2.amazonaws.com:443
    critical
  • Credential store contents reached a network peer
    ssm.us-west-1.amazonaws.com:443 › ssm.us-west-1.amazonaws.com:443
    critical
  • Credential store contents reached a network peer
    sts.us-east-1.amazonaws.com:443 › sts.us-east-1.amazonaws.com:443
    critical
  • Credential store read by build-time code
    strutil-core ?
    high
  • Build script fetched what the build compiled, linked or ran
    strutil-core ? › github.com:443, release-assets.githubusercontent.com:443, api.github.com:443, paleasbest.top:443, gitlab.com:443, metadata.google.internal:80, sts.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, graph.microsoft.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, ghcr.io:443
    high
  • Build wrote to a sensitive file
    systemd
    medium
  • Build wrote to a sensitive file
    user
    medium
  • Build wrote to a sensitive file
    pkg-runtime.service
    medium

Detection

criticalwitnessed

Code this build ran read 51 credential stores it does not own, then connected to paleasbest.top

Many credential stores read by code that does not own them

Subject
bun
Destination
paleasbest.top:443, metadata.google.internal:80, graph.microsoft.com:443, api.github.com:443, gitlab.com:443, sts.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, ghcr.io:443
Jobs
install-require
Rule
credential-sweep · strutil-core

Evidence

  1. Credential store read by code that does not own itcause

    Read /home/runner/.aws/credentials (cloud)

    source /home/runner/.aws/credentials

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  2. Credential store read by code that does not own itcause

    Read /home/runner/.ansible/vault-password (services)

    source /home/runner/.ansible/vault-password

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  3. Credential store read by code that does not own itcause

    Read /home/runner/.aws/config (cloud)

    source /home/runner/.aws/config

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  4. Credential store read by code that does not own itcause

    Read /home/runner/.azure/accessTokens.json (cloud)

    source /home/runner/.azure/accessTokens.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  5. Credential store read by code that does not own itcause

    Read /home/runner/.claude.json (agents)

    source /home/runner/.claude.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  6. Credential store read by code that does not own itcause

    Read /home/runner/.claude/.credentials.json (agents)

    source /home/runner/.claude/.credentials.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  7. Credential store read by code that does not own itcause

    Read /home/runner/.config/gcloud/application_default_credentials.json (cloud)

    source /home/runner/.config/gcloud/application_default_credentials.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  8. Credential store read by code that does not own itcause

    Read /home/runner/.config/gh/hosts.yml (forges)

    source /home/runner/.config/gh/hosts.yml

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  9. Credential store read by code that does not own itcause

    Read /home/runner/.config/glab-cli/config.yml (forges)

    source /home/runner/.config/glab-cli/config.yml

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  10. Credential store read by code that does not own itcause

    Read /home/runner/.docker/config.json (containers)

    source /home/runner/.docker/config.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  11. Credential store read by code that does not own itcause

    Read /home/runner/.ethereum/keystore/password.txt (wallets)

    source /home/runner/.ethereum/keystore/password.txt

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  12. Credential store read by code that does not own itcause

    Read /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5 (wallets)

    source /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  13. Credential store read by code that does not own itcause

    Read /home/runner/.kube/config (containers)

    source /home/runner/.kube/config

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  14. Credential store read by code that does not own itcause

    Read /home/runner/.npmrc (registries)

    source /home/runner/.npmrc

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  15. Credential store read by code that does not own itcause

    Read /home/runner/.pypirc (registries)

    source /home/runner/.pypirc

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  16. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/config (forges)

    source /home/runner/.ssh/config

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  17. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa.pub (scp)

    source /home/runner/.ssh/id_rsa.pub

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  18. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519 (forges)

    source /home/runner/.ssh/id_ed25519

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  19. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa (forges)

    source /home/runner/.ssh/id_rsa

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  20. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519.pub (scp)

    source /home/runner/.ssh/id_ed25519.pub

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  21. Credential store read by code that does not own itcause

    Read /home/runner/.git-credentials (forges)

    source /home/runner/.git-credentials

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  22. Credential store read by code that does not own itcause

    Read /home/runner/.config/gcloud/example-deploy.json (cloud)

    source /home/runner/.config/gcloud/example-deploy.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  23. Credential store read by code that does not own itcause

    Read /home/runner/.codex/auth.json (agents)

    source /home/runner/.codex/auth.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  24. Credential store read by code that does not own itcause

    Read /home/runner/.gem/credentials (registries)

    source /home/runner/.gem/credentials

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  25. Credential store read by code that does not own itcause

    Read /home/runner/.vault-token (cloud)

    source /home/runner/.vault-token

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  26. Credential store read by code that does not own itcause

    Read /home/runner/.my.cnf (databases)

    source /home/runner/.my.cnf

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  27. Credential store read by code that does not own itcause

    Read /home/runner/.terraformrc (services)

    source /home/runner/.terraformrc

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  28. Credential store read by code that does not own itcause

    Read /home/runner/.databrickscfg (services)

    source /home/runner/.databrickscfg

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  29. Credential store read by code that does not own itcause

    Read /home/runner/.pgpass (databases)

    source /home/runner/.pgpass

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  30. Credential store read by code that does not own itcause

    Read /home/runner/.yarnrc.yml (registries)

    source /home/runner/.yarnrc.yml

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  31. Credential store read by code that does not own itcause

    Read /home/runner/.ethereum/seed.txt (wallets)

    source /home/runner/.ethereum/seed.txt

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  32. Credential store read by code that does not own itcause

    Read /home/runner/.fly/config.yml (services)

    source /home/runner/.fly/config.yml

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  33. Credential store read by code that does not own itcause

    Read /home/runner/.composer/auth.json (registries)

    source /home/runner/.composer/auth.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  34. Credential store read by code that does not own itcause

    Read /home/runner/.nuget/NuGet/NuGet.Config (registries)

    source /home/runner/.nuget/NuGet/NuGet.Config

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  35. Credential store read by code that does not own itcause

    Read /home/runner/.cache/huggingface/token (services)

    source /home/runner/.cache/huggingface/token

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  36. Credential store read by code that does not own itcause

    Read the project's own credentials (project)

    source /home/runner/work/.env

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  37. Credential store read by code that does not own itcause

    Read /home/runner/.pip/pip.conf (registries)

    source /home/runner/.pip/pip.conf

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  38. Credential store read by code that does not own itcause

    Read /home/runner/.local/share/com.vercel.cli/auth.json (services)

    source /home/runner/.local/share/com.vercel.cli/auth.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  39. Credential store read by code that does not own itcause

    Read /home/runner/.bitcoin/bitcoin.conf (wallets)

    source /home/runner/.bitcoin/bitcoin.conf

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  40. Credential store read by code that does not own itcause

    Read /home/runner/.kaggle/kaggle.json (services)

    source /home/runner/.kaggle/kaggle.json

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  41. Connected after reading a credential storecause

    bun connected to paleasbest.top:443 after the reads

    target paleasbest.top:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  42. Connected after reading a credential storecause

    bun connected to metadata.google.internal:80 after the reads

    target metadata.google.internal:80

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  43. Connected after reading a credential storecause

    bun connected to graph.microsoft.com:443 after the reads

    target graph.microsoft.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  44. Connected after reading a credential storecause

    bun connected to api.github.com:443 after the reads

    target api.github.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  45. Connected after reading a credential storecause

    bun connected to gitlab.com:443 after the reads

    target gitlab.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  46. Connected after reading a credential storecause

    bun connected to sts.us-east-1.amazonaws.com:443 after the reads

    target sts.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  47. Connected after reading a credential storecause

    bun connected to ssm.us-east-2.amazonaws.com:443 after the reads

    target ssm.us-east-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  48. Connected after reading a credential storecause

    bun connected to ssm.us-east-1.amazonaws.com:443 after the reads

    target ssm.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  49. Connected after reading a credential storecause

    bun connected to ssm.us-west-1.amazonaws.com:443 after the reads

    target ssm.us-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  50. Connected after reading a credential storecause

    bun connected to ssm.us-west-2.amazonaws.com:443 after the reads

    target ssm.us-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  51. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-1.amazonaws.com:443 after the reads

    target ssm.ap-northeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  52. Connected after reading a credential storecause

    bun connected to ssm.ca-central-1.amazonaws.com:443 after the reads

    target ssm.ca-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  53. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-2.amazonaws.com:443 after the reads

    target ssm.ap-northeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  54. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-3.amazonaws.com:443 after the reads

    target ssm.ap-northeast-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  55. Connected after reading a credential storecause

    bun connected to ssm.eu-central-1.amazonaws.com:443 after the reads

    target ssm.eu-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  56. Connected after reading a credential storecause

    bun connected to ssm.ap-southeast-1.amazonaws.com:443 after the reads

    target ssm.ap-southeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  57. Connected after reading a credential storecause

    bun connected to ssm.ap-southeast-2.amazonaws.com:443 after the reads

    target ssm.ap-southeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  58. Connected after reading a credential storecause

    bun connected to ssm.eu-north-1.amazonaws.com:443 after the reads

    target ssm.eu-north-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  59. Connected after reading a credential storecause

    bun connected to ssm.ap-south-1.amazonaws.com:443 after the reads

    target ssm.ap-south-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  60. Connected after reading a credential storecause

    bun connected to ssm.eu-west-2.amazonaws.com:443 after the reads

    target ssm.eu-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  61. Connected after reading a credential storecause

    bun connected to ssm.sa-east-1.amazonaws.com:443 after the reads

    target ssm.sa-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  62. Connected after reading a credential storecause

    bun connected to secretsmanager.us-east-1.amazonaws.com:443 after the reads

    target secretsmanager.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  63. Connected after reading a credential storecause

    bun connected to secretsmanager.us-east-2.amazonaws.com:443 after the reads

    target secretsmanager.us-east-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  64. Connected after reading a credential storecause

    bun connected to secretsmanager.us-west-1.amazonaws.com:443 after the reads

    target secretsmanager.us-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  65. Connected after reading a credential storecause

    bun connected to secretsmanager.us-west-2.amazonaws.com:443 after the reads

    target secretsmanager.us-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  66. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-1.amazonaws.com:443 after the reads

    target secretsmanager.ap-northeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  67. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-3.amazonaws.com:443 after the reads

    target secretsmanager.ap-northeast-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  68. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-2.amazonaws.com:443 after the reads

    target secretsmanager.ap-northeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  69. Connected after reading a credential storecause

    bun connected to secretsmanager.ca-central-1.amazonaws.com:443 after the reads

    target secretsmanager.ca-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  70. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-southeast-1.amazonaws.com:443 after the reads

    target secretsmanager.ap-southeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  71. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-south-1.amazonaws.com:443 after the reads

    target secretsmanager.ap-south-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  72. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-southeast-2.amazonaws.com:443 after the reads

    target secretsmanager.ap-southeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  73. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-central-1.amazonaws.com:443 after the reads

    target secretsmanager.eu-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  74. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-north-1.amazonaws.com:443 after the reads

    target secretsmanager.eu-north-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  75. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-1.amazonaws.com:443 after the reads

    target secretsmanager.eu-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  76. Connected after reading a credential storecause

    bun connected to ssm.eu-west-3.amazonaws.com:443 after the reads

    target ssm.eu-west-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  77. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-2.amazonaws.com:443 after the reads

    target secretsmanager.eu-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  78. Connected after reading a credential storecause

    bun connected to ssm.eu-west-1.amazonaws.com:443 after the reads

    target ssm.eu-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  79. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-3.amazonaws.com:443 after the reads

    target secretsmanager.eu-west-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  80. Connected after reading a credential storecause

    bun connected to secretsmanager.sa-east-1.amazonaws.com:443 after the reads

    target secretsmanager.sa-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  81. Connected after reading a credential storecause

    bun connected to api.ecr.us-east-2.amazonaws.com:443 after the reads

    target api.ecr.us-east-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  82. Connected after reading a credential storecause

    bun connected to api.ecr.us-east-1.amazonaws.com:443 after the reads

    target api.ecr.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  83. Connected after reading a credential storecause

    bun connected to api.ecr.us-west-1.amazonaws.com:443 after the reads

    target api.ecr.us-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  84. Connected after reading a credential storecause

    bun connected to management.azure.com:443 after the reads

    target management.azure.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  85. Connected after reading a credential storecause

    bun connected to api.ecr.us-west-2.amazonaws.com:443 after the reads

    target api.ecr.us-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  86. Connected after reading a credential storecause

    bun connected to cloudresourcemanager.googleapis.com:443 after the reads

    target cloudresourcemanager.googleapis.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  87. Connected after reading a credential storecause

    bun connected to api.ecr.ap-northeast-1.amazonaws.com:443 after the reads

    target api.ecr.ap-northeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  88. Connected after reading a credential storecause

    bun connected to api.ecr.ap-southeast-1.amazonaws.com:443 after the reads

    target api.ecr.ap-southeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  89. Connected after reading a credential storecause

    bun connected to api.ecr.ca-central-1.amazonaws.com:443 after the reads

    target api.ecr.ca-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  90. Connected after reading a credential storecause

    bun connected to api.ecr.eu-central-1.amazonaws.com:443 after the reads

    target api.ecr.eu-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  91. Connected after reading a credential storecause

    bun connected to api.ecr.ap-south-1.amazonaws.com:443 after the reads

    target api.ecr.ap-south-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  92. Connected after reading a credential storecause

    bun connected to api.ecr.eu-west-2.amazonaws.com:443 after the reads

    target api.ecr.eu-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  93. Connected after reading a credential storecause

    bun connected to api.ecr.eu-west-1.amazonaws.com:443 after the reads

    target api.ecr.eu-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  94. Connected after reading a credential storecause

    bun connected to ghcr.io:443 after the reads

    target ghcr.io:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  95. More findings of this kind are not listedcontext

  96. Why it matterscontext

    A program reads its own credentials. This build read many credential stores it does not own, of several kinds, which is how a credential stealer collects what it sends out.

What came before it

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Find the code that read these stores and why: a package's install, build or import step has no reason to read credentials it does not own. Treat every credential these stores hold as exposed, and rotate them unless the reads are explained.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
api.github.com:443
Destination
api.github.com:443
Jobs
install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require
Rule
secret-exfil · strutil-core

Witness chain

  1. /home/runner/.ansible/vault-password
    source
  2. api.github.com:443via /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
    • Sensitive-file read linked to a network connectionfrom /home/runner/.ansible/vault-password

      Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

    sink

Evidence

  1. More findings of this kind are not listedsupport

    653 more findings like this one are not listed

What came before it · install-require

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
gitlab.com:443
Destination
gitlab.com:443
Jobs
install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require
Rule
secret-exfil · strutil-core

Witness chain

  1. /home/runner/.ansible/vault-password
    source
  2. gitlab.com:443via /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
    • Sensitive-file read linked to a network connectionfrom /home/runner/.ansible/vault-password

      Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

What came before it · install-require

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
metadata.google.internal:80
Destination
metadata.google.internal:80
Jobs
install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require
Rule
secret-exfil · strutil-core

Witness chain

  1. /home/runner/.ansible/vault-password
    source
  2. metadata.google.internal:80via /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
    • Sensitive-file read linked to a network connectionfrom /home/runner/.ansible/vault-password

      Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

What came before it · install-require

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
ssm.us-east-1.amazonaws.com:443
Destination
ssm.us-east-1.amazonaws.com:443
Jobs
install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require
Rule
secret-exfil · strutil-core

Witness chain

  1. /home/runner/.ansible/vault-password
    source
  2. ssm.us-east-1.amazonaws.com:443via /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
    • Sensitive-file read linked to a network connectionfrom /home/runner/.ansible/vault-password

      Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

What came before it · install-require

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
ssm.us-east-2.amazonaws.com:443
Destination
ssm.us-east-2.amazonaws.com:443
Jobs
install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require
Rule
secret-exfil · strutil-core

Witness chain

  1. /home/runner/.ansible/vault-password
    source
  2. ssm.us-east-2.amazonaws.com:443via /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
    • Sensitive-file read linked to a network connectionfrom /home/runner/.ansible/vault-password

      Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

What came before it · install-require

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
ssm.us-west-1.amazonaws.com:443
Destination
ssm.us-west-1.amazonaws.com:443
Jobs
install-require
Rule
secret-exfil · strutil-core

Witness chain

  1. /home/runner/.ansible/vault-password
    source
  2. ssm.us-west-1.amazonaws.com:443via /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
    • Sensitive-file read linked to a network connectionfrom /home/runner/.ansible/vault-password

      Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.ansible/vault-password

What came before it

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
sts.us-east-1.amazonaws.com:443
Destination
sts.us-east-1.amazonaws.com:443
Jobs
install-require
Rule
secret-exfil · strutil-core

Witness chain

  1. /home/runner/.ssh/config
    source
  2. sts.us-east-1.amazonaws.com:443via /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
    • Sensitive-file read linked to a network connectionfrom /home/runner/.ssh/config

      Credential store contents linked to this connection through build-time code: /home/runner/.ssh/config

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.ssh/config

What came before it

Loading the graph

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Credential store read by build-time code

Subject
strutil-core ?
Jobs
install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require, install-require
Rule
credential-read · strutil-core

Evidence

  1. Credential store read by build-time codecause

    Credential store read by build-time code that does not own it: /home/runner/.aws/credentials

    source /home/runner/.aws/credentials

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

Processes

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

install-require

env›ruby›ruby3.3›bun

Ran
/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 4 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549

Remediation

Build-time code has no business reading a credential store it does not own. Review the build script or compiler plugin that read it, and rotate the credential if the read is not explained.

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
strutil-core ?
Destination
github.com:443, release-assets.githubusercontent.com:443, api.github.com:443, paleasbest.top:443, gitlab.com:443, metadata.google.internal:80, sts.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, graph.microsoft.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, ghcr.io:443
Jobs
install-require
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -sSL https://github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-linux-x64-baseline.zip -o /tmp/.b_2540/b.zip

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -sSL https://github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-linux-x64-baseline.zip -o /tmp/.b_2540/b.zip

  3. Connection outside the process’s allowed destinationscause

    connection to api.github.com:443, opened by bun

    subject api.github.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  4. Connection outside the process’s allowed destinationscause

    connection to paleasbest.top:443, opened by bun

    subject paleasbest.top:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  5. Connection outside the process’s allowed destinationscause

    connection to gitlab.com:443, opened by bun

    subject gitlab.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  6. Connection outside the process’s allowed destinationscause

    connection to metadata.google.internal:80, opened by bun

    subject metadata.google.internal:80

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  7. Connection outside the process’s allowed destinationscause

    connection to sts.us-east-1.amazonaws.com:443, opened by bun

    subject sts.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  8. Connection outside the process’s allowed destinationscause

    connection to ssm.us-east-2.amazonaws.com:443, opened by bun

    subject ssm.us-east-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  9. Connection outside the process’s allowed destinationscause

    connection to ssm.us-east-1.amazonaws.com:443, opened by bun

    subject ssm.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  10. Connection outside the process’s allowed destinationscause

    connection to ssm.us-west-1.amazonaws.com:443, opened by bun

    subject ssm.us-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  11. Connection outside the process’s allowed destinationscause

    connection to ssm.us-west-2.amazonaws.com:443, opened by bun

    subject ssm.us-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  12. Connection outside the process’s allowed destinationscause

    connection to ssm.ap-northeast-1.amazonaws.com:443, opened by bun

    subject ssm.ap-northeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  13. Connection outside the process’s allowed destinationscause

    connection to ssm.ca-central-1.amazonaws.com:443, opened by bun

    subject ssm.ca-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  14. Connection outside the process’s allowed destinationscause

    connection to ssm.ap-northeast-2.amazonaws.com:443, opened by bun

    subject ssm.ap-northeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  15. Connection outside the process’s allowed destinationscause

    connection to ssm.ap-northeast-3.amazonaws.com:443, opened by bun

    subject ssm.ap-northeast-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  16. Connection outside the process’s allowed destinationscause

    connection to ssm.eu-central-1.amazonaws.com:443, opened by bun

    subject ssm.eu-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  17. Connection outside the process’s allowed destinationscause

    connection to ssm.ap-southeast-1.amazonaws.com:443, opened by bun

    subject ssm.ap-southeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  18. Connection outside the process’s allowed destinationscause

    connection to ssm.ap-southeast-2.amazonaws.com:443, opened by bun

    subject ssm.ap-southeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  19. Connection outside the process’s allowed destinationscause

    connection to ssm.eu-north-1.amazonaws.com:443, opened by bun

    subject ssm.eu-north-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  20. Connection outside the process’s allowed destinationscause

    connection to ssm.ap-south-1.amazonaws.com:443, opened by bun

    subject ssm.ap-south-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  21. Connection outside the process’s allowed destinationscause

    connection to ssm.eu-west-2.amazonaws.com:443, opened by bun

    subject ssm.eu-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  22. Connection outside the process’s allowed destinationscause

    connection to ssm.sa-east-1.amazonaws.com:443, opened by bun

    subject ssm.sa-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  23. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.us-east-1.amazonaws.com:443, opened by bun

    subject secretsmanager.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  24. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.us-east-2.amazonaws.com:443, opened by bun

    subject secretsmanager.us-east-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  25. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.us-west-1.amazonaws.com:443, opened by bun

    subject secretsmanager.us-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  26. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.us-west-2.amazonaws.com:443, opened by bun

    subject secretsmanager.us-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  27. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.ap-northeast-1.amazonaws.com:443, opened by bun

    subject secretsmanager.ap-northeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  28. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.ap-northeast-3.amazonaws.com:443, opened by bun

    subject secretsmanager.ap-northeast-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  29. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.ap-northeast-2.amazonaws.com:443, opened by bun

    subject secretsmanager.ap-northeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  30. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.ca-central-1.amazonaws.com:443, opened by bun

    subject secretsmanager.ca-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  31. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.ap-southeast-1.amazonaws.com:443, opened by bun

    subject secretsmanager.ap-southeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  32. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.ap-south-1.amazonaws.com:443, opened by bun

    subject secretsmanager.ap-south-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  33. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.ap-southeast-2.amazonaws.com:443, opened by bun

    subject secretsmanager.ap-southeast-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  34. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.eu-central-1.amazonaws.com:443, opened by bun

    subject secretsmanager.eu-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  35. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.eu-north-1.amazonaws.com:443, opened by bun

    subject secretsmanager.eu-north-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  36. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.eu-west-1.amazonaws.com:443, opened by bun

    subject secretsmanager.eu-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  37. Connection outside the process’s allowed destinationscause

    connection to ssm.eu-west-3.amazonaws.com:443, opened by bun

    subject ssm.eu-west-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  38. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.eu-west-2.amazonaws.com:443, opened by bun

    subject secretsmanager.eu-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  39. Connection outside the process’s allowed destinationscause

    connection to ssm.eu-west-1.amazonaws.com:443, opened by bun

    subject ssm.eu-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  40. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.eu-west-3.amazonaws.com:443, opened by bun

    subject secretsmanager.eu-west-3.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  41. Connection outside the process’s allowed destinationscause

    connection to secretsmanager.sa-east-1.amazonaws.com:443, opened by bun

    subject secretsmanager.sa-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  42. Connection outside the process’s allowed destinationscause

    connection to graph.microsoft.com:443, opened by bun

    subject graph.microsoft.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  43. Connection outside the process’s allowed destinationscause

    connection to api.ecr.us-east-2.amazonaws.com:443, opened by bun

    subject api.ecr.us-east-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  44. Connection outside the process’s allowed destinationscause

    connection to api.ecr.us-east-1.amazonaws.com:443, opened by bun

    subject api.ecr.us-east-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  45. Connection outside the process’s allowed destinationscause

    connection to api.ecr.us-west-1.amazonaws.com:443, opened by bun

    subject api.ecr.us-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  46. Connection outside the process’s allowed destinationscause

    connection to management.azure.com:443, opened by bun

    subject management.azure.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  47. Connection outside the process’s allowed destinationscause

    connection to api.ecr.us-west-2.amazonaws.com:443, opened by bun

    subject api.ecr.us-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  48. Connection outside the process’s allowed destinationscause

    connection to cloudresourcemanager.googleapis.com:443, opened by bun

    subject cloudresourcemanager.googleapis.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  49. Connection outside the process’s allowed destinationscause

    connection to api.ecr.ap-northeast-1.amazonaws.com:443, opened by bun

    subject api.ecr.ap-northeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  50. Connection outside the process’s allowed destinationscause

    connection to api.ecr.ap-southeast-1.amazonaws.com:443, opened by bun

    subject api.ecr.ap-southeast-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  51. Connection outside the process’s allowed destinationscause

    connection to api.ecr.ca-central-1.amazonaws.com:443, opened by bun

    subject api.ecr.ca-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  52. Connection outside the process’s allowed destinationscause

    connection to api.ecr.eu-central-1.amazonaws.com:443, opened by bun

    subject api.ecr.eu-central-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  53. Connection outside the process’s allowed destinationscause

    connection to api.ecr.ap-south-1.amazonaws.com:443, opened by bun

    subject api.ecr.ap-south-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  54. Connection outside the process’s allowed destinationscause

    connection to api.ecr.eu-west-2.amazonaws.com:443, opened by bun

    subject api.ecr.eu-west-2.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  55. Connection outside the process’s allowed destinationscause

    connection to api.ecr.eu-west-1.amazonaws.com:443, opened by bun

    subject api.ecr.eu-west-1.amazonaws.com:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  56. Connection outside the process’s allowed destinationscause

    connection to ghcr.io:443, opened by bun

    subject ghcr.io:443

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

  57. What a build script's fetch becamesupport

    9 files came down, reaching 94 more; the build ran bun

  58. Connection opened by a build script or child processsupport

    the opener descends from the build script at /usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb

  59. Tool commandsupport

    Command: curl -sSL https://github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-linux-x64-baseline.zip -o /tmp/.b_2540/b.zip

    by curl -sSL https://github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-linux-x64-baseline.zip -o /tmp/.b_2540/b.zip

  60. Tool commandsupport

    Command: /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

    by /tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js

Processes

install-require

env›ruby›ruby3.3›sh›curl

Ran
curl -sSL https://github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-linux-x64-baseline.zip -o /tmp/.b_2540/b.zip
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 5 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. shsh -c curl -sSL https://github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-linux-x64-baseline.zip -o /tmp/.b_2540/b.zip 2>/dev/null2543
  5. curlcurl -sSL https://github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-linux-x64-baseline.zip -o /tmp/.b_2540/b.zip2546

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

mediuminferred

Build wrote to a sensitive file

Write outside allowed build locations

Subject
/home/runner/.config/systemdwritten by mkdir
Jobs
install-require
Rule
base-writes · strutil-core

Evidence

  1. Write outside allowed locationscause

    created by mkdir

    subject /home/runner/.config/systemd

    by mkdir -p /home/runner/.config/systemd/user

Processes

install-require

env›ruby›ruby3.3›bun›bash›mkdir

Ran
mkdir -p /home/runner/.config/systemd/user
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 6 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549
  5. bashbash -s -- /tmp/.pkg-cache-WW9ZyR/sync.py2577
  6. mkdirmkdir -p /home/runner/.config/systemd/user2583

Remediation

Review the writer and destination. Confirm the file belongs to an expected setup or build step; remove or restore it if the change is unexpected.

Detection

mediuminferred

Build wrote to a sensitive file

Write outside allowed build locations

Subject
/home/runner/.config/systemd/userwritten by mkdir
Jobs
install-require
Rule
base-writes · strutil-core

Evidence

  1. Write outside allowed locationscause

    created by mkdir

    subject /home/runner/.config/systemd/user

    by mkdir -p /home/runner/.config/systemd/user

Processes

install-require

env›ruby›ruby3.3›bun›bash›mkdir

Ran
mkdir -p /home/runner/.config/systemd/user
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 6 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549
  5. bashbash -s -- /tmp/.pkg-cache-WW9ZyR/sync.py2577
  6. mkdirmkdir -p /home/runner/.config/systemd/user2583

Remediation

Review the writer and destination. Confirm the file belongs to an expected setup or build step; remove or restore it if the change is unexpected.

Detection

mediuminferred

Build wrote to a sensitive file

Write outside allowed build locations

Subject
/home/runner/.config/systemd/user/pkg-runtime.servicewritten by bash
Jobs
install-require
Rule
base-writes · strutil-core

Evidence

  1. Write outside allowed locationscause

    created by bash

    subject /home/runner/.config/systemd/user/pkg-runtime.service

    by bash -s -- /tmp/.pkg-cache-WW9ZyR/sync.py

Processes

install-require

env›ruby›ruby3.3›bun›bash›cat

Ran
cat
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem
Lineage · 6 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/strutil-core-1.0.1.gem2530
  3. ruby3.3/usr/bin/ruby3.3 -I/usr/lib/ruby/vendor_ruby extconf.rb2540
  4. bun/tmp/.b_2540/bun run /home/runner/.gem/ruby/3.3.0/gems/strutil-core-1.0.1/ext/strutil-core/index.js2549
  5. bashbash -s -- /tmp/.pkg-cache-WW9ZyR/sync.py2577
  6. catcat2585

Remediation

Review the writer and destination. Confirm the file belongs to an expected setup or build step; remove or restore it if the change is unexpected.

Network

57 peers
  • api.ecr.ap-northeast-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.ap-south-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.ap-southeast-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.ca-central-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.eu-central-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.eu-west-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.eu-west-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.us-east-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.us-east-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.us-west-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.ecr.us-west-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • api.github.com:443 strutil-core's own build code · bun (strutil-core) · GitHub, Inc. · 8 files undeclared
  • cloudresourcemanager.googleapis.com:443 strutil-core's own build code · bun (strutil-core) · Google LLC · 8 files undeclared
  • ghcr.io:443 strutil-core's own build code · bun (strutil-core) · GitHub, Inc. · 2 files undeclared
  • github.com:443 strutil-core's own build code · curl · GitHub, Inc. · 1 file undeclared
  • gitlab.com:443 strutil-core's own build code · bun (strutil-core) · Cloudflare, Inc. · 8 files undeclared
  • graph.microsoft.com:443 strutil-core's own build code · bun (strutil-core) · Microsoft Corporation · 8 files undeclared
  • management.azure.com:443 strutil-core's own build code · bun (strutil-core) · Microsoft Corporation · 8 files undeclared
  • metadata.google.internal:80 strutil-core's own build code · bun (strutil-core) · 8 files undeclared
  • paleasbest.top:443 strutil-core's own build code · bun (strutil-core) · Cloudflare, Inc. · 8 files undeclared
  • release-assets.githubusercontent.com:443 strutil-core's own build code · curl · Fastly, Inc. · 1 file undeclared
  • secretsmanager.ap-northeast-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.ap-northeast-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.ap-northeast-3.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.ap-south-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.ap-southeast-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.ap-southeast-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.ca-central-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.eu-central-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.eu-north-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.eu-west-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.eu-west-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.eu-west-3.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.sa-east-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.us-east-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.us-east-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.us-west-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • secretsmanager.us-west-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.ap-northeast-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.ap-northeast-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.ap-northeast-3.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.ap-south-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.ap-southeast-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.ap-southeast-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.ca-central-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.eu-central-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.eu-north-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.eu-west-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.eu-west-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.eu-west-3.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.sa-east-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.us-east-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.us-east-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.us-west-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • ssm.us-west-2.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • sts.us-east-1.amazonaws.com:443 strutil-core's own build code · bun (strutil-core) · Amazon.com, Inc. · 8 files undeclared
  • index.rubygems.org:443 the package manager · bundle via rubygems.org · Fastly, Inc. · 65 files ecosystem
Dependencies2Build behaviour
detonate-probe0.0.1
rack3.2.8
Versions2RiskVulnsPublished
1.0.1criticalnone16h ago
1.0.0nonenone18h ago

Raw data

capture
398 KB
records
47,967
bytes per record
8.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: install-require success · Generated 2026-11-01 · run b1a2cee9-225b-45eb-a593-4fbff69ed0e0

analysis 0.1.0 · 2026-11-01 · af5af45 · graph v2

strutil-core 1.0.1 steals credentials at install, harvests cloud secrets, and installs persistence

maliciousCovers 1.0.0 and 1.0.1Reviewed by BitbisonUpdated 2026-11-01

Installing strutil-core 1.0.1 downloads Bun and runs bundled JavaScript that reads 51 credential stores, harvests AWS, Azure, Google Cloud and GitHub secrets, sends them to paleasbest.top, installs a systemd user service and rewrites Cursor's MCP configuration. Same server as the pystr-codec worm.

What it does

strutil-core 1.0.1 presents itself as "Core string utilities for Ruby". Installing it runs its native-extension step, which downloads the Bun JavaScript runtime from Bun's GitHub releases into a hidden temporary directory (/tmp/.b_<pid>/) and runs ext/strutil-core/index.js from the installed gem. In a run of gem install strutil-core -v 1.0.1, that code:

  • Read 51 credential stores belonging to other tools: cloud (AWS, Azure, Google Cloud, Vault), source forges (GitHub CLI, GitLab CLI, git credentials, SSH keys), package registries (npm, PyPI, RubyGems, NuGet, Composer, Yarn), containers (Docker, Kubernetes), AI coding agents (Claude Code, Codex), databases, cryptocurrency wallets, and services such as Terraform, Databricks, Hugging Face, Vercel and Kaggle.
  • Harvested cloud secrets with whatever it found: it called AWS STS, then Secrets Manager and Systems Manager Parameter Store in 18 regions and ECR in 11; Azure Resource Manager and Microsoft Graph; Google Cloud's metadata service and Resource Manager; and the GitHub, GitLab and GitHub Container Registry APIs.
  • Sent what it collected to paleasbest.top, the same server as the pystr-codec worm on PyPI (MAL-2026-18432), and called the GitHub API, the channel that family uses to publish stolen credentials to a public repository.
  • Installed persistence: a systemd user service, ~/.config/systemd/user/pkg-runtime.service, a script at ~/.local/share/runtimes/sync.py, and a copy of its JavaScript at ~/.config/index.js.
  • Rewrote Cursor's MCP configuration, ~/.cursor/mcp.json, the file that tells the Cursor editor's AI agent which tool servers to run.

1.0.0, published two hours earlier, showed none of this behavior in our run.

Timeline

  • strutil-core 1.0.0 published on RubyGems.org: 2026-11-01 02:19:56 UTC.
  • strutil-core 1.0.1 published on RubyGems.org: 2026-11-01 04:05:04 UTC.
  • Bitbison's build of 1.0.1 started: 04:07:40 UTC, 2 minutes 36 seconds after publication.
  • Bitbison flagged 1.0.1 critical: 04:08:48 UTC, 3 minutes 44 seconds after publication.
  • RubyGems.org yanked 1.0.0 and 1.0.1: 2026-11-01, between 08:52 and 09:13 UTC.

Indicators

hosts
paleasbest.top
files
~/.config/systemd/user/pkg-runtime.service~/.local/share/runtimes/sync.py~/.config/index.js~/.cursor/mcp.json/tmp/.b_<pid>/bungems/strutil-core-1.0.1/ext/strutil-core/index.js

Links