{"profiles":[{"schema_version":"0.1","run":{"profile_id":"019f4867-bbe2-71f9-9bac-923de0da80f3","run_id":"29045269057","repository":"umar-sik/OpenHands","github_web_origin":"https://github.com","workflow":"Run UI Component Build","job":"ui-build","runner_os":"Linux","runner_arch":"X64","actor":"umar-sik","start_time":"2026-07-09T19:43:05.686761Z","end_time":"2026-07-09T19:43:05.686761Z","commit_sha":"f1f04c64c2f06ffc815f3c5c9bb36a3e9f731885","ref":"refs/pull/1/merge","agent_id":"6bdd3df1-3c6a-4417-af79-83fd574d25c6"},"egress":{"unique_domains":[{"domain":"registry.npmjs.org","process":"bun","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","bun"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"104.16.1.34","result":"pass","process_detail":"bun install --frozen-lockfile"},{"domain":"localhost","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"localhost","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/tmp/provjobd1825345188"},{"domain":"localhost","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/tmp/provjobd1825345188"},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"hosted-compute-watchdog-prod-iad-01.githubapp","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/tmp/provjobd1825345188"},{"domain":"hosted-compute-watchdog-prod-iad-01.githubapp","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-db52c2cf8be544.github.com","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.114.21","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"results-receiver.actions.githubusercontent","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.114.21","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"blob.bn3prdstrz12a.store.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"20.209.112.225","result":"pass","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"blob.bn3prdstrz12a.trafficmanager.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"20.209.112.225","result":"pass","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"productionresultssa6.blob.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"20.209.112.225","result":"pass","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"}],"total_domains":9,"flagged_domains":0},"assertions":[{"id":"no_bad_egress_domain","result":"ATTENTION","details":"A process contacted a bad network domain.","evidence":[],"assertion_id":"no_bad_egress_domain","class":"Network Egress","class_id":"Network Egress"},{"id":"no_binary_execution_and_deletion","result":"PASS","details":"A program was executed, and then its file was deleted.","evidence":[],"assertion_id":"no_binary_execution_and_deletion","class":"Stealth","class_id":"Stealth"},{"id":"no_code_injection_via_proc_memory","result":"FAIL","details":"A process initiated code injection via /proc/{pid}/mem access.","evidence":[{"timestamp":"2026-07-09T19:42:54.906555528Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"event_id":"","processArgs":"/tmp/provjobd1825345188"},{"timestamp":"2026-07-09T19:42:54.906555528Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"event_id":"","processArgs":"/opt/hca/hosted-compute-agent"}],"assertion_id":"no_code_injection_via_proc_memory","class":"Privilege Escalation","class_id":"Privilege Escalation","detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1813,"process":"provjobd1825345188","executable":"/tmp/provjobd1825345188","arguments":"/tmp/provjobd1825345188","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"]},{"pid":1813,"process":"hosted-compute-agent","executable":"/opt/hca/hosted-compute-agent","arguments":"/opt/hca/hosted-compute-agent","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"]}]}]}],"telemetry":{"total_events":12,"total_connections":10,"unique_domains":9},"score":null,"profile_detections":[{"class_id":"Privilege Escalation","digested_detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1813,"process":"provjobd1825345188","executable":"/tmp/provjobd1825345188","arguments":"/tmp/provjobd1825345188","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"]},{"pid":1813,"process":"hosted-compute-agent","executable":"/opt/hca/hosted-compute-agent","arguments":"/opt/hca/hosted-compute-agent","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"]}]}]}],"workload_identity":null,"filesystem":null,"execution":null}],"count":1,"profile":{"schema_version":"0.1","run":{"profile_id":"019f4867-bbe2-71f9-9bac-923de0da80f3","run_id":"29045269057","repository":"umar-sik/OpenHands","github_web_origin":"https://github.com","workflow":"Run UI Component Build","job":"ui-build","runner_os":"Linux","runner_arch":"X64","actor":"umar-sik","start_time":"2026-07-09T19:43:05.686761Z","end_time":"2026-07-09T19:43:05.686761Z","commit_sha":"f1f04c64c2f06ffc815f3c5c9bb36a3e9f731885","ref":"refs/pull/1/merge","agent_id":"6bdd3df1-3c6a-4417-af79-83fd574d25c6"},"egress":{"unique_domains":[{"domain":"registry.npmjs.org","process":"bun","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","bash","bun"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"104.16.1.34","result":"pass","process_detail":"bun install --frozen-lockfile"},{"domain":"localhost","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"localhost","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/tmp/provjobd1825345188"},{"domain":"localhost","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow","interpreter_shell_spawn"],"protocol":"UDP","remote_address":"127.0.0.53","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/tmp/provjobd1825345188"},{"domain":"glb-2a3c35-public-internal.githubapp.com","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"hosted-compute-watchdog-prod-iad-01.githubapp","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/tmp/provjobd1825345188"},{"domain":"hosted-compute-watchdog-prod-iad-01.githubapp","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"status":"ok","reason":null,"event_ids":[],"detections":["code_modification_through_procfs","flow"],"protocol":"TCP","remote_address":"140.82.113.23","result":"attention","process_detail":"/opt/hca/hosted-compute-agent"},{"domain":"glb-db52c2cf8be544.github.com","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.114.21","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"results-receiver.actions.githubusercontent","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow","interpreter_shell_spawn"],"protocol":"TCP","remote_address":"140.82.114.21","result":"attention","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"blob.bn3prdstrz12a.store.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"20.209.112.225","result":"pass","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"blob.bn3prdstrz12a.trafficmanager.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"20.209.112.225","result":"pass","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"},{"domain":"productionresultssa6.blob.core.windows.net","process":"node","ancestry":["systemd","hosted-compute-agent","Runner.Listener","Runner.Worker","node"],"status":"ok","reason":null,"event_ids":[],"detections":["flow"],"protocol":"TCP","remote_address":"20.209.112.225","result":"pass","process_detail":"/home/runner/actions-runner/cached/2.335.1/externals/node24/bin/node /home/runner/work/_actions/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/dist/setup/index.js"}],"total_domains":9,"flagged_domains":0},"assertions":[{"id":"no_bad_egress_domain","result":"ATTENTION","details":"A process contacted a bad network domain.","evidence":[],"assertion_id":"no_bad_egress_domain","class":"Network Egress","class_id":"Network Egress"},{"id":"no_binary_execution_and_deletion","result":"PASS","details":"A program was executed, and then its file was deleted.","evidence":[],"assertion_id":"no_binary_execution_and_deletion","class":"Stealth","class_id":"Stealth"},{"id":"no_code_injection_via_proc_memory","result":"FAIL","details":"A process initiated code injection via /proc/{pid}/mem access.","evidence":[{"timestamp":"2026-07-09T19:42:54.906555528Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"provjobd1825345188","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"],"event_id":"","processArgs":"/tmp/provjobd1825345188"},{"timestamp":"2026-07-09T19:42:54.906555528Z","event_type":"code_modification_through_procfs","domain":"","remote_address":"","process":"hosted-compute-agent","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"],"event_id":"","processArgs":"/opt/hca/hosted-compute-agent"}],"assertion_id":"no_code_injection_via_proc_memory","class":"Privilege Escalation","class_id":"Privilege Escalation","detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1813,"process":"provjobd1825345188","executable":"/tmp/provjobd1825345188","arguments":"/tmp/provjobd1825345188","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"]},{"pid":1813,"process":"hosted-compute-agent","executable":"/opt/hca/hosted-compute-agent","arguments":"/opt/hca/hosted-compute-agent","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"]}]}]}],"telemetry":{"total_events":12,"total_connections":10,"unique_domains":9},"score":null,"profile_detections":[{"class_id":"Privilege Escalation","digested_detections":[{"class_id":"Privilege Escalation","assertion_id":"no_code_injection_via_proc_memory","result":"fail","metadata":{"kind":"code_modification_through_procfs","name":"code_modification_through_procfs_0","format":"file_access","version":"1.0","description":"Code modification through procfs","tactic":"privilege_escalation","technique":"process_injection","subtechnique":"proc_memory","importance":"high","documentation":"https://jibril.garnet.ai/detections/file-access/code_modification_through_procfs"},"score":{"source":"jibril","severity":75,"severity_level":"high","confidence":0.99,"risk_score":74.25},"proc_trees":[{"pid":1813,"process":"provjobd1825345188","executable":"/tmp/provjobd1825345188","arguments":"/tmp/provjobd1825345188","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","sudo","provjobd1825345188"]},{"pid":1813,"process":"hosted-compute-agent","executable":"/opt/hca/hosted-compute-agent","arguments":"/opt/hca/hosted-compute-agent","github_step":"99. Runner Processes","ancestry":["systemd","hosted-compute-agent","hosted-compute-agent","hosted-compute-agent"]}]}]}],"workload_identity":null,"filesystem":null,"execution":null}}