{"artifacts":[{"built_by":["build"],"declared":true,"digest":"9a7b2588337f4f3e04b1d15e6a8dddf071f3e58f509f96b5e3ea40e94c239d5c","findings":[],"graph":{"caption":["Built from ironworm. Nothing it was made from was downloaded during the build."],"edges":[{"count":1,"files":{"witnessed":1},"from":"s:compile:c","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:object"},{"count":1,"files":{"witnessed":1},"from":"s:compile:c","label":"wrote","rels":["wrote"],"tie":"witnessed","ties":{"witnessed":1},"to":"t:source:asm"},{"count":2,"files":{"witnessed":1},"from":"s:link","label":"named as its output by the command, wrote","rels":["requested","wrote"],"tie":"witnessed","ties":{"declared":1,"witnessed":1},"to":"t:executable"},{"count":1,"files":{"witnessed":1},"from":"t:executable","label":"is","rels":["is"],"tie":"witnessed","ties":{"witnessed":1},"to":"a:artifact"},{"count":1,"files":{"declared":1},"from":"t:object","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1},"to":"s:link"},{"count":1,"files":{"declared":1},"from":"t:source:asm","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1},"to":"s:compile:c"},{"count":1,"files":{"declared":1},"from":"u:checkout","label":"read into","rels":["fed"],"tie":"declared","ties":{"declared":1},"to":"s:compile:c"}],"groups":[{"count":2,"family":"c","id":"s:compile:c","kind":"stage","label":"Compiled (C/C++)","lane":"stage","programs":{"cc1":1,"x86_64-linux-gnu-as":1},"rank":1,"stage":"compile","sub":"cc1, x86_64-linux-gnu-as · 2 runs","tone":"ok"},{"count":2,"id":"s:link","kind":"stage","label":"Linked","lane":"stage","programs":{"collect2":1,"ld":1},"rank":4,"stage":"link","sub":"collect2, ld · 2 runs","tone":"ok"},{"count":1,"id":"t:executable","kind":"type","label":"Programs","lane":"made","rank":5,"sub":"1 program · ran","tone":"ok","type":"executable","typed_by":{"use":1},"versions":1},{"count":1,"id":"t:object","kind":"type","label":"Object files","lane":"made","rank":3,"sub":"1 object · stated by the compiler","tone":"ok","type":"object","typed_by":{"producer":1},"versions":1},{"count":1,"family":"asm","id":"t:source:asm","kind":"type","label":"Assembly sources","lane":"made","rank":2,"sub":"1 source file · stated by the compiler","tone":"ok","type":"source","typed_by":{"producer":1},"versions":1},{"arrival":"checkout","count":1,"id":"u:checkout","kind":"unit","label":"ironworm","lane":"input","rank":0,"sub":"1 file · from the checkout","tone":"ok","unit":{"kind":"checkout"},"versions":1},{"artifact_kind":"file","count":1,"id":"a:artifact","kind":"artifact","label":"greeter","lane":"artifact","rank":6,"state":"retained","sub":"file · retained","tone":"ok"}],"schema":2,"size":{"disputed":0,"edges":7,"hows":{"window":3},"nodes":8,"ties":{"declared":3},"typed_by":{"producer":2,"use":1}}},"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"clean"},"kind":"file","license":{"classes":{},"compatibility":null,"declared_state":"none","inherited":null,"product":null,"restrictive":[],"undetermined":{}},"name":"greeter","role":"retained","shipments":[],"slug":"greeter","state":"retained","vulnerabilities":[],"witnessed":true,"witnessed_size":{"objects":4,"processes":4}}],"built":true,"checks":[{"description":"Network activity","examined":{"connections":1,"processes":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"network-activity","state":"findings"},{"description":"Sensitive data access and transfer","examined":{"flows":236},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"sensitive-data","state":"findings"},{"description":"Cross-process access","examined":{"operations":0,"processes":106},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"process-interaction","state":"clean"},{"description":"Build file changes","examined":{"trees":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"tree-integrity","state":"clean"},{"description":"Build script activity","examined":{"scripts":2},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"build-time-code","state":"clean"},{"description":"Data flow analysis","examined":{"objects":1},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"output-provenance","state":"clean"},{"description":"Filesystem writes","examined":{"trees":4,"writes":11},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"filesystem-writes","state":"clean"},{"description":"Context collection","examined":{"processes":106},"group":"behavior","group_label":"Build behavior","jobs":1,"jobs_unchecked":0,"key":"environment","state":"clean"},{"description":"Known vulnerabilities","examined":{"feeds":0,"packages":1},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"known-vulnerabilities","state":"not checked"},{"description":"Build-time dependency advisories","examined":{"feeds":0,"scripts":2},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"build-time-advisories","state":"not checked"},{"description":"Dependency advisories","examined":{"feeds":0,"packages":1},"group":"supply","group_label":"Supply chain","jobs":0,"jobs_unchecked":1,"key":"dependency-notices","state":"not checked"},{"description":"Declared and observed dependencies","examined":{"lockfiles":1,"packages":1},"group":"supply","group_label":"Supply chain","jobs":1,"jobs_unchecked":0,"key":"declared-dependencies","state":"clean"},{"description":"Dependency and toolchain versions","examined":{"packages":1,"sources":0},"group":"supply","group_label":"Supply chain","jobs":1,"jobs_unchecked":0,"key":"source-pinning","state":"clean"},{"description":"Pipeline coverage","examined":{"captured":1,"jobs":0},"group":"pipeline","group_label":"Pipeline","jobs":1,"jobs_unchecked":0,"key":"pipeline-coverage","state":"clean"}],"counts":{"detections":2,"discrepancies":0,"posture":0,"suppressed":0,"vulnerabilities":0},"coverage":{"captured":1,"declared":0,"missing":[]},"findings":[{"affects":"build","check":"sensitive-data","confidence":"witnessed","evidence":{"claims":[{"label":"Sensitive-file read linked to a network connection","process":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030},"role":"cause","subjects":[{"kind":"file","path":"/home/bb/work/ironworm/.npmrc","role":"source"},{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n2","port":443,"proto":"tcp","role":"target"}],"text":"Credential store contents linked to this connection through build-time code: /home/bb/work/ironworm/.npmrc","type":"secret.reached_peer","values":{}}],"evidence":["Credential store contents linked to this connection through build-time code: /home/bb/work/ironworm/.npmrc"],"remediation":"Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.","witness":[{"kind":"file","label":"/home/bb/work/ironworm/.npmrc","node":"n1","path":"/home/bb/work/ironworm/.npmrc","role":"source","via":null},{"host":"18.238.80.121","kind":"connection","label":"18.238.80.121:443","node":"n2","path":null,"port":443,"role":"sink","via":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030}}]},"jobs":[{"actor":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030},"chain":["systemd","sshd:","sshd-session:","…","node","phone-home"],"graph":{"file":"finding-0c0000000000000000000000010000000000000000000000.json","job":0},"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":6835},{"argv":"sshd-session: bb [priv]","exe":null,"pid":6918},{"argv":"sshd-session: bb@notty","exe":null,"pid":6973},{"argv":"sudo","exe":null,"pid":6974},{"argv":"sh","exe":"/usr/bin/dash","pid":6976},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build","exe":"/usr/sbin/runuser","pid":7007},{"argv":"sh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build","exe":"/usr/bin/dash","pid":7008},{"argv":"/usr/bin/env node /usr/bin/npm install --no-audit --no-fund","exe":"/usr/share/nodejs/npm/bin/npm-cli.js","pid":7009},{"argv":"node /usr/bin/npm install --no-audit --no-fund","exe":"/usr/bin/node","pid":7019},{"argv":"sh -c node scripts/preinstall.js","exe":"/usr/bin/dash","pid":7020},{"argv":"node scripts/preinstall.js","exe":"/usr/bin/node","pid":7021},{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030}],"exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030}}],"kind":"detection","reach":[],"rule_title":"Possible credential exposure","severity":"critical","status":null,"subject":{"host":"18.238.80.121","kind":"net","port":443},"suppressed":false,"title":"Credential store contents reached a network peer"},{"affects":"build","check":"network-activity","confidence":"witnessed","evidence":{"claims":[{"label":"What a build script's fetch became","process":null,"role":"support","subjects":[],"text":"nothing came down that the build kept","type":"fetch.kept","values":{"built":[],"files":0,"ran":[]}},{"label":"Connection outside the process’s allowed destinations","process":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030},"role":"cause","subjects":[{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n1","port":443,"proto":"tcp","role":"subject"}],"text":"connection to 18.238.80.121:443, opened by phone-home","type":"egress.unentitled_connection","values":{"entitlement":"none"}},{"label":"Data sent; no reply recorded","process":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030},"role":"support","subjects":[{"direction":"out","ip":"18.238.80.121","kind":"connection","node":"n1","port":443,"proto":"tcp","role":"subject"}],"text":null,"type":"egress.sent_no_reply","values":{}},{"label":"Connection opened by a build script or child process","process":null,"role":"support","subjects":[],"text":"the opener descends from the build script at sh -c node scripts/preinstall.js","type":"buildscript.connected","values":{"build_script":"sh -c node scripts/preinstall.js","crate":"@toy/ironworm"}},{"label":"Tool command","process":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030},"role":"support","subjects":[{"kind":"process","process":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030},"role":"subject"}],"text":"Command: /home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","type":"buildscript.invocation","values":{}}],"evidence":["nothing came down that the build kept","connection to 18.238.80.121:443, opened by phone-home","Data sent; no reply recorded"],"remediation":"The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.","witness":[]},"jobs":[{"actor":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030},"chain":["systemd","sshd:","sshd-session:","…","node","phone-home"],"graph":{"file":"finding-0c0000000000000000000000010000000000000000000000.json","job":0},"invoked_by":{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},"name":"build","step":null,"writer":{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","chain":[{"argv":"/usr/lib/systemd/systemd","exe":null,"pid":1},{"argv":"sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups","exe":null,"pid":6835},{"argv":"sshd-session: bb [priv]","exe":null,"pid":6918},{"argv":"sshd-session: bb@notty","exe":null,"pid":6973},{"argv":"sudo","exe":null,"pid":6974},{"argv":"sh","exe":"/usr/bin/dash","pid":6976},{"argv":"runuser -u bb -- sh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build","exe":"/usr/sbin/runuser","pid":7007},{"argv":"sh -c cd '/home/bb/work/ironworm' && HOME='/home/bb/work' npm install --no-audit --no-fund && HOME='/home/bb/work' npm run build","exe":"/usr/bin/dash","pid":7008},{"argv":"/usr/bin/env node /usr/bin/npm install --no-audit --no-fund","exe":"/usr/share/nodejs/npm/bin/npm-cli.js","pid":7009},{"argv":"node /usr/bin/npm install --no-audit --no-fund","exe":"/usr/bin/node","pid":7019},{"argv":"sh -c node scripts/preinstall.js","exe":"/usr/bin/dash","pid":7020},{"argv":"node scripts/preinstall.js","exe":"/usr/bin/node","pid":7021},{"argv":"/home/bb/work/ironworm/.ironworm-stage/phone-home /home/bb/work/ironworm/.npmrc","exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030}],"exe":"/home/bb/work/ironworm/.ironworm-stage/phone-home","pid":7030}}],"kind":"detection","reach":[],"rule_title":"Unexpected network connection","severity":"medium","status":null,"subject":{"kind":"crate","name":"@toy/ironworm","version":"?"},"suppressed":false,"title":"Build script reached 18.238.80.121"}],"generated_at_ms":1791990825145,"groups":{"behavior":"flagged","pipeline":"clean","posture":"not checked","supply":"clean"},"jobs":[{"analyzed":true,"conclusion":"success","job":"build","name":"build","status":"analyzed","verdict":"flagged"}],"network":{"fetches":[],"peers":[{"actors":[{"by":"project","class":"undeclared","component":"@toy/ironworm","exe":"phone-home","jobs":["build"],"package":null,"threads":[{"job":"build","name":"build"}],"verdicts":["build-flagged"],"vias":[]}],"asn":null,"class":"undeclared","host":"18.238.80.121","jobs":[{"job":"build","name":"build","status":"flagged"}],"org":null,"port":443,"status":"flagged"}]},"pipeline_id":"ironworm-0.1.0-2","report":"report.json","repository":"incidents/npm/ironworm","run":{"analyzed_ts_ms":1792007684729,"branch":"","built":true,"groups":null,"pipeline_id":"ironworm-0.1.0-2","ref":"refs/tags/0.1.0","revision":"","started_ts_ms":1792007682424,"status":"complete","verdict":"flagged"},"schema":1,"stats":{"analyzed":{"artifacts":1,"compiler_invocations":2,"feeds":0,"lockfiles":1,"packages":3},"checks":{"clean":9,"findings":2,"not_applicable":1,"not_checked":3,"run":15},"observed":{"connections":1,"interactions":488,"jobs":1,"objects":933,"operations":3064,"processes":106,"wall_s":0}},"status":"open","tarp_version":"0.1.0+gefb1d7d200bf","verdict":"flagged"}