Skip to content
Open-Source Registry

pypi / pystr-codec

pystr-codec 0.1.1

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
310
operations
29K
packages
0
compiler runs
4
connections
57
build time
1m 23s
job time
1m 23s
capture
454 KB
records
56K
bytes / record
8.0

Python string codec utilities

published 2026-10-31 View on PyPI
Reviewed by Bitbison: maliciouspystr-codec installs a .pth file that runs obfuscated JavaScript through Bun at every Python start. It reads other tools' credential stores, sends them out, persists, spreads with the stolen credentials, and turns destructive once they are revoked. A Miasma-family worm.

Graph

credential-sweep · critical · in pystr_codec-0.1.1-py3-none-any.whl
3

Checks

7 of 10 clear · 1 not checked Sensitive data access and transfer Credential stores read
Build behavior✓▲▲✓✓✓○✓
Supply chain✓
Pipeline✓

Detections

2
  • Code this build ran read 47 credential stores it does not own, then connected to paleasbest.top
    bun › paleasbest.top:443, metadata.google.internal:80, graph.microsoft.com:443, api.github.com:443, gitlab.com:443, sts.us-east-1.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, ghcr.io:443
    critical
  • Code this build ran connected to an undeclared host after reading a credential store
    bun › api.github.com:443, paleasbest.top:443, gitlab.com:443, metadata.google.internal:80, sts.us-east-1.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, graph.microsoft.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, ghcr.io:443
    high

Detection

criticalwitnessed

Code this build ran read 47 credential stores it does not own, then connected to paleasbest.top

Many credential stores read by code that does not own them

Subject
bun
Destination
paleasbest.top:443, metadata.google.internal:80, graph.microsoft.com:443, api.github.com:443, gitlab.com:443, sts.us-east-1.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, ghcr.io:443
Reaches
Jobs
build-import
Rule
credential-sweep

Evidence

  1. Credential store read by code that does not own itcause

    Read the project's own credentials (project)

    source /home/runner/work/pystr-codec/pystr-codec/.env

    by /tmp/b/bun run /home/runner/work/pystr-codec/pystr-codec/.venv/lib/python3.14/site-packages/pystr_codec/ci.js

  2. Credential store read by code that does not own itcause

    Read /home/runner/.aws/credentials (cloud)

    source /home/runner/.aws/credentials

    by /tmp/b/bun run -

  3. Credential store read by code that does not own itcause

    Read /home/runner/.ansible/vault-password (services)

    source /home/runner/.ansible/vault-password

    by /tmp/b/bun run -

  4. Credential store read by code that does not own itcause

    Read /home/runner/.aws/config (cloud)

    source /home/runner/.aws/config

    by /tmp/b/bun run -

  5. Credential store read by code that does not own itcause

    Read /home/runner/.azure/accessTokens.json (cloud)

    source /home/runner/.azure/accessTokens.json

    by /tmp/b/bun run -

  6. Credential store read by code that does not own itcause

    Read /home/runner/.config/gcloud/application_default_credentials.json (cloud)

    source /home/runner/.config/gcloud/application_default_credentials.json

    by /tmp/b/bun run -

  7. Credential store read by code that does not own itcause

    Read /home/runner/.config/gh/hosts.yml (forges)

    source /home/runner/.config/gh/hosts.yml

    by /tmp/b/bun run -

  8. Credential store read by code that does not own itcause

    Read /home/runner/.config/glab-cli/config.yml (forges)

    source /home/runner/.config/glab-cli/config.yml

    by /tmp/b/bun run -

  9. Credential store read by code that does not own itcause

    Read /home/runner/.docker/config.json (containers)

    source /home/runner/.docker/config.json

    by /tmp/b/bun run -

  10. Credential store read by code that does not own itcause

    Read /home/runner/.ethereum/keystore/password.txt (wallets)

    source /home/runner/.ethereum/keystore/password.txt

    by /tmp/b/bun run -

  11. Credential store read by code that does not own itcause

    Read /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5 (wallets)

    source /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5

    by /tmp/b/bun run -

  12. Credential store read by code that does not own itcause

    Read /home/runner/.kube/config (containers)

    source /home/runner/.kube/config

    by /tmp/b/bun run -

  13. Credential store read by code that does not own itcause

    Read /home/runner/.npmrc (registries)

    source /home/runner/.npmrc

    by /tmp/b/bun run -

  14. Credential store read by code that does not own itcause

    Read /home/runner/.pypirc (registries)

    source /home/runner/.pypirc

    by /tmp/b/bun run -

  15. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/config (forges)

    source /home/runner/.ssh/config

    by /tmp/b/bun run -

  16. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa.pub (scp)

    source /home/runner/.ssh/id_rsa.pub

    by /tmp/b/bun run -

  17. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519 (forges)

    source /home/runner/.ssh/id_ed25519

    by /tmp/b/bun run -

  18. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa (forges)

    source /home/runner/.ssh/id_rsa

    by /tmp/b/bun run -

  19. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519.pub (scp)

    source /home/runner/.ssh/id_ed25519.pub

    by /tmp/b/bun run -

  20. Credential store read by code that does not own itcause

    Read /home/runner/.git-credentials (forges)

    source /home/runner/.git-credentials

    by /tmp/b/bun run -

  21. Credential store read by code that does not own itcause

    Read /home/runner/.config/gcloud/example-deploy.json (cloud)

    source /home/runner/.config/gcloud/example-deploy.json

    by /tmp/b/bun run -

  22. Credential store read by code that does not own itcause

    Read /home/runner/.gem/credentials (registries)

    source /home/runner/.gem/credentials

    by /tmp/b/bun run -

  23. Credential store read by code that does not own itcause

    Read /home/runner/.vault-token (cloud)

    source /home/runner/.vault-token

    by /tmp/b/bun run -

  24. Credential store read by code that does not own itcause

    Read /home/runner/.my.cnf (databases)

    source /home/runner/.my.cnf

    by /tmp/b/bun run -

  25. Credential store read by code that does not own itcause

    Read /home/runner/.terraformrc (services)

    source /home/runner/.terraformrc

    by /tmp/b/bun run -

  26. Credential store read by code that does not own itcause

    Read /home/runner/.databrickscfg (services)

    source /home/runner/.databrickscfg

    by /tmp/b/bun run -

  27. Credential store read by code that does not own itcause

    Read /home/runner/.pgpass (databases)

    source /home/runner/.pgpass

    by /tmp/b/bun run -

  28. Credential store read by code that does not own itcause

    Read /home/runner/.yarnrc.yml (registries)

    source /home/runner/.yarnrc.yml

    by /tmp/b/bun run -

  29. Credential store read by code that does not own itcause

    Read /home/runner/.ethereum/seed.txt (wallets)

    source /home/runner/.ethereum/seed.txt

    by /tmp/b/bun run -

  30. Credential store read by code that does not own itcause

    Read /home/runner/.fly/config.yml (services)

    source /home/runner/.fly/config.yml

    by /tmp/b/bun run -

  31. Credential store read by code that does not own itcause

    Read /home/runner/.composer/auth.json (registries)

    source /home/runner/.composer/auth.json

    by /tmp/b/bun run -

  32. Credential store read by code that does not own itcause

    Read /home/runner/.nuget/NuGet/NuGet.Config (registries)

    source /home/runner/.nuget/NuGet/NuGet.Config

    by /tmp/b/bun run -

  33. Credential store read by code that does not own itcause

    Read /home/runner/.cache/huggingface/token (services)

    source /home/runner/.cache/huggingface/token

    by /tmp/b/bun run -

  34. Credential store read by code that does not own itcause

    Read /home/runner/.pip/pip.conf (registries)

    source /home/runner/.pip/pip.conf

    by /tmp/b/bun run -

  35. Credential store read by code that does not own itcause

    Read /home/runner/.local/share/com.vercel.cli/auth.json (services)

    source /home/runner/.local/share/com.vercel.cli/auth.json

    by /tmp/b/bun run -

  36. Credential store read by code that does not own itcause

    Read /home/runner/.bitcoin/bitcoin.conf (wallets)

    source /home/runner/.bitcoin/bitcoin.conf

    by /tmp/b/bun run -

  37. Credential store read by code that does not own itcause

    Read /home/runner/.kaggle/kaggle.json (services)

    source /home/runner/.kaggle/kaggle.json

    by /tmp/b/bun run -

  38. Credential store read by code that does not own itcause

    Read /home/runner/.mongodb/mongosh.conf (databases)

    source /home/runner/.mongodb/mongosh.conf

    by /tmp/b/bun run -

  39. Credential store read by code that does not own itcause

    Read /home/runner/.m2/settings.xml (registries)

    source /home/runner/.m2/settings.xml

    by /tmp/b/bun run -

  40. Credential store read by code that does not own itcause

    Read /home/runner/.config/containers/auth.json (containers)

    source /home/runner/.config/containers/auth.json

    by /tmp/b/bun run -

  41. Connected after reading a credential storecause

    bun connected to paleasbest.top:443 after the reads

    target paleasbest.top:443

    by /tmp/b/bun run -

  42. Connected after reading a credential storecause

    bun connected to metadata.google.internal:80 after the reads

    target metadata.google.internal:80

    by /tmp/b/bun run -

  43. Connected after reading a credential storecause

    bun connected to graph.microsoft.com:443 after the reads

    target graph.microsoft.com:443

    by /tmp/b/bun run -

  44. Connected after reading a credential storecause

    bun connected to api.github.com:443 after the reads

    target api.github.com:443

    by /tmp/b/bun run -

  45. Connected after reading a credential storecause

    bun connected to gitlab.com:443 after the reads

    target gitlab.com:443

    by /tmp/b/bun run -

  46. Connected after reading a credential storecause

    bun connected to sts.us-east-1.amazonaws.com:443 after the reads

    target sts.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  47. Connected after reading a credential storecause

    bun connected to ssm.us-east-1.amazonaws.com:443 after the reads

    target ssm.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  48. Connected after reading a credential storecause

    bun connected to ssm.us-east-2.amazonaws.com:443 after the reads

    target ssm.us-east-2.amazonaws.com:443

    by /tmp/b/bun run -

  49. Connected after reading a credential storecause

    bun connected to ssm.us-west-1.amazonaws.com:443 after the reads

    target ssm.us-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  50. Connected after reading a credential storecause

    bun connected to ssm.us-west-2.amazonaws.com:443 after the reads

    target ssm.us-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  51. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-1.amazonaws.com:443 after the reads

    target ssm.ap-northeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  52. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-2.amazonaws.com:443 after the reads

    target ssm.ap-northeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  53. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-3.amazonaws.com:443 after the reads

    target ssm.ap-northeast-3.amazonaws.com:443

    by /tmp/b/bun run -

  54. Connected after reading a credential storecause

    bun connected to ssm.ap-southeast-1.amazonaws.com:443 after the reads

    target ssm.ap-southeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  55. Connected after reading a credential storecause

    bun connected to ssm.ap-south-1.amazonaws.com:443 after the reads

    target ssm.ap-south-1.amazonaws.com:443

    by /tmp/b/bun run -

  56. Connected after reading a credential storecause

    bun connected to ssm.ca-central-1.amazonaws.com:443 after the reads

    target ssm.ca-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  57. Connected after reading a credential storecause

    bun connected to ssm.ap-southeast-2.amazonaws.com:443 after the reads

    target ssm.ap-southeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  58. Connected after reading a credential storecause

    bun connected to ssm.eu-central-1.amazonaws.com:443 after the reads

    target ssm.eu-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  59. Connected after reading a credential storecause

    bun connected to ssm.eu-north-1.amazonaws.com:443 after the reads

    target ssm.eu-north-1.amazonaws.com:443

    by /tmp/b/bun run -

  60. Connected after reading a credential storecause

    bun connected to ssm.eu-west-1.amazonaws.com:443 after the reads

    target ssm.eu-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  61. Connected after reading a credential storecause

    bun connected to ssm.eu-west-2.amazonaws.com:443 after the reads

    target ssm.eu-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  62. Connected after reading a credential storecause

    bun connected to ssm.eu-west-3.amazonaws.com:443 after the reads

    target ssm.eu-west-3.amazonaws.com:443

    by /tmp/b/bun run -

  63. Connected after reading a credential storecause

    bun connected to ssm.sa-east-1.amazonaws.com:443 after the reads

    target ssm.sa-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  64. Connected after reading a credential storecause

    bun connected to secretsmanager.us-east-1.amazonaws.com:443 after the reads

    target secretsmanager.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  65. Connected after reading a credential storecause

    bun connected to secretsmanager.us-east-2.amazonaws.com:443 after the reads

    target secretsmanager.us-east-2.amazonaws.com:443

    by /tmp/b/bun run -

  66. Connected after reading a credential storecause

    bun connected to secretsmanager.us-west-1.amazonaws.com:443 after the reads

    target secretsmanager.us-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  67. Connected after reading a credential storecause

    bun connected to secretsmanager.us-west-2.amazonaws.com:443 after the reads

    target secretsmanager.us-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  68. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-1.amazonaws.com:443 after the reads

    target secretsmanager.ap-northeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  69. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-2.amazonaws.com:443 after the reads

    target secretsmanager.ap-northeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  70. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-3.amazonaws.com:443 after the reads

    target secretsmanager.ap-northeast-3.amazonaws.com:443

    by /tmp/b/bun run -

  71. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-south-1.amazonaws.com:443 after the reads

    target secretsmanager.ap-south-1.amazonaws.com:443

    by /tmp/b/bun run -

  72. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-southeast-1.amazonaws.com:443 after the reads

    target secretsmanager.ap-southeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  73. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-southeast-2.amazonaws.com:443 after the reads

    target secretsmanager.ap-southeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  74. Connected after reading a credential storecause

    bun connected to secretsmanager.ca-central-1.amazonaws.com:443 after the reads

    target secretsmanager.ca-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  75. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-central-1.amazonaws.com:443 after the reads

    target secretsmanager.eu-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  76. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-north-1.amazonaws.com:443 after the reads

    target secretsmanager.eu-north-1.amazonaws.com:443

    by /tmp/b/bun run -

  77. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-1.amazonaws.com:443 after the reads

    target secretsmanager.eu-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  78. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-2.amazonaws.com:443 after the reads

    target secretsmanager.eu-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  79. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-3.amazonaws.com:443 after the reads

    target secretsmanager.eu-west-3.amazonaws.com:443

    by /tmp/b/bun run -

  80. Connected after reading a credential storecause

    bun connected to secretsmanager.sa-east-1.amazonaws.com:443 after the reads

    target secretsmanager.sa-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  81. Connected after reading a credential storecause

    bun connected to api.ecr.us-east-1.amazonaws.com:443 after the reads

    target api.ecr.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  82. Connected after reading a credential storecause

    bun connected to api.ecr.us-east-2.amazonaws.com:443 after the reads

    target api.ecr.us-east-2.amazonaws.com:443

    by /tmp/b/bun run -

  83. Connected after reading a credential storecause

    bun connected to api.ecr.us-west-1.amazonaws.com:443 after the reads

    target api.ecr.us-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  84. Connected after reading a credential storecause

    bun connected to management.azure.com:443 after the reads

    target management.azure.com:443

    by /tmp/b/bun run -

  85. Connected after reading a credential storecause

    bun connected to api.ecr.us-west-2.amazonaws.com:443 after the reads

    target api.ecr.us-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  86. Connected after reading a credential storecause

    bun connected to api.ecr.ap-northeast-1.amazonaws.com:443 after the reads

    target api.ecr.ap-northeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  87. Connected after reading a credential storecause

    bun connected to api.ecr.ap-southeast-1.amazonaws.com:443 after the reads

    target api.ecr.ap-southeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  88. Connected after reading a credential storecause

    bun connected to cloudresourcemanager.googleapis.com:443 after the reads

    target cloudresourcemanager.googleapis.com:443

    by /tmp/b/bun run -

  89. Connected after reading a credential storecause

    bun connected to api.ecr.ca-central-1.amazonaws.com:443 after the reads

    target api.ecr.ca-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  90. Connected after reading a credential storecause

    bun connected to api.ecr.ap-south-1.amazonaws.com:443 after the reads

    target api.ecr.ap-south-1.amazonaws.com:443

    by /tmp/b/bun run -

  91. Connected after reading a credential storecause

    bun connected to api.ecr.eu-central-1.amazonaws.com:443 after the reads

    target api.ecr.eu-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  92. Connected after reading a credential storecause

    bun connected to api.ecr.eu-west-1.amazonaws.com:443 after the reads

    target api.ecr.eu-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  93. Connected after reading a credential storecause

    bun connected to api.ecr.eu-west-2.amazonaws.com:443 after the reads

    target api.ecr.eu-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  94. Connected after reading a credential storecause

    bun connected to ghcr.io:443 after the reads

    target ghcr.io:443

    by /tmp/b/bun run -

  95. More findings of this kind are not listedcontext

  96. Why it matterscontext

    A program reads its own credentials. This build read many credential stores it does not own, of several kinds, which is how a credential stealer collects what it sends out.

In pystr_codec-0.1.1-py3-none-any.whl

Loading the graph

Processes

build-import

python›bun›bun

Ran
/tmp/b/bun run -
Invoked by
.venv/bin/python -m pip download --no-deps --only-binary :all: --dest published pystr-codec==0.1.1
Lineage · 3 processes
  1. python.venv/bin/python -m pip download --no-deps --only-binary :all: --dest published pystr-codec==0.1.12523
  2. bun/tmp/b/bun run /home/runner/work/pystr-codec/pystr-codec/.venv/lib/python3.14/site-packages/pystr_codec/ci.js2524
  3. bun/tmp/b/bun run -2529

Remediation

Find the code that read these stores and why: a package's install, build or import step has no reason to read credentials it does not own. Treat every credential these stores hold as exposed, and rotate them unless the reads are explained.

Detection

highwitnessed

Code this build ran connected to an undeclared host after reading a credential store

Credentials used by code the build ran

Subject
bun
Destination
api.github.com:443, paleasbest.top:443, gitlab.com:443, metadata.google.internal:80, sts.us-east-1.amazonaws.com:443, ssm.us-east-1.amazonaws.com:443, ssm.us-east-2.amazonaws.com:443, ssm.us-west-1.amazonaws.com:443, ssm.us-west-2.amazonaws.com:443, ssm.ap-northeast-1.amazonaws.com:443, ssm.ap-northeast-2.amazonaws.com:443, ssm.ap-northeast-3.amazonaws.com:443, ssm.ap-southeast-1.amazonaws.com:443, ssm.ap-south-1.amazonaws.com:443, ssm.ca-central-1.amazonaws.com:443, ssm.ap-southeast-2.amazonaws.com:443, ssm.eu-central-1.amazonaws.com:443, ssm.eu-north-1.amazonaws.com:443, ssm.eu-west-1.amazonaws.com:443, ssm.eu-west-2.amazonaws.com:443, ssm.eu-west-3.amazonaws.com:443, ssm.sa-east-1.amazonaws.com:443, secretsmanager.us-east-1.amazonaws.com:443, secretsmanager.us-east-2.amazonaws.com:443, secretsmanager.us-west-1.amazonaws.com:443, secretsmanager.us-west-2.amazonaws.com:443, secretsmanager.ap-northeast-1.amazonaws.com:443, secretsmanager.ap-northeast-2.amazonaws.com:443, secretsmanager.ap-northeast-3.amazonaws.com:443, secretsmanager.ap-south-1.amazonaws.com:443, secretsmanager.ap-southeast-1.amazonaws.com:443, secretsmanager.ap-southeast-2.amazonaws.com:443, secretsmanager.ca-central-1.amazonaws.com:443, secretsmanager.eu-central-1.amazonaws.com:443, secretsmanager.eu-north-1.amazonaws.com:443, secretsmanager.eu-west-1.amazonaws.com:443, secretsmanager.eu-west-2.amazonaws.com:443, secretsmanager.eu-west-3.amazonaws.com:443, secretsmanager.sa-east-1.amazonaws.com:443, graph.microsoft.com:443, api.ecr.us-east-1.amazonaws.com:443, api.ecr.us-east-2.amazonaws.com:443, api.ecr.us-west-1.amazonaws.com:443, management.azure.com:443, api.ecr.us-west-2.amazonaws.com:443, api.ecr.ap-northeast-1.amazonaws.com:443, api.ecr.ap-southeast-1.amazonaws.com:443, cloudresourcemanager.googleapis.com:443, api.ecr.ca-central-1.amazonaws.com:443, api.ecr.ap-south-1.amazonaws.com:443, api.ecr.eu-central-1.amazonaws.com:443, api.ecr.eu-west-1.amazonaws.com:443, api.ecr.eu-west-2.amazonaws.com:443, ghcr.io:443
Reaches
Jobs
build-import
Rule
credential-use

Evidence

  1. Connected after reading a credential storecause

    bun connected to api.github.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.github.com:443

    by /tmp/b/bun run -

  2. Connected after reading a credential storecause

    bun connected to paleasbest.top:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget paleasbest.top:443

    by /tmp/b/bun run -

  3. Connected after reading a credential storecause

    bun connected to gitlab.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget gitlab.com:443

    by /tmp/b/bun run -

  4. Connected after reading a credential storecause

    bun connected to metadata.google.internal:80 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget metadata.google.internal:80

    by /tmp/b/bun run -

  5. Connected after reading a credential storecause

    bun connected to sts.us-east-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget sts.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  6. Connected after reading a credential storecause

    bun connected to ssm.us-east-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  7. Connected after reading a credential storecause

    bun connected to ssm.us-east-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.us-east-2.amazonaws.com:443

    by /tmp/b/bun run -

  8. Connected after reading a credential storecause

    bun connected to ssm.us-west-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.us-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  9. Connected after reading a credential storecause

    bun connected to ssm.us-west-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.us-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  10. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.ap-northeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  11. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.ap-northeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  12. Connected after reading a credential storecause

    bun connected to ssm.ap-northeast-3.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.ap-northeast-3.amazonaws.com:443

    by /tmp/b/bun run -

  13. Connected after reading a credential storecause

    bun connected to ssm.ap-southeast-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.ap-southeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  14. Connected after reading a credential storecause

    bun connected to ssm.ap-south-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.ap-south-1.amazonaws.com:443

    by /tmp/b/bun run -

  15. Connected after reading a credential storecause

    bun connected to ssm.ca-central-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.ca-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  16. Connected after reading a credential storecause

    bun connected to ssm.ap-southeast-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.ap-southeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  17. Connected after reading a credential storecause

    bun connected to ssm.eu-central-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.eu-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  18. Connected after reading a credential storecause

    bun connected to ssm.eu-north-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.eu-north-1.amazonaws.com:443

    by /tmp/b/bun run -

  19. Connected after reading a credential storecause

    bun connected to ssm.eu-west-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.eu-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  20. Connected after reading a credential storecause

    bun connected to ssm.eu-west-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.eu-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  21. Connected after reading a credential storecause

    bun connected to ssm.eu-west-3.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.eu-west-3.amazonaws.com:443

    by /tmp/b/bun run -

  22. Connected after reading a credential storecause

    bun connected to ssm.sa-east-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ssm.sa-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  23. Connected after reading a credential storecause

    bun connected to secretsmanager.us-east-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  24. Connected after reading a credential storecause

    bun connected to secretsmanager.us-east-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.us-east-2.amazonaws.com:443

    by /tmp/b/bun run -

  25. Connected after reading a credential storecause

    bun connected to secretsmanager.us-west-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.us-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  26. Connected after reading a credential storecause

    bun connected to secretsmanager.us-west-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.us-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  27. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.ap-northeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  28. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.ap-northeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  29. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-northeast-3.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.ap-northeast-3.amazonaws.com:443

    by /tmp/b/bun run -

  30. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-south-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.ap-south-1.amazonaws.com:443

    by /tmp/b/bun run -

  31. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-southeast-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.ap-southeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  32. Connected after reading a credential storecause

    bun connected to secretsmanager.ap-southeast-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.ap-southeast-2.amazonaws.com:443

    by /tmp/b/bun run -

  33. Connected after reading a credential storecause

    bun connected to secretsmanager.ca-central-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.ca-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  34. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-central-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.eu-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  35. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-north-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.eu-north-1.amazonaws.com:443

    by /tmp/b/bun run -

  36. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.eu-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  37. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.eu-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  38. Connected after reading a credential storecause

    bun connected to secretsmanager.eu-west-3.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.eu-west-3.amazonaws.com:443

    by /tmp/b/bun run -

  39. Connected after reading a credential storecause

    bun connected to secretsmanager.sa-east-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget secretsmanager.sa-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  40. Connected after reading a credential storecause

    bun connected to graph.microsoft.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget graph.microsoft.com:443

    by /tmp/b/bun run -

  41. Connected after reading a credential storecause

    bun connected to api.ecr.us-east-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.us-east-1.amazonaws.com:443

    by /tmp/b/bun run -

  42. Connected after reading a credential storecause

    bun connected to api.ecr.us-east-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.us-east-2.amazonaws.com:443

    by /tmp/b/bun run -

  43. Connected after reading a credential storecause

    bun connected to api.ecr.us-west-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.us-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  44. Connected after reading a credential storecause

    bun connected to management.azure.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget management.azure.com:443

    by /tmp/b/bun run -

  45. Connected after reading a credential storecause

    bun connected to api.ecr.us-west-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.us-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  46. Connected after reading a credential storecause

    bun connected to api.ecr.ap-northeast-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.ap-northeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  47. Connected after reading a credential storecause

    bun connected to api.ecr.ap-southeast-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.ap-southeast-1.amazonaws.com:443

    by /tmp/b/bun run -

  48. Connected after reading a credential storecause

    bun connected to cloudresourcemanager.googleapis.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget cloudresourcemanager.googleapis.com:443

    by /tmp/b/bun run -

  49. Connected after reading a credential storecause

    bun connected to api.ecr.ca-central-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.ca-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  50. Connected after reading a credential storecause

    bun connected to api.ecr.ap-south-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.ap-south-1.amazonaws.com:443

    by /tmp/b/bun run -

  51. Connected after reading a credential storecause

    bun connected to api.ecr.eu-central-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.eu-central-1.amazonaws.com:443

    by /tmp/b/bun run -

  52. Connected after reading a credential storecause

    bun connected to api.ecr.eu-west-1.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.eu-west-1.amazonaws.com:443

    by /tmp/b/bun run -

  53. Connected after reading a credential storecause

    bun connected to api.ecr.eu-west-2.amazonaws.com:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget api.ecr.eu-west-2.amazonaws.com:443

    by /tmp/b/bun run -

  54. Connected after reading a credential storecause

    bun connected to ghcr.io:443 after reading /home/runner/work/pystr-codec/pystr-codec/.env, /home/runner/.aws/credentials, /home/runner/.ansible/vault-password, /home/runner/.aws/config, /home/runner/.azure/accessTokens.json, /home/runner/.config/gcloud/application_default_credentials.json, /home/runner/.config/gh/hosts.yml, /home/runner/.config/glab-cli/config.yml, /home/runner/.docker/config.json, /home/runner/.ethereum/keystore/password.txt, /home/runner/.ethereum/keystore/UTC--2026-02-11T09-14-22.000000000Z--a4f9c2e8b1d7c3e5a7b9d1f3a5c7e9b1d3f5, /home/runner/work/pystr-codec/pystr-codec/.git/config, /home/runner/.kube/config, /home/runner/.npmrc, /home/runner/.pypirc, /home/runner/.ssh/config, /home/runner/.ssh/id_rsa.pub, /home/runner/.ssh/id_ed25519, /home/runner/.ssh/id_rsa, /home/runner/.ssh/id_ed25519.pub, /home/runner/.git-credentials, /home/runner/.config/gcloud/example-deploy.json, /home/runner/.gem/credentials, /home/runner/.vault-token, /home/runner/.my.cnf, /home/runner/.terraformrc, /home/runner/.databrickscfg, /home/runner/.pgpass, /home/runner/.yarnrc.yml, /home/runner/.ethereum/seed.txt, /home/runner/.fly/config.yml, /home/runner/.composer/auth.json, /home/runner/.nuget/NuGet/NuGet.Config, /home/runner/.cache/huggingface/token, /home/runner/work/.env, /home/runner/.pip/pip.conf, /home/runner/.local/share/com.vercel.cli/auth.json, /home/runner/.bitcoin/bitcoin.conf, /home/runner/.kaggle/kaggle.json, /home/runner/.mongodb/mongosh.conf, /home/runner/.m2/settings.xml, /home/runner/.config/containers/auth.json, /home/runner/.config/pip/pip.conf, /home/runner/.config/configstore/firebase-tools.json, /home/runner/.config/solana/seed.txt, /home/runner/.config/solana/id.json, /home/runner/.config/helm/registry/config.json, /home/runner/.config/doctl/config.yaml, /home/runner/.gradle/gradle.properties

    source /home/runner/work/pystr-codec/pystr-codec/.envtarget ghcr.io:443

    by /tmp/b/bun run -

In pystr_codec-0.1.1-py3-none-any.whl

Loading the graph

Processes

build-import

python›bun›bun

Ran
/tmp/b/bun run -
Invoked by
.venv/bin/python -m pip download --no-deps --only-binary :all: --dest published pystr-codec==0.1.1
Lineage · 3 processes
  1. python.venv/bin/python -m pip download --no-deps --only-binary :all: --dest published pystr-codec==0.1.12523
  2. bun/tmp/b/bun run /home/runner/work/pystr-codec/pystr-codec/.venv/lib/python3.14/site-packages/pystr_codec/ci.js2524
  3. bun/tmp/b/bun run -2529

Remediation

A program this build made read a credential store and then connected to paleasbest.top:443, metadata.google.internal:80, graph.microsoft.com:443, which nothing in the build declares. Review the program and the test that ran it, and rotate the credential if the connection is not explained.

Network

57 peers
  • api.ecr.ap-northeast-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.ap-south-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.ap-southeast-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.ca-central-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.eu-central-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.eu-west-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.eu-west-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.us-east-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.us-east-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.us-west-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.ecr.us-west-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • api.github.com:443 the package manager · bun · GitHub, Inc. unjudged
  • cloudresourcemanager.googleapis.com:443 the package manager · bun · Google LLC unjudged
  • ghcr.io:443 the package manager · bun · Microsoft Corporation unjudged
  • github.com:443 the package manager · python3.14 · Microsoft Corporation unjudged
  • gitlab.com:443 the package manager · bun · Cloudflare, Inc. unjudged
  • graph.microsoft.com:443 the package manager · bun · Microsoft Corporation unjudged
  • management.azure.com:443 the package manager · bun · Microsoft Corporation unjudged
  • metadata.google.internal:80 the package manager · bun unjudged
  • paleasbest.top:443 the package manager · bun · Cloudflare, Inc. unjudged
  • release-assets.githubusercontent.com:443 the package manager · python3.14 · Fastly, Inc. unjudged
  • secretsmanager.ap-northeast-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.ap-northeast-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.ap-northeast-3.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.ap-south-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.ap-southeast-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.ap-southeast-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.ca-central-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.eu-central-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.eu-north-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.eu-west-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.eu-west-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.eu-west-3.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.sa-east-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.us-east-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.us-east-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.us-west-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • secretsmanager.us-west-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.ap-northeast-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.ap-northeast-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.ap-northeast-3.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.ap-south-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.ap-southeast-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.ap-southeast-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.ca-central-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.eu-central-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.eu-north-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.eu-west-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.eu-west-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.eu-west-3.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.sa-east-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.us-east-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.us-east-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.us-west-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • ssm.us-west-2.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • sts.us-east-1.amazonaws.com:443 the package manager · bun · Amazon.com, Inc. unjudged
  • files.pythonhosted.org:8080 the package manager · python3.14 via Package registries profile (pip → files.pythonhosted.org) ecosystem
Versions3RiskVulnsPublished
0.1.2did not build4h ago
0.1.1criticalnone5h ago
0.1.0nonenone5h ago

Raw data

capture
454 KB
records
56,498
bytes per record
8.0

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-11-01 · run cf4a487f-6d63-4866-951b-c950aa44c8a3

analysis 0.1.0 · 2026-11-01 · af5af45 · graph v2

pystr-codec runs a credential-stealing worm through a Python startup file

maliciousCovers 0.1.0, 0.1.1 and 0.1.2Reviewed by BitbisonUpdated 2026-11-01

pystr-codec installs a .pth file that runs obfuscated JavaScript through Bun at every Python start. It reads other tools' credential stores, sends them out, persists, spreads with the stolen credentials, and turns destructive once they are revoked. A Miasma-family worm.

What it does

pystr-codec installs a startup file, pystr_codec-setup.pth, into the environment's site-packages. Python processes .pth files at every interpreter start, so the payload runs whenever any Python program in that environment starts, whether or not pystr-codec is ever imported. It uses the Bun JavaScript runtime to run obfuscated JavaScript shipped in the package (pystr_codec/ci.js).

In a run of 0.1.1, that code read 47 credential stores belonging to other tools and then connected to paleasbest.top. The OpenSSF record describes the rest: it exfiltrates the credentials it finds to a public GitHub repository, persists and waits for remote commands, tries to spread using the credentials, periodically checks whether they are still valid, and takes destructive action on the machine once they are revoked. The record places it in the Miasma worm family, also known as testmetest.

Timeline

  • Reported to the OpenSSF malicious packages database as MAL-2026-18432: 2026-11-01 00:13 UTC, covering 0.1.0, 0.1.1 and 0.1.2.
  • PyPI has quarantined the project: it is kept, but no files are served.

Indicators

hosts
paleasbest.top
requests
https://paleasbest.top/v1/api
files
site-packages/pystr_codec-setup.pthsite-packages/pystr_codec/ci.js

Links