Skip to content
Open-Source Registry

npm / gitnexus / 1.6.13-rc.205

gitnexus 1.6.13-rc.205

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
343
operations
122K
packages
214
compiler runs
0
connections
3
build time
1m 19s
job time
1m 19s
capture
2.3 MB
records
243K
bytes / record
9.5
run ab94e284-c54e-4404-968a-1981dd65e6eb · built 2026-11-05 · complete View on npm

Graph

egress · medium
2

Checks

15 of 18 clear · 1 not checked Network activity Build file changes
Build behavior▲✓✓✓▲✓✓✓✓✓
Supply chain✓✓✓✓✓✓
Build hardening○
Pipeline✓

Detections

19
  • An install script rewrote the installed package.json of tree-sitter-c, tree-sitter-cpp, tree-sitter-java, tree-sitter-javascript, tree-sitter-php, tree-sitter-ruby, tree-sitter-rust, tree-sitter-typescript after running
    package.json
    high
  • An install script rewrote the installed package.json of tree-sitter-c, tree-sitter-cpp, tree-sitter-java, tree-sitter-javascript, tree-sitter-php, tree-sitter-ruby, tree-sitter-rust, tree-sitter-typescript after running
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script wrote into another dependency's sources
    package.json
    high
  • Build script reached scarf.sh
    @scarf/scarf 1.4.0 › scarf.sh:443
    medium

Detection

highwitnessed

An install script rewrote the installed package.json of tree-sitter-c, tree-sitter-cpp, tree-sitter-java, tree-sitter-javascript, tree-sitter-php, tree-sitter-ruby, tree-sitter-rust, tree-sitter-typescript after running

Build file tampered

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-c/package.json
Jobs
install
Rule
build-file-tamper · consumer-upgrade

Evidence

  1. Covered its trackscause

    An install script rewrote the installed package.json of tree-sitter-c, tree-sitter-cpp, tree-sitter-java, tree-sitter-javascript, tree-sitter-php, tree-sitter-ruby, tree-sitter-rust, tree-sitter-typescript after running

    by node scripts/prepare-tree-sitter-bundle.cjs

  2. Written by dependency build codesupport

    script: sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  3. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

  4. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

  5. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

  6. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

  7. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

  8. Additional itemscontext

    … +3 more

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

The package's code covered its tracks: it rewrote what the project declares, or deleted what its install laid down, after running. Restore the project's declaration from version control, treat what the package ran as compromise, and replace the package.

Detection

highwitnessed

An install script rewrote the installed package.json of tree-sitter-c, tree-sitter-cpp, tree-sitter-java, tree-sitter-javascript, tree-sitter-php, tree-sitter-ruby, tree-sitter-rust, tree-sitter-typescript after running

Build file tampered

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-c/package.json
Jobs
install
Rule
build-file-tamper · consumer

Evidence

  1. Covered its trackscause

    An install script rewrote the installed package.json of tree-sitter-c, tree-sitter-cpp, tree-sitter-java, tree-sitter-javascript, tree-sitter-php, tree-sitter-ruby, tree-sitter-rust, tree-sitter-typescript after running

    by node scripts/prepare-tree-sitter-bundle.cjs

  2. Written by dependency build codesupport

    script: sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  3. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

  4. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

  5. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

  6. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

  7. Generated file edited in placesupport

    rewritten: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

  8. Additional itemscontext

    … +3 more

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

The package's code covered its tracks: it rewrote what the project declares, or deleted what its install laid down, after running. Restore the project's declaration from version control, treat what the package ran as compromise, and replace the package.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-c/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_c written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_cpp written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-java/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_java written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-php/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_php written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_ruby written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-rust/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_rust written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-rust/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-rust/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-rust/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_javascript written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_typescript written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer-upgrade/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.json

Processes

install

node›env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
node /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/
Lineage · 5 processes
  1. nodenode /home/runner/work/_temp/upgrade.js gitnexus 1.6.13-rc.205 consumer-upgrade http://registry.npmjs.org:8080/1945
  2. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  3. nodenode /usr/local/bin/npm install --foreground-scripts --save-exact gitnexus@1.6.13-rc.2052222
  4. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs2442
  5. nodenode scripts/prepare-tree-sitter-bundle.cjs2443

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-c/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_c written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-c/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_cpp written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-cpp/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-java/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_java written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-java/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-php/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_php written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-php/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_ruby written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-ruby/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-rust/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_rust written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-rust/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-rust/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-rust/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_javascript written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/node_modules/tree-sitter-javascript/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

highwitnessed

Build script wrote into another dependency's sources

Dependency sources written by the build

Subject
/home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.jsonwritten by node
Jobs
install
Rule
store-write

Evidence

  1. Dependency sources written by the buildcause

    1 file of tree_sitter_typescript written by sh, the build script at /usr/bin/dash

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.json

    by sh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs

  2. A dependency's file the build wrotesupport

    created: /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.json

    subject /home/runner/work/GitNexus/GitNexus/consumer/node_modules/gitnexus/node_modules/tree-sitter-typescript/package.json

Processes

install

env›node›sh›node

Ran
node scripts/prepare-tree-sitter-bundle.cjs
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node scripts/prepare-tree-sitter-bundle.cjs && node scripts/build-tree-sitter-grammars.cjs1639
  4. nodenode scripts/prepare-tree-sitter-bundle.cjs1640

Remediation

A dependency's unpacked sources are the package manager's to write. Review what was written and why; a build script needs OUT_DIR, a patch belongs in the project's own tree.

Detection

mediumwitnessed

Build script reached scarf.sh

Unexpected network connection

Subject
@scarf/scarf 1.4.0
Destination
scarf.sh:443
Jobs
install
Rule
egress · consumer

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to scarf.sh:443, opened by node

    subject scarf.sh:443

    by node ./report.js

  2. What a build script's fetch becamesupport

    nothing came down that the build kept

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at sh -c node ./report.js

  4. Tool commandsupport

    Command: node ./report.js

    by node ./report.js

What came before it

Loading the graph

Processes

install

env›node›sh›node

Ran
node ./report.js
Invoked by
/usr/bin/env node /usr/local/bin/npm install --foreground-scripts
Lineage · 4 processes
  1. env/usr/bin/env node /usr/local/bin/npm install --foreground-scripts1385
  2. nodenode /usr/local/bin/npm install --foreground-scripts1385
  3. shsh -c node ./report.js1613
  4. nodenode ./report.js1614

Remediation

The build script or a dependency connected to the network during the build. Nothing it downloaded was compiled, linked or run. Build the package from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • scarf.sh:443 build code of @scarf/scarf · node (consumer) · Amazon.com, Inc. undeclared
  • github.com:443 gitnexus's own build code · git-remote-http via the job's own repository (abhigyanpatwari/gitnexus on github.com) · GitHub, Inc. · 2 files infrastructure
  • registry.npmjs.org:8080 the package manager · node (consumer) · 25,724 files ecosystem

Dependencies

223
Dependencies223Build behaviour
@hono/node-server2.1.6
@isaacs/fs-minipass4.0.1
@isaacs/nonrecursive-glob-match1.0.3
@ladybugdb/core0.22.0
@ladybugdb/core-linux-x640.22.0
@modelcontextprotocol/sdk1.32.2
@nodable/entities3.1.0
@pinojs/redact0.4.0
@scarf/scarf1.4.0
@types/node25.9.9
accepts2.0.0
ajv8.20.0
ajv-formats3.0.1
ansi-regex5.0.1
ansi-styles4.3.0
anynum1.0.1
apache-arrow21.2.0
argparse3.0.4
atomic-sleep1.0.0
balanced-match4.0.4
body-parser2.4.0
brace-expansion5.0.12
busboy1.6.0
bytes3.1.2
call-bind-apply-helpers1.0.2
call-bound1.0.4
chokidar5.0.0
chownr3.0.0
cli-progress3.12.0
cliui8.0.1
cmake-js8.0.0
color-convert2.0.1
color-name1.1.4
colorette2.0.20
commander15.0.0
content-disposition2.0.1
content-type1.0.5
content-type2.1.0
cookie0.7.2
cookie-signature1.2.2
cors2.8.6
cross-spawn7.0.6
dateformat4.6.3
debug4.4.3
deep-extend0.6.0
depd2.0.0
dunder-proto1.0.1
ee-first1.1.1
emoji-regex8.0.0
encodeurl2.0.1
end-of-stream1.4.5
es-define-property1.0.1
es-errors1.3.0
es-object-atoms1.1.2
escalade3.2.0
escape-html1.0.3
etag1.8.1
events3.3.0
eventsource3.0.7
eventsource-parser3.1.1
express5.3.0
express-rate-limit8.7.3
fast-copy4.3.1
fast-deep-equal3.1.3
fast-safe-stringify2.1.1
fast-uri3.1.9
fast-xml-builder1.3.1
fast-xml-parser5.12.0
finalhandler2.1.1
flatbuffers25.9.23
forwarded0.2.0
fresh2.0.0
fs-extra11.4.1
function-bind1.1.2
get-caller-file2.0.5
get-intrinsic1.3.0
get-proto1.0.1
glob14.0.3
gopd1.2.0
graceful-fs4.2.11
graphology0.26.0
graphology-indices0.17.1
graphology-types0.24.8
graphology-utils2.5.2
graphql17.1.0
has-symbols1.1.0
hasown2.0.4
help-me5.0.0
hono4.13.16
http-errors2.0.1
iconv-lite0.7.3
ignore7.0.14
inherits2.0.4
ini1.3.8
ip-address10.7.6
ipaddr.js1.9.1
is-fullwidth-code-point3.0.0
is-promise4.0.0
is-unsafe2.0.3
isexe2.0.0
isexe4.0.0
jose6.2.15
joycon3.1.1
js-yaml5.5.0
json-schema-traverse1.0.0
json-schema-typed8.0.2
json-with-bigint3.5.12
jsonc-parser3.3.1
jsonfile6.2.1
lru-cache11.5.3
math-intrinsics1.1.0
media-typer1.1.1
merge-descriptors2.0.0
mime-db1.54.0
mime-types3.0.2
minimatch11.0.4
minimist1.2.8
minipass7.1.3
minizlib3.1.0
mnemonist0.39.8
mnemonist0.40.7
ms2.1.3
negotiator1.1.0
node-addon-api6.1.0
node-addon-api8.9.2
node-api-headers1.9.0
node-gyp-build4.8.4
object-assign4.1.1
object-inspect1.13.4
obliterator2.0.5
on-exit-leak-free2.1.2
on-finished2.4.2
once1.4.0
onnxruntime-common1.31.1
pandemonium2.4.1
parseurl1.3.3
path-expression-matcher1.6.2
path-key3.1.1
path-scurry3.0.0
path-to-regexp8.4.2
pino10.4.0
pino-abstract-transport3.0.0
pino-pretty13.2.0
pino-std-serializers7.1.0
pkce-challenge5.0.1
process-warning5.1.1
proxy-addr2.0.8
pump3.0.4
qs6.17.1
quick-format-unescaped4.0.4
range-parser1.3.0
raw-body3.0.2
rc1.2.8
readdirp5.1.1
real-require1.0.0
require-directory2.1.1
require-from-string2.0.2
router2.2.0
safe-stable-stringify2.5.0
safer-buffer2.1.2
secure-json-parse4.1.1
semver7.8.6
send1.2.1
serve-static2.2.1
setprototypeof1.2.0
shebang-command2.0.0
shebang-regex3.0.0
side-channel1.1.1
side-channel-list1.0.1
side-channel-map1.0.1
side-channel-weakmap1.0.2
smol-toml1.9.1
sonic-boom4.2.1
sonic-boom5.0.2
split24.2.0
statuses2.0.2
streamsearch1.1.0
string-width4.2.3
strip-ansi6.0.1
strip-json-comments2.0.1
strip-json-comments5.0.3
strnum2.5.1
tar7.5.22
thread-stream4.2.1
toidentifier1.0.1
tree-sitter0.25.1
tree-sitter-c0.23.6
tree-sitter-c-sharp0.23.5
tree-sitter-cpp0.23.4
tree-sitter-go0.25.0
tree-sitter-java0.23.5
tree-sitter-javascript0.23.1
tree-sitter-javascript0.25.0
tree-sitter-php0.24.2
tree-sitter-python0.25.0
tree-sitter-ruby0.23.1
tree-sitter-rust0.24.0
tree-sitter-typescript0.23.2
tslib2.9.1
type-is2.1.0
undici-types7.24.6
universalify2.0.1
unpipe1.0.0
url-join4.0.1
uuid14.0.3
vary1.1.2
which2.0.2
which6.0.1
wrap-ansi7.0.0
wrappy1.0.2
xml-naming0.3.0
y18n5.0.8
yallist5.0.0
yargs17.7.3
yargs-parser21.1.1
zod4.6.7
zod-to-json-schema3.25.2
@ladybugdb/core-darwin-arm640.22.0
@ladybugdb/core-darwin-x640.22.0
@ladybugdb/core-linux-arm640.22.0
@ladybugdb/core-win32-x640.22.0
consumer1.0.0
consumer-upgrade1.0.0

Versions500

Raw data

capture
2.3 MB
records
243,289
bytes per record
9.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: install success · Generated 2026-11-05 · run ab94e284-c54e-4404-968a-1981dd65e6eb

analysis 0.1.0 · 2026-11-04 · bfee307 · graph v2