garnet-labs/posthog

Kernel-recorded by the Garnet eBPF sensorpinned to commit f3dbca3 (merge ref)

Garnet Runtime Visibility/dep-install

run 309612256112026-08-04 23:53:38 UTC

Network Egress

23 destinations · 23 flows · 10 processes

systemd
- systemd
  - systemd
    - Runner.Worker
      - bash
        node
        node
        node
        node
        nodejs.org104.16.212.131:443 (https) · tcp(detection: hidden_elf_exec)
        nodejs.org104.16.213.131:443 (https) · tcp
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
        github.com140.82.113.3:443 (https) · tcp
        release-assets.githubusercontent.com185.199.108.133:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
        release-assets.githubusercontent.com185.199.110.133:443 (https) · tcp
        registry.npmjs.org104.16.0.34:443 (https) · tcp
        registry.npmjs.org104.16.1.34:443 (https) · tcp(detection: interpreter_shell_spawn)
        example.com104.20.23.154:443 (https) · tcp
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
        codeload.github.com140.82.114.9:443 (https) · tcp
      - MainThread
        MainThread
        registry.npmjs.org104.16.1.34:443 (https) · tcp(detection: interpreter_shell_spawn)
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
        api.github.com140.82.112.6:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
        github.com140.82.114.4:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
        release-assets.githubusercontent.com185.199.108.133:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
      - localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
    - provjobd3084085
      - localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
  - ip6-allroutersff02::2:0 (reserved) · icmpv6
- hosted-compute-agentRunner.ListenerRunner.Worker
  - node
    - node
      - registry.npmjs.org104.16.1.34:443 (https) · tcp(detection: interpreter_shell_spawn)
      - localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
    - localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: hidden_elf_exec)(detection: interpreter_shell_spawn)
    - api.github.com140.82.112.6:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
    - github.com140.82.114.4:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
    - release-assets.githubusercontent.com185.199.108.133:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)

Assertions

1 hit

ATTENTIONno_bad_egress_domain

Workload

Repositorygarnet-labs/posthog

WorkflowGarnet Runtime Visibility

Jobdep-install

Run ID30961225611

Profile UUID019fcf32-744e-7741-9867-9157ec8a81c0

Commit SHAf3dbca3e93db6ffaa57812588f0e3d98d56687ba(merge ref)

Refrefs/pull/38/merge

Timestamp2026-08-04 23:53:38 UTC

💡 How to read this

Runner.Worker
- bash
  - curl
    - example.com
    - localhost(dns resolver)