{ "ml": { "v": "7", "eng": "2.12.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0000062187514, "rte": "az", "prob": 0.0000062187514 }, { "cls": 0, "raw": 0.0000837942, "rte": "az/gem", "prob": 0.0000837942 } ], "prob": 0.000025133291, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000025133291273959912, "type": "gem" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000013738870620727539, "type": "tar.gz" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000013391177162702661, "type": "ruby" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00001477201749366941, "type": "ruby" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.000013520319953386206, "type": "registry" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.000013520319953386206, "type": "registry" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.000025133291273959912, "type": "gem" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.00002481540104781743, "type": "tar.gz" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000012228886589582544, "type": "markdown" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.000012626250281755347, "type": "ruby" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.000016848245650180615, "type": "ruby" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.00001872579196060542, "type": "ruby" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.00001566608807479497, "type": "ruby" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.0000073909759521484375, "type": "" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.000013381242752075195, "type": "registry" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.000015735626220703125, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-20T11:30:41Z" }, "path": "apirelio-rails-0.1.1.gem", "raw": { "fetched": [ { "kind": "dependency", "size": 10752, "cached": false, "status": 200, "headers": [ [ "connection", "keep-alive" ], [ "content-length", "10752" ], [ "x-amz-request-id", "6AKDA97YJET2D5GD" ], [ "x-amz-id-2", "o/1kKQqPqXrJc0FPDnLz5ORP4t4x25ThFOKhFFr+4ixCim94HL3Lp4LDohw9b5WkY0mQRJGLkpBzFgggaCvcO8ZKS0uxPPSn" ], [ "last-modified", "Sun, 20 Sep 2026 10:29:50 GMT" ], [ "etag", "\"3f96f069079e20611dddd1c41150bbed\"" ], [ "x-amz-meta-version", "0.1.1" ], [ "x-amz-meta-gem", "apirelio" ], [ "x-amz-meta-platform", "ruby" ], [ "x-amz-meta-surrogate-key", "gem/apirelio" ], [ "x-amz-meta-sha256", "I0XMG+OynUGZUeljTZZtkF1AkAtgZ5fmgv0tkK4AtpU=" ], [ "x-amz-version-id", "BFotXgJpkGFzaP1o93WRda4EyVP6AJIT" ], [ "cache-control", "max-age=31536000" ], [ "content-type", "application/octet-stream" ], [ "x-amz-server-side-encryption", "AES256" ], [ "x-amz-replication-status", "PENDING" ], [ "via", "1.1 varnish, 1.1 varnish" ], [ "x-backend", "F_S3 16.15.35.60:443, fastlyshield--shield_ssl_cache_bfi_krnt7300057_BFI 167.82.143.57:443" ], [ "accept-ranges", "bytes" ], [ "age", "3649" ], [ "date", "Sun, 20 Sep 2026 11:30:39 GMT" ], [ "x-served-by", "cache-bfi-krnt7300057-BFI, cache-iad-kiad7000143-IAD" ], [ "x-cache", "HIT, HIT" ], [ "x-cache-hits", "2, 0" ], [ "x-timer", "S1789903839.356268,VS0,VE1" ], [ "server", "RubyGems.org" ] ], "locator": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby", "outcome": "ok", "final_url": "https://rubygems.org/downloads/apirelio-0.1.1.gem", "fetched_at": 1789903839, "pin_verified": true, "resolved_url": "https://rubygems.org/downloads/apirelio-0.1.1.gem", "source_offset": 0, "source_sha256": "0d395676abf9201504d23522b1aa836e91987b6f03b83778f49581a4595f86d6", "content_sha256": "2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695" }, { "kind": "dependency", "size": 202752, "cached": true, "status": 200, "headers": [ [ "connection", "keep-alive" ], [ "content-length", "202752" ], [ "x-amz-id-2", "YDm6AEL6umq7LqAbUS3QK7tGQLSL2EysZtNMqe/KBIEFYYXYmI3Ou81IyzcmDWzxZaVz03M46l2gujglhgBCIdyMFMAbD7ZB" ], [ "x-amz-request-id", "9FSEW07AT7ZPCXVN" ], [ "x-amz-replication-status", "PENDING" ], [ "last-modified", "Wed, 29 Jul 2026 15:02:39 GMT" ], [ "etag", "\"fafbb0bd88fddfb445532bce3258d366\"" ], [ "x-amz-server-side-encryption", "AES256" ], [ "x-amz-meta-sha256", "I4iiMleaAM7+pEh95myFU8NAjBMAq9xs8Xmdhv+wRIc=" ], [ "x-amz-meta-gem", "railties" ], [ "x-amz-meta-version", "8.1.3.1" ], [ "cache-control", "max-age=31536000" ], [ "x-amz-meta-platform", "ruby" ], [ "x-amz-meta-surrogate-key", "gem/railties" ], [ "x-amz-version-id", "whj1unI_uWjG89n7N8oMEg7J.kUY3vcp" ], [ "content-type", "application/octet-stream" ], [ "via", "1.1 varnish, 1.1 varnish" ], [ "x-backend", "F_S3 16.15.39.120:443, fastlyshield--shield_ssl_cache_bfi_kbfi7400084_BFI 167.82.142.84:443" ], [ "accept-ranges", "bytes" ], [ "date", "Sun, 20 Sep 2026 06:26:40 GMT" ], [ "age", "454170" ], [ "x-served-by", "cache-bfi-kbfi7400084-BFI, cache-iad-kiad7000115-IAD" ], [ "x-cache", "HIT, HIT" ], [ "x-cache-hits", "3, 337" ], [ "x-timer", "S1789885601.810369,VS0,VE0" ], [ "server", "RubyGems.org" ] ], "locator": "pkg:gem/railties@8.1.3.1?checksum=sha256:2388a232579a00cefea4487de66c8553c3408c1300abdc6cf1799d86ffb04487\u0026platform=ruby", "outcome": "ok", "final_url": "https://rubygems.org/downloads/railties-8.1.3.1.gem", "fetched_at": 1789885600, "pin_verified": true, "resolved_url": "https://rubygems.org/downloads/railties-8.1.3.1.gem", "source_offset": 0, "source_sha256": "0d395676abf9201504d23522b1aa836e91987b6f03b83778f49581a4595f86d6", "content_sha256": "2388a232579a00cefea4487de66c8553c3408c1300abdc6cf1799d86ffb04487" }, { "kind": "dependency", "cached": true, "locator": "pkg:gem/rack", "outcome": "skipped", "fetched_at": 1789903840, "source_offset": 0, "source_sha256": "2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695", "content_sha256": "5158fb64313c17fb2535c8e5def3de7e8b38baf2ab9e4c90155ebed5a9db207d" } ], "files": [ { "id": 0, "mol": "H₂(CmOs)", "sha": "0d395676abf9201504d23522b1aa836e91987b6f03b83778f49581a4595f86d6", "path": "apirelio-rails-0.1.1.gem", "refs": [ { "to": "pkg:gem/apirelio", "off": 0, "file": 16, "kind": "dependency" }, { "to": "pkg:gem/railties", "off": 0, "kind": "dependency" } ], "risk": 2, "size": 6656, "type": "gem", "facts": { "metrics": { "gem": { "dependency_count": 5, "runtime_dependency_count": 2, "development_dependency_count": 3 }, "file": { "size": 6656, "entropy": 5.54 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 7.81 }, "archive": { "file_count": 3, "member_count": 3, "script_count": 0, "directory_count": 0, "executable_count": 0, "hidden_file_count": 0, "uncompressed_size": 3609, "max_filename_length": 17, "rtlo_filename_count": 0, "format.regular_count": 3, "nested_archive_count": 3, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "timing.mtime_unique_count": 1, "misplaced_executable_count": 0, "timing.mtime_spread_seconds": 0, "security.world_writable_count": 0 }, "references": { "declared_count": 2, "unresolved_count": 0, "security_hold_count": 0, "unresolved_extension_count": 0 } } }, "ident": { "name": { "value": "apirelio-rails", "source": "gem.name", "verified": false }, "urls": [ { "url": "https://apirelio.com", "kind": "homepage", "source": "gem.homepage" } ], "trust": "unsigned", "authors": [ { "name": "Apirelio", "role": "author", "source": "gem.authors" } ], "version": { "value": "0.1.1", "source": "gem.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix" }, { "id": "micro-behaviors/os/module/load::ruby-require-relative", "conf": 0.9, "crit": 3, "desc": "Ruby loads a relative source module" }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "micro-behaviors/communications/http/request/cgi::http-user-agent-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_USER_AGENT variable" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 2538, "entropy": 7.91 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 2538, "peak_region_entropy": 7.81 } } }, "id": 1, "mol": "H₂(CmOs)", "path": "apirelio-rails-0.1.1.gem!!data.tar.gz", "pid": 0, "risk": 2, "sha": "542625e19fef4932d16014580e4773cdd7280d0fcca982803a0dde99b6d5bb59", "size": 2538, "traits": [ { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal" }, { "id": "micro-behaviors/os/module/load::ruby-require-relative", "conf": 0.9, "crit": 3, "desc": "Ruby loads a relative source module" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "micro-behaviors/communications/http/request/cgi::http-user-agent-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_USER_AGENT variable" } ], "type": "tar.gz" }, { "id": 2, "mol": "H(Os)", "sha": "d894b56df5f49a1fcdf6c70495ffa000e4e6abae043f3dd735c01f0ac73f4e9c", "path": "apirelio-rails-0.1.1.gem!!data.tar.gz!!lib/apirelio/rails.rb", "risk": 1, "size": 602, "type": "ruby", "depth": 2 }, { "id": 3, "mol": "H(Cm)", "sha": "6c04650914c8dfbf3b995592daddf67e071d2afa41fb07575041afa3d4bb4112", "path": "apirelio-rails-0.1.1.gem!!data.tar.gz!!lib/apirelio/rails/configuration.rb", "risk": 1, "size": 1863, "type": "ruby", "depth": 2 }, { "id": 14, "mol": "Md(Re)", "sha": "dbbd2bdfd28b1000834647478c5c1831fced8f7c7b112ed6236cbff2a9b792f6", "path": "apirelio@0.1.1.registry.json", "risk": 1, "size": 867, "type": "registry", "depth": 1 }, { "id": 15, "mol": "Md(Re)", "sha": "c97bc56ea35f929cf7bc4bf6e6b0956c1624cf77351f292b026413d50c8b1132", "path": "railties@8.1.3.1.registry.json", "risk": 1, "size": 912, "type": "registry", "depth": 1 }, { "depth": 1, "facts": { "metrics": { "gem": { "dependency_count": 3, "runtime_dependency_count": 1, "development_dependency_count": 2 }, "file": { "size": 10752, "entropy": 6.43 }, "binary": { "peak_region_bytes": 6144, "peak_region_entropy": 7.82 }, "archive": { "file_count": 3, "member_count": 3, "script_count": 0, "directory_count": 0, "executable_count": 0, "hidden_file_count": 0, "uncompressed_size": 7254, "max_filename_length": 17, "rtlo_filename_count": 0, "format.regular_count": 3, "nested_archive_count": 3, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "timing.mtime_unique_count": 1, "misplaced_executable_count": 0, "timing.mtime_spread_seconds": 0, "security.world_writable_count": 0 }, "references": { "declared_count": 1, "unresolved_count": 0, "security_hold_count": 0, "unresolved_extension_count": 0 } } }, "id": 16, "ident": { "name": { "value": "apirelio", "source": "gem.name", "verified": false }, "urls": [ { "url": "https://apirelio.com", "kind": "homepage", "source": "gem.homepage" } ], "trust": "unsigned", "authors": [ { "name": "Apirelio", "role": "author", "source": "gem.authors" } ], "version": { "value": "0.1.1", "source": "gem.version", "verified": false } }, "mol": "O(Eu)H₄(Cm₈DbOsPo)", "path": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby", "pid": 0, "refs": [ { "to": "pkg:gem/rack", "off": 0, "kind": "dependency" } ], "rel": "fetched", "risk": 5, "sha": "2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695", "size": 10752, "traits": [ { "id": "micro-behaviors/communications/http/response::source-http-429-status", "atk": "T1590", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Source checks for HTTP 429 rate-limit response" }, { "id": "objectives/exfiltration/stealer/credential/platform::ruby-net-http-collect-post", "atk": "T1041", "conf": 0.94, "crit": 3, "desc": "Ruby Net::HTTP POST constructor" }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-start", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Starts a Ruby Net::HTTP session" }, { "id": "micro-behaviors/communications/http/post::net-http-post", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Net::HTTP POST request" }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix" }, { "id": "micro-behaviors/data/source/dynamic/reflect::ruby-send-call", "conf": 0.9, "crit": 3, "desc": "Ruby dynamically invokes a method with send" }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Uses the Ruby Net::HTTP client" }, { "id": "micro-behaviors/os/module/load::ruby-require-relative", "conf": 0.9, "crit": 3, "desc": "Ruby loads a relative source module" }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.4, "crit": 3, "desc": "Very few string literals" }, { "id": "micro-behaviors/process/create/thread::ruby-thread-new", "conf": 0.8, "crit": 3, "desc": "Creates a Ruby background thread" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "micro-behaviors/communications/http/request/netlib::ruby-http-request-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Ruby HTTP request call" }, { "id": "micro-behaviors/communications/http/request/cgi::http-user-agent-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_USER_AGENT variable" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" } ], "type": "gem", "via": "https://rubygems.org/downloads/apirelio-0.1.1.gem" }, { "depth": 2, "facts": { "metrics": { "file": { "size": 6199, "entropy": 7.97 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 6144, "peak_region_entropy": 7.82 } } }, "id": 17, "mol": "O(Eu)H₄(Cm₈DbOsPo)", "path": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby!!data.tar.gz", "pid": 16, "risk": 5, "sha": "82ca934aae9255715031df4ca53f2f8b43b7bbf97af255f627e5ee1c408db3bf", "size": 6199, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal" }, { "id": "micro-behaviors/communications/http/request/cgi::http-user-agent-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_USER_AGENT variable" }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-start", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Starts a Ruby Net::HTTP session" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "micro-behaviors/data/source/dynamic/reflect::ruby-send-call", "conf": 0.9, "crit": 3, "desc": "Ruby dynamically invokes a method with send" }, { "id": "objectives/exfiltration/stealer/credential/platform::ruby-net-http-collect-post", "atk": "T1041", "conf": 0.94, "crit": 3, "desc": "Ruby Net::HTTP POST constructor" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Uses the Ruby Net::HTTP client" }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix" }, { "id": "micro-behaviors/os/module/load::ruby-require-relative", "conf": 0.9, "crit": 3, "desc": "Ruby loads a relative source module" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "micro-behaviors/process/create/thread::ruby-thread-new", "conf": 0.8, "crit": 3, "desc": "Creates a Ruby background thread" }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.4, "crit": 3, "desc": "Very few string literals" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "micro-behaviors/communications/http/response::source-http-429-status", "atk": "T1590", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Source checks for HTTP 429 rate-limit response" }, { "id": "micro-behaviors/communications/http/post::net-http-post", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Net::HTTP POST request" }, { "id": "micro-behaviors/communications/http/request/netlib::ruby-http-request-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Ruby HTTP request call" }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json" }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix" } ], "type": "tar.gz" }, { "id": 18, "mol": "H(Cm)", "sha": "4f9518bc6c1411db11ca9933beb6a656cd325b70391ad68e576d40bde6222596", "path": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby!!data.tar.gz!!README.md", "risk": 1, "size": 953, "type": "markdown", "depth": 3 }, { "id": 19, "mol": "H(Os)", "sha": "5bafbf95bf042992484b6cd68fd8b59f1945cf08cfb77739c0e4ed81d6c70edb", "path": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby!!data.tar.gz!!lib/apirelio.rb", "risk": 1, "size": 362, "type": "ruby", "depth": 3 }, { "ctx": [ { "b": "z/xVbwm5?+B-8pd3lQDlay]4}azC.cBzkf1x)Ktsvq]{/yH}=LefG1BA=#ebwJzv+wO#3$z!T9hiV]RWBAzFyiXJc{Aa%u7y?W/uv@DidefFIwC4\u003e#nzF-%5BugJ*Ab](cBZ]Jcz/c:IaAz4fwNPT\u003eiV@rOy+b]oarR^HarR^HarR^HarR^HarUlkvpB4:wi7\u0026PA=\u003e}AayX=3v}Yj\u003cx)KtKatCM7efFK", "ln": 81, "col": 20, "line": 5 }, { "b": "3lQDlarR^(v@c78wN(]Dazb4#B7CX3arR^Hav6ETz/xVbwm5?+B-8pzjS(A=arR^HarS{[z/PS8AV^H/ra{q-vpR0dwP]nzaA}:AyH}J[y\u0026slhaBKOtarR^Hav7c?A+/lbe]C9mwGTbUb4kC8A+f63zZ3rrw/%u.z/PS8AXqxzB8V5nwm6B%kpwNgvqPNsdgdguarUlkwc@U^arR!qwO95{vq{shA+cUez/fVdCYUwwarR^HarUYoBAIRwaz7", "ln": 1117, "col": 41, "line": 26 }, { "b": "arR^HarR!EwPS6nzxK4wB.8Xfw/$L\u003eByO#pwO(ydC%qSyarR^HarR^HarUc8xk8k\u003carR^HarR^HarR^HkY?3PzGx=nA=-{PwO#3bvQTv*xEKoharR^HarR^HaAz4mv%8u9q/(C=wmoH?mriA!ATA{iarR^HarR^HarUinz/xVbwm5[\u003ewO#QhauZ\u0026Kt).X%arR^HarR^HarS{^B-.hte]#qQv}Y[3zFsAday]x$arR^HarR^HarR^H", "ln": 2141, "col": 4, "line": 65 } ], "depth": 3, "facts": { "imp": [ [ "", "attr_reader" ], [ "", "to_s" ], [ "", "to_s" ], [ "", "to_s" ], [ "", "min" ], [ "", "max" ], [ "", "to_i" ], [ "", "max" ], [ "", "to_f" ], [ "", "max" ], [ "", "to_i" ], [ "", "freeze" ], [ "", "map" ], [ "", "new" ], [ "", "new" ], [ "", "new" ], [ "", "new" ], [ "", "new" ], [ "", "name" ], [ "", "respond_to?" ], [ "", "empty?" ], [ "", "build" ], [ "", "synchronize" ], [ "", "length" ], [ "", "signal" ], [ "", "length" ], [ "", "report_dropped" ], [ "", "report" ], [ "", "synchronize" ], [ "", "length" ], [ "", "synchronize" ], [ "", "loop" ], [ "", "synchronize" ], [ "", "shift" ], [ "", "empty?" ], [ "", "send" ], [ "", "synchronize" ], [ "", "unshift" ], [ "", "each" ], [ "", "report_dropped" ], [ "", "synchronize" ], [ "", "broadcast" ], [ "", "join" ], [ "", "max" ], [ "", "to_f" ], [ "", "report" ], [ "", "loop" ], [ "", "synchronize" ], [ "", "wait" ], [ "", "positive?" ], [ "", "report" ], [ "", "length" ], [ "", "pop" ], [ "", "call" ], [ "", "call" ] ], "mbr": [ "@api_key.empty?", "@condition.broadcast", "@condition.signal", "@condition.wait", "@flush_mutex.synchronize", "@mutex.synchronize", "@on_dropped.call", "@on_error.call", "@queue.length", "@queue.pop", "@queue.shift", "@queue.unshift", "@transport.send", "@worker.join", "@worker.name", "@worker.respond_to?", "ConditionVariable.new", "Event.build", "HttpBatchTransport.new", "Mutex.new", "Thread.new", "api_key.to_s", "batch.empty?", "batch_size.to_i", "dropped_events.each", "environment.to_s", "flush_interval.to_f", "max_queue_size.to_i", "metadata_keys.map", "metadata_keys.map.freeze", "pending_count.positive?", "service.to_s", "timeout.to_f" ], "tgt": [ "attr_reader", "broadcast", "build", "call", "each", "empty?", "freeze", "join", "length", "loop", "map", "max", "min", "name", "new", "pop", "positive?", "report", "report_dropped", "respond_to?", "send", "shift", "signal", "synchronize", "to_f", "to_i", "to_s", "unshift", "wait" ], "funcs": [ [ "initialize", 98 ], [ "capture", 1284 ], [ "pending_count", 1937 ], [ "flush", 2011 ], [ "shutdown", 2553 ], [ "worker_loop", 2816 ], [ "trim_queue", 3127 ], [ "report", 3321 ], [ "report_dropped", 3416 ] ], "metrics": { "ast": { "op.ge": 2, "op.gt": 1, "op.add": 2, "op.lor": 3, "op.shl": 2, "op.lnot": 1, "max_depth": 22, "op.concat": 45, "call_count": 55, "node_count": 790, "member_count": 33, "max_array_len": 2, "op_density.ge": 0, "op_density.gt": 0, "op_density.add": 0, "op_density.lor": 0, "op_density.shl": 0, "op_density.lnot": 0, "member_depth_max": 3, "op_density.concat": 0.06 }, "file": { "size": 3542, "entropy": 4.35 }, "text": { "lines": 130, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 986, "char_entropy": 4.35, "unique_chars": 64, "top_char_null": 0, "string_density": 0.02, "top_char_ratio": 0.09, "avg_line_length": 26.25, "max_line_length": 137, "empty_line_ratio": 0.1, "last_line_length": 3, "whitespace_ratio": 0.32, "identifier_density": 1.63, "line_length_stddev": 23.76, "normalized_string_count": 0.26, "repeated_char_sequences": 22, "normalized_unique_identifiers": 12.39 }, "binds": { "count": 31 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 4.56 }, "source": { "class_count": 2, "function_count": 9 }, "strings": { "bytes": 38, "count": 3, "url_count": 1, "avg_length": 12.67, "max_length": 20, "avg_entropy": 3.23, "entropy_stddev": 0.44 }, "comments": { "chars": 28, "count": 1, "lines": 1, "to_code_ratio": 0.01 }, "functions": { "count": 11 }, "identifiers": { "count": 212, "unique": 87, "avg_length": 8.09, "max_length": 18, "min_length": 3, "avg_entropy": 2.57, "reuse_ratio": 0.41, "length_stddev": 3.59, "high_entropy_count": 2, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.66 } } }, "id": 20, "mol": "H₂(DbPo)", "path": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby!!data.tar.gz!!lib/apirelio/client.rb", "pid": 17, "risk": 3, "sha": "0183a09e554fa65b3383fd9ec10561f6c43e119bb7c7871633c2f4523c426ed4", "size": 3542, "traits": [ { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix", "spans": [ [ 144, 0 ] ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::ruby-send-call", "conf": 0.9, "crit": 3, "desc": "Ruby dynamically invokes a method with send", "spans": [ [ 2205, 4 ] ] }, { "id": "micro-behaviors/process/create/thread::ruby-thread-new", "conf": 0.8, "crit": 3, "desc": "Creates a Ruby background thread", "spans": [ [ 1181, 10 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.4, "crit": 3, "desc": "Very few string literals" }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal", "spans": [ [ 144, 0 ] ] } ], "type": "ruby" }, { "ctx": [ { "b": "Bp6ckarUiaw/$/9x([5$y?Xibc$NpbAbPDdBug@}vq]{/yH}=LefG4GzdNTdBugK1e?!?0zddV@A+fukx\u003equDatLwMarR^HarS{(A+MTVaxqrhe]2rszyuXNDU489AbPB", "ln": 284, "col": 26, "line": 17 }, { "b": "wmYu}B7Gl1c$NNkzGG}G3lQDlarR!EwPS6nzxJU9az2.czGG}LwO(ydC%qSyarR^HarUYoADL\u0026lBrAZ?pgXJdi.ijHp=ZTlz/Z1MzE[2ukY}9YdgdguarR^HA+flkwPI@$b0/ZGwPh-nt{8oMb4kCfy?Wx/BzkVhfktMDzxYAgarR^HaAz4kB.bSotoVvQBzbPkx)Kifx(v(kt{8oMb0]\u003cHA+fnlbyqW:Aa@V{wQeXF3lQDlarR!EwPq\u003c7B97RglVl\u003c:wO#Pwrc-B]b3=rOar\u003elkAbok#vruj4zzb:Cz/c:aarR^HarUYoADL\u0026lBxY}?B7Gwzl1:+DBrU0kjS\u003e}SAa%u7y?W/tA=\u003e\u0026pfc+*Amn^5QpFMrZ3lQDlarR!EwPq\u003c7B963zz!abojS)u}pFJJPwO#71vru6ewP?T5BAoF=wP?T5BAn(r3lQDlarR!nBAz8hAccdzjS(A=arR^HarUc8xk8k\u003carR^HarR^HA+frhz/fScauZ\u0026xwPP%]nk@L+e]#byA=-Y{B-IgGxM4%lefEi2A+NdBz/P}JaA.:puVQp8iV{XgA+NdEv}YB\u003cwGTc0ar\u003eGvBz#pBefF\u003eIwO$\u003c%x(dB1B-YU!kY*ZSwP8ZkefF$AvpS.!x(dB1B-YU!kY*ZSwP8ZkdiJetaBE\u003cABz#QmarR^HarR^HarUutBz@\u003cMwPq\u003c7B95*JwPq\u003c7B95\u0026rarR^HarR^HwO#2=arR^HarR^HB97\u0026jB-OV*aAz4mAbPSnwIdFhwmWxnz^Nh=arR^HarR^HA+funA=91lw/#epvruTke[eylCv+u6kpwovfF1t4ixnI}3lQDlarR^Haz2Olz/M%-aw3D-wPI%cz/d#", "ln": 579, "col": 5, "line": 25 }, { "b": "r8=WpbysGNvruTkEj=Y{aAITkBAITN3lQDlarR^HaAy[8B7DF9A=M8sazCBgB97\u0026jB-OV/at\u003e\u0026basnATB97\u0026jB-OVGjS(Npisl(KarR^HarUYkx(^\u0026dwPz*fATA{iarR^HA+fr4B.8W]Byx5$vrb)EA=M8sau.[hwPz*fATA{iarR^HarUxgaz2Olz/NEAB6\u0026uuc}Oq?wPI%cz/e0:A=k$EasnATwPz*fAXqAPvruTkauQ=7fFBQ@clM(uA=k$JA@", "ln": 1297, "col": 66, "line": 43 }, { "b": "A:-W6wGUM8A=k$vx\u003ewF@BAz8hAccdzj%iacvr=d1wPR%bwPFg=arR^HarR^HB8kA0A40y)f^4}*c]9n4c$djtwO(ydB094Sf!1L23lQDlarR^HaAz4nA^n0marR^Haz2C33lQDlaz2C33lQE5zE:8=zE:7", "ln": 1579, "col": 9, "line": 51 } ], "depth": 3, "facts": { "imp": [ [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "attr_reader" ], [ "", "join" ], [ "", "sub" ], [ "", "to_s" ], [ "", "max" ], [ "", "to_f" ], [ "", "min" ], [ "", "max" ], [ "", "to_i" ], [ "", "empty?" ], [ "", "new" ], [ "", "body" ], [ "", "generate" ], [ "", "start" ], [ "", "host" ], [ "", "port" ], [ "", "scheme" ], [ "", "request" ], [ "", "to_i" ], [ "", "code" ], [ "", "between?" ], [ "", "new" ], [ "", "raise" ], [ "", "raise" ], [ "", "is_a?" ], [ "", "status" ], [ "", "status" ], [ "", "raise" ], [ "", "raise" ], [ "", "sleep" ], [ "", "json" ], [ "", "net/http" ], [ "", "uri" ] ], "mbr": [ "@uri.host", "@uri.port", "@uri.scheme", "IngestionError.new", "JSON.generate", "URI.join", "endpoint.to_s", "endpoint.to_s.sub", "error.is_a?", "error.status", "events.empty?", "http.request", "max_retries.to_i", "request.body", "response.code", "response.code.to_i", "status.between?", "timeout.to_f" ], "tgt": [ "attr_reader", "between?", "body", "code", "empty?", "generate", "host", "is_a?", "join", "max", "min", "new", "port", "raise", "request", "require", "scheme", "sleep", "start", "status", "sub", "to_f", "to_i", "to_s" ], "funcs": [ [ "initialize", 164 ], [ "initialize", 290 ], [ "send", 579 ] ], "metrics": { "ast": { "op.eq": 1, "op.gt": 1, "op.lt": 2, "op.ne": 2, "op.add": 1, "op.mul": 1, "op.pow": 1, "op.sub": 1, "op.land": 3, "max_depth": 17, "op.concat": 24, "call_count": 34, "node_count": 505, "member_count": 18, "max_array_len": 2, "op_density.eq": 0, "op_density.gt": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.mul": 0, "op_density.pow": 0, "op_density.sub": 0, "op_density.land": 0.01, "member_depth_max": 3, "op_density.concat": 0.05 }, "file": { "size": 1702, "entropy": 4.71 }, "text": { "lines": 58, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 376, "char_entropy": 4.71, "unique_chars": 75, "top_char_null": 0, "string_density": 0.26, "top_char_ratio": 0.08, "avg_line_length": 28.34, "max_line_length": 147, "empty_line_ratio": 0.16, "last_line_length": 3, "whitespace_ratio": 0.25, "identifier_density": 1.88, "line_length_stddev": 27.53, "normalized_string_count": 1.97, "repeated_char_sequences": 2, "normalized_unique_identifiers": 8.71 }, "binds": { "count": 12 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 4.86 }, "source": { "class_count": 3, "function_count": 2 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 235, "count": 15, "avg_length": 15.67, "max_length": 43, "avg_entropy": 3.12, "entropy_stddev": 0.9 }, "comments": { "chars": 28, "count": 1, "lines": 1, "to_code_ratio": 0.02 }, "functions": { "count": 5 }, "identifiers": { "count": 109, "unique": 51, "avg_length": 6.37, "max_length": 18, "min_length": 3, "avg_entropy": 2.24, "reuse_ratio": 0.47, "length_stddev": 3.15, "all_lowercase_ratio": 0.65, "all_uppercase_ratio": 0.08 } } }, "id": 21, "mol": "O(Eu)H(Cm₆)", "path": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby!!data.tar.gz!!lib/apirelio/http_batch_transport.rb", "pid": 17, "risk": 2, "sha": "8e0f8e0d37f674139a1398634eb4f5fbd4065d8180838b44cfa09a564f5471ab", "size": 1702, "traits": [ { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "spans": [ [ 729, 25 ] ] }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Uses the Ruby Net::HTTP client", "spans": [ [ 643, 9 ] ] }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-start", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Starts a Ruby Net::HTTP session", "spans": [ [ 978, 15 ] ] }, { "id": "micro-behaviors/communications/http/post::net-http-post", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Net::HTTP POST request", "spans": [ [ 643, 15 ] ] }, { "id": "micro-behaviors/communications/http/request/netlib::ruby-http-request-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Ruby HTTP request call", "spans": [ [ 1117, 13 ] ] }, { "id": "micro-behaviors/communications/http/response::source-http-429-status", "atk": "T1590", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Source checks for HTTP 429 rate-limit response", "spans": [ [ 1361, 13 ] ] }, { "id": "objectives/exfiltration/stealer/credential/platform::ruby-net-http-collect-post", "atk": "T1041", "conf": 0.94, "crit": 3, "desc": "Ruby Net::HTTP POST constructor", "spans": [ [ 643, 19 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 783, 34 ] ] } ], "type": "ruby" }, { "id": 22, "mol": "H(Cm)", "sha": "57468cae670bd4c70f7a02a6b58f8488f4fecdb997cd1b82b2404b0f3dd429a9", "path": "pkg:gem/apirelio@0.1.1?checksum=sha256:2345cc1be3b29d419951e9634d966d905d40900b606797e682fd2d90ae00b695\u0026platform=ruby!!data.tar.gz!!lib/apirelio/rack/middleware.rb", "risk": 1, "size": 4434, "type": "ruby", "depth": 3 }, { "id": 34, "sha": "2388a232579a00cefea4487de66c8553c3408c1300abdc6cf1799d86ffb04487", "path": "pkg:gem/railties@8.1.3.1?checksum=sha256:2388a232579a00cefea4487de66c8553c3408c1300abdc6cf1799d86ffb04487\u0026platform=ruby", "size": 202752, "type": "", "depth": 1 }, { "id": 35, "mol": "Md(Re)", "sha": "796036b7f3e5d1db8b559f6eb912f7c0206ecde17d1029487ed83e9f89743001", "path": "rack@3.2.7.registry.json", "risk": 1, "size": 1121, "type": "registry", "depth": 2 }, { "id": 36, "mol": "O(S)Md(Re)", "sha": "078000eb3aafd39abe4cf483c57b1280797f73bb9058b5eebfed9d3a922fc67e", "path": "apirelio-rails@0.1.1.registry.json", "risk": 2, "size": 887, "type": "registry", "depth": 1 } ], "omitted_files": 10, "rev": "e86a6", "v": "8" } }