Skip to content
Open-Source Registry

pypi / rasa-pro / 3.22.0.dev3

rasa-pro 3.22.0.dev3

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnshigh
processes
791
operations
362K
packages
225
compiler runs
3
connections
2
build time
5m 12s
job time
5m 12s
capture
5.4 MB
records
685K
bytes / record
7.9
run 17931dbb-ddad-447c-b203-28f3fa391001 · built 2026-11-05 · complete View on PyPI

Graph

secret-exfil · critical
4

Checks

13 of 19 clear Network activity Sensitive data access and transfer +4 more
Build behavior▲▲✓✓✓✓✓✓✓✓✓
Supply chain▲▲✓✓✓▲▲
Pipeline✓

Detections

4
  • Credential store contents reached a network peer
    raw.githubusercontent.com:443 › raw.githubusercontent.com:443
    critical
  • Package code connected to an undeclared host
    raw.githubusercontent.com:443 › raw.githubusercontent.com:443, pypi.org
    medium
  • Published wheel differs from a build of its source
    rasa_pro 3.22.0.dev3 · discrepancy
    low
  • coloredlogs 15.0.1 installs coloredlogs.pth, which Python runs at every start
    coloredlogs 15.0.1
    low

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
raw.githubusercontent.com:443
Destination
raw.githubusercontent.com:443
Jobs
build-import
Rule
secret-exfil · rasa-pro

Witness chain

  1. /home/runner/work/rasa/rasa/.env
    source
  2. raw.githubusercontent.com:443via /home/runner/work/rasa/rasa/.venv/bin/python -m rasa
    • Sensitive-file read linked to a network connectionfrom /home/runner/work/rasa/rasa/.env

      Credential store contents linked to this connection through build-time code: /home/runner/work/rasa/rasa/.env

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/work/rasa/rasa/.env

What came before it

Loading the graph

Processes

build-import

python›python

Ran
/home/runner/work/rasa/rasa/.venv/bin/python -m rasa
Invoked by
.venv/bin/python /home/runner/work/_temp/exercise.py rasa-pro 94780f59d9fdd2b9dd752241f7d0c1579bbdae7b4e4e500950b6298f96eaaea1
Lineage · 2 processes
  1. python.venv/bin/python /home/runner/work/_temp/exercise.py rasa-pro 94780f59d9fdd2b9dd752241f7d0c1579bbdae7b4e4e500950b6298f96eaaea11767
  2. python/home/runner/work/rasa/rasa/.venv/bin/python -m rasa1774

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

mediumwitnessed

Package code connected to an undeclared host

Unexpected network connection

Subject
raw.githubusercontent.com:443
Destination
raw.githubusercontent.com:443, pypi.org
Jobs
build-import, build-import
Rule
egress · rasa-pro

Evidence

  1. Connection outside the process’s allowed destinationscause

    opened by python

    subject raw.githubusercontent.com:443

    by /home/runner/work/rasa/rasa/.venv/bin/python -c import importlib, pkgutil, sys, threading, time THREAD_WAIT = 3.0 m = importlib.import_module(sys.argv[1]) coun…

  2. Allowed hostssupport

    Declared or allowed hosts: pypi.org

  3. Why it matterscontext

    The package's own code reached this host while the release ran; no manifest, tool profile, network allowlist entry or accepted download covers it.

What came before it · build-import

Loading the graph

What came before it · build-import

Loading the graph

Processes

build-import

python›python

Ran
/home/runner/work/rasa/rasa/.venv/bin/python -c import importlib, pkgutil, sys, threading, time THREAD_WAIT = 3.0 m = importlib.import_module(sys.argv[1]) coun…
Invoked by
.venv/bin/python /home/runner/work/_temp/imports.py rasa-pro
Lineage · 2 processes
  1. python.venv/bin/python /home/runner/work/_temp/imports.py rasa-pro1674
  2. python/home/runner/work/rasa/rasa/.venv/bin/python -c import importlib, pkgutil, sys, threading, time THREAD_WAIT = 3.0 m = importlib.import_module(sys.argv[1]) coun…1676

build-import

python›python

Ran
/home/runner/work/rasa/rasa/.venv/bin/python /home/runner/work/rasa/rasa/.venv/bin/rasa --help
Invoked by
.venv/bin/python /home/runner/work/_temp/imports.py rasa-pro
Lineage · 2 processes
  1. python.venv/bin/python /home/runner/work/_temp/imports.py rasa-pro1674
  2. python/home/runner/work/rasa/rasa/.venv/bin/python /home/runner/work/rasa/rasa/.venv/bin/rasa --help1684

Remediation

Identify the request. If required, declare the host in the relevant manifest or tool profile, or add a reviewed allow_hosts entry. Otherwise remove it.

Detection

lowwitnesseddiscrepancy

Published wheel differs from a build of its source

Published package differs from its source

Subject
rasa_pro 3.22.0.dev3
Jobs
build-import
Rule
package-divergence

Evidence

  1. Published wheel file differs from the buildsupport

    Only in the published wheel: rasa/builder/document_retrieval/local/data/docs_vectors.parquet

  2. Published wheel file differs from the buildsupport

    Only in the published wheel: rasa/builder/document_retrieval/local/data/mantle_docs_vectors.parquet

  3. Wheels comparedcontext

    The published wheel rasa_pro-3.22.0.dev3-py3-none-any.whl against dist/rasa_pro-3.22.0.dev3-py3-none-any.whl, which this job built from the release's source distribution

  4. Why it matterscontext

    The published wheel and the wheel built from the release's source distribution differ in files a build may legitimately vary, such as a generated version file or packaged resources.

Remediation

Compare the published wheel with the release's source before installing it. Pin the release by hash to a wheel you have reviewed, or install from the source distribution.

Detection

lowwitnessed

coloredlogs 15.0.1 installs coloredlogs.pth, which Python runs at every start

Package installs code that runs at every start

Subject
coloredlogs 15.0.1
Jobs
build-import
Rule
startup-hook

Evidence

  1. Installs a module run at every startcause

    coloredlogs 15.0.1 installs coloredlogs.pth at the root of /home/runner/work/rasa/rasa/.venv-develop/lib/python3.14/site-packages, /home/runner/work/rasa/rasa/.venv/lib/python3.14/site-packages. Every Python started in that environment runs it before its own program.

    subject coloredlogs 15.0.1

Remediation

Find out why the package installs code that runs at every Python start. Unless that is its purpose, pin the previous release, rebuild the environment and rotate the credentials the jobs that used it could reach.

Network

2 peers
  • raw.githubusercontent.com:443 rasa-pro's own build code · python3.14 (rasa-pro); rasa (rasa-pro) · Fastly, Inc. unjudged
  • files.pythonhosted.org:8080 the package manager · python3.14 (rasa-pro) via pypi.org ecosystem
Vulnerabilities20FixSeverity
Dependencies
filelock 3.32.7>=4.2.1
CVE-2026-112940filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own fileshigh
CVE-2026-112908filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdmedium
CVE-2026-112909filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathmedium
CVE-2026-112910filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLmedium
CVE-2026-112911filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionmedium
CVE-2026-112915filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutmedium
CVE-2026-112935filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersmedium
CVE-2026-112936filelock: ReadWriteLock follows a symlink at the lock path into SQLitemedium
CVE-2026-112938filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesmedium
CVE-2026-112939filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markermedium
CVE-2026-112907filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breaklow
CVE-2026-112912filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerlow
CVE-2026-112913filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databaselow
pip 25.1.1>=26.2.0
CVE-2025-8869pip's fallback tar extraction doesn't check symbolic links point to extraction directorymedium
CVE-2026-13346pip would incorrectly handle doubly-encoded package URLs from indexesmedium
CVE-2026-3219pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP filesmedium
CVE-2026-6357pip Vulnerable to Inclusion of Functionality from Untrusted Control Spheremedium
CVE-2026-8643pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directorymedium
CVE-2026-1703pip Path Traversal vulnerabilitylow
setuptools 83.0.0>=84.1.0
GHSA-xmj3-9gf7-h52wsetuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Descriptionlow

Dependencies

225
Dependencies225Build behaviour
a2a-sdk1.1.5
absl-py2.4.0
aio-pika9.6.2
aiofiles25.1.0
aiohappyeyeballs2.7.1
aiohttp3.14.5
aiormq6.9.4
aioshutil1.6
aiosignal1.4.0
annotated-doc0.0.5
annotated-types0.8.0
anyio4.16.0
apscheduler3.11.3
attrs26.1.0
audioop-lts0.2.2
aws-msk-iam-sasl-signer-python1.0.2
azure-core1.41.0
azure-identity1.27.0
azure-storage-blob12.31.1
bidict0.24.1
boto31.43.124
botocore1.43.124
build1.6.1
cachecontrol0.14.4
cachetools7.2.8
certifi2026.10.23
cffi2.1.1
charset-normalizer3.5.2
click8.5.0
cloudpickle3.1.2
colorama0.4.6
colorclass2.2.2
coloredlogs15.0.1
colorhash2.3.0
confluent-kafka2.15.1
contourpy1.4.0
cryptography50.0.2
cycler0.12.1
dask2024.12.1
demoji1.1.0
deprecation2.1.0
distro1.9.0
dnspython2.9.2
docopt0.6.2
duoname0.0.2
et-xmlfile2.0.0
faiss-cpu1.14.3
fastapi0.162.0
fastuuid0.14.0
filelock3.32.7
flatbuffers25.12.19
fonttools4.68.0
frozenlist1.8.0
fsspec2026.9.0
google-api-core2.43.2
google-auth2.62.1
google-cloud-core2.8.0
google-cloud-storage3.17.1
google-crc32c1.9.0
google-resumable-media2.11.0
googleapis-common-protos1.76.0
greenlet3.5.6
griffe2.3.2
griffecli2.3.2
griffelib2.3.2
grpcio1.84.2
grpcio-health-checking1.84.2
h110.16.0
h24.4.1
hf-xet1.8.0
hpack4.2.0
html5tagger2.0.0
httpcore1.0.9
httptools0.9.0
httpx0.28.1
httpx-sse0.4.3
huggingface-hub1.33.0
humanfriendly10.0
hvac2.4.0
hyperframe6.1.0
idna3.20
importlib-metadata8.9.0
importlib-resources7.1.0
iniconfig2.3.1
isodate0.7.2
jinja23.1.6
jiter0.18.0
jmespath1.1.0
joblib1.6.0
json-rpc1.15.0
jsonpatch1.42
jsonpickle4.1.4
jsonpointer3.8
jsonschema4.26.0
jsonschema-specifications2025.9.1
jwcrypto1.6.1
kiwisolver1.5.1
langcodes3.5.1
language-data1.4.0
litellm1.105.3
locket1.0.0
marisa-trie1.4.1
markdown-it-py4.2.0
markupsafe3.0.4
matplotlib3.11.2
mcp1.30.0
mdurl0.1.2
miniaudio1.71
msal1.39.0
msal-extensions1.3.1
msgpack1.2.4
multidict6.9.1
networkx3.6.1
numpy2.3.5
onnxruntime1.31.1
openai2.54.0
openpyxl3.1.5
opentelemetry-api1.45.2
opentelemetry-exporter-http-transport0.66b2
opentelemetry-exporter-otlp1.45.2
opentelemetry-exporter-otlp-common0.66b2
opentelemetry-exporter-otlp-proto-common1.45.2
opentelemetry-exporter-otlp-proto-grpc1.45.2
opentelemetry-exporter-otlp-proto-http1.45.2
opentelemetry-proto1.45.2
opentelemetry-sdk1.45.2
opentelemetry-semantic-conventions0.66b2
orjson3.13.0
packaging26.3
pamqp3.3.0
pandas3.1.1
partd1.4.2
pillow13.0.0
pluggy1.7.0
ply3.11
portalocker3.2.0
prompt-toolkit3.0.53
propcache0.5.4
proto-plus1.29.0
protobuf7.36.2
psutil5.9.8
psycopg2-binary2.9.13
pyasn10.6.5
pyasn1-modules0.4.2
pycparser3.12
pydantic2.13.5
pydantic-core2.46.5
pydantic-settings2.16.2
pydot4.0.1
pygments2.21.0
pyjwt2.15.1
pykwalify1.8.0
pymilvus2.6.17
pymongo4.18.3
pyparsing3.3.3
pypred0.4.0
pyproject-hooks1.3.3
pytest9.2.0
python-dateutil2.9.0.post0
python-dotenv1.2.4
python-engineio4.13.5
python-keycloak7.1.1
python-multipart0.0.33
python-socketio5.16.4
pytz2026.2
pyyaml6.0.3
qdrant-client1.19.1
questionary2.1.1
rasa-sdk3.21.2
redis8.1.0
referencing0.37.0
regex2026.9.29
requests2.34.2
requests-toolbelt1.0.0
rich14.2.0
rpds-py2026.9.1
ruamel-yaml0.19.1
s3transfer0.19.3
sanic25.12.1
sanic-jwt1.8.0
sanic-openapi21.12.0
sanic-routing23.12.0
scikit-learn1.7.2
scipy1.16.3
sentry-sdk2.73.0
simple-websocket1.1.0
six1.17.0
sniffio1.3.1
soundfile0.14.0
sqlalchemy2.0.57
sse-starlette3.6.0
starlette1.3.1
structlog26.1.0
structlog-sentry2.2.1
tarsafe0.0.5
tenacity9.1.4
terminaltables3.1.10
threadpoolctl3.7.0
tiktoken0.13.0
tokenizers0.23.3
tomlkit0.15.2
toolz1.2.0
tqdm4.67.3
tracerite2.6.5
types-cachetools7.0.0.20260713
typing-extensions4.16.0
typing-inspection0.4.5
typing-utils0.1.0
tzlocal5.4.5
ujson5.13.0
urllib32.8.0
uvicorn0.54.0
uvloop0.23.0
wcwidth0.9.4
websockets15.0.1
werkzeug3.1.9
wsproto1.3.2
yarl1.25.1
zipp4.1.2
pip25.1.1
pip26.3
poetry-core2.5.0
setuptools83.0.0
wheel0.48.0
~ip25.1.1

Versions500

Raw data

capture
5.4 MB
records
684,858
bytes per record
7.9

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-11-05 · run 17931dbb-ddad-447c-b203-28f3fa391001

analysis 0.1.0 · 2026-11-04 · 5e67feb · graph v2