garnet-labs/posthog

Kernel-recorded by the Garnet eBPF sensorpinned to commit e90750f (merge ref)

demo — keyv Shai-Hulud install-time replica/install

run 310729275932026-08-06 05:03:41 UTC

Network Egress

7 destinations · 7 flows · 4 processes

systemd
- hosted-compute-agent[1816 · hosted-compute-agent]runner infrastructure
  - Runner.Listener
    - Runner.Worker
      - bash
        node[2369 · node]step: 1. Read manifest and install pinned tarball
        dash
        node
        node[2392 · node]
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)
        example.com172.66.147.243:443 (https) · tcp(detection: exec_from_unusual_dir)
        httpbin.org3.216.212.208:443 (https) · tcp(detection: exec_from_unusual_dir)
        registry.npmjs.org104.16.11.34:443 (https) · tcp(detection: exec_from_unusual_dir)
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)
      - node[2318 · node]runner infrastructure
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)
        api.github.com140.82.112.6:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
        github.com140.82.114.4:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
        release-assets.githubusercontent.com185.199.110.133:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)

Assertions

1 hit

ATTENTIONno_bad_egress_domain

Workload

Repositorygarnet-labs/posthog

Workflowdemo — keyv Shai-Hulud install-time replica

Jobinstall

Run ID31072927593

Profile UUID019fd574-af91-7fe1-8e92-638b988e7657

Commit SHAe90750fdca74be8d23f91199e3ddfa42c80dfa10(merge ref)

Refrefs/pull/77/merge

Timestamp2026-08-06 05:03:41 UTC

💡 How to read this

Runner.Worker
- bash
  - curl
    - example.com
    - localhost(dns resolver)