{ "ml": { "v": "7", "eng": "2.1.0-rc.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000017374754, "rte": "az", "prob": 0.000017374754 } ], "prob": 0.000032623608, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0000326236076944042, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0000326236076944042, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010391076102678198, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-18T08:20:58Z" }, "path": "clang22-bash-completion-22.1.8-r0.apk", "raw": { "files": [ { "id": 0, "mol": "H(Po₂)", "sha": "0d49ebb557f6886eda70c90c2b0a0154a3e12690dfe89643932264d3d714d776", "path": "clang22-bash-completion-22.1.8-r0.apk", "risk": 2, "size": 2731, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 2731.0, "entropy": 7.9, "size_bytes": 2731.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.9 } } }, "traits": [ { "id": "micro-behaviors/process/create/shell/build::clang-invocation", "atk": "T1027.004", "conf": 0.8500000238418579, "crit": 3, "desc": "Clang compiler invocation", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/invoke::backtick-command-substitution", "conf": 1.0, "crit": 2, "desc": "shell backtick command substitution", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/eval::shell-eval", "atk": "T1059", "crit": 3, "desc": "Shell eval call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/invoke::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "off": 1012, "file": 1, "line": 31 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" } ] }, { "ctx": [ { "b": "boP*0wNPT\u003eayO!\u003ear\u003e(BB-H#6atmXxBz9sHz.CNdB7^dlB-.Liz/6DfwPRGoB7=:uBz\u0026pEz/{7ye[emgxMvP9Bz\u0026pAB7DFoxLzJu3jpcIy*?i]uUj1*wN]H}c[bHI3lQDoayw.{y?mc\u003eAV!$pzEW^5z/cXpA=lbnwmYo]vTf8pwN/p?BrC:rA=U@kzGu}sw/$L\u003eB7^dnz/6DfwPRT8zxJ[bv@2H=wGUYd3lQDoayX]7By/FnBzb92ar\u003erlze:c0zxHJya%puav{%I3wGV8dwGUP6A=2xdaztXhz/P[wB8UL$wPF#dzxJ[bBzbM2zdN=hCw7YbwEoL5boR8wwGU!$BAz8may]z4B8AvEe*a8haA}xtB-Rapv@Dj6xjU%6z/fxpaA}HgzxJp#x(4u\u003ex(UtgB0bvsBrCKyz*2\u00269wN)z2arU36x(4u\u003ex(UsKj%hH?wP/.AB.\u003e\u003epE0^57pFBU-mnMVXjT.A#c)i2rze:c0zxHJyasOAZ3vJl*uT)[XzF7vD3vra5az+$avqE5@B-FQzA+fzpCw?IjB0a$pz/Pwhvrc06w]7)*B0bVYaA]NFarR)KnOf8Yvru74BrC43B7^dnz/6DfwPRT8zxJUmaz#ataAIWAAbP=swN(]#B-RTEx(mTbx\u003c\u003e*(DsXi^pFBU-mnMVXayPd#3lQDoazC.cBzkf1x)KtkC42A9vpB4:B0a}qaAIaoBzkS9az\u003eL8BZY95C}GBDayw\u00262x()Y(z/6DfwPRT8zxHJGatMb6fjXTqfk+]GyZIpcx\u003ewF(toCanko.i[", "ln": 0, "col": 1, "line": 1 }, { "b": "a{]Cnw[.OVarR)Kp*[A^ayP85aARpday/LmA+fcgay/tbzddr)eO]cswGUP3vp%T7Bz\u0026piy*?i]efG1LaARp9BrC7fvqYZ2v{%l$xKL^?y?i}@ar@1JxK#l@azC.nwPzV%y\u00261wH3lQDoasxr1azC)tB7Gr0A::63wftz%w[CQ{wO#QaC{3NwayX=2xE\u003eoEzY\u003cmnazthbwGV8kay/tcv{%E4Bzbl5aA}KwxM53naswY/3lQE6z/M$mazCZou#][0atB#:v%q\u003ciwmdFwwn.!$arR!vw/$qZas7UzjV%]kv%q\u003ciwfunEar\u00267TlR*AMuSQ33l@Nqnc[3uPd\u003e@F4u40[tjV%]njTRvTt@%fJxK#5*arR^HarU9kxfvB:vrc0aDQyO6p*Wp1qBBC/bXZLja{]CnarUliB7CX3arR^HayPq6jT8dWA+uUAlR*AMuSQ33l@Nqnx\u003cDcra{]CnarUog3lQE4z/fa[3lQDoaz2!pvqYP#EJS-Jas6GNo*]yiaz2.8y-)Ljv{%f@Aa9\u003c4jTtwwpFBU)s5hZZq^g}YEf}8tboQ0cwGSlCtY.toB8JgyxKM09vQTs\u003eaz2!pvqYQ%aARpday61hw]zYjz!@@}AV/KpA=U@kzGu}sw/#eawg!iiazbB#xlciYc)fYVAa9\u003c4a%nD?vrDWgv@Dj6y?mZ1jT8dWA+uNsgcNv4wP/.AB.\u003e\u003epD)0GwwfrEnas5sQfi\u0026PKdLAC5asNTuar@12w/$P1vqYZ2x(+zny?aVgxKM09x(\u003eFdz!i#jzF%RtB9hCvz/P}xeIgyNBz\u003eVcze:r5By^0garR)Kw)]H(ayX+?yAN.qaARpdazbt7wO${[wGUG3ze:r5BzkVhe^-Zzx\u003ewF(toCanko.i[jS(B3u0PJmBz7", "ln": 812, "col": 34, "line": 25 }, { "b": "vpyu/w]}Q8ar?{Led9HxboQ-zB95KkB-.Liz/6DfwPRGaw[=6)B1N!xazCBgtu-i]bXy\u003e3xlbmtjV%]ibQ^klxM21BwGSv9zyl\u003eSayenmaARpdzvdHearR)KnOf7%w]zPJjAL1vj%joKwft#cwPzu8CvtLnzF{Upz/Y#lvR/P#C42ifwPGyBvrDWgv@Dj6y?mZ1azbt7wPGEharR^Htu-i]bX7$qa%o3iasxr1aBFLVa%ZVvAV#R?jS(sajS[3oasnA", "ln": 1635, "col": 75, "line": 50 }, { "b": "uT)[XzF9r*x(4u\u003ex(TL6az2w6w/$qZar\u00267vB-FVGjV%]njTRvTt@%fJxK#5*arR^HlR*AMqBKzQsV[eQbQ:^Bz/6DawO@Rxs0eXjw]7)*B0q.UeG=kYdiH5DarUliB7CX3arR^KavoHTxDQ-aBz(28Bzkk[y\u00261wtvq{f%zE^/hvixSgvpJ\u003c\u003evp\u003cQ)AV=.)cM((zay]4}vrDyde^-ZzarR)Kl${ZJvR/P#x(\u003eFszY\u003cdnvrrSaBrC^CA+/.szFrP(y\u003cvdnz/M$sAcb/jzGu}mzxK4mwGUP6A+#}qw/@Wqz/m^Fvr9$cao", "ln": 1854, "col": 5, "line": 55 }, { "b": "EiG^%jS(ancM(Y2asnATv@Dj6z/x!vePh+Hz/Y(av}u=rj%hH?wP/.AB.\u003e\u003e3arR^HlR*AMqBKzQsV[eQbQ:^Bz/6DawO@Rxs0eXjw]7)*B0q.UeG=k.v%8/oasOAZ3lQE6x:Pm}v@Dj6y?mZ1at359uT)[XzF784y*?i]3i", "ln": 2117, "col": 20, "line": 61 } ], "depth": 1, "facts": { "imp": [ [ "", "_filedir" ], [ "", "compgen" ], [ "", "_init_completion" ], [ "", "seq" ], [ "", "eval" ], [ "", "\"$path\"" ], [ "", "sed" ], [ "", "_clang_filedir" ], [ "", "return" ], [ "", "echo" ], [ "", "_clang_filedir" ], [ "", "compgen" ], [ "", "compopt" ], [ "", "compgen" ], [ "", "complete" ] ], "tgt": [ "\"$path\"", "_clang_filedir", "_filedir", "_init_completion", "compgen", "complete", "compopt", "echo", "eval", "return", "sed", "seq" ], "funcs": [ [ "_clang_filedir", 82 ], [ "_clang", 400 ] ], "metrics": { "ast": { "op.eq": 7, "op.gt": 1, "op.ne": 2, "op.add": 1, "op.lor": 2, "op.sub": 3, "max_depth": 15, "call_count": 15, "node_count": 505, "op_density.eq": 0.01, "op_density.gt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.lor": 0, "op_density.sub": 0.01, "max_array_length": 1 }, "file": { "size": 2250, "entropy": 5.03 }, "text": { "lines": 65, "top_char": 101, "digit_ratio": 0.01, "space_count": 438, "char_entropy": 5.03, "unique_chars": 76, "top_char_null": 0, "string_density": 0.38, "top_char_ratio": 0.06, "avg_line_length": 33.62, "max_line_length": 87, "empty_line_ratio": 0.09, "last_line_length": 24, "whitespace_ratio": 0.22, "identifier_density": 1.58, "line_length_stddev": 27.55, "max_whitespace_run": 1, "normalized_string_count": 3.1, "suspicious_string_ratio": 0.08, "normalized_function_count": 0.25, "strings_to_functions_ratio": 12.5, "suspicious_identifier_ratio": 0.08, "normalized_unique_identifiers": 6.64, "identifiers_to_functions_ratio": 20 }, "binds": { "count": 12 }, "calls": { "dynamic_target_count": 1 }, "binary": { "peak_region_bytes": 2250, "peak_region_entropy": 5 }, "source": { "function_count": 2 }, "strings": { "bytes": 215, "count": 25, "shell": 2, "avg_length": 8.6, "max_length": 25, "avg_entropy": 2.37, "empty_count": 2, "entropy_stddev": 1.48 }, "comments": { "chars": 1074, "count": 18, "lines": 18, "to_code_ratio": 0.38 }, "functions": { "count": 2, "density": 3.08, "code_ratio": 0.94, "length_stddev": 23.5, "avg_name_length": 10, "no_params_count": 2, "avg_length_lines": 30.5, "max_length_lines": 54, "min_length_lines": 7 }, "identifiers": { "count": 103, "unique": 40, "avg_length": 5.45, "max_length": 16, "min_length": 1, "avg_entropy": 1.98, "reuse_ratio": 0.39, "length_stddev": 3.67, "has_digit_ratio": 0.05, "sequential_names": 3, "single_char_count": 1, "single_char_ratio": 0.03, "all_lowercase_ratio": 0.57, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 2, "underscore_prefix_count": 4 } } }, "id": 1, "mol": "H₂(FPo₃)Md", "path": "clang22-bash-completion-22.1.8-r0.apk!!usr/share/bash-completion/completions/clang", "pid": 0, "risk": 5, "sha": "c15de92028c1dc32c8a98390a1995346ebdfbe78002a65d52711ac9ec1f9f2db", "size": 2250, "traits": [ { "id": "metadata/file/profile/identifier-population::shell-sequential-short-identifiers", "conf": 0.8, "crit": 3, "desc": "Sequential single-letter identifiers" }, { "id": "micro-behaviors/fs/path/config/shell::bash-rc-path-text", "conf": 0.82, "crit": 3, "desc": "References a .bashrc or .bash_profile path", "spans": [ [ 60, 7 ] ] }, { "id": "micro-behaviors/fs/path/config/shell::bashrc-filename", "conf": 0.98, "crit": 3, "desc": ".bashrc shell profile filename", "spans": [ [ 61, 6 ] ] }, { "id": "micro-behaviors/process/create/local-exec::execute-quoted-var", "atk": "T1059.004", "conf": 0.88, "crit": 3, "desc": "Executes a quoted shell-variable path", "spans": [ [ 1330, 29 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::backtick-command-substitution", "conf": 1.0, "crit": 3, "desc": "Backtick shell command-substitution syntax", "spans": [ [ 1012, 14 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::command-substitution", "conf": 1.0, "crit": 3, "desc": "Shell command-substitution syntax", "spans": [ [ 379, 15 ], [ 1327, 67 ], [ 1699, 15 ], [ 1918, 29 ], [ 2181, 34 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell stderr discard command text", "spans": [ [ 351, 12 ] ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::shell-eval", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Evaluates a shell command string", "spans": [ [ 1217, 4 ] ] }, { "id": "metadata/build/archive::versioned-source-tree-archive-member", "conf": 0.9, "crit": 2, "desc": "Versioned source-tree archive member" }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension" }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "conf": 0.5, "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 1361, 0 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::sed-processing", "conf": 1.0, "crit": 2, "desc": "Uses sed for text processing", "spans": [ [ 1374, 0 ] ] }, { "id": "metadata/file/string/identity::cli-posix-shell-common-token", "conf": 0.7, "crit": 1, "desc": "CLI argument names a common POSIX shell", "spans": [ [ 1271, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::english-edit-verb-token", "conf": 0.88, "crit": 1, "desc": "English edit-action verb token", "spans": [ [ 9, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 218, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 529, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 877, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 969, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 1003, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 75, 0 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsePJJ", "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 32 }, { "b": "Abf97vqPM#jS[lJvqYZkga=%zB7^dnz/6DfwPRT8zu", "ln": 3, "addr": 64 }, { "b": "Abf9fwPw[RatLY8f!LBqAXE", "ln": 4, "addr": 98 }, { "b": "Abf8%wPIu7jS)71B7=Xaz/6DfwPRT8zGu}jz/M$gy*?i]gbn", "ln": 5, "addr": 117 }, { "b": "B-IpvjS[AWBz#pZfe4cTC5n\u003cIA+v3", "ln": 6, "addr": 156 }, { "b": "B7]@iauZ\u00265gbQ-", "ln": 9, "addr": 261 }, { "b": "vrb\u003c\u003eauZ\u0026+z^^V@xA", "ln": 10, "addr": 273 }, { "b": "z/PM8x(k4Ray/j@zF7ZW", "ln": 11, "addr": 287 }, { "b": "v@Dj3x(\u003eEXay^9nf/Z{Bv}oaVw?W+7gI5B5w\u0026IL8g?Hfdvp.Abg=d3Bwh(Fchu", "ln": 12, "addr": 304 }, { "b": "zddc@Byw)3wPw[RavfHJx(4Pdm}(^LwO${$BrAXOv}YN)y^qAsxLzp0e]L=yj]", "ln": 13, "addr": 354 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 705.0, "entropy": 5.13, "size_bytes": 705.0 }, "binary": { "overall_entropy": 5.13 } } }, "id": 2, "path": "clang22-bash-completion-22.1.8-r0.apk!!.PKGINFO", "risk": 1, "sha": "2fc8095ff5662074b9b06fa23f7ebdf065a586be31bb22591c14620818f06045", "size": 705, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 287, 16 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 98, 18 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 64, 33 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 98, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 64, 33 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 64, 33 ], [ 98, 18 ], [ 287, 16 ] ] } ], "type": "text" } ], "v": "8" } }