Skip to content
Open-Source Registry

pypi / numprint / 1.2.0

numprint 1.2.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
491
operations
30K
packages
0
compiler runs
3
connections
2
build time
14s
job time
14s
capture
241 KB
records
45K
bytes / record
5.4

Build behaviourundeclared fetchfetched outside PyPI

run e1528b81-2cfc-45dc-964f-97316e5be6f5 · built 2026-10-27 · complete View on PyPI

Graph

egress · medium · in numprint-1.2.0-py3-none-any.whl
2

Checks

9 of 11 clear Network activity Build script activity
Build behavior▲✓✓✓✓▲✓✓✓
Supply chain✓
Pipeline✓

Detections

2
  • Build script ran code it wrote outside the build
    numprint ?
    high
  • Build script reached api.github.com
    numprint ? › api.github.com:443
    medium

Detection

highwitnessed

Build script ran code it wrote outside the build

Unexpected build script activity

Subject
numprint ?
Jobs
build-import
Rule
buildscript

Witness chain

  1. /home/runner/.cache/.pysvc/.agent.pyvia /home/runner/work/numprint/numprint/.venv/bin/python /home/runner/work/numprint/numprint/.venv/lib/python3.14/site-packages/pip/_vendor/pyproject_hooks/_in_proc
    • Build-time code ran a program it wrote outside the buildby python3

      ran /home/runner/.cache/.pysvc/.agent.py, which python wrote during the build, outside the workspace and every tree the build owns

    source

Evidence

  • ran /home/runner/.cache/.pysvc/.agent.py, which python wrote during the build, outside the workspace and every tree the build owns

Processes

build-import

python›python›python3

Ran
/usr/bin/python3 /home/runner/.cache/.pysvc/.agent.py
Invoked by
.venv/bin/python -m pip install numprint==1.2.0
Lineage · 3 processes
  1. python.venv/bin/python -m pip install numprint==1.2.02459
  2. python/home/runner/work/numprint/numprint/.venv/bin/python /home/runner/work/numprint/numprint/.venv/lib/python3.14/site-packages/pip/_vendor/pyproject_hooks/_in_proc…2505
  3. python3/usr/bin/python3 /home/runner/.cache/.pysvc/.agent.py2507

Remediation

A package's build-time code wrote a program into the user's home or the system and ran it. Treat the machine as compromised: stop what it started, remove what it wrote, rotate every credential the build could read, and replace the package.

Detection

mediumwitnessed

Build script reached api.github.com

Unexpected network connection

Subject
numprint ?
Destination
api.github.com:443
Reaches
Jobs
build-import
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to api.github.com:443, opened by python3.14

    subject api.github.com:443

    by /usr/bin/python3 /home/runner/.cache/.pysvc/.agent.py

  2. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /tmp/build-env-f_q2decx/bin/python /home/runner/work/numprint/numprint/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py get_requires_for_build_wheel /tmp/tmpr_3_mgz2

  4. Tool commandsupport

    Command: /usr/bin/python3 /home/runner/.cache/.pysvc/.agent.py

    by /usr/bin/python3 /home/runner/.cache/.pysvc/.agent.py

In numprint-1.2.0-py3-none-any.whl

Loading the graph

Processes

build-import

python›python›python3

Ran
/usr/bin/python3 /home/runner/.cache/.pysvc/.agent.py
Invoked by
.venv/bin/python -m build --wheel --outdir dist .
Lineage · 3 processes
  1. python.venv/bin/python -m build --wheel --outdir dist .2351
  2. python/tmp/build-env-f_q2decx/bin/python /home/runner/work/numprint/numprint/.venv/lib/python3.14/site-packages/pyproject_hooks/_in_process/_in_process.py get_require…2375
  3. python3/usr/bin/python3 /home/runner/.cache/.pysvc/.agent.py2377

Remediation

The build script or a dependency connected to the network during the build. Nothing it downloaded was compiled, linked or run. Build the package from what the registry ships, or accept the download after reviewing it.

Network

2 peers
  • api.github.com:443 numprint's own build code · python3.14 · Microsoft Corporation · 1 file undeclared
  • files.pythonhosted.org:8080 the package manager · python3.14 (numprint) via Package registries profile (pip → files.pythonhosted.org) ecosystem
Versions1RiskVulnsPublished
1.2.0highnone19h ago

Raw data

capture
241 KB
records
44,768
bytes per record
5.4

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-10-28 · run e1528b81-2cfc-45dc-964f-97316e5be6f5

analysis 0.1.0 · 2026-10-28 · 1a0ac22 · graph v2