{"profiles":[{"schema_version":"0.1","run":{"profile_id":"019f4865-0f47-7fdb-a1ab-a7be4eeb3c0d","run_id":"29045107690","repository":"umar-sik/OpenHands","github_web_origin":"https://github.com","workflow":"Run UI Component Build","job":"ui-build","runner_os":"Linux","runner_arch":"X64","actor":"umar-sik","start_time":"2026-07-09T19:40:10.429356Z","end_time":"2026-07-09T19:40:10.429356Z","commit_sha":"063d7f407cabc328711cd7fa8cde3316fd788233","ref":"refs/pull/1/merge","agent_id":"68559eed-acb8-4b19-b06f-6ccd1d2f4a12"},"egress":{"unique_domains":[{"domain":"registry.npmjs.org","process":"bun","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","bun"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec"],"protocol":"TCP","remote_address":"104.16.0.34","result":"attention","process_detail":"bun install --frozen-lockfile"},{"domain":"localhost","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"curl -X GET https://api.garnet.ai"},{"domain":"localhost","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"localhost","process":"bun","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","bun"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"bun install --frozen-lockfile"},{"domain":"localhost","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-db52c2cf8be544.github.com","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.113.22","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"results-receiver.actions.githubusercontent","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.113.22","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"hosted-compute-watchdog-prod-iad-02.githubapp","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.114.24","result":"pass","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.114.24","result":"pass","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"api.garnet.ai","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"172.67.75.100","result":"pass","process_detail":"curl -X GET https://api.garnet.ai"},{"domain":"blob.bn3prdstrz12a.store.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"20.209.112.225","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"blob.bn3prdstrz12a.trafficmanager.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"20.209.112.225","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"productionresultssa6.blob.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"20.209.112.225","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"}],"total_domains":10,"flagged_domains":0},"assertions":[{"id":"no_bad_egress_domain","result":"ATTENTION","details":"A process contacted a bad network domain.","evidence":[],"assertion_id":"no_bad_egress_domain","class":"Network Egress","class_id":"Network Egress"},{"id":"no_binary_execution_and_deletion","result":"PASS","details":"A program was executed, and then its file was deleted.","evidence":[],"assertion_id":"no_binary_execution_and_deletion","class":"Stealth","class_id":"Stealth"},{"id":"no_code_injection_via_proc_memory","result":"FAIL","details":"A process initiated code injection via /proc/{pid}/mem access.","evidence":[{"timestamp":"2026-07-09T19:40:10.404452061Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"provjobd34581330","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"],"event_id":"","processArgs":"/tmp/provjobd34581330"},{"timestamp":"2026-07-09T19:40:10.404452061Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"provjobd34581330","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"],"event_id":"","processArgs":"/tmp/provjobd34581330"}],"assertion_id":"no_code_injection_via_proc_memory","class":"Privilege Escalation","class_id":"Privilege Escalation","detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]},{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]}]}]}],"telemetry":{"total_events":14,"total_connections":12,"unique_domains":10},"score":null,"profile_detections":[{"class_id":"Privilege Escalation","digested_detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]},{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]}]}]}],"workload_identity":null,"filesystem":null,"execution":null}],"count":1,"profile":{"schema_version":"0.1","run":{"profile_id":"019f4865-0f47-7fdb-a1ab-a7be4eeb3c0d","run_id":"29045107690","repository":"umar-sik/OpenHands","github_web_origin":"https://github.com","workflow":"Run UI Component Build","job":"ui-build","runner_os":"Linux","runner_arch":"X64","actor":"umar-sik","start_time":"2026-07-09T19:40:10.429356Z","end_time":"2026-07-09T19:40:10.429356Z","commit_sha":"063d7f407cabc328711cd7fa8cde3316fd788233","ref":"refs/pull/1/merge","agent_id":"68559eed-acb8-4b19-b06f-6ccd1d2f4a12"},"egress":{"unique_domains":[{"domain":"registry.npmjs.org","process":"bun","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","bun"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec"],"protocol":"TCP","remote_address":"104.16.0.34","result":"attention","process_detail":"bun install --frozen-lockfile"},{"domain":"localhost","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"curl -X GET https://api.garnet.ai"},{"domain":"localhost","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"localhost","process":"bun","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","bun"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"bun install --frozen-lockfile"},{"domain":"localhost","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","hidden_elf_exec","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-db52c2cf8be544.github.com","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.113.22","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"results-receiver.actions.githubusercontent","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.113.22","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"hosted-compute-watchdog-prod-iad-02.githubapp","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.114.24","result":"pass","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"140.82.114.24","result":"pass","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"api.garnet.ai","process":"curl","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","curl"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"172.67.75.100","result":"pass","process_detail":"curl -X GET https://api.garnet.ai"},{"domain":"blob.bn3prdstrz12a.store.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"20.209.112.225","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"blob.bn3prdstrz12a.trafficmanager.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"20.209.112.225","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"productionresultssa6.blob.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"20.209.112.225","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"}],"total_domains":10,"flagged_domains":0},"assertions":[{"id":"no_bad_egress_domain","result":"ATTENTION","details":"A process contacted a bad network domain.","evidence":[],"assertion_id":"no_bad_egress_domain","class":"Network Egress","class_id":"Network Egress"},{"id":"no_binary_execution_and_deletion","result":"PASS","details":"A program was executed, and then its file was deleted.","evidence":[],"assertion_id":"no_binary_execution_and_deletion","class":"Stealth","class_id":"Stealth"},{"id":"no_code_injection_via_proc_memory","result":"FAIL","details":"A process initiated code injection via /proc/{pid}/mem access.","evidence":[{"timestamp":"2026-07-09T19:40:10.404452061Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"provjobd34581330","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"],"event_id":"","processArgs":"/tmp/provjobd34581330"},{"timestamp":"2026-07-09T19:40:10.404452061Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"provjobd34581330","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"],"event_id":"","processArgs":"/tmp/provjobd34581330"}],"assertion_id":"no_code_injection_via_proc_memory","class":"Privilege Escalation","class_id":"Privilege Escalation","detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]},{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]}]}]}],"telemetry":{"total_events":14,"total_connections":12,"unique_domains":10},"score":null,"profile_detections":[{"class_id":"Privilege Escalation","digested_detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]},{"pid":1837,"process":"provjobd34581330","executable":"/tmp/provjobd34581330","arguments":"/tmp/provjobd34581330","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd34581330"]}]}]}],"workload_identity":null,"filesystem":null,"execution":null}}