{"profiles":[{"schema_version":"0.1","run":{"profile_id":"019d30a7-2bc2-7b91-9c1f-ba56f5af2a0b","run_id":"23662517211","repository":"jadoonf/pypi-analysis-feed","github_web_origin":"https://github.com","workflow":"Garnet: telnyx TeamPCP supply chain replay","job":"telnyx-replay","runner_os":"Linux","runner_arch":"X64","actor":"jadoonf","start_time":"2026-03-27T18:55:55.324972Z","end_time":"2026-03-27T18:55:55.324972Z","commit_sha":"7d41ba07152ff346afd94211d98cb511147c76f0","ref":"refs/heads/main","agent_id":"520571c7-9979-409f-9830-ab3ff28b7c2c"},"egress":{"unique_domains":[{"domain":"localhost","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"localhost","process":"provjobd548272256","ancestry":["systemd","hosted-compute-agent","sudo","provjobd548272256"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"localhost","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"localhost","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"140.82.113.23","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"pass","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"GitHub, Inc.","org":"GitHub, Inc.","asname":"GITHUB"}},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"provjobd548272256","ancestry":["systemd","hosted-compute-agent","sudo","provjobd548272256"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.113.24","result":"pass","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"GitHub, Inc.","org":"GitHub, Inc.","asname":"GITHUB"}},{"domain":"hosted-compute-watchdog-prod-iad-02.githubapp","process":"provjobd548272256","ancestry":["systemd","hosted-compute-agent","sudo","provjobd548272256"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.113.24","result":"pass","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"GitHub, Inc.","org":"GitHub, Inc.","asname":"GITHUB"}},{"domain":"dualstack.python.map.fastly.net","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"dualstack.python.map.fastly.net","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"files.pythonhosted.org","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"files.pythonhosted.org","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"pypi.org","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"151.101.0.223","result":"attention","remote_geo_info":{"latitude":45.5019,"longitude":-73.5674,"continent":"North America","continent_code":"NA","country":"Canada","country_code":"CA","region":"QC","region_name":"Quebec","city":"Montreal","isp":"Fastly, Inc.","org":"Fastly, Inc.","asname":"FASTLY"}},{"domain":"pypi.org","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"151.101.128.223","result":"attention","remote_geo_info":{"latitude":45.5019,"longitude":-73.5674,"continent":"North America","continent_code":"NA","country":"Canada","country_code":"CA","region":"QC","region_name":"Quebec","city":"Montreal","isp":"Fastly, Inc.","org":"Fastly, Inc.","asname":"FASTLY"}},{"domain":"raw.githubusercontent.com","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","plaintext_communication"],"protocol":"TCP","remote_address":"185.199.109.133","result":"attention","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"Fastly, Inc.","org":"GitHub, Inc","asname":"FASTLY"}},{"domain":"83.142.209.203","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","python3.11","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["code_on_the_fly","exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"83.142.209.203","result":"attention","remote_geo_info":{"latitude":50.4504,"longitude":30.5245,"continent":"Europe","continent_code":"EU","country":"Ukraine","country_code":"UA","region":"30","region_name":"Kyiv City","city":"Kyiv","isp":"Ghosty Networks LLC","org":"Demenin B.V","asname":"GHOSTYNETWORKS"}},{"domain":"83.142.209.203","process":"python3.11","ancestry":["systemd","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["code_on_the_fly","exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"83.142.209.203","result":"attention","remote_geo_info":{"latitude":50.4504,"longitude":30.5245,"continent":"Europe","continent_code":"EU","country":"Ukraine","country_code":"UA","region":"30","region_name":"Kyiv City","city":"Kyiv","isp":"Ghosty Networks LLC","org":"Demenin B.V","asname":"GHOSTYNETWORKS"}}],"total_domains":9,"flagged_domains":0},"assertions":[{"id":"no_bad_egress_domain","result":"PASS","details":"No domains matched known bad lists","evidence":[]}],"telemetry":{"total_events":10,"total_connections":10,"unique_domains":7},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":1},"workload_identity":null,"filesystem":null,"execution":null}],"count":1,"profile":{"schema_version":"0.1","run":{"profile_id":"019d30a7-2bc2-7b91-9c1f-ba56f5af2a0b","run_id":"23662517211","repository":"jadoonf/pypi-analysis-feed","github_web_origin":"https://github.com","workflow":"Garnet: telnyx TeamPCP supply chain replay","job":"telnyx-replay","runner_os":"Linux","runner_arch":"X64","actor":"jadoonf","start_time":"2026-03-27T18:55:55.324972Z","end_time":"2026-03-27T18:55:55.324972Z","commit_sha":"7d41ba07152ff346afd94211d98cb511147c76f0","ref":"refs/heads/main","agent_id":"520571c7-9979-409f-9830-ab3ff28b7c2c"},"egress":{"unique_domains":[{"domain":"localhost","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"localhost","process":"provjobd548272256","ancestry":["systemd","hosted-compute-agent","sudo","provjobd548272256"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"localhost","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"localhost","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow","plaintext_communication"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention"},{"domain":"140.82.113.23","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"pass","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"GitHub, Inc.","org":"GitHub, Inc.","asname":"GITHUB"}},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"provjobd548272256","ancestry":["systemd","hosted-compute-agent","sudo","provjobd548272256"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.113.24","result":"pass","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"GitHub, Inc.","org":"GitHub, Inc.","asname":"GITHUB"}},{"domain":"hosted-compute-watchdog-prod-iad-02.githubapp","process":"provjobd548272256","ancestry":["systemd","hosted-compute-agent","sudo","provjobd548272256"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.113.24","result":"pass","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"GitHub, Inc.","org":"GitHub, Inc.","asname":"GITHUB"}},{"domain":"dualstack.python.map.fastly.net","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"dualstack.python.map.fastly.net","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"files.pythonhosted.org","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"files.pythonhosted.org","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"146.75.76.223","result":"attention","remote_geo_info":{"latitude":41.8835,"longitude":-87.6305,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"IL","region_name":"Illinois","city":"Chicago","isp":"Fastly, Inc.","org":"Fastly, Inc","asname":"FASTLY"}},{"domain":"pypi.org","process":"pip","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"151.101.0.223","result":"attention","remote_geo_info":{"latitude":45.5019,"longitude":-73.5674,"continent":"North America","continent_code":"NA","country":"Canada","country_code":"CA","region":"QC","region_name":"Quebec","city":"Montreal","isp":"Fastly, Inc.","org":"Fastly, Inc.","asname":"FASTLY"}},{"domain":"pypi.org","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","pip","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"151.101.128.223","result":"attention","remote_geo_info":{"latitude":45.5019,"longitude":-73.5674,"continent":"North America","continent_code":"NA","country":"Canada","country_code":"CA","region":"QC","region_name":"Quebec","city":"Montreal","isp":"Fastly, Inc.","org":"Fastly, Inc.","asname":"FASTLY"}},{"domain":"raw.githubusercontent.com","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","plaintext_communication"],"protocol":"TCP","remote_address":"185.199.109.133","result":"attention","remote_geo_info":{"latitude":37.7823,"longitude":-122.391,"continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"CA","region_name":"California","city":"San Francisco","isp":"Fastly, Inc.","org":"GitHub, Inc","asname":"FASTLY"}},{"domain":"83.142.209.203","process":"python3.11","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","python3.11","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["code_on_the_fly","exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"83.142.209.203","result":"attention","remote_geo_info":{"latitude":50.4504,"longitude":30.5245,"continent":"Europe","continent_code":"EU","country":"Ukraine","country_code":"UA","region":"30","region_name":"Kyiv City","city":"Kyiv","isp":"Ghosty Networks LLC","org":"Demenin B.V","asname":"GHOSTYNETWORKS"}},{"domain":"83.142.209.203","process":"python3.11","ancestry":["systemd","python3.11"],"status":"ok","reason":null,"event_ids":[],"detections":["code_on_the_fly","exec_from_unusual_dir","flow"],"protocol":"TCP","remote_address":"83.142.209.203","result":"attention","remote_geo_info":{"latitude":50.4504,"longitude":30.5245,"continent":"Europe","continent_code":"EU","country":"Ukraine","country_code":"UA","region":"30","region_name":"Kyiv City","city":"Kyiv","isp":"Ghosty Networks LLC","org":"Demenin B.V","asname":"GHOSTYNETWORKS"}}],"total_domains":9,"flagged_domains":0},"assertions":[{"id":"no_bad_egress_domain","result":"PASS","details":"No domains matched known bad lists","evidence":[]}],"telemetry":{"total_events":10,"total_connections":10,"unique_domains":7},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":1},"workload_identity":null,"filesystem":null,"execution":null}}