Skip to content
Open-Source Registry

Incidents / npm/ironworm / 0.1.0

npm/ironworm 0.1.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean RiskcriticalVulnsnone
processes
106
operations
3.1K
packages
3
compiler runs
2
connections
1
capture
48 KB
records
5.1K
bytes / record
9.4

Build behaviourconnected outside the registrycompiled C/C++

run ironworm-0.1.0-2 · built 2026-10-14 · complete

Graph

secret-exfil · critical
3

Checks

9 of 14 clear · 3 not checked Network activity Sensitive data access and transfer
Build behavior▲▲✓✓✓✓✓✓
Supply chain○○○✓✓
Pipeline✓

Detections

2
  • Credential store contents reached a network peer
    18.238.80.121:443 › 18.238.80.121:443
    critical
  • Build script reached 18.238.80.121
    @toy/ironworm ? › 18.238.80.121:443
    medium

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
18.238.80.121:443
Destination
18.238.80.121:443
Jobs
build
Rule
secret-exfil · @toy/ironworm

Witness chain

  1. /home/bb/work/ironworm/.npmrc
    source
  2. 18.238.80.121:443via /home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc
    • Sensitive-file read linked to a network connectionfrom /home/bb/work/ironworm/.npmrc

      Credential store contents linked to this connection through build-time code: /home/bb/work/ironworm/.npmrc

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/bb/work/ironworm/.npmrc

What came before it

Loading the graph

Processes

build

systemd›sshd:›sshd-session:›…›node›phone-home

Ran
/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc
Invoked by
/usr/lib/systemd/systemd
Lineage · 13 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups6835
  3. sshd-session:sshd-session: bb [priv]6918
  4. sshd-session:sshd-session: bb@notty6973
  5. sudosudo6974
  6. shsh6976
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build7007
  8. shsh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build7008
  9. env/usr/bin/env node /usr/bin/npm install --no-audit --no-fund7009
  10. nodenode /usr/bin/npm install --no-audit --no-fund7019
  11. shsh -c node scripts/preinstall.js7020
  12. nodenode scripts/preinstall.js7021
  13. phone-home/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc7030

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

mediumwitnessed

Build script reached 18.238.80.121

Unexpected network connection

Subject
@toy/ironworm ?
Destination
18.238.80.121:443
Jobs
build
Rule
egress · @toy/ironworm

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to 18.238.80.121:443, opened by phone-home

    subject 18.238.80.121:443

    by /home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc

  2. What a build script's fetch becamesupport

    nothing came down that the build kept

  3. Data sent; no reply recordedsupport

    subject 18.238.80.121:443

    by /home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at sh -c node scripts/preinstall.js

  5. Tool commandsupport

    Command: /home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc

    by /home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc

  • Data sent; no reply recorded

What came before it

Loading the graph

Processes

build

systemd›sshd:›sshd-session:›…›node›phone-home

Ran
/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc
Invoked by
/usr/lib/systemd/systemd
Lineage · 13 processes
  1. systemd/usr/lib/systemd/systemd1
  2. sshd:sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups6835
  3. sshd-session:sshd-session: bb [priv]6918
  4. sshd-session:sshd-session: bb@notty6973
  5. sudosudo6974
  6. shsh6976
  7. runuserrunuser -u bb -- sh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build7007
  8. shsh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build7008
  9. env/usr/bin/env node /usr/bin/npm install --no-audit --no-fund7009
  10. nodenode /usr/bin/npm install --no-audit --no-fund7019
  11. shsh -c node scripts/preinstall.js7020
  12. nodenode scripts/preinstall.js7021
  13. phone-home/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc7030

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

1 peers
  • 18.238.80.121:443 npm/ironworm's own build code · phone-home (@toy/ironworm) undeclared
Dependencies4Build behaviour
ld-linux-x86-64.so.2system library
libc.so.6system library
libgcc_s.so.1system library
@toy/ironworm0.1.0
Versions1RiskVulnsPublished
0.1.0criticalnone

Raw data

capture
48 KB
records
5,125
bytes per record
9.4

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build success · Generated 2026-10-14 · run ironworm-0.1.0-2

analysis 0.1.0+gefb1d7d200bf · graph v2