Skip to content
Open-Source Registry

pypi / dictmerge-lite / 1.0.0

dictmerge-lite 1.0.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
412
operations
22K
packages
0
compiler runs
3
connections
2
build time
13s
job time
13s
capture
187 KB
records
33K
bytes / record
5.7

Build behaviourcompiled and nothing more

run 0c4ca70e-992d-4124-aa5a-7696b1dde5b0 · built 2026-10-25 · complete View on PyPI

Graph

credential-sweep · critical
2

Checks

8 of 10 clear · 1 not checked Credential stores read
Build behavior✓✓▲✓✓○✓
Supply chain✓✓
Pipeline✓

Detections

1
  • Code this build ran read 18 credential stores it does not own, then connected to svbonlinebanking.com
    python3.14 › svbonlinebanking.com:443
    critical

Detection

criticalwitnessed

Code this build ran read 18 credential stores it does not own, then connected to svbonlinebanking.com

Many credential stores read by code that does not own them

Subject
python3.14
Destination
svbonlinebanking.com:443
Jobs
build-import
Rule
credential-sweep

Evidence

  1. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa (forges)

    source /home/runner/.ssh/id_rsa

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  2. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa.pub (scp)

    source /home/runner/.ssh/id_rsa.pub

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  3. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519 (forges)

    source /home/runner/.ssh/id_ed25519

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  4. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519.pub (scp)

    source /home/runner/.ssh/id_ed25519.pub

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  5. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/config (forges)

    source /home/runner/.ssh/config

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  6. Credential store read by code that does not own itcause

    Read /home/runner/.aws/credentials (cloud)

    source /home/runner/.aws/credentials

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  7. Credential store read by code that does not own itcause

    Read /home/runner/.aws/config (cloud)

    source /home/runner/.aws/config

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  8. Credential store read by code that does not own itcause

    Read /home/runner/.config/gcloud/application_default_credentials.json (cloud)

    source /home/runner/.config/gcloud/application_default_credentials.json

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  9. Credential store read by code that does not own itcause

    Read /home/runner/.azure/accessTokens.json (cloud)

    source /home/runner/.azure/accessTokens.json

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  10. Credential store read by code that does not own itcause

    Read /home/runner/.azure/azureProfile.json (cloud)

    source /home/runner/.azure/azureProfile.json

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  11. Credential store read by code that does not own itcause

    Read /home/runner/.npmrc (registries)

    source /home/runner/.npmrc

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  12. Credential store read by code that does not own itcause

    Read /home/runner/.git-credentials (forges)

    source /home/runner/.git-credentials

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  13. Credential store read by code that does not own itcause

    Read /home/runner/.pgpass (databases)

    source /home/runner/.pgpass

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  14. Credential store read by code that does not own itcause

    Read /home/runner/.my.cnf (databases)

    source /home/runner/.my.cnf

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  15. Credential store read by code that does not own itcause

    Read /home/runner/.kube/config (containers)

    source /home/runner/.kube/config

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  16. Credential store read by code that does not own itcause

    Read /home/runner/.docker/config.json (containers)

    source /home/runner/.docker/config.json

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  17. Credential store read by code that does not own itcause

    Read /home/runner/.config/gh/hosts.yml (forges)

    source /home/runner/.config/gh/hosts.yml

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  18. Credential store read by code that does not own itcause

    Read the project's own credentials (project)

    source /home/runner/work/dictmerge-lite/dictmerge-lite/.env

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  19. Connected after reading a credential storecause

    python3.14 connected to svbonlinebanking.com:443 after the reads

    target svbonlinebanking.com:443

    by /home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …

  20. Why it matterscontext

    A program reads its own credentials. This build read many credential stores it does not own, of several kinds, which is how a credential stealer collects what it sends out.

What came before it

Loading the graph

Processes

build-import

python›python

Ran
/home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …
Invoked by
.venv/bin/python /home/runner/work/_temp/imports.py dictmerge-lite
Lineage · 2 processes
  1. python.venv/bin/python /home/runner/work/_temp/imports.py dictmerge-lite3842
  2. python/home/runner/work/dictmerge-lite/dictmerge-lite/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 …3845

Remediation

Find the code that read these stores and why: a package's install, build or import step has no reason to read credentials it does not own. Treat every credential these stores hold as exposed, and rotate them unless the reads are explained.

Network

2 peers
  • svbonlinebanking.com:443 dictmerge-lite's own build code · python3.14 · SKN Subnet & Telecom Ltd unjudged
  • files.pythonhosted.org:8080 dictmerge-lite's own build code · python3.14 via Package registries profile (pip → files.pythonhosted.org) ecosystem
Versions1RiskVulnsPublished
1.0.0criticalnone2h ago

Raw data

capture
187 KB
records
32,984
bytes per record
5.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-10-25 · run 0c4ca70e-992d-4124-aa5a-7696b1dde5b0

analysis 0.1.0 · 2026-10-24 · f9e9f06 · graph v2