{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.10393649, "rte": "az", "prob": 0.10393649 }, { "cls": 0, "raw": 0.0028946102, "rte": "az/whl", "prob": 0.0028946102 } ], "prob": 0.2916565, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "whl" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.004772961139678955, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.002005338668823242, "type": "python" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "python" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.002897024154663086, "type": "python" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.002005338668823242, "type": "python" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0014989376068115234, "type": "python" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "python" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.07871532440185547, "type": "python" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.006900280714035034, "type": "javascript" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "text" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.040082454681396484, "type": "javascript" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "pkg_info" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-07T21:30:51Z" }, "path": "sphinx_riddle_whisper-1.2.0-py3-none-any.whl", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awas00000aPIGx0000000000000=m0047VxLzveuVG\u003c\u003ewnC*:Cw7YiAaK5yp!H([6Awas2MK\u00268aPOw[iXz\u0026+006tj", "n": [ { "c": 2, "d": "Python wheel archive basename", "i": "metadata/file/extension/identity::python-wheel-basename", "o": 0, "z": 44, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "O(As)Md", "sha": "0525c51b9ea3ad3c72d96281dc09c5c695250480221ca9231513a27f601a1710", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl", "risk": 3, "size": 46095, "type": "whl", "facts": { "metrics": { "whl": { "native_extension_count": 0.0 }, "file": { "size": 46095.0, "entropy": 7.96, "size_bytes": 46095.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 44032.0, "peak_region_entropy": 7.82 }, "archive": { "file_count": 16.0, "member_count": 20.0, "script_count": 10.0, "zip_bomb_ratio": 3.31, "directory_count": 4.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 43085.0, "compression.ratio": 0.34, "hidden_file_count": 0.0, "total_uncompressed": 124944.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 54.0, "rtlo_filename_count": 0.0, "format.regular_count": 16.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "format.directory_count": 4.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.05, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 20.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 4.0, "compression.method_counts.deflate": 16.0 } } }, "ident": { "name": { "value": "sphinx_riddle_whisper", "source": "whl.distribution", "verified": false }, "trust": "unsigned", "authors": [ { "name": "usaturn", "role": "author", "source": "whl.author" } ], "version": { "value": "1.2.0", "source": "whl.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/os/env/config::python-env-or-config-module-filename", "conf": 0.4000000059604645, "crit": 3, "desc": "Python env.py or config.py module", "from": [ { "file": 3 } ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--purge", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: purge", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid", "conf": 0.8999999761581421, "crit": 1, "desc": "getElementById/querySelector (getElementById)", "from": [ { "file": 11 } ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/manipulation::queryselectorall-call", "conf": 0.800000011920929, "crit": 1, "desc": "querySelectorAll call" }, { "id": "metadata/file/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "conf": 0.8999999761581421, "crit": 1, "desc": "getElementById/querySelector DOM (querySelector)", "from": [ { "file": 11 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-summary-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package summary", "from": [ { "file": 13 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-name-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package name", "from": [ { "file": 13 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-requires-python", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares Python requirement", "from": [ { "file": 13 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-requires-dist", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares runtime dependencies", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "conf": 0.8999999761581421, "crit": 1, "desc": "Reads .value property of a DOM element", "from": [ { "file": 11 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 1, "desc": "Python core metadata marker", "from": [ { "file": 13 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-license-expression", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares license expression", "from": [ { "file": 13 } ] }, { "id": "metadata/file/format::vocab-invalid", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary invalid", "from": [ { "file": 11 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-recognized-text--rx-12", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "WebP token inside multiline blob", "from": [ { "file": 11 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package version", "from": [ { "file": 13 } ] }, { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.800000011920929, "crit": 3, "desc": "Japanese script detection (Hiragana/Katakana)", "from": [ { "file": 1 } ], "spans": [ [ 3, 15 ], [ 18, 18 ], [ 34, 9 ], [ 62, 6 ], [ 91, 18 ], [ 93, 6 ], [ 116, 9 ], [ 294, 9 ] ] }, { "id": "metadata/file/format::vocab-boolean", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary boolean", "from": [ { "file": 11 } ] }, { "id": "metadata/file/format::han-ideograph-prose", "conf": 0.8999999761581421, "crit": 2, "desc": "Dense Han ideograph prose (localized source)", "from": [ { "file": 2 } ], "spans": [ [ 20, 12 ], [ 221, 12 ], [ 231, 12 ], [ 291, 12 ], [ 828, 12 ], [ 1165, 12 ] ] }, { "id": "micro-behaviors/data/manipulation::ad-selector-token", "conf": 0.800000011920929, "crit": 1, "desc": "Ad selector token", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/manipulation::remove-call", "conf": 0.800000011920929, "crit": 1, "desc": "DOM remove call", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup", "conf": 0.8999999761581421, "crit": 1, "desc": "getElementById/querySelector DOM lookup", "from": [ { "off": 5862, "file": 11, "line": 182 } ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "from": [ { "file": 1 } ], "spans": [ [ 20, 12 ], [ 28, 15 ], [ 45, 9 ], [ 84, 9 ], [ 221, 12 ], [ 231, 12 ], [ 382, 9 ], [ 545, 9 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/dropper::py-chr-join-decode", "atk": "T1027", "conf": 0.8500000238418579, "crit": 3, "desc": "chr-join character assembly transform", "from": [ { "file": 8 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--codebase", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: codebase", "from": [ { "file": 8 } ] }, { "id": "metadata/file/format::vocab-object", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary object", "from": [ { "file": 11 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-license-file", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares license file", "from": [ { "file": 13 } ] } ] }, { "ctx": [ { "b": "a%FjLAa\u0026%6CR9@IwmPH/eQ7(xB8UYhiV@6Kz/Y#dA^n^HwPzSgwmYv!zFsibz/cXpz/x\u0026raz2!twO#N6z/cXfz/M$0Aa\u0026%6CRgf:a]", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 11, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 82 }, { "b": "x(d*cA=-Brze:AlBzLV2e]tfwvpS!*ve", "ln": 3, "addr": 83 }, { "b": "w].*baAIHnx(nf5A+P5{y?l%$xLzKbwPxzzB-8qnzdN6:z/ff3xcp]9AbP=sazC.dwN/*?A=(nwx(dA*v@Dl%x\u003eE", "ln": 14, "addr": 385 }, { "b": "", "ln": 15, "addr": 456 }, { "b": "bru$cGothDGx4M*\u003caC28G1f%kS]FYb\u003caBX#G1o]]H#Tc2\u003caBz{Ns:EITlk.C\u003cah)zF@wVwKMg#a\u003cas/3GqW:ZV/uRt\u003caASSF#N^.YYjTB\u003caADNGm\u0026ioUJpqg\u003ca8Z", "n": [ { "c": 3, "d": "Japanese script detection (Hiragana/Katakana)", "i": "metadata/file/profile/language::lang-japanese", "o": 460, "z": 9, "cf": 0.800000011920929 } ], "ln": 16, "addr": 457 }, { "b": "uQ^sPoHq3joj7Z*qD3d.p9qXxa$$S6e?!E", "ln": 17, "addr": 557 }, { "b": "bru$cGokbCYYjQN\u003caBn\u0026Gr%W2MGt\u0026E\u003cajn]L=iR[GYvVx(4LbUXp-*]K(I7D\u003casL@Gs{k@XAe*i\u003ca8Z", "ln": 18, "addr": 585 }, { "b": "", "ln": 21, "addr": 695 }, { "b": "wmYu}uVGZ\u003cx(!xcA:J\u003c3wmPH/uTX1%wPR#wvq{fDax9k)x(neAat2=1ph+2YiS", "ln": 22, "addr": 696 }, { "b": "arR^Ha%Fj4r834e\u003caAMQGra3+IrpjT\u003cajlNA+P5{y?kklB09aUA+P5{y?kkeB8@F:F%bq+YxLoW\u003caiKtB97\u0026jx\u003e5pCF%bkSJol\u003et\u003caiSUF@wVtF=", "n": [ { "c": 2, "d": "Recognized developer credential marker", "i": "objectives/credential-access/cloud/devops-bundle::developer-credential-sweep-recognized-marker", "o": 753, "z": 127, "cf": 0.949999988079071 } ], "ln": 23, "addr": 746 }, { "b": "", "ln": 24, "addr": 836 }, { "b": "arR^HvS=y3wmY^kx(mTbwN(}zFV!3+ZVf{w\u003caA#:Gr%P\u0026U\u0026yqj\u003c=NjoFW1f^Jn]IF\u003ca8:COT{@{r834evS=y3wmY^7\u003cajb*FV[dFMe^EF\u003caiMSFVv:YGYvPm", "ln": 25, "addr": 837 }, { "b": "", "ln": 40, "addr": 1709 }, { "b": "", "ln": 41, "addr": 1710 }, { "b": "wmYu}B7GDoA42dlA5]auAa\u0026%6CQT:!j%ipsBy/uhx(v(-wPRu\u003evrt{s", "n": [ { "c": 3, "d": "setup.py installation file", "i": "objectives/supply-chain/install-hook/dropper/setup-hook::robust-setup-py", "o": 1711, "z": 5, "cf": 1.0 } ], "ln": 42, "addr": 1711 }, { "b": "arR^HA+e($B97#luT[1(w[+)+C42ifwPGndAbWl", "ln": 43, "addr": 1756 }, { "b": "arR^Hvq{frv@Dm5wN/*gb4#7ny+oQmxjSV8z/fVdCYUbXazC.dwN/*?wmYv!zFsibz/e{7wO(y5vru74df", "ln": 44, "addr": 1788 }, { "b": "arR^Hvq{frv@Dm5wN/*gb4#7ny+oQmxjSV8z/fVdCYUbXazC.dwN/*?A=(nwx(dA*v@Dl%x\u003eF\u003c", "ln": 47, "addr": 2058 }, { "b": "arR^Hvq{frv@Dm5wN/*gb4tXey?d9$eOP9pBy!#befFquwOkZ#By/G1A+P5{y?l%ZB8$]mB14", "ln": 48, "addr": 2118 }, { "b": "arR^HboV9xM/T3T\u003caAMQGra3+Iq%e+aztXgwHMVyN=?z:\u003caA/XGs{k@XgcKnIrpqm\u003e9Z?YFVE)[G6d\u0026=\u003caA/XGs{k@Xz@g7\u003c+w=SO4dHfJPC@b\u003caiMSFTbnDO8Y9U\u003cI4hDT^Fd2Lh?7z", "n": [ { "c": 3, "d": "CJK Han ideograph sequence", "i": "metadata/file/profile/language::script-han", "o": 2223, "z": 9, "cf": 0.800000011920929 } ], "ln": 49, "addr": 2177 }, { "b": "arR^HboV6SRSAS2\u003e9@)vFSn=DY5Ovd\u003cajuQw]zZ9aMXDt\u003caB#cRMeWeM/A.2\u003cas]6G1o])R@Uvr\u003e8lt8Sf(?dVG3I7\u003cariTYOHcpB$NrpAaJ]$wO#0(wPG0OFW\u003efYIq%br", "ln": 50, "addr": 2290 }, { "b": "arR^Hvq{frv@Dm5wN/*gb4UUneP(2yvru6\u003ea$K\u003cSwN/U0wm6p:xjUB-z/65)wmYZ\u003ezE^r@v}/H}df", "ln": 51, "addr": 2395 } ], "depth": 1, "facts": { "imp": [ [ "", "os.path.join" ], [ "", "os.path.dirname" ], [ "", "app.config.html_static_path.append" ], [ "", "app.add_css_file" ], [ "", "app.add_js_file" ], [ "", "register_config_values" ], [ "", "app.connect" ], [ "", "app.connect" ], [ "", "app.connect" ], [ "", "app.connect" ], [ "", "importlib.metadata.version" ], [ "", "ExtensionMetadata" ], [ "", "Sphinx" ], [ "", "importlib.metadata" ], [ "", "inject_definition_templates" ], [ "", "inject_runtime_config" ], [ "", "os" ], [ "", "record_page_home_dependencies" ], [ "", "register_config_values" ], [ "", "sphinx.application" ], [ "", "sphinx.util.typing" ], [ "", "sphinx_riddle_whisper.config" ], [ "", "sphinx_riddle_whisper.inject" ], [ "", "sphinx_riddle_whisper.runtime_config" ] ], "mbr": [ "app.add_css_file", "app.add_js_file", "app.builder", "app.builder.format", "app.config", "app.config.html_static_path", "app.config.html_static_path.append", "app.connect", "importlib.metadata", "importlib.metadata.PackageNotFoundError", "importlib.metadata.version", "os.path", "os.path.dirname", "os.path.join" ], "tgt": [ "app.add_css_file", "app.add_js_file", "app.config.html_static_path.append", "app.connect", "importlib.metadata.version", "os.path.dirname", "os.path.join", "register_config_values" ], "metrics": { "ast": { "max_depth": 10.0, "bind_count": 5.0, "call_count": 11.0, "node_count": 381.0, "member_count": 14.0, "identifier_count": 37.0, "member_depth_max": 4.0, "string_literal_count": 16.0 }, "file": { "size": 2739.0, "entropy": 5.66, "size_bytes": 2739.0 }, "text": { "digit_ratio": 0.0, "space_count": 286.0, "total_lines": 60.0, "char_entropy": 5.66, "unique_chars": 131.0, "string_density": 0.27, "avg_line_length": 44.65, "high_byte_ratio": 0.28, "max_line_length": 112.0, "non_ascii_ratio": 0.28, "empty_line_ratio": 0.17, "last_line_length": 5.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.07, "identifier_density": 1.32, "line_length_stddev": 34.26, "normalized_string_count": 2.07, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.9, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 227.0, "normalized_unique_identifiers": 6.26 }, "binds": { "count": 5.0 }, "calls": { "count": 11.0 }, "binary": { "overall_entropy": 5.66, "peak_region_bytes": 2739.0, "peak_region_entropy": 5.62 }, "source": { "function_count": 2.0 }, "imports": { "count": 13.0, "stdlib_count": 2.0, "stdlib_ratio": 0.15, "unique_modules": 13.0, "dynamic_imports": 1.0, "third_party_count": 11.0, "third_party_ratio": 0.85 }, "members": { "count": 14.0 }, "strings": { "total": 16.0, "avg_length": 30.56, "max_length": 241.0, "avg_entropy": 3.1, "total_bytes": 489.0, "entropy_stddev": 0.91, "high_entropy_count": 1.0 }, "comments": { "chars": 933.0, "lines": 10.0, "total": 10.0, "to_code_ratio": 0.2, "base64_in_comments": 1.0, "high_entropy_comments": 8.0 }, "functions": { "count": 2.0, "avg_params": 1.0, "max_params": 1.0, "length_stddev": 0.5, "avg_name_length": 14.0, "avg_length_lines": 18.5, "max_length_lines": 19.0, "min_length_lines": 18.0, "avg_param_name_length": 3.0, "density_per_100_lines": 3.33, "code_in_functions_ratio": 0.62 }, "identifiers": { "count": 37.0, "total": 79.0, "avg_length": 11.08, "max_length": 29.0, "min_length": 2.0, "avg_entropy": 2.75, "reuse_ratio": 0.47, "unique_count": 37.0, "length_stddev": 7.21, "high_entropy_count": 8.0, "high_entropy_ratio": 0.22, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.05, "double_underscore_count": 1.0, "underscore_prefix_count": 4.0 } } }, "id": 1, "mol": "Md", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/__init__.py", "risk": 1, "sha": "4ad8e2213b226360cb71739a7d84cb54433f88d9a6d35041cc884209d2dedf88", "size": 2739, "traits": [ { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.800000011920929, "crit": 3, "desc": "Japanese script detection (Hiragana/Katakana)", "spans": [ [ 460, 9 ] ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "spans": [ [ 2223, 9 ] ] } ], "type": "python" }, { "ctx": [ { "b": "a%Fjzy\u0026sxovrcSo\u003eAI}eS?em4T@}*$A=0yxwfx(^K%1BRzdN6+z!0V[zdK\u003cMW4=V{Me^EV\u003ebjd2UzIp\u003cND5)S\u003caB8^G1f\u0026[Rq)iv\u003caBz)FpW", "n": [ { "c": 3, "d": "Japanese script detection (Hiragana/Katakana)", "i": "metadata/file/profile/language::lang-japanese", "o": 62, "z": 6, "cf": 0.800000011920929 }, { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 10, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 87 }, { "b": "q/Dz:zG)q:FVZa]Byx5$vrb)Dz/5]%zxN$\u003cUJr3X\u003e76uLu%)[ZygQ)%B6@w#\u003carDRJdH2uQ2QVO\u003cai=YFV!aaI@Pw(", "ln": 3, "addr": 88 }, { "b": "", "ln": 16, "addr": 511 }, { "b": "v@bN{B0a**Byx5$vrb)Dz/5]%zCj+WwHHw}z//]cz!{\u003c-", "ln": 17, "addr": 512 }, { "b": "arR^Ha%Fjsu#GH?wN/?6u%\u003ebsV7y9dR@Jw(\u003e8s(KFUTz!Byx5$vrb)Dz/5]%zxO2KLid*{\u003casq\u003eGo\u003eLHXz@gs\u003casF{GnwMsUi8Tu(42C\u0026NUo^]I@Ptt", "n": [ { "c": 3, "d": "CJK Han ideograph sequence", "i": "metadata/file/profile/language::script-han", "o": 626, "z": 12, "cf": 0.800000011920929 } ], "ln": 18, "addr": 549 }, { "b": "", "ln": 19, "addr": 642 }, { "b": "arR^H\u003c/Ui#u%(]PvqYQ:A+4NRzddc@e]LilwN/?6u%\u003ebqFV[pqT(B#E\u003c=t./F@nV]G6ew%\u003cajuQAb](owPz)raMF3Q\u003cai\u0026.F}q%jFLZx9Bz\u003eVcy-}?\u003cWbV:\u0026", "ln": 20, "addr": 643 }, { "b": "", "ln": 35, "addr": 1217 }, { "b": "wmYu}vS=y3wm6B\u0026A=2e%z/65)x(mD)CQNSPwm5\u003e=zddc@iV}^dByx5$vrb)Dz/5]%zCj+WwHO-Nj%jxIv@${@BAe]PB98CdiS", "ln": 36, "addr": 1218 }, { "b": "arR^Ha%FjMwPzStx\u003elXBH?{HewO=6\u003e[4sIqFS5MuI6cFIzdN6+z!0V[zdSgGH?7BlzEEx[[4sIqFW\u003c-\u003eUiif^\u003c?c(sF%bn]I%4p2\u003caiSUF@wVtF=", "n": [ { "c": 2, "d": "Recognized developer credential marker", "i": "objectives/credential-access/cloud/devops-bundle::developer-credential-sweep-recognized-marker", "o": 1303, "z": 128, "cf": 0.949999988079071 } ], "ln": 37, "addr": 1296 }, { "b": "", "ln": 38, "addr": 1386 }, { "b": "arR^Hi=FIFvqNcdByX-?z/5]%zAn[Fu#GH?wN/?6u%\u003ebsV7y9dR@Jw(\u003e8s(KFUTz!Byx5$vrb)Dz/5]%zxO2KLid*{\u003casq\u003eGo\u003eLHXz@gs\u003casF{GnwMrF=", "ln": 39, "addr": 1387 }, { "b": "arR^Ha%Fi", "ln": 42, "addr": 1627 }, { "b": "arR^Hx(mD)CSD%Tx\u003e8l?B98BNaAITBt{8oMDWL", "ln": 43, "addr": 1635 }, { "b": "arR^Hw]zYjc#SNfBA}?pefFqqvqPN8efDuKz!0V[zdLmvy**^:y?WAeazCZoB97@1wn=r[x(kLwvRPE:BAo6GBy/rgc[dg", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 1669, "z": 6, "cf": 0.5 } ], "ln": 44, "addr": 1666 }, { "b": "arR^HarR^Hx\u003ewGavRQ1gAaHdnjS\u003e}\u003cwPzSiiS", "ln": 45, "addr": 1742 }, { "b": "arR^HarR^HarR^Hv@Dmbx(n68", "ln": 46, "addr": 1772 }, { "b": "", "ln": 50, "addr": 1844 }, { "b": "wmYu}vS=y3wm6B\u0026A=2e%z/65)x(mD)CWB{9uV6p?wHIRwwm5\u003e=zddc@iV}^dByx5$vrb)Dz/5]%zCj+WwHO-Nj%jxIv@${@BAe]PB98CdiS", "ln": 51, "addr": 1845 }, { "b": "arR^Ha%Fk]L=i/CP5(5[[4sFrU-E}jHVLU8\u003c=2I]YOUW1I@PzCaztXgwNw$^v@tZ(w:^o/wn+%}vqPPAYOUW1Xz@dy\u003eD{#BYP}JeLieW2\u003eDx:5FTLLII@Ptt", "n": [ { "c": 2, "d": "Contains documentation strings", "i": "metadata/package/quality/profile::documented", "o": 1938, "z": 128, "cf": 0.800000011920929 } ], "ln": 52, "addr": 1931 }, { "b": "", "ln": 53, "addr": 2028 }, { "b": "arR^Hi+AILv(!1bB.LV5uVY\u003e1zc{%{zdN6*zE^s6u)aGXJ39jNA=0yxwBEf!y**^:y?WCGYOUW2Lh?d@\u003caC28FVE*ZND5)S\u003cajw[FVE[oZt\u003c^h\u003ca8ZyOug$vQum-B\u003cajx", "ln": 54, "addr": 2029 }, { "b": "arR^Ha%Fk]L=i/CP5(5[[4sFrU-E}jHVLU8\u003c=2I]YOUW1I@PzCasH]wzdN6+z!0V[zdLmvBy/GfuUK41aMF3.\u003cajw@W4=V{Me^EV\u003ebjd2UzIp\u003cND5)S\u003ca8Z", "n": [ { "c": 2, "d": "Sphinx :param: directive", "i": "metadata/package/documentation::sphinx-param", "o": 3109, "z": 128, "cf": 0.6000000238418579 } ], "ln": 75, "addr": 3102 }, { "b": "", "ln": 76, "addr": 3198 }, { "b": "arR^Ha%FjMwPzStx\u003elXBH?{HewO=6\u003e[4sIqFS5MuIryb4\u003e=gloKD5.wH\u0026cTrw:^o*\u003caj-2FV!gyQuf4M\u003carDRR\u0026f-wIq%eP\u003cariHFpW", "n": [ { "c": 2, "d": "Sphinx :param: directive", "i": "metadata/package/documentation::sphinx-param", "o": 4186, "z": 128, "cf": 0.6000000238418579 } ], "ln": 95, "addr": 4179 }, { "b": "arR^HarR^Ha%FjxzGWe.FV6Y2B.LV5wPw{NF%bifO-U(Z\u003caiMSFpV*pH3sk*\u003casz[GqmEVGx4M)\u003caBh*F%bkKO-VDm\u003c=2I=FTLLII@Ptt", "n": [ { "c": 2, "d": "Sphinx :param: directive", "i": "metadata/package/documentation::sphinx-param", "o": 5319, "z": 126, "cf": 0.6000000238418579 } ], "ln": 120, "addr": 5308 }, { "b": "arR^HarR^Ha%FjAz/65)wn+%}vqPM#\u003cajw%R\u003e-yVY5{IU\u003caj@/wn+$1A+e/8\u003carDOGq4sTQudu1\u003caiMSFU}UCL\u0026Es.\u003ca8Z", "n": [ { "c": 2, "d": "Sphinx :param: directive", "i": "metadata/package/documentation::sphinx-param", "o": 5753, "z": 128, "cf": 0.6000000238418579 } ], "ln": 130, "addr": 5742 }, { "b": "arR^Ha%Fk{R\u003e-yVY5{IU\u003caj@/wn+$1A+e/8\u003carDTWxO!=Yw[EeaARgnz7PEjaMwcsay]4}x(mTbx(v(i\u003cajuQwmYs\u003ev@DsiaMF6p\u003e!AwxFTLLGF=", "n": [ { "c": 2, "d": "Sphinx :param: directive", "i": "metadata/package/documentation::sphinx-param", "o": 6614, "z": 128, "cf": 0.6000000238418579 } ], "ln": 146, "addr": 6607 } ], "depth": 1, "facts": { "imp": [ [ "", "std_domain.objects.items" ], [ "", "std_domain.objects.items" ], [ "", "name.lower" ], [ "", "std_domain.objects.items" ], [ "", "name.lower" ], [ "", "std_domain.objects.items" ], [ "", "getattr" ], [ "", "self._env.get_and_resolve_doctree" ], [ "", "doctree.findall" ], [ "", "glossary.findall" ], [ "", "dl.findall" ], [ "", "next" ], [ "", "isinstance" ], [ "", "isinstance" ], [ "", "definition.deepcopy" ], [ "", "Protocol" ], [ "", "addnodes" ], [ "", "docutils" ], [ "", "nodes" ], [ "", "sphinx" ], [ "", "typing" ] ], "mbr": [ "addnodes.glossary", "child.ids", "definition.deepcopy", "dl.findall", "doctree.findall", "glossary.findall", "item.children", "name.lower", "nodes.Node", "nodes.definition", "nodes.definition_list", "nodes.definition_list_item", "nodes.document", "nodes.term", "self._builder", "self._cache", "self._env", "self._env.get_and_resolve_doctree", "std_domain.objects", "std_domain.objects.items" ], "tgt": [ "definition.deepcopy", "dl.findall", "doctree.findall", "getattr", "glossary.findall", "isinstance", "name.lower", "next", "self._env.get_and_resolve_doctree", "std_domain.objects.items" ], "metrics": { "ast": { "max_depth": 18.0, "bind_count": 10.0, "call_count": 15.0, "node_count": 1009.0, "member_count": 20.0, "identifier_count": 63.0, "member_depth_max": 3.0, "string_literal_count": 17.0, "array_literal_max_length": 2.0 }, "file": { "size": 8439.0, "entropy": 5.57, "size_bytes": 8439.0 }, "text": { "digit_ratio": 0.0, "space_count": 1345.0, "total_lines": 177.0, "char_entropy": 5.57, "unique_chars": 129.0, "string_density": 0.1, "avg_line_length": 46.68, "high_byte_ratio": 0.35, "max_line_length": 116.0, "non_ascii_ratio": 0.35, "empty_line_ratio": 0.21, "last_line_length": 17.0, "long_token_count": 1.0, "whitespace_ratio": 0.18, "most_common_ratio": 0.07, "identifier_density": 1.27, "line_length_stddev": 37.5, "normalized_string_count": 1.28, "repeated_char_sequences": 26.0, "suspicious_string_ratio": 0.59, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 227.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 8.44 }, "binds": { "count": 10.0 }, "calls": { "count": 15.0 }, "binary": { "overall_entropy": 5.57, "peak_region_bytes": 7168.0, "peak_region_entropy": 5.68 }, "source": { "class_count": 3.0, "function_count": 9.0 }, "imports": { "count": 6.0, "stdlib_count": 1.0, "stdlib_ratio": 0.17, "unique_modules": 6.0, "third_party_count": 5.0, "third_party_ratio": 0.83 }, "members": { "count": 20.0 }, "strings": { "total": 17.0, "avg_length": 283.94, "max_length": 843.0, "avg_entropy": 4.18, "total_bytes": 4827.0, "entropy_stddev": 1.67, "high_entropy_count": 11.0, "shell_command_strings": 10.0 }, "comments": { "chars": 478.0, "lines": 6.0, "total": 6.0, "to_code_ratio": 0.04, "high_entropy_comments": 6.0 }, "functions": { "count": 12.0, "avg_params": 1.78, "max_params": 5.0, "one_liners": 1.0, "length_stddev": 9.08, "avg_name_length": 17.89, "avg_length_lines": 14.22, "max_length_lines": 33.0, "min_length_lines": 1.0, "high_entropy_names": 4.0, "single_char_params": 1.0, "avg_param_name_length": 6.5, "density_per_100_lines": 5.08, "code_in_functions_ratio": 0.72 }, "identifiers": { "count": 63.0, "total": 225.0, "avg_length": 8.67, "max_length": 30.0, "min_length": 1.0, "avg_entropy": 2.54, "reuse_ratio": 0.28, "unique_count": 63.0, "length_stddev": 6.16, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.02, "high_entropy_count": 5.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.92, "double_underscore_count": 1.0, "underscore_prefix_count": 9.0 } } }, "id": 2, "mol": "Md", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/collect.py", "risk": 1, "sha": "011aae7e14f36713c42b6a2a09c2b1cfe5873dcd47b2827b6130217c7911966b", "size": 8439, "traits": [ { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.800000011920929, "crit": 3, "desc": "Japanese script detection (Hiragana/Katakana)", "spans": [ [ 62, 6 ] ] }, { "id": "metadata/file/format::han-ideograph-prose", "conf": 0.8999999761581421, "crit": 2, "desc": "Dense Han ideograph prose (localized source)", "spans": [ [ 626, 12 ] ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "spans": [ [ 626, 12 ] ] } ], "type": "python" }, { "ctx": [ { "b": "a%FjLAa\u0026%6CR9@IwmPH/eQ7(xB8UYhaMF3Q\u003e+$SBUa1E5R01eT(5q}dFVd.bOAM]:\u003ca8.9a%E", "n": [ { "c": 3, "d": "CJK Han ideograph sequence", "i": "metadata/file/profile/language::script-han", "o": 28, "z": 15, "cf": 0.800000011920929 }, { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 9, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 59 }, { "b": "w].*bay/tay?m9#x(v)ge[5j0azCXiz/P}xnPXJ:vpB4:", "ln": 3, "addr": 60 }, { "b": "uSndhaxiS9wMAkWc)A1$a$i", "ln": 10, "addr": 247 }, { "b": "", "ln": 11, "addr": 266 }, { "b": "bru@/x\u003eg:\u003cwNxL1x\u003eI6\u0026AV\u003cy[TluH!\u003c=uR9FTbnEJn]IF\u003c::e!FpW", "n": [ { "c": 3, "d": "Japanese script detection (Hiragana/Katakana)", "i": "metadata/file/profile/language::lang-japanese", "o": 294, "z": 9, "cf": 0.800000011920929 } ], "ln": 12, "addr": 267 }, { "b": "uQmvVpGG$MuSo]{m[l0CqY[jCc)AtyC4CXrefDcDy?Wx{a$K\u0026XvScv4a$i", "ln": 13, "addr": 310 }, { "b": "", "ln": 14, "addr": 357 }, { "b": "arR^HarR^Hdf", "ln": 73, "addr": 2954 }, { "b": "arR^HzF%MjvqGU7wN(]DaAR:By?k2rvqH6$df", "ln": 74, "addr": 2964 }, { "b": "arR^Hw]zYjx(){6azCZozF%MjvqGU7wN)?", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 2997, "z": 13, "cf": 0.5 } ], "ln": 75, "addr": 2994 }, { "b": "arR^HarR^HuV]\u003c]x\u003egT]wNxL8AaHCfb71iozdObr\u003cajw%RH^{qPDU{fx(){6efG1QAX5sSB98BDdf", "ln": 76, "addr": 3022 }, { "b": "arR^HA+funA=91qz/PY6y?Xibwb", "ln": 77, "addr": 3084 } ], "depth": 1, "facts": { "imp": [ [ "", "TypeVar" ], [ "", "app.add_config_value" ], [ "", "app.connect" ], [ "", "type" ], [ "", "ExtensionError" ], [ "", "validate_type" ], [ "", "ExtensionError" ], [ "", "validate_type" ], [ "", "isinstance" ], [ "", "isinstance" ], [ "", "ExtensionError" ], [ "", "tuple" ], [ "", "validate_type" ], [ "", "validate_type" ], [ "", "ExtensionError" ], [ "", "validate_type" ], [ "", "validate_type" ], [ "", "validate_non_negative_int" ], [ "", "validate_non_negative_int" ], [ "", "validate_bool" ], [ "", "validate_bool" ], [ "", "validate_bool" ], [ "", "validate_bool" ], [ "", "validate_bool" ], [ "", "validate_bool" ], [ "", "validate_bool" ], [ "", "normalize_str_iterable" ], [ "", "normalize_str_iterable" ], [ "", "normalize_str_iterable" ], [ "", "normalize_allowed_attributes" ], [ "", "validate_type" ], [ "", "validated.items" ], [ "", "validate_type" ], [ "", "normalize_str_iterable" ], [ "", "Config" ], [ "", "ExtensionError" ], [ "", "Iterable" ], [ "", "Literal" ], [ "", "Sphinx" ], [ "", "TypeVar" ], [ "", "collections.abc" ], [ "", "sphinx.application" ], [ "", "sphinx.config" ], [ "", "sphinx.errors" ], [ "", "typing" ] ], "mbr": [ "app.add_config_value", "app.connect", "config.riddle_allowed_attributes", "config.riddle_allowed_schemes", "config.riddle_allowed_tags", "config.riddle_close_delay_ms", "config.riddle_footnotes", "config.riddle_image_popup", "config.riddle_include_term_title", "config.riddle_interactive", "config.riddle_mark_terms", "config.riddle_max_height", "config.riddle_max_width", "config.riddle_nested", "config.riddle_open_delay_ms", "config.riddle_sanitize", "config.riddle_strip_classes", "config.riddle_trigger", "validated.items" ], "tgt": [ "ExtensionError", "TypeVar", "_normalize_allowed_attributes", "_normalize_str_iterable", "_validate_bool", "_validate_non_negative_int", "_validate_type", "app.add_config_value", "app.connect", "isinstance", "tuple", "type", "validated.items" ], "metrics": { "ast": { "op.lor": 1.0, "max_depth": 14.0, "bind_count": 11.0, "call_count": 34.0, "node_count": 1328.0, "member_count": 19.0, "op_density.lor": 0.0, "identifier_count": 64.0, "member_depth_max": 2.0, "string_literal_count": 83.0, "array_literal_max_length": 16.0 }, "file": { "size": 5679.0, "entropy": 5.32, "size_bytes": 5679.0 }, "text": { "digit_ratio": 0.0, "space_count": 792.0, "total_lines": 135.0, "char_entropy": 5.32, "unique_chars": 136.0, "string_density": 0.61, "avg_line_length": 41.07, "high_byte_ratio": 0.13, "max_line_length": 115.0, "non_ascii_ratio": 0.13, "empty_line_ratio": 0.19, "last_line_length": 21.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.07, "identifier_density": 1.59, "line_length_stddev": 30.5, "normalized_string_count": 7.14, "repeated_char_sequences": 10.0, "suspicious_string_ratio": 0.01, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.67, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 9.04 }, "binds": { "count": 11.0 }, "calls": { "count": 34.0 }, "binary": { "overall_entropy": 5.32, "peak_region_bytes": 4096.0, "peak_region_entropy": 5.56 }, "source": { "function_count": 7.0 }, "imports": { "count": 11.0, "stdlib_count": 2.0, "stdlib_ratio": 0.18, "unique_modules": 11.0, "third_party_count": 9.0, "third_party_ratio": 0.82 }, "members": { "count": 19.0 }, "strings": { "total": 83.0, "avg_length": 23.23, "max_length": 200.0, "avg_entropy": 3.04, "total_bytes": 1928.0, "entropy_stddev": 1.05, "high_entropy_count": 4.0, "shell_command_strings": 1.0 }, "comments": { "chars": 212.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.02, "high_entropy_comments": 2.0 }, "functions": { "count": 7.0, "avg_params": 2.0, "max_params": 4.0, "length_stddev": 12.8, "avg_name_length": 20.43, "avg_length_lines": 12.43, "max_length_lines": 43.0, "min_length_lines": 3.0, "high_entropy_names": 4.0, "avg_param_name_length": 5.36, "density_per_100_lines": 5.19, "code_in_functions_ratio": 0.64 }, "identifiers": { "count": 64.0, "total": 214.0, "avg_length": 11.34, "max_length": 29.0, "min_length": 2.0, "avg_entropy": 2.76, "reuse_ratio": 0.3, "unique_count": 64.0, "length_stddev": 6.98, "high_entropy_count": 7.0, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.05, "underscore_prefix_count": 8.0 } } }, "id": 3, "mol": "Md", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/config.py", "risk": 2, "sha": "eb038b815036d89ae88c5c596dbfcc2866da81d11758ddc1a01fe965f847bebf", "size": 5679, "traits": [ { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.800000011920929, "crit": 3, "desc": "Japanese script detection (Hiragana/Katakana)", "spans": [ [ 294, 9 ] ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "spans": [ [ 28, 15 ] ] }, { "id": "micro-behaviors/os/env/config::python-env-or-config-module-filename", "conf": 0.4000000059604645, "crit": 3, "desc": "Python env.py or config.py module", "spans": [ [ 0, 31 ] ] } ], "type": "python" }, { "id": 4, "mol": "Md", "sha": "525c1c277f63e046675f2e2c858c50d2e6803f4a8eecbde7337dd40a61aec551", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/inject.py", "risk": 1, "size": 17558, "type": "python", "depth": 1 }, { "id": 5, "mol": "Md", "sha": "322cefa4343b45f5130cacc42bedc8c3e8cf04e4e1fe5ad2cafd1f3cc4ede448", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/rebase.py", "risk": 1, "size": 9054, "type": "python", "depth": 1 }, { "id": 6, "mol": "Md", "sha": "48ff7c88aa28dcedda6cd719d8c720c03f35264ba3d8a733302655c9a65eb1d6", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/render.py", "risk": 1, "size": 3225, "type": "python", "depth": 1 }, { "id": 7, "mol": "Md", "sha": "aa62a51633ef41da3761464ca22c8c4209af1721d04d750a87808fd672cc4ec4", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/runtime_config.py", "risk": 1, "size": 3940, "type": "python", "depth": 1 }, { "ctx": [ { "b": "a%Fk\u003eGoLtFTk!??\u003e9Z/zsw@cv\u003cHx:5TFa)CVGn/]\u003cajw[FUg$OF-zr:\u003casY0GnX=wZVf{w\u003cas(9W3o*vQum-B\u003ca8Z", "n": [ { "c": 3, "d": "Japanese script detection (Hiragana/Katakana)", "i": "metadata/file/profile/language::lang-japanese", "o": 3, "z": 9, "cf": 0.800000011920929 }, { "c": 3, "d": "CJK Han ideograph sequence", "i": "metadata/file/profile/language::script-han", "o": 20, "z": 12, "cf": 0.800000011920929 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 72 }, { "b": "A+fc0wPw{PZkR96Ui8m8\u003eE2):nk@qSaM!#B\u003c/K)hH)NdNK%1TQgA+.eUiq*?\u003c=uR9Gr0%-X-nr#\u003cajb*G0\u003cS\u003eI@PA7\u003cas8!G1x#[ND5)S\u003eD{GrMziJbUM", "ln": 3, "addr": 73 }, { "b": "df", "ln": 19, "addr": 534 }, { "b": "", "ln": 20, "addr": 536 }, { "b": "uQDIOlR*DRqCP$[pF$K#p^EDqauZ?\u003ea$^RGx(ktexMtIhz!9A#z!T9hdiJkvAV!\u003egwmYZ#x(n2nx(k5lvqYZ?c[])3f!1K", "n": [ { "c": 3, "d": "chr-join character assembly transform", "i": "objectives/anti-static/obfuscation/eval/dropper::py-chr-join-decode", "o": 563, "z": 9, "cf": 0.8500000238418579 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 583, "z": 3, "cf": 0.800000011920929 } ], "ln": 21, "addr": 537 }, { "b": "uSx#$uSfx\u0026k#H0FpF$K!ni{ctlSuGLqY[jCc)z]ra$K\u0026XtY7-par\u003e6ha$i", "ln": 22, "addr": 613 }, { "b": "uSx#$uQmQTnL9n*k%!{OqErf/s4(gXmiB-oDJ", "ln": 23, "addr": 660 }, { "b": "Ee", "ln": 28, "addr": 865 }, { "b": "uQNgVl0)LTnjulwuQEaOl}G^jr7gd}nMnk/lR*AJk{erkA+c\u003ekz/6Dcy?k0", "ln": 29, "addr": 867 }, { "b": "arR^HAV#[@i:NhrtYRD4do*54fFC7-CRQ%UdR8$fvlbO-", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 915, "z": 30, "cf": 0.8999999761581421 } ], "ln": 30, "addr": 915 }, { "b": "arR^HA+c\u003c{m[#\u0026TmmfvtmjX", "ln": 31, "addr": 952 }, { "b": "df", "ln": 32, "addr": 971 }, { "b": "arR^Hb6d^ma$J", "ln": 39, "addr": 1131 }, { "b": "arR^Hb4Lb7viNl", "ln": 40, "addr": 1142 }, { "b": "arR^Hb4CL4wNY7?wG\u0026V", "n": [ { "c": 1, "d": "Codebase/repository target word: codebase", "i": "objectives/impact/destroy/keywords::target-codebase--codebase", "o": 1159, "z": 8, "cf": 0.8799999952316284 } ], "ln": 41, "addr": 1154 }, { "b": "arR^Hb4kI4xLzT3a$J", "ln": 42, "addr": 1170 }, { "b": "arR^Hb4CB$B8#5aa$J", "ln": 43, "addr": 1185 }, { "b": "arR^Ha%Fjsu$rX/vld!7axqrhaMF3Q\u003caA/XF#4BVT(C5D\u003caAiGFSeY[IrfC\u0026\u003cajk[L!l4fK04d*o*{h!J?#0kT)0G\u003c\u003caicGF%bkKQ#!+F\u003caiSUF@wVtF=", "ln": 63, "addr": 1491 }, { "b": "", "ln": 64, "addr": 1585 }, { "b": "arR^Hu%[d^y\u0026%q%u)aGXUomjXwmoN*i:=tr\u003carDUNww\u003e]GYvSQ\u003eb%T5F@o3fH#=pdayFO\u003ezdd6*fk$/wj7qStwI#v@e?O+:vdg:+\u003ca8Z", "n": [ { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 1651, "z": 6, "cf": 0.699999988079071 } ], "ln": 65, "addr": 1586 }, { "b": "arR^H\u003e+$=FKfvO@S]FYw\u003caAdgu%)tuk$jpInLIGvmpeCGr6:\u003e=nLISYu)aGXUh+7^\u003caiVVF@F-vI@Pw?dK%L.Job+(\u003cHx:7HQnJX\u003caiSUF@wVuI@Pts\u003cai=YFVX", "ln": 66, "addr": 1670 }, { "b": "arR^H\u003eBn\u003cuZkR96J37?^o*{h^JjObbHVr#z[4sD:u]}+7aMF9p\u003caBt\u003eGq4sTYYjQUatj\u003cBu[tX[aMF9f\u003caC28G1{DrTMm6U[4sIqFV4KVG5.Dv\u003caje?FSnYvUh+8F", "ln": 67, "addr": 1769 }, { "b": "arR^HADMhwwJy@PBAeHKawM\u0026)wGTbUph+2Y", "ln": 96, "addr": 3043 }, { "b": "arR^HAbP!ujS[//vrcDjd\u003ccL", "ln": 97, "addr": 3072 }, { "b": "arR^HCw7YbwGU@gB09N/y?mGjxMO9cdlm", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 3092, "z": 26, "cf": 0.5 } ], "ln": 98, "addr": 3092 }, { "b": "arR^HarR^Hv}Yp\u003eauZ\u0026XBzU?#AbP/6", "ln": 99, "addr": 3119 }, { "b": "arR^HarR^Hx\u003ewGcB-hwkazC)tzF%Rtph+2YiS", "ln": 100, "addr": 3144 }, { "b": "arR^HarR^HAb]JeA=kD0B8$]6auZ\u0026OAb]JeA=kD0B8$YhA+]8{z/Piav}YB\u003cwHI.gy\u0026%qr", "ln": 155, "addr": 4837 }, { "b": "arR^HarR^Hx\u003ewG9vqPM#jV%]iB8\u003e+mayPd#aAhvjAb](bwPI{7wg?XpCv+!ydk2W-vrcEhCwhejc)AhgByviOdlm", "ln": 156, "addr": 4894 }, { "b": "arR^HarR^HarR^HAaa3dz^^f0jS[Y:wPhWdv}x.5wN]1YwO@[uwmoN*iWc0}i:z", "n": [ { "c": 1, "d": "payload keyword", "i": "objectives/command-and-control/dropper/keywords::payload", "o": 4977, "z": 7, "cf": 0.6000000238418579 } ], "ln": 157, "addr": 4965 }, { "b": "arR^HarR^HarR^Hx\u003ewG9z/^aex(^T5vp\u003c7Tx(do\u003ewNw$RBywK0A+M}vvr(WcvpQ/F", "ln": 158, "addr": 5016 }, { "b": "arR^HarR^HarR^HarR^HA+f9aC42ide[5ZrwO#3bc$djtA:J)fvrcDvayPwlA:Jx}wgn@", "ln": 159, "addr": 5069 }, { "b": "arR^HvqG:#Cv+q(B7n({zdN=HaAIaotxs[bt{aIqph+2YauZ\u0026xz/fbq", "ln": 291, "addr": 8455 }, { "b": "diHiaaAITBiS", "ln": 292, "addr": 8500 }, { "b": "arR^Ha%Fj4r834e\u003e9y!:T^wd9M/AWX\u003e+$=FKfvO@S]FYw\u003caAfFFV4KWWC#)$\u003cat5aF#4BUY5Ovf\u003cariHFpW", "n": [ { "c": 2, "d": "Recognized developer credential marker", "i": "objectives/credential-access/cloud/devops-bundle::developer-credential-sweep-recognized-marker", "o": 8517, "z": 126, "cf": 0.949999988079071 } ], "ln": 293, "addr": 8510 }, { "b": "", "ln": 294, "addr": 8577 }, { "b": "arR^Hu%)L-vpB4:wiAy\u003cy\u0026:e}u)aGXS]FX/\u003caADNF#4BVK(I57\u003caiMSFU\u003cL$u$:U0y*ZS[\u003carDOFT$?LUh+8E\u003caj@dZM^=fND5*H", "ln": 295, "addr": 8578 }, { "b": "arR^Hu%(@OB.a@*aMF3M\u003caragu%)\u003e=gCifNwNPE:u)aGXR%77:\u003c=uR9Gr0%-X-nr#\u003casY0GnX=wZVf{w\u003cas(5F%bt\u003eJn]Fz\u003ca8Z", "n": [ { "c": 1, "d": "Cleanup/action word: clean", "i": "objectives/impact/destroy/keywords::cleanup-verb--clean", "o": 8685, "z": 5, "cf": 0.8799999952316284 } ], "ln": 296, "addr": 8659 }, { "b": "arR^Hu%)zVy\u0026sJewm3/]u)aGXJ38Ioph+2Yu%\u003ebqFVv:ZIrpe0\u003c/U6jFV!jnVe}4I\u003caBw(G1o]]HY", "ln": 297, "addr": 8739 }, { "b": "arR^H[4sD:u{)BMk#*PTuQmvVpGG$MuSorYq^-#QfcBUgl}6Nhrzlw0k$\u003c%Fs4bI:k#Z/YnKuARmn)P4ati", "ln": 298, "addr": 8801 } ], "depth": 1, "facts": { "imp": [ [ "", "\"\".join" ], [ "", "chr" ], [ "", "range" ], [ "", "ord" ], [ "", "ord" ], [ "", "re.compile" ], [ "", "re.compile" ], [ "", "value.lstrip().lower" ], [ "", "value.lstrip" ], [ "", "any" ], [ "", "head.startswith" ], [ "", "head.startswith" ], [ "", "value.translate(_URL_ASCII_TAB_OR_NEWLINE).lstrip" ], [ "", "value.translate" ], [ "", "value.translate" ], [ "", "pattern.search" ], [ "", "len" ], [ "", "len" ], [ "", "tag[pos].isspace" ], [ "", "tag[pos].isspace" ], [ "", "tag[pos].isspace" ], [ "", "tag[name_start:pos].lower" ], [ "", "tag[pos].isspace" ], [ "", "tag[pos].isspace" ], [ "", "tag[pos].isspace" ], [ "", "preprocess_url_for_scheme" ], [ "", "preprocessed.lower().startswith" ], [ "", "preprocessed.lower" ], [ "", "len" ], [ "", "is_safe_image_data_uri" ], [ "", "removals.append" ], [ "", "parts.append" ], [ "", "parts.append" ], [ "", "\"\".join" ], [ "", "len" ], [ "", "len" ], [ "", "html[pos + 1].isalpha" ], [ "", "find_start_tag_end" ], [ "", "parts.append" ], [ "", "parts.append" ], [ "", "strip_unsafe_data_src_from_tag" ], [ "", "parts.append" ], [ "", "\"\".join" ], [ "", "attr.lower" ], [ "", "contains_data_scheme_candidate" ], [ "", "preprocess_url_for_scheme" ], [ "", "preprocessed.lower().startswith" ], [ "", "preprocessed.lower" ], [ "", "len" ], [ "", "is_safe_image_data_uri" ], [ "", "set" ], [ "", "allowed_attributes.items" ], [ "", "strip_unsafe_data_src" ], [ "", "nh3.clean" ], [ "", "nh3" ], [ "", "re" ] ], "mbr": [ "allowed_attributes.items", "attr.lower", "head.startswith", "nh3.clean", "parts.append", "pattern.search", "preprocessed.lower", "preprocessed.lower().startswith", "re.IGNORECASE", "re.compile", "removals.append", "value.lstrip", "value.lstrip().lower", "value.translate", "value.translate().lstrip" ], "tgt": [ "_contains_data_scheme_candidate", "_find_start_tag_end", "_is_safe_image_data_uri", "_preprocess_url_for_scheme", "_strip_unsafe_data_src", "_strip_unsafe_data_src_from_tag", "allowed_attributes.items", "any", "attr.lower", "chr", "head.startswith", "len", "nh3.clean", "ord", "parts.append", "pattern.search", "preprocessed.lower", "preprocessed.lower().startswith", "range", "re.compile", "removals.append", "set", "value.lstrip", "value.lstrip().lower", "value.translate", "value.translate().lstrip" ], "metrics": { "ast": { "op.add": 19.0, "op.bor": 4.0, "op.lor": 4.0, "op.sub": 1.0, "op.land": 17.0, "max_depth": 17.0, "bind_count": 63.0, "call_count": 54.0, "node_count": 2367.0, "member_count": 15.0, "op_density.add": 0.01, "op_density.bor": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.land": 0.01, "identifier_count": 88.0, "member_depth_max": 3.0, "string_literal_count": 128.0, "array_literal_max_length": 41.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 10235.0, "entropy": 5.52, "size_bytes": 10235.0 }, "text": { "digit_ratio": 0.01, "space_count": 2168.0, "total_lines": 330.0, "char_entropy": 5.52, "unique_chars": 154.0, "escape_density": 0.04, "string_density": 0.39, "avg_line_length": 30.02, "high_byte_ratio": 0.19, "max_line_length": 111.0, "non_ascii_ratio": 0.19, "empty_line_ratio": 0.13, "hex_escape_count": 4.0, "last_line_length": 5.0, "whitespace_ratio": 0.24, "most_common_ratio": 0.04, "identifier_density": 1.21, "line_length_stddev": 28.08, "normalized_string_count": 7.05, "repeated_char_sequences": 38.0, "suspicious_string_ratio": 0.05, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 227.0, "normalized_unique_identifiers": 10.52 }, "binds": { "count": 63.0 }, "calls": { "count": 54.0 }, "binary": { "overall_entropy": 5.52, "peak_region_bytes": 4096.0, "peak_region_entropy": 6.12 }, "source": { "function_count": 8.0 }, "imports": { "count": 2.0, "stdlib_count": 1.0, "stdlib_ratio": 0.5, "unique_modules": 2.0, "third_party_count": 1.0, "third_party_ratio": 0.5 }, "members": { "count": 15.0 }, "strings": { "total": 128.0, "avg_length": 26.38, "max_length": 896.0, "path_count": 2.0, "avg_entropy": 1.88, "empty_count": 4.0, "total_bytes": 3377.0, "entropy_stddev": 1.34, "high_entropy_count": 5.0, "shell_command_strings": 7.0 }, "comments": { "chars": 278.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.01, "high_entropy_comments": 3.0 }, "functions": { "count": 8.0, "avg_params": 2.25, "max_params": 6.0, "length_stddev": 18.22, "avg_name_length": 23.88, "avg_length_lines": 25.0, "max_length_lines": 60.0, "min_length_lines": 3.0, "high_entropy_names": 1.0, "single_char_params": 2.0, "avg_param_name_length": 6.61, "density_per_100_lines": 2.42, "code_in_functions_ratio": 0.61 }, "identifiers": { "count": 88.0, "total": 399.0, "avg_length": 10.97, "max_length": 36.0, "min_length": 2.0, "avg_entropy": 2.57, "reuse_ratio": 0.22, "unique_count": 88.0, "length_stddev": 8.95, "has_digit_ratio": 0.02, "high_entropy_count": 8.0, "high_entropy_ratio": 0.09, "all_lowercase_ratio": 0.84, "all_uppercase_ratio": 0.14, "numeric_suffix_count": 1.0, "underscore_prefix_count": 16.0 } } }, "id": 8, "mol": "O(As)Md", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/sanitize.py", "risk": 2, "sha": "b202f589c55f8b0f2c94676d6fdbeb518006eb791e04bac9e9d25c1ebeecacaa", "size": 10235, "traits": [ { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.800000011920929, "crit": 3, "desc": "Japanese script detection (Hiragana/Katakana)", "spans": [ [ 3, 9 ] ] }, { "id": "metadata/file/format::han-ideograph-prose", "conf": 0.8999999761581421, "crit": 2, "desc": "Dense Han ideograph prose (localized source)", "spans": [ [ 20, 12 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--codebase", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: codebase", "spans": [ [ 1159, 8 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/dropper::py-chr-join-decode", "atk": "T1027", "conf": 0.8500000238418579, "crit": 3, "desc": "chr-join character assembly transform", "spans": [ [ 563, 9 ] ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "spans": [ [ 20, 12 ] ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "spans": [ [ 8685, 5 ] ] } ], "type": "python" }, { "id": 9, "mol": "Md", "sha": "79120d789d315543fe718ac2993a00db25f2aae3940cb6146fa4d71cd443bcad", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/static/riddle-init.js", "risk": 1, "size": 903, "type": "javascript", "depth": 1 }, { "id": 10, "mol": "Md", "sha": "1ec2a4d39d66edbf144d611075af32e3192971625c358afda5a64f4f7dd28967", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/static/riddle.css", "risk": 1, "size": 3331, "type": "text", "depth": 1 }, { "ctx": [ { "b": "fdF8=Aa\u0026%6CR9@IwmPH/eQ7(xB8UYhazkIeB8$=gC{46AAbP]hAV==Hy***+xM4Y$wPx\u003cPx(d*9wO(0@By!#9x(k4rf/HWegb7d1dLy", "n": [ { "c": 2, "d": "Any script file", "i": "metadata/file/extension/identity::script-file", "o": 0, "z": 9, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 83 }, { "b": "fe1CEA+e/-vqGZ\u003cAV\u003cy[R%71e\u003eD{]xGo1#AYYjT3\u003cai(-FSX#ALi6fD\u003c^R\u003e4FTLLII@PwX\u003caq\u003cxFV!3=Me^E\u003e\u003caBz)G1{=!H!.(0wKZxIBy/FBq+fX=uQWTSo*}/R[4sIqFpW", "n": [ { "c": 3, "d": "Japanese script detection (Hiragana/Katakana)", "i": "metadata/file/profile/language::lang-japanese", "o": 116, "z": 9, "cf": 0.800000011920929 } ], "ln": 3, "addr": 84 }, { "b": "v@DmaBrBHMpGH)(oHRVApe\u0026u0atw3{i@", "ln": 4, "addr": 191 }, { "b": "", "ln": 5, "addr": 217 }, { "b": "fe1EeX@t^MQ3m@I\u003c?vCGFV!jAU\u0026.N\u0026\u003cajb?ZN:ICF-zrH\u003cariMSiLDBUJR\u003cm\u003eD{]JYOHfdx(2why\u0026sxawftq%y\u0026sJlx(!yRGs=hkzFsibDsXZFC{8c#T]", "n": [ { "c": 3, "d": "CJK Han ideograph sequence", "i": "metadata/file/profile/language::script-han", "o": 221, "z": 12, "cf": 0.800000011920929 } ], "ln": 6, "addr": 218 }, { "b": "fe1CommGNyoJkv+oIwk-mmpGZk$s\u0026@\u003caje\u003eM9/UmI0@0k\u003ca8:wFS]bCJo4QE\u003c!Oj5FV!jlF-\u003czk\u003cajz]Go1#AYYjT3\u003caiDPFVd?3Q#^SG\u003caiSUF@wVtF=", "ln": 7, "addr": 312 }, { "b": "fe1EgUAXm-Gx4M=\u003caC28FV[ghR@\u003cq2\u003c/K)fFVE}nQV!Oo\u003c=2I=FTLLII-I$Kr834e\u003e+-{]W4MDgT@}*{xhh(LwGZ2:UJpE\u003c\u003caicGF@eP+R@\u003cq2\u003c/K)fFUq4OJn]Ct", "ln": 8, "addr": 406 }, { "b": "asXH4pFz$(FVF1jRSin!\u003caiVZW3o:VI@Pw*\u003eDpfnP{aI/Uh+8F\u003cajb(SefStM/AT+\u003cariTYOLWXR@\u003c}C\u003cajz@M9xw2Q#N9tAcJI/MwsO7M/T3\u0026\u003c=2I=FV[r?SPPIA\u003c:\u003c/0FV!jxTMtwd[4sIqFpW", "ln": 65, "addr": 1653 }, { "b": "asXH0Aa9=}z6jgzvRPE:BBtoJvrb^[A@", "ln": 66, "addr": 1772 }, { "b": "asXH0Aa9=}z6jgLBz(aVzGP/9wPxtrwOc3BzGP/9wPxthz/*8tz8#MSzdm6%eokDqxMMpMB.$P0AX8AGwoqGCzGP/9wPxtnwOC^\u003cBujqZzdm6%EsikSvrb^[B1RMPx\u003eI6\u0026A-cEUBrGQ@H#Tb/\u003casw}Pq*}=Q5", "n": [ { "c": 1, "d": "DOM or CSS size property (height)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--height", "o": 1873, "z": 6, "cf": 1.0 }, { "c": 1, "d": "DOM or CSS size property (width)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--width", "o": 1860, "z": 5, "cf": 1.0 } ], "ln": 67, "addr": 1798 }, { "b": "asXH0Aa9=}z6jgyB.$P0A^Y6Hvrb^[B1RAIA93::Bz8/SGpR4PGx4PJ\u003c**6", "ln": 68, "addr": 1924 }, { "b": "asXH0Aa9=}z6jgyB.$P0A^Y6Hvrb^[B1RAIA7BLOxj#xf\u003caA].Gm\u0026ipM*7Mr\u003caiD", "ln": 69, "addr": 1972 }, { "b": "", "ln": 146, "addr": 4387 }, { "b": "fdFB", "ln": 147, "addr": 4388 }, { "b": "asXHEA+e\u00269\u003cajuQu)x54\u003cH.nMNt{lULi4:\u003c\u003carfIHQ#I%M/AT]ay]4[z!9AVqB%k]ze:AhwO#Pj\u003caiMSFUh7\u003cHVLU8\u003c+Pn-F%bujL\u0026Es.[4sFrG%x()N=x3=\u003caBt\u003eG0so/Q2Q^i\u003caAfIIOnbbY6)p*\u003ca8Z", "n": [ { "c": 2, "d": "decodeURIComponent function", "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-decodeuricomponent", "o": 4433, "z": 18, "cf": 0.699999988079071 } ], "ln": 148, "addr": 4392 }, { "b": "asXHwbvzUSGRvBSM*.OF\u003cHyiiT!T{dSn\u0026Jp\u003casR$Gs{k%Iq%e+ay]4[z!9AVqB%k]ze:AhwO#Pj\u003caifIZkI9GMG9K@\u003caragzGP=i\u003ca8:ASK?bxMe^H@\u003casI}Gq4sTV/uW]\u003cajxRa%Fe\u0026F%bujL\u0026Es.\u003ca8Z", "ln": 149, "addr": 4516 }, { "b": "asXH0Aa9=}z6jgDBAh8kxmg[oA+e\u00269\u003cI3J{a%Q/jgA)}{ar\u0026A\u003cfk$ujwIdUrzepCswPzStfD{", "ln": 150, "addr": 4640 }, { "b": "asY2", "ln": 152, "addr": 4788 }, { "b": "w{503BzkVhay]4[z!9AIA+e\u0026LA:-P$wO#PrxMvV@diJ%", "ln": 153, "addr": 4792 }, { "b": "arUfjzGx[xxKL%}nP56ICPYc(xMvV@e[]ilwQ40.c)x(Wdlv", "n": [ { "c": 2, "d": "JavaScript substring search call", "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "o": 4853, "z": 8, "cf": 0.8199999928474426 } ], "ln": 154, "addr": 4828 }, { "b": "arUxgasH]iB7!c.wmZ0djV$}JeIOW%DJ", "ln": 155, "addr": 4867 }, { "b": "arR^HA+funA=91qB.\u003e\u003eQ", "ln": 156, "addr": 4893 }, { "b": "", "ln": 180, "addr": 5769 }, { "b": "fdFB", "ln": 181, "addr": 5770 }, { "b": "asXHEA+e\u00269\u003cajuQu)x54\u003cH.nMNt{lULi4:\u003c\u003carfIHQ#I%M/AT]azbU5xkIi$BrCpdaMF6p\u003e!AwxFTL#tI0fIX\u003ecI0t\u003c?c(wL=i-mTMm6U\u003cajuQxjVfNy?mD{zGFi\u003cnN@$bL=j5-Iq%br", "n": [ { "c": 1, "d": "getElementById/querySelector (getElementById)", "i": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid", "o": 5862, "z": 14, "cf": 0.8999999761581421 } ], "ln": 182, "addr": 5774 }, { "b": "asXHwbvzUSGRvBSM*.OF\u003eC=5MGo+FHSPePm\u003caB5=Gr%P\u003cI0@0q\u003cHyiiT!T{dSn\u0026Jp\u003casR$Gs{k%Iq%e+ay]4[z!9AVqB%k]ze:AhwO#Pj\u003caifIZkI9GMG9K@\u003caragzGP=i\u003ca8Z", "ln": 183, "addr": 5887 }, { "b": "asXH0Aa9=}z6jgDBAh8kxmg[oA+e\u00269\u003cI3J{a%Q/jgA)}{ar\u0026A\u003cfk$ujwIdUrzepCbx()]rCP)", "ln": 184, "addr": 5995 }, { "b": "arSr\u003caM/hA\u003c+PF/FVZaGau{$[aMF6f\u003carfIIh*LDS#%CC\u003caifHFR8{lJn]F[\u003ca8ZvG1o][T(C5D\u003caB2+F%bn-J{0jH\u003caiMSFU}EUGYvVx\u003caje?FXQk@S]FU#\u003ca8Z", "ln": 205, "addr": 6609 }, { "b": "arUfjzGx[xvR6d\u0026A+ef*wN/B.y-\u003e\u003e-BAh8jzdNlgB8U@fBsn!DffZW!fdXk2do!Gii@", "ln": 206, "addr": 6709 }, { "b": "arUxgasHYgw]zZ3q/DqTx\u003c\u003e*gx(mA%B.268c)yX@djDx^", "n": [ { "c": 1, "d": "JavaScript includes method", "i": "metadata/lang/scripted::includes-method", "o": 6783, "z": 8, "cf": 1.0 } ], "ln": 207, "addr": 6763 }, { "b": "arR^Hfe1EdG1o][T(C5D\u003caB2^Ua$iVFA8ij\u003cardHaM//3\u003e+:B3FV!3+X-npz\u003caC28Gp}mSH#Tc2\u003casF{Gr%P?I@Pw:ayP85z*c2iB95L+FV!3+G5.A+\u003cajw[FXQAEVe}4I\u003ca8Z", "ln": 208, "addr": 6800 }, { "b": "arR^Hv@DmaBrCTmxK#3(auZ\u0026RwOb\u003e3wM9LVv}/v/e]$\u0026yv}v5xefFzkw]zZ3q/DqTx\u003c\u003e*gx(mD)CU.{1b03[%as!M?dlv", "ln": 209, "addr": 6908 }, { "b": "arSr\u003caMF6:\u003casz[Gs{k%PYJtK\u003e+%3(FVv:YM*.OT\u003eBo0yUF8bVqCub3F)@efwGZ6CNb-:S\u003cajb(R\u003e-yVY5/0R\u003c=Dw1F%bq\u003eY6ceN\u003caiSUF@wVtF=", "ln": 214, "addr": 7105 }, { "b": "arU=DC{4C", "ln": 215, "addr": 7195 }, { "b": "arR^HzE[2mxkzG}vqF[Rx(+[bqCnGXA+PxcwN)tmb4#7uA5]T9wQ4T2Abo8rx(n95y?WAka$kO", "n": [ { "c": 2, "d": "HTTP protocol prefix", "i": "micro-behaviors/communications/http/message::http-prefix", "o": 7236, "z": 7, "cf": 0.8999999761581421 }, { "c": 1, "d": "Validation vocabulary invalid", "i": "metadata/file/format::vocab-invalid", "o": 7251, "z": 7, "cf": 0.9700000286102295 } ], "ln": 216, "addr": 7203 }, { "b": "arR^HA+funA=91wA=\u003e}P", "ln": 217, "addr": 7263 }, { "b": "arV7Pv{%E?xDRT", "ln": 218, "addr": 7280 }, { "b": "asY2", "ln": 226, "addr": 7521 }, { "b": "w{503BzkVhaAH$ex([6nwKQADzdNQbl3di?x\u003c#jbwPGnhy:*GN", "ln": 227, "addr": 7525 }, { "b": "arUomAV==uz/fSrayPwlAV/pjax{DJe[F\u0026KvruQix\u003c#jbwPIcaaBs", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 7567, "z": 6, "cf": 0.5 } ], "ln": 228, "addr": 7566 }, { "b": "arR^Hv@DmaBrCEfzdK?MayPwlAXqlrzdLtwz+L7[wPydDB7D:Gi@", "ln": 229, "addr": 7609 }, { "b": "arR^Hx\u003ewFozEEx[e]#byA==w7x([2pb5.uydjDx^", "ln": 230, "addr": 7651 }, { "b": "arR^HarUlie]\u003eJuz*2XTBAzLqvS=^7c$djtAXqlrzdLdT", "ln": 231, "addr": 7684 }, { "b": "arR^HEir9qB7DFdw/@H4qCpB-r8=:]e[!Wmc#JEgwHO-GclKECB5MHVwMr+!c$djtAXqJzy\u0026%qrdiJ%", "n": [ { "c": 1, "d": "Reads .value property of a DOM element", "i": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "o": 7774, "z": 6, "cf": 0.8999999761581421 } ], "ln": 232, "addr": 7721 }, { "b": "arR^HarUlie]\u003eJuz*2XTBAzLqvS=^7c$djtAXqlrzdLdT", "ln": 233, "addr": 7785 }, { "b": "arR^HEe", "ln": 234, "addr": 7822 }, { "b": "arR^HAa9=#zGEHBzGxxfBv6LJz/PzqwO-#hx(XoplUHgIwgO\u003cmy:?B", "ln": 248, "addr": 8175 }, { "b": "arV7", "ln": 249, "addr": 8219 }, { "b": "arUlie]\u003eJuz*2Xudlv", "n": [ { "c": 1, "d": "DOM remove call", "i": "micro-behaviors/data/manipulation::remove-call", "o": 8227, "z": 8, "cf": 0.800000011920929 } ], "ln": 250, "addr": 8223 }, { "b": "Ee", "ln": 251, "addr": 8238 }, { "b": "", "ln": 252, "addr": 8240 }, { "b": "", "ln": 292, "addr": 9775 }, { "b": "fe1EhL!l4fKlhv]\u003c?e1.T=S1:H?H*uw*3b+Jn]FM\u003carlIFVE\u003ewFAR=}\u003caiSUF@wVuSn\u0026C*\u003cai(-FSX#BSPePa\u003caAfFGpH$OGx4M!\u003cas\u00266Jf-HPND5)S\u003ca8.[vqfKfv@c78wN$nxIq%br", "ln": 293, "addr": 9776 }, { "b": "v@DmaBrBdHk$svJmoAIijS(y.e*$WRxmaDkwJ%*Pxk7$9Cv+l5D#\u003cEzD%}hjw*]b)i:j/[t}NPQko})@i@", "n": [ { "c": 1, "d": "WebP token inside multiline blob", "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-recognized-text--rx-12", "o": 9925, "z": 4, "cf": 0.949999988079071 } ], "ln": 294, "addr": 9889 }, { "b": "", "ln": 295, "addr": 9955 }, { "b": "fdFB", "ln": 296, "addr": 9956 }, { "b": "asY2", "ln": 301, "addr": 10209 }, { "b": "wQ5fjA=-BoB-7Yhx(v(ix(^iYw[sLJvp%dxA+e\u0026hxMvV@efFzgB7FuHnHU^e", "ln": 302, "addr": 10213 }, { "b": "arUxgasItSAaJ%1azt!bw/@lWjS\u003e}\u0026BAh8kxcFECD(%ODB5MHVwMr+!c$)Tjw*]eKDJ", "n": [ { "c": 1, "d": "Validation vocabulary string", "i": "metadata/file/format::vocab-string", "o": 10285, "z": 6, "cf": 0.9700000286102295 } ], "ln": 303, "addr": 10262 }, { "b": "arR^HA+funA=91ivqH0@i@", "ln": 304, "addr": 10316 }, { "b": "arV7", "ln": 305, "addr": 10334 }, { "b": "asY2", "ln": 326, "addr": 11068 }, { "b": "wQ5fjA=-BoB-7Yhx(v(iA+frgy\u003c6wYzdd6*q/Vv@BAh8dxjV9mayX=2wMqS1diJ%", "ln": 327, "addr": 11072 }, { "b": "arUxgasItLx\u003eI6\u0026AXquOwPA5{wO+{/Bz(gFb57[ba$jS$jV%{9B.\u003e\u003eyaBs", "n": [ { "c": 1, "d": "getElementById/querySelector DOM (querySelector)", "i": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "o": 11138, "z": 13, "cf": 0.8999999761581421 } ], "ln": 328, "addr": 11124 }, { "b": "arR^HA+funA=91qB.\u003e\u003eQ", "ln": 329, "addr": 11171 }, { "b": "arV7", "ln": 330, "addr": 11188 }, { "b": "asXI}Ua1K/Suup]ze:r1By=PPFSeY[PxhPw\u003caiSUF@wVwS]F-r\u003casF{FUq4OK(I4R\u003caA@-Gs{k@UJ7h4\u003cariTYOHVvze:r1By=PQXq/QuSn\u0026Jxl@cJ1v@c6)vR6N]zF79LFV/", "ln": 358, "addr": 12557 }, { "b": "asXI}UFfk9Q2\u00268o\u003cajuQw)]y\u0026eN@QnB7F[JYOUW0F]CTEz*2YjaNaPt\u003cHycdFV!3=S]F-r\u003casF{FV[f\u0026JPEWO(6O^sT!K\u003cbUi87B\u003c/K{jMBVmnO-tp2\u003cai9FF@n/XQ#!zr\u003caiSUF@wVtF=", "ln": 359, "addr": 12664 }, { "b": "asXHzy*?yaoLFM\u0026e[5p3aMF3N\u003car9EF@wZ4Nb\u003e=q\u003cajw[FUg$OF-RSC\u003c/UltP]w2.M/AT]\u003caq)EHMgI[HVr@L\u003cajk\u003cFRrH8H#\u003cw\u003e\u003eDfQfYOUW0F=", "n": [ { "c": 1, "d": "Ad selector token", "i": "micro-behaviors/data/manipulation::ad-selector-token", "o": 12790, "z": 3, "cf": 0.800000011920929 } ], "ln": 360, "addr": 12778 }, { "b": "asXH0Aa9=}z6jf[z!0{bwO#Qray]z2aMY/v\u003e={*7wn+$2zdNQb", "ln": 361, "addr": 12868 }, { "b": "asXH0A+funA=b}vDV0$yvR6OdaMF9C\u003caC28G0ji=M/AT?\u003cas2=Gr%P\u0026Tk!\u0026B\u003e9rd", "ln": 362, "addr": 12909 }, { "b": "asXH0Aa9=}z6jf[z!0{bwO#Qray]z2aMY/v\u003e={*7wn+$2zdNQb", "ln": 689, "addr": 25498 }, { "b": "asXH0Aa9=}z6jgDBAh8kxmg[twPRQ7wklMIwGZimQVO?)\u003caiSUF@wVwQ2Q:r\u003caA0AGnFYKJQKJob6dsqrb3hXz/{dCatj\u0026Yv@bZ+A-u:\u0026wP8ZkbjAg3", "ln": 690, "addr": 25539 }, { "b": "asXH0Aa9=}z6jf{B-7Yhx(v)qazb4#y*{*.yANe0w)]*#Bxi9!CoC$RJPDXe\u003e9Z?YFVE\u003eBZVf)1az#9Hz/u\u0026ZO4dN[LJdj%\u003caASSF#N^.YYjTB\u003caADNGm\u0026ioUk", "n": [ { "c": 2, "d": "Function constructor keyword", "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "o": 25643, "z": 8, "cf": 0.699999988079071 } ], "ln": 691, "addr": 25632 }, { "b": "asXH0A+funA=b}vDQ-c}v@#B6zHATpx(mD7\u003ed3lcFXQk$Q2Q:r\u003caA0AGnFSsF-zr}\u003cai\u0026.FV*hdvqG:?vpK6", "ln": 692, "addr": 25730 }, { "b": "asY2", "ln": 693, "addr": 25798 }, { "b": "arSr\u003caA8jgzCj+SxMNZ4CP=3$RYYX\u003ewPz(nd\u003cenvx\u003c\u0026Pbx\u003eg:=zxN$\u003eLh%lx\u003cHylgFTtzFPcdPYwo/rXO3.m^I%d3?\u003eD{]xFV!jnNcxNn[4sD^y\u0026sxaoLFcMByGfkaMF3J\u003e+\u003eiuNwxq:Iq%br", "ln": 745, "addr": 28676 }, { "b": "arUGiBrCpnwPz)7wjprCzdNQbB09Q*tu%q", "ln": 746, "addr": 28793 }, { "b": "arSr\u003caA8jgzCj+SxMNZ4CP=3$R@UQ-\u003c/K{gFTtzFPcdV.v%8T1zGFr-wO(0@BrGQ{T@}UawPzy0z*9t=G[FGqR0\u003e%Lv@c78wLu/JxMNZ4CP=3$R@+T(\u003c+nuQYOUW0F=", "n": [ { "c": 1, "d": "overflow keyword", "i": "objectives/privilege-escalation/exploit/keywords::overflow", "o": 28875, "z": 8, "cf": 0.5 } ], "ln": 747, "addr": 28821 }, { "b": "arUGiBrCTkC4ChWC4CYay\u0026sIujS[S+y?#f", "ln": 748, "addr": 28923 }, { "b": "", "ln": 749, "addr": 28951 }, { "b": "asY2", "ln": 1101, "addr": 43842 }, { "b": "w{503BzkVhaz#arzddl{DsYAYz!@#[zyxWpy\u0026%quazb4#y*{*.yBHxM", "ln": 1102, "addr": 43846 }, { "b": "arUYoBAIRwaAR)FwP8f6C42ifwGTc0jS\u003e}Tz/oD6vqWnikoLbTy\u0026%qiiV@3yy\u00260M?v@1d", "n": [ { "c": 1, "d": "Validation vocabulary boolean", "i": "metadata/file/format::vocab-boolean", "o": 43918, "z": 7, "cf": 0.9700000286102295 } ], "ln": 1103, "addr": 43891 }, { "b": "Ee", "ln": 1104, "addr": 43947 }, { "b": "", "ln": 1105, "addr": 43949 }, { "b": "arUGiBrCQjCrk", "ln": 1130, "addr": 45150 }, { "b": "arU=DC{4C", "ln": 1131, "addr": 45161 }, { "b": "arR^HA::emjS)u}pFJJYvrcB2c$NiEBy/YslVl\u003c:wO#Psi@", "n": [ { "c": 2, "d": "JSON.parse call", "i": "micro-behaviors/data/serialize/json::json-parse-call", "o": 45179, "z": 10, "cf": 0.5 } ], "ln": 1132, "addr": 45169 }, { "b": "arV7Pv{%E?xDRT", "ln": 1133, "addr": 45207 }, { "b": "arR^HA+funA=91Datbo0lR*DDnK)bQmmGNyoJj}kEld", "ln": 1134, "addr": 45219 }, { "b": "arV7", "ln": 1135, "addr": 45254 }, { "b": "arUxgasInsCox4ijS[S+y?$kwD)0JRAaJ%1aAy[mar-)har\u003e-kygQ)%a$jTY", "n": [ { "c": 1, "d": "Validation vocabulary object", "i": "metadata/file/format::vocab-object", "o": 45296, "z": 6, "cf": 0.9700000286102295 } ], "ln": 1136, "addr": 45258 }, { "b": "arR^HA+funA=91Datbo0lR*DDnK)bQmmGNyoJj}kEld", "ln": 1137, "addr": 45307 }, { "b": "arV7", "ln": 1138, "addr": 45342 } ], "depth": 1, "facts": { "imp": [ [ "", "SHOW_ELEMENT" ], [ "", "ALLOWED_TAGS" ], [ "", "URL_ATTRS" ], [ "", "ALLOWED_SCHEMES" ], [ "", "RIDDLE_TIP_ID_PREFIX" ], [ "", "spaceBelow" ], [ "", "spaceAbove" ], [ "", "fitsBelow" ], [ "", "fitsAbove" ], [ "", "placement" ], [ "", "placement" ], [ "", "placement" ], [ "", "placement" ], [ "", "top" ], [ "", "left" ], [ "", "left" ], [ "", "left" ], [ "", "el.style.top" ], [ "", "el.style.left" ], [ "", "pending" ], [ "", "pending" ], [ "", "requestFrame" ], [ "", "pending" ], [ "", "reposition" ], [ "", "hashIndex" ], [ "", "href.indexOf" ], [ "", "decodeURIComponent" ], [ "", "href.slice" ], [ "", "decoded" ], [ "", "decodeHrefFragment" ], [ "", "termId" ], [ "", "decoded.slice" ], [ "", "decoded.lastIndexOf" ], [ "", "termId.startsWith" ], [ "", "decoded" ], [ "", "decodeHrefFragment" ], [ "", "trimmed" ], [ "", "value.trim" ], [ "", "trimmed.startsWith" ], [ "", "beforeSpecial" ], [ "", "trimmed.split" ], [ "", "beforeSpecial.includes" ], [ "", "scheme" ], [ "", "beforeSpecial.slice" ], [ "", "beforeSpecial.indexOf" ], [ "", "ALLOWED_SCHEMES.has" ], [ "", "scheme.toLowerCase" ], [ "", "name" ], [ "", "attr.name.toLowerCase" ], [ "", "name.startsWith" ], [ "", "el.removeAttribute" ], [ "", "URL_ATTRS.has" ], [ "", "isSafeUrl" ], [ "", "el.removeAttribute" ], [ "", "el.getAttribute" ], [ "", "el.setAttribute" ], [ "", "parent" ], [ "", "parent.insertBefore" ], [ "", "el.remove" ], [ "", "el" ], [ "", "doc.getElementById" ], [ "", "view" ], [ "", "doc" ], [ "", "walker" ], [ "", "doc.createTreeWalker" ], [ "", "toRemove" ], [ "", "node" ], [ "", "walker.nextNode" ], [ "", "node" ], [ "", "walker.nextNode" ], [ "", "ALLOWED_TAGS.has" ], [ "", "node.tagName.toUpperCase" ], [ "", "sanitizeElementAttributes" ], [ "", "toRemove.push" ], [ "", "unwrapElement" ], [ "", "IMAGE_EXT" ], [ "", "isSafeUrl" ], [ "", "url" ], [ "", "url" ], [ "", "url" ], [ "", "IMAGE_EXT.test" ], [ "", "trigger.querySelector" ], [ "", "href" ], [ "", "trigger.getAttribute" ], [ "", "isSafeImageHref" ], [ "", "TERM_TRIGGER_SELECTOR" ], [ "", "FOOTNOTE_TRIGGER_SELECTOR" ], [ "", "IMAGE_TRIGGER_SELECTOR" ], [ "", "POPOVER_CLASS" ], [ "", "POPOVER_SELECTOR" ], [ "", "POPOVER_ID" ], [ "", "TERM_MARK_CLASS" ], [ "", "marked" ], [ "", "doc.querySelectorAll" ], [ "", "anchor.closest" ], [ "", "termId" ], [ "", "deriveTermId" ], [ "", "anchor.getAttribute" ], [ "", "getRiddleTemplate" ], [ "", "anchor.classList.add" ], [ "", "POPOVER_NESTED_CLASS" ], [ "", "POPOVER_NESTED_SELECTOR" ], [ "", "POPOVER_NESTED_ID" ], [ "", "POPOVER_LEVEL1_SELECTOR" ], [ "", "trigger" ], [ "", "event.target.closest" ], [ "", "trigger.closest" ], [ "", "trigger.closest" ], [ "", "trigger.matches" ], [ "", "trigger.matches" ], [ "", "deriveTermId" ], [ "", "trigger.getAttribute" ], [ "", "event.target.closest" ], [ "", "termId" ], [ "", "deriveTermId" ], [ "", "trigger.getAttribute" ], [ "", "template" ], [ "", "getRiddleTemplate" ], [ "", "sanitizeFragment" ], [ "", "template.content.cloneNode" ], [ "", "FOOTNOTE_BODY_CLASSES" ], [ "", "FOOTNOTE_BODY_CLASSES.some" ], [ "", "el.classList.contains" ], [ "", "fragmentId" ], [ "", "deriveFragmentId" ], [ "", "trigger.getAttribute" ], [ "", "body" ], [ "", "doc.getElementById" ], [ "", "isFootnoteBody" ], [ "", "clone" ], [ "", "body.cloneNode" ], [ "", "clone.querySelectorAll" ], [ "", "label.remove" ], [ "", "fragment" ], [ "", "doc.createDocumentFragment" ], [ "", "fragment.appendChild" ], [ "", "sanitizeFragment" ], [ "", "trigger.matches" ], [ "", "resolveTermContent" ], [ "", "trigger.matches" ], [ "", "resolveFootnoteContent" ], [ "", "view" ], [ "", "triggerRect" ], [ "", "trigger.getBoundingClientRect" ], [ "", "pos" ], [ "", "computePopoverPosition" ], [ "", "applyPopoverPosition" ], [ "", "view" ], [ "", "requestFrame" ], [ "", "view.requestAnimationFrame.bind" ], [ "", "callback" ], [ "", "schedule" ], [ "", "createRepositionScheduler" ], [ "", "positionPopover" ], [ "", "view.addEventListener" ], [ "", "view.addEventListener" ], [ "", "view.removeEventListener" ], [ "", "view.removeEventListener" ], [ "", "el" ], [ "", "doc.querySelector" ], [ "", "el" ], [ "", "doc.createElement" ], [ "", "el.className" ], [ "", "initFn" ], [ "", "doc.body.appendChild" ], [ "", "getLazyElement" ], [ "", "el.setAttribute" ], [ "", "getLazyElement" ], [ "", "el.setAttribute" ], [ "", "trigger.closest" ], [ "", "LIGHTBOX_CLASS" ], [ "", "LIGHTBOX_SELECTOR" ], [ "", "LIGHTBOX_CLOSE_LABEL" ], [ "", "LIGHTBOX_FALLBACK_LABEL" ], [ "", "getLazyElement" ], [ "", "lightbox.setAttribute" ], [ "", "lightbox.setAttribute" ], [ "", "lightbox.setAttribute" ], [ "", "lightbox.setAttribute" ], [ "", "img" ], [ "", "doc.createElement" ], [ "", "img.className" ], [ "", "lightbox.appendChild" ], [ "", "closeBtn" ], [ "", "doc.createElement" ], [ "", "closeBtn.setAttribute" ], [ "", "closeBtn.className" ], [ "", "closeBtn.setAttribute" ], [ "", "lightbox.appendChild" ], [ "", "lightbox" ], [ "", "doc.querySelector" ], [ "", "lightbox.hasAttribute" ], [ "", "el" ], [ "", "doc.querySelector" ], [ "", "el.hasAttribute" ], [ "", "view" ], [ "", "view.methodName.bind" ], [ "", "resolveViewTimer" ], [ "", "resolveViewTimer" ], [ "", "triggerSelector" ], [ "", "pendingTimer" ], [ "", "levels" ], [ "", "activeImageTrigger" ], [ "", "inertedElements" ], [ "", "savedOverflow" ], [ "", "level" ], [ "", "levelOfTrigger" ], [ "", "result" ], [ "", "handleTriggerForElement" ], [ "", "termId" ], [ "", "closePopover" ], [ "", "state" ], [ "", "popover" ], [ "", "getNestedPopover" ], [ "", "getPopover" ], [ "", "popover.addEventListener" ], [ "", "popover.addEventListener" ], [ "", "scheduleClose" ], [ "", "state.hoverWired" ], [ "", "popover.replaceChildren" ], [ "", "popover.setAttribute" ], [ "", "popoverId" ], [ "", "popover.getAttribute" ], [ "", "popover.setAttribute" ], [ "", "state.activeTrigger.removeAttribute" ], [ "", "result.trigger.setAttribute" ], [ "", "state.activeTrigger" ], [ "", "state.openedByFocus" ], [ "", "state.termId" ], [ "", "popover.removeAttribute" ], [ "", "positionPopover" ], [ "", "state.detachReposition" ], [ "", "state.detachReposition" ], [ "", "attachRepositionListeners" ], [ "", "selector" ], [ "", "popover" ], [ "", "doc.querySelector" ], [ "", "popover.setAttribute" ], [ "", "state" ], [ "", "state.detachReposition" ], [ "", "state.detachReposition" ], [ "", "state.termId" ], [ "", "triggerToRestore" ], [ "", "wasFocusOpen" ], [ "", "state.activeTrigger" ], [ "", "state.openedByFocus" ], [ "", "triggerToRestore.removeAttribute" ], [ "", "triggerToRestore.focus" ], [ "", "lightbox" ], [ "", "getLightbox" ], [ "", "img" ], [ "", "lightbox.querySelector" ], [ "", "img.src" ], [ "", "innerImg" ], [ "", "triggerEl.querySelector" ], [ "", "alt" ], [ "", "innerImg.getAttribute" ], [ "", "img.alt" ], [ "", "lightbox.setAttribute" ], [ "", "activeImageTrigger" ], [ "", "inertedElements" ], [ "", "bodyChildren" ], [ "", "Array.from" ], [ "", "child.hasAttribute" ], [ "", "child.setAttribute" ], [ "", "child.setAttribute" ], [ "", "inertedElements.push" ], [ "", "savedOverflow" ], [ "", "doc.documentElement.style.overflow" ], [ "", "lightbox.removeAttribute" ], [ "", "closeBtn" ], [ "", "lightbox.querySelector" ], [ "", "closeBtn.focus" ], [ "", "lightbox.focus" ], [ "", "lightbox" ], [ "", "doc.querySelector" ], [ "", "lightbox.setAttribute" ], [ "", "el.removeAttribute" ], [ "", "el.removeAttribute" ], [ "", "inertedElements" ], [ "", "doc.documentElement.style.overflow" ], [ "", "savedOverflow" ], [ "", "toRestore" ], [ "", "activeImageTrigger" ], [ "", "toRestore.focus" ], [ "", "clearTimer" ], [ "", "pendingTimer" ], [ "", "setTimer" ], [ "", "pendingTimer" ], [ "", "action" ], [ "", "clearTimer" ], [ "", "pendingTimer" ], [ "", "scheduleTimer" ], [ "", "openFromTrigger" ], [ "", "lvl" ], [ "", "scheduleTimer" ], [ "", "closePopover" ], [ "", "doc.addEventListener" ], [ "", "triggerEl" ], [ "", "findTriggerFromEvent" ], [ "", "handle" ], [ "", "openOnClick" ], [ "", "openOnHover" ], [ "", "doc.addEventListener" ], [ "", "isLightboxOpen" ], [ "", "closeLightbox" ], [ "", "imageTrigger" ], [ "", "event.target.closest" ], [ "", "imageTrigger.closest" ], [ "", "src" ], [ "", "resolveImageSrc" ], [ "", "event.preventDefault" ], [ "", "openLightbox" ], [ "", "triggerEl" ], [ "", "findTriggerFromEvent" ], [ "", "openFromTrigger" ], [ "", "isOutsidePopover" ], [ "", "closePopover" ], [ "", "event.target.closest" ], [ "", "closePopover" ], [ "", "doc.addEventListener" ], [ "", "isNestedPopoverOpen" ], [ "", "isLightboxOpen" ], [ "", "closePopover" ], [ "", "closePopover" ], [ "", "closeLightbox" ], [ "", "isLightboxOpen" ], [ "", "event.preventDefault" ], [ "", "lightbox" ], [ "", "doc.querySelector" ], [ "", "closeBtn" ], [ "", "lightbox.querySelector" ], [ "", "closeBtn.focus" ], [ "", "addTriggerListener" ], [ "", "addTriggerListener" ], [ "", "scheduleClose" ], [ "", "levelOfTrigger" ], [ "", "addTriggerListener" ], [ "", "scheduleOpen" ], [ "", "addTriggerListener" ], [ "", "scheduleClose" ], [ "", "levelOfTrigger" ], [ "", "RIDDLE_CONFIG_ID" ], [ "", "CONFIG_DEFAULTS" ], [ "", "Object.freeze" ], [ "", "ALLOWED_TRIGGERS" ], [ "", "Number.isInteger" ], [ "", "el" ], [ "", "doc.getElementById" ], [ "", "raw" ], [ "", "raw" ], [ "", "JSON.parse" ], [ "", "ALLOWED_TRIGGERS.has" ], [ "", "normalizeNonNegativeInt" ], [ "", "normalizeNonNegativeInt" ], [ "", "normalizeBoolean" ], [ "", "normalizeString" ], [ "", "normalizeString" ], [ "", "normalizeBoolean" ], [ "", "normalizeBoolean" ], [ "", "normalizeBoolean" ], [ "", "normalizeBoolean" ], [ "", "root" ], [ "", "root.style.setProperty" ], [ "", "root.style.setProperty" ], [ "", "cfg" ], [ "", "readRiddleConfig" ], [ "", "applyRiddleCssVars" ], [ "", "installRiddlePopover" ], [ "", "markTermTriggers" ] ], "mbr": [ "ALLOWED_SCHEMES.has", "ALLOWED_TAGS.has", "ALLOWED_TRIGGERS.has", "Array.from", "CONFIG_DEFAULTS.closeDelayMs", "CONFIG_DEFAULTS.footnotes", "CONFIG_DEFAULTS.imagePopup", "CONFIG_DEFAULTS.interactive", "CONFIG_DEFAULTS.markTerms", "CONFIG_DEFAULTS.maxHeight", "CONFIG_DEFAULTS.maxWidth", "CONFIG_DEFAULTS.nested", "CONFIG_DEFAULTS.openDelayMs", "CONFIG_DEFAULTS.trigger", "FOOTNOTE_BODY_CLASSES.some", "IMAGE_EXT.test", "JSON.parse", "Number.isInteger", "Object.freeze", "URL_ATTRS.has", "anchor.classList", "anchor.classList.add", "anchor.closest", "anchor.getAttribute", "attr.name", "attr.name.toLowerCase", "attr.value", "beforeSpecial.includes", "beforeSpecial.indexOf", "beforeSpecial.slice", "body.cloneNode", "cfg.markTerms", "child.hasAttribute", "child.setAttribute", "clone.firstChild", "clone.querySelectorAll", "closeBtn.className", "closeBtn.focus", "closeBtn.setAttribute", "decoded.lastIndexOf", "decoded.slice", "doc.addEventListener", "doc.baseURI", "doc.body", "doc.body.appendChild", "doc.body.children", "doc.createDocumentFragment", "doc.createElement", "doc.createTreeWalker", "doc.defaultView", "doc.documentElement", "doc.documentElement.style", "doc.documentElement.style.overflow", "doc.getElementById", "doc.querySelector", "doc.querySelectorAll", "el.attributes", "el.classList", "el.classList.contains", "el.className", "el.firstChild", "el.getAttribute", "el.hasAttribute", "el.parentNode", "el.remove", "el.removeAttribute", "el.setAttribute", "el.style", "el.style.left", "el.style.top", "el.tagName", "el.textContent", "event.key", "event.preventDefault", "event.target", "event.target.closest", "frag.ownerDocument", "fragment.appendChild", "globalThis.URL", "href.indexOf", "href.slice", "imageTrigger.closest", "img.alt", "img.className", "img.src", "inertedElements.push", "innerImg.getAttribute", "label.remove", "levels.length", "lightbox.appendChild", "lightbox.focus", "lightbox.hasAttribute", "lightbox.querySelector", "lightbox.removeAttribute", "lightbox.setAttribute", "name.startsWith", "node.tagName", "node.tagName.toUpperCase", "parent.insertBefore", "popover.addEventListener", "popover.getAttribute", "popover.offsetHeight", "popover.offsetWidth", "popover.removeAttribute", "popover.replaceChildren", "popover.setAttribute", "pos.left", "pos.top", "raw.closeDelayMs", "raw.footnotes", "raw.imagePopup", "raw.interactive", "raw.markTerms", "raw.maxHeight", "raw.maxWidth", "raw.nested", "raw.openDelayMs", "raw.trigger", "result.fragment", "result.termId", "result.trigger", "result.trigger.setAttribute", "root.style", "root.style.setProperty", "scheme.toLowerCase", "state.activeTrigger", "state.activeTrigger.removeAttribute", "state.detachReposition", "state.hoverWired", "state.openedByFocus", "state.termId", "template.content", "template.content.cloneNode", "termId.startsWith", "toRemove.push", "toRestore.focus", "trigger.closest", "trigger.getAttribute", "trigger.getBoundingClientRect", "trigger.matches", "trigger.querySelector", "triggerEl.querySelector", "triggerRect.bottom", "triggerRect.left", "triggerRect.top", "triggerToRestore.focus", "triggerToRestore.removeAttribute", "trimmed.split", "trimmed.startsWith", "url.pathname", "value.trim", "view.HTMLTemplateElement", "view.addEventListener", "view.innerHeight", "view.innerWidth", "view.removeEventListener", "view.requestAnimationFrame", "view.requestAnimationFrame.bind", "walker.nextNode" ], "tgt": [ "ALLOWED_SCHEMES.has", "ALLOWED_TAGS.has", "ALLOWED_TRIGGERS.has", "Array.from", "FOOTNOTE_BODY_CLASSES.some", "IMAGE_EXT.test", "JSON.parse", "Number.isInteger", "Object.freeze", "Set", "URL_ATTRS.has", "action", "addTriggerListener", "anchor.classList.add", "anchor.closest", "anchor.getAttribute", "applyPopoverPosition", "applyRiddleCssVars", "attachRepositionListeners", "attr.name.toLowerCase", "beforeSpecial.includes", "beforeSpecial.indexOf", "beforeSpecial.slice", "body.cloneNode", "callback", "child.hasAttribute", "child.setAttribute", "clearTimer", "clone.querySelectorAll", "closeBtn.focus", "closeBtn.setAttribute", "closeLightbox", "closePopover", "computePopoverPosition", "createRepositionScheduler", "decodeHrefFragment", "decodeURIComponent", "decoded.lastIndexOf", "decoded.slice", "deriveFragmentId", "deriveTermId", "doc.addEventListener", "doc.body.appendChild", "doc.createDocumentFragment", "doc.createElement", "doc.createTreeWalker", "doc.getElementById", "doc.querySelector", "doc.querySelectorAll", "el.classList.contains", "el.getAttribute", "el.hasAttribute", "el.remove", "el.removeAttribute", "el.setAttribute", "event.preventDefault", "event.target.closest", "findTriggerFromEvent", "fragment.appendChild", "getLazyElement", "getLightbox", "getNestedPopover", "getPopover", "getRiddleTemplate", "globalThis.URL", "handle", "handleTriggerForElement", "href.indexOf", "href.slice", "imageTrigger.closest", "inertedElements.push", "initFn", "innerImg.getAttribute", "installRiddlePopover", "isFootnoteBody", "isLightboxOpen", "isNestedPopoverOpen", "isOutsidePopover", "isSafeImageHref", "isSafeUrl", "label.remove", "levelOfTrigger", "lightbox.appendChild", "lightbox.focus", "lightbox.hasAttribute", "lightbox.querySelector", "lightbox.removeAttribute", "lightbox.setAttribute", "markTermTriggers", "name.startsWith", "node.tagName.toUpperCase", "normalizeBoolean", "normalizeNonNegativeInt", "normalizeString", "openFromTrigger", "openLightbox", "parent.insertBefore", "popover.addEventListener", "popover.getAttribute", "popover.removeAttribute", "popover.replaceChildren", "popover.setAttribute", "positionPopover", "readRiddleConfig", "reposition", "requestFrame", "resolveFootnoteContent", "resolveImageSrc", "resolveTermContent", "resolveViewTimer", "result.trigger.setAttribute", "root.style.setProperty", "sanitizeElementAttributes", "sanitizeFragment", "scheduleClose", "scheduleOpen", "scheduleTimer", "scheme.toLowerCase", "setTimer", "state.activeTrigger.removeAttribute", "state.detachReposition", "template.content.cloneNode", "termId.startsWith", "toRemove.push", "toRestore.focus", "trigger.closest", "trigger.getAttribute", "trigger.getBoundingClientRect", "trigger.matches", "trigger.querySelector", "triggerEl.querySelector", "triggerToRestore.focus", "triggerToRestore.removeAttribute", "trimmed.split", "trimmed.startsWith", "unwrapElement", "value.trim", "view.addEventListener", "view.removeEventListener", "view.requestAnimationFrame.bind", "walker.nextNode" ], "metrics": { "ast": { "op.eq": 50.0, "op.ge": 5.0, "op.gt": 1.0, "op.lt": 1.0, "op.ne": 34.0, "op.add": 8.0, "op.lor": 16.0, "op.sub": 9.0, "op.land": 21.0, "op.lnot": 15.0, "max_depth": 20.0, "bind_count": 146.0, "call_count": 230.0, "node_count": 7173.0, "op.coalesce": 1.0, "member_count": 159.0, "op_density.eq": 0.01, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 258.0, "member_depth_max": 4.0, "op_density.coalesce": 0.0, "string_literal_count": 197.0, "array_literal_max_length": 41.0, "const_return_function_count": 1.0, "const_return_function_ratio": 0.01, "string_concat_chain_max_length": 2.0 }, "file": { "size": 47838.0, "entropy": 6.02, "size_bytes": 47838.0 }, "text": { "digit_ratio": 0.01, "space_count": 5742.0, "total_lines": 1203.0, "char_entropy": 6.02, "unique_chars": 168.0, "lines_over_200": 1.0, "string_density": 0.16, "avg_line_length": 38.77, "high_byte_ratio": 0.32, "max_line_length": 201.0, "non_ascii_ratio": 0.32, "empty_line_ratio": 0.06, "last_line_length": 1.0, "long_token_count": 6.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.06, "identifier_density": 1.01, "line_length_stddev": 35.24, "normalized_string_count": 5.68, "repeated_char_sequences": 8.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.93, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 227.0, "suspicious_identifier_ratio": 0.0, "normalized_unique_identifiers": 25.21 }, "binds": { "count": 146.0 }, "calls": { "count": 230.0 }, "binary": { "overall_entropy": 6.02, "peak_region_bytes": 30430.0, "peak_region_entropy": 6.16 }, "source": { "function_count": 46.0 }, "members": { "count": 159.0 }, "strings": { "total": 197.0, "url_count": 2.0, "avg_length": 7.65, "max_length": 54.0, "avg_entropy": 2.25, "empty_count": 11.0, "total_bytes": 1508.0, "entropy_stddev": 0.97 }, "comments": { "chars": 24628.0, "lines": 377.0, "total": 151.0, "to_code_ratio": 0.46, "base64_in_comments": 8.0, "high_entropy_comments": 132.0 }, "functions": { "count": 46.0, "anonymous": 20.0, "avg_params": 1.25, "max_params": 4.0, "one_liners": 10.0, "length_stddev": 42.8, "over_100_lines": 1.0, "avg_name_length": 15.98, "no_params_count": 12.0, "avg_length_lines": 16.43, "max_length_lines": 351.0, "min_length_lines": 1.0, "nested_functions": 13.0, "avg_nesting_depth": 0.54, "max_nesting_depth": 2.0, "high_entropy_names": 12.0, "avg_param_name_length": 6.93, "density_per_100_lines": 5.57, "code_in_functions_ratio": 0.92 }, "identifiers": { "count": 258.0, "total": 1210.0, "avg_length": 10.68, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.79, "reuse_ratio": 0.21, "unique_count": 258.0, "length_stddev": 5.48, "has_digit_ratio": 0.0, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.0, "high_entropy_count": 20.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.34, "all_uppercase_ratio": 0.1 } } }, "id": 11, "mol": "Md", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper/static/riddle.js", "risk": 2, "sha": "8d02e788c7e3fdd3ecd83234fcddb5e3cd0019e0184dc5124c14ca7eb40d488e", "size": 47838, "traits": [ { "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "conf": 0.8999999761581421, "crit": 1, "desc": "Reads .value property of a DOM element", "spans": [ [ 7774, 6 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "conf": 0.8999999761581421, "crit": 1, "desc": "getElementById/querySelector DOM (querySelector)", "spans": [ [ 11138, 13 ] ] }, { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.800000011920929, "crit": 3, "desc": "Japanese script detection (Hiragana/Katakana)", "spans": [ [ 116, 9 ] ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "spans": [ [ 221, 12 ] ] }, { "id": "micro-behaviors/data/manipulation::remove-call", "conf": 0.800000011920929, "crit": 1, "desc": "DOM remove call", "spans": [ [ 8227, 8 ] ] }, { "id": "micro-behaviors/data/manipulation::queryselectorall-call", "conf": 0.800000011920929, "crit": 1, "desc": "querySelectorAll call" }, { "id": "micro-behaviors/data/manipulation::ad-selector-token", "conf": 0.800000011920929, "crit": 1, "desc": "Ad selector token", "spans": [ [ 12790, 3 ] ] }, { "id": "metadata/file/format::han-ideograph-prose", "conf": 0.8999999761581421, "crit": 2, "desc": "Dense Han ideograph prose (localized source)", "spans": [ [ 221, 12 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid", "conf": 0.8999999761581421, "crit": 1, "desc": "getElementById/querySelector (getElementById)", "spans": [ [ 5862, 14 ] ] }, { "id": "metadata/file/format::vocab-boolean", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary boolean", "spans": [ [ 43918, 7 ] ] }, { "id": "metadata/file/format::vocab-object", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary object", "spans": [ [ 45296, 6 ] ] }, { "id": "metadata/file/format::vocab-invalid", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary invalid", "spans": [ [ 7251, 7 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-recognized-text--rx-12", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "WebP token inside multiline blob", "spans": [ [ 9925, 4 ] ] }, { "id": "metadata/file/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string", "spans": [ [ 10285, 6 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup", "conf": 0.8999999761581421, "crit": 1, "desc": "getElementById/querySelector DOM lookup", "spans": [ [ 5862, 14 ], [ 11138, 13 ] ] } ], "type": "javascript" }, { "id": 12, "sha": "102ec2a729d500a714756fa36cc6e0bcb6cfb3a10ebc33f18cf15b9b897fc7d4", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper-1.2.0.dist-info/licenses/LICENSE", "risk": 1, "size": 1064, "type": "text", "depth": 1 }, { "id": 13, "sha": "6de444b1dbb242772e82eded737c167eb8bc80706a47a0e3d1689ac6d180d13e", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/sphinx-riddle-whisper/sphinx_riddle_whisper-1.2.0-py3-none-any.whl!!sphinx_riddle_whisper-1.2.0.dist-info/METADATA", "risk": 1, "size": 9405, "type": "pkg_info", "depth": 1 }, { "id": 14, "mol": "Md", "sha": "b0d8bd067cc42810a06a2b7c4491f88f0852342f6950e8ad270fde8318acca3c", "path": "sphinx-riddle-whisper@1.2.0.registry.json", "risk": 1, "size": 840, "type": "registry", "depth": 1 } ], "omitted_files": 9, "rev": "86099", "v": "8" } }