Skip to content
Open-Source Registry

pypi / zhongyitang / 0.2.5

zhongyitang 0.2.5

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
235
operations
45K
packages
39
compiler runs
3
connections
2
build time
39s
job time
39s
capture
394 KB
records
72K
bytes / record
5.5
run b34857a7-e892-424c-b926-abddf1e3f559 · built 2026-11-06 · complete View on PyPI

Graph

secret-exfil · critical
2

Checks

17 of 19 clear Sensitive data access and transfer Build-time dependency advisories
Build behavior✓▲✓✓✓✓✓✓✓✓✓
Supply chain✓▲✓✓✓✓✓
Pipeline✓

Detections

1
  • Credential store contents reached a network peer
    github.com:443 › github.com:443
    critical

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
github.com:443
Destination
github.com:443
Jobs
build-import
Rule
secret-exfil · zhongyitang

Witness chain

  1. /home/runner/.cloudflared/config.yml
    source
  2. github.com:443via .venv/bin/python /home/runner/work/_temp/exercise.py zhongyitang 079f09075411bf19f627c98d136a38e4f8f2ee12f5e2d6b75cb7320bd762d6c4
    • Sensitive-file read linked to a network connectionfrom /home/runner/.cloudflared/config.yml

      Credential store contents linked to this connection through build-time code: /home/runner/.cloudflared/config.yml

    sink

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/.cloudflared/config.yml

What came before it

Loading the graph

Processes

build-import

python

Ran
.venv/bin/python /home/runner/work/_temp/exercise.py zhongyitang 079f09075411bf19f627c98d136a38e4f8f2ee12f5e2d6b75cb7320bd762d6c4
Invoked by
.venv/bin/python /home/runner/work/_temp/exercise.py zhongyitang 079f09075411bf19f627c98d136a38e4f8f2ee12f5e2d6b75cb7320bd762d6c4

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Network

2 peers
  • github.com:443 zhongyitang's own build code · python3.14 (zhongyitang) · GitHub, Inc. unjudged
  • files.pythonhosted.org:8080 the package manager · python3.14 (zhongyitang) via pypi.org ecosystem
Vulnerabilities6FixSeverity
Dependencies
pip 25.1.1>=26.2.0
CVE-2025-8869pip's fallback tar extraction doesn't check symbolic links point to extraction directorymedium
CVE-2026-13346pip would incorrectly handle doubly-encoded package URLs from indexesmedium
CVE-2026-3219pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP filesmedium
CVE-2026-6357pip Vulnerable to Inclusion of Functionality from Untrusted Control Spheremedium
CVE-2026-8643pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directorymedium
CVE-2026-1703pip Path Traversal vulnerabilitylow

Dependencies

39
Dependencies39Build behaviour
build1.6.1
certifi2026.10.23
cffi2.1.1
charset-normalizer3.5.2
cryptography50.0.2
docutils0.23
id1.6.1
idna3.20
iniconfig2.3.1
jaraco-classes3.4.0
jaraco-context6.1.2
jaraco-functools4.6.0
jeepney0.9.0
keyring25.7.0
markdown-it-py4.2.0
mdurl0.1.2
more-itertools11.2.1
nh30.3.7
packaging26.3
pluggy1.7.0
pycparser3.12
pygments2.21.0
pyproject-hooks1.3.3
pytest9.2.0
readme-renderer46.0
requests2.34.2
requests-toolbelt1.0.0
rfc39862.0.0
rich15.0.0
secretstorage3.5.0
twine7.0.0
urllib32.8.0
hatchling1.33.0
pathspec1.1.1
pip25.1.1
pip26.3
tomlkit0.15.2
trove-classifiers2026.9.21.13
~ip25.1.1

Versions13

Raw data

capture
394 KB
records
72,145
bytes per record
5.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-11-06 · run b34857a7-e892-424c-b926-abddf1e3f559

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2