{ "llm": { "conf": 0.9966558, "grade": "suspicious", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.99500865, "class": "benign" }, "outcome": "suspicious", "interpretation": "Auto-generated package name" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 279, "conf": 80, "mods": [ { "cls": 0, "raw": 0.99500865, "rte": "az", "prob": 0.99500865 }, { "cls": 0, "raw": 0.9520394, "rte": "az/npm", "prob": 0.9520394 } ], "prob": 0.9966558, "files": [ { "id": 0, "lvl": 279, "conf": 80, "prob": 0.9966558218002319, "type": "npm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010460615158081055, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00022294123482424766, "type": "package.json" } ], "version": "v18.18", "analyzed_at": "2026-09-07T02:49:54Z" }, "path": "elf-stats-candlelit-pantry-649-1.0.0.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000@}UMk$/9H6VUB=R*d\u003cfu#aFs6^@Phk#v4[CZ^8tyH0rYb:xbmYpk$LGlV)UGf:%M7YJ)[nj9qe8MKsI(72}=W=@Zv}#.[.VmaSUEir2-h\u003eui++Gs\u003ccD/VC:k28OMxb}]9L%mm72FPhW^5KU\u003cL*SO.\u003c18+teDT\u003cJ", "ln": 0 } ], "mol": "O(S₂)Md(Pa₃)", "sha": "107401fcae930fabe70cff28ebf3b24813986f2566429d5eade69f08bd942fb2", "path": "elf-stats-candlelit-pantry-649-1.0.0.tgz", "risk": 70, "size": 325, "type": "npm", "facts": { "metrics": { "file": { "size": 325, "entropy": 7.25 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 325, "peak_region_entropy": 7.25 } } }, "ident": { "name": { "value": "elf-stats-candlelit-pantry-649", "source": "npm.name", "verified": false }, "trust": "unsigned", "authors": [ { "name": "Elf Workshop", "role": "author", "source": "npm.author" } ], "version": { "value": "1.0.0", "source": "npm.version", "verified": false }, "identifier": { "value": "elf-stats-candlelit-pantry-649", "source": "npm.name", "verified": false } }, "traits": [ { "id": "metadata/package/files/package-json::desc-auto-generated", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "Description says package is auto-generated" }, { "id": "objectives/supply-chain/impersonation/name::npm-numeric-suffixed-package-name", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Package name ends with a numeric suffix" }, { "id": "metadata/package/quality/empty::tiny-commonjs-exports-object", "conf": 0.85, "crit": 3, "desc": "Tiny CommonJS stub exports object literal", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/impersonation/manifest/placeholder::desc-auto-generated", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "Description says package is auto-generated" }, { "id": "metadata/package/manifest/freeform::pkg-skeleton-small", "conf": 0.7, "crit": 3, "desc": "Tiny package.json manifest", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "zeS%cy?kkgCYmOwBAnM/aBsCrazC.9z-P0?diH=qar\u003clFmJ=+]vruMky?Wv0vrcSoAbn@)wOu0#wmY^93vK#y", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "module.exports" ] ], "mbr": [ "module.exports" ], "funcs": [ [ "anonymous", 27 ] ], "metrics": { "ast": { "max_depth": 7, "call_count": 0, "node_count": 24, "member_count": 1, "member_depth_max": 2, "const_return_function_count": 1, "const_return_function_ratio": 1, "string_return_function_count": 1, "string_return_function_ratio": 1 }, "file": { "size": 68, "entropy": 4.7 }, "text": { "lines": 3, "top_char": 114, "max_ws_run": 1, "space_count": 10, "char_entropy": 4.7, "unique_chars": 34, "top_char_null": 0, "string_density": 0.33, "top_char_ratio": 0.06, "avg_line_length": 21.67, "max_line_length": 45, "last_line_length": 2, "whitespace_ratio": 0.19, "identifier_density": 1, "line_length_stddev": 17.75, "normalized_string_count": 0.58, "normalized_unique_identifiers": 1.89 }, "binds": { "count": 1 }, "binary": { "peak_region_bytes": 68, "peak_region_entropy": 4.7 }, "strings": { "bytes": 29, "count": 1, "avg_length": 29, "max_length": 29, "avg_entropy": 4 }, "functions": { "density": 33.33, "anonymous": 1, "code_ratio": 0.33, "one_liners": 1, "no_params_count": 1, "avg_length_lines": 1, "max_length_lines": 1, "min_length_lines": 1 }, "identifiers": { "count": 3, "unique": 3, "avg_length": 5.67, "max_length": 7, "min_length": 4, "avg_entropy": 2.46, "reuse_ratio": 1, "length_stddev": 1.25, "all_lowercase_ratio": 1 } } }, "id": 1, "mol": "Md(Pa)", "path": "elf-stats-candlelit-pantry-649-1.0.0.tgz!!package/index.js", "pid": 0, "risk": 1, "sha": "254d2d9e8cb77ad0fb585a8e771dcf7af0adabab84bb8eb8da5220590698a97f", "size": 68, "traits": [ { "id": "metadata/package/quality/empty::tiny-commonjs-exports-object", "conf": 0.85, "crit": 3, "desc": "Tiny CommonJS stub exports object literal", "spans": [ [ 0, 18 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb4UO5ePV2xBAo3zvqYQ(wO=75ePtcoBAhTUhz^Ared9Hxb6EKrB7]Mgb03?\u003cf!LdjfD@4ParR\u003eBvqfQ6iV]RXzE^s6e]2CKed9Hxb4Lnav@=p5BzkVhb03?\u003cp*)\u003cHvp%c]xjU%(A::63wftr6Bz(28Bzkk[y\u00261wtwP?T9C{1\u003c+ze0)gBy/ICe*q?NarR\u003epB-.qnAW0K!b1lrWaxJG4yJBfcA3u?uarR\u003eAx\u003e7Z(B7DKRar\u003cJKr3zV$3i", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 209, "entropy": 4.74 }, "binary": { "peak_region_bytes": 209, "peak_region_entropy": 4.74 } } }, "id": 2, "mol": "O(S₂)Md(Pa₂)", "path": "elf-stats-candlelit-pantry-649-1.0.0.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "index.js", "off": 79, "file": 1, "kind": "local" } ], "risk": 69, "sha": "f3d7ed7097281e434b78e355c8a627b59268f3e8cc2aab29dbb9ac4b8465c075", "size": 209, "traits": [ { "id": "metadata/package/files/package-json::desc-auto-generated", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "Description says package is auto-generated", "spans": [ [ 92, 49 ] ] }, { "id": "metadata/package/manifest/freeform::pkg-skeleton-small", "conf": 0.7, "crit": 3, "desc": "Tiny package.json manifest", "spans": [ [ 0, 20 ] ] }, { "id": "objectives/supply-chain/impersonation/manifest/placeholder::desc-auto-generated", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "Description says package is auto-generated", "spans": [ [ 92, 49 ] ] }, { "id": "objectives/supply-chain/impersonation/name::npm-numeric-suffixed-package-name", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Package name ends with a numeric suffix", "spans": [ [ 4, 30 ] ] } ], "type": "package.json" } ], "rev": "479f3", "v": "8" } }