{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.010605931, "rte": "az", "prob": 0.010605931 } ], "prob": 0.010605931, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.010605931282043457, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000014632940292358398, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.007849733345210552, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.007985810749232769, "type": "shell" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000013569991097028833, "type": "kotlin" } ], "version": "v18.18", "analyzed_at": "2026-06-29T00:37:48Z" }, "path": "tex-ebgaramond-maths-1.3.tgz", "raw": { "files": [ { "id": 0, "mol": "O(Er)H(Po₂)", "sha": "12d5289ebef401f9349b5bd329c80555dc700572f49fd75a8c6d431ac75fb633", "path": "tex-ebgaramond-maths-1.3.tgz", "risk": 4, "size": 9560, "type": "xz", "facts": { "metrics": { "file": { "size": 9560.0, "entropy": 7.98, "size_bytes": 9560.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 9560.0, "peak_region_entropy": 7.83 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)" }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 2 }, { "file": 3 } ], "spans": [ [ 0, 34 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with" }, { "id": "metadata/file/extension/encrypted::ext-enc", "conf": 0.6000000238418579, "crit": 3, "desc": "Encrypted file extension marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path" }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "metadata/file/extension/encrypted::encrypted-extensions", "conf": 0.6000000238418579, "crit": 3, "desc": "Encrypted file extensions", "from": [ { "off": 2240, "file": 1, "line": 56 } ] } ] }, { "ctx": [ { "b": "b{leTnMc:3nLzL}s3Y+ck#*(Wo*I-IlQsytsS*j6pdn5Dr7fg$eIe8kpASzdr3jQ$nMl37b{+\u003c1Bz\u003cP=v{:d\u003ey*Q:.xjk*?zeTr5uOI)lavQfTz!9N1xcpY8wNPW(wftubaA8vlBz(nkz6i+maxi2%avY{KatLR[fFLQzh99DLatLSah3$SLlVl*U", "n": [ { "c": 3, "d": "Basename uses the .enc encrypted extension", "i": "metadata/file/extension/encrypted::ext-enc", "o": 0, "z": 20, "cf": 0.6000000238418579 } ], "ln": 0, "col": 1, "line": 1 }, { "b": "x(mL\u003cff%-5z:!LNuVf^$uU9XVvrb^[z/f8)f^6Wcb}}1WarSscvqP\u003c\u0026atm\u003ePx!Rt6g+HH9fh#Q@ByupBoKR^EwmlPlszn)hp?.49q!Y(Yvivj6Ac2-fz/b[8atlK", "n": [ { "c": 1, "d": "Percent-encoded octet context", "i": "micro-behaviors/communications/url/encoded::percent-encoded-octet-context", "o": 202, "z": 3, "cf": 0.8500000238418579 } ], "ln": 170, "col": 29, "line": 5 } ], "depth": 1, "facts": { "metrics": { "ast": { "op.div": 112.0, "op.mod": 15.0, "op.sub": 2.0, "max_depth": 274.0, "call_count": 0.0, "node_count": 1171.0, "op_density.div": 0.1, "op_density.mod": 0.01, "op_density.sub": 0.0, "identifier_count": 139.0, "string_literal_count": 1.0 }, "file": { "size": 2282.0, "entropy": 4.39, "size_bytes": 2282.0 }, "text": { "digit_ratio": 0.05, "space_count": 319.0, "total_lines": 56.0, "char_entropy": 4.39, "unique_chars": 73.0, "string_density": 0.02, "avg_line_length": 39.75, "max_line_length": 73.0, "empty_line_ratio": 0.02, "last_line_length": 70.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.11, "identifier_density": 5.09, "line_length_stddev": 29.42, "normalized_string_count": 0.13, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "suspicious_identifier_ratio": 0.42, "normalized_unique_identifiers": 23.94 }, "binary": { "overall_entropy": 4.39, "peak_region_bytes": 1024.0, "peak_region_entropy": 4.88 }, "strings": { "total": 1.0, "avg_length": 52.0, "max_length": 52.0, "avg_entropy": 4.15, "total_bytes": 52.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_unknown": 1.0 }, "identifiers": { "count": 139.0, "total": 285.0, "avg_length": 3.53, "max_length": 24.0, "min_length": 1.0, "avg_entropy": 1.25, "reuse_ratio": 0.49, "unique_count": 139.0, "length_stddev": 3.09, "has_digit_ratio": 0.14, "sequential_names": 58.0, "single_char_count": 52.0, "single_char_ratio": 0.37, "high_entropy_count": 1.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.53, "all_uppercase_ratio": 0.24, "numeric_suffix_count": 18.0 } } }, "id": 1, "path": "tex-ebgaramond-maths-1.3.tgz!!share/texmf-dist/fonts/enc/dvips/ebgaramond-maths/oml-ebgaramond-1.enc", "pid": 0, "risk": 1, "sha": "266e262462426274bdd5c760cb956ceb870ef09b0b55086604e95a37e5461879", "size": 2282, "traits": [ { "id": "metadata/file/extension/encrypted::ext-enc", "conf": 0.6000000238418579, "crit": 3, "desc": "Basename uses the .enc encrypted extension", "spans": [ [ 0, 20 ] ] }, { "id": "metadata/file/extension/encrypted::encrypted-extensions", "conf": 0.6000000238418579, "crit": 3, "desc": "Encrypted file extensions", "spans": [ [ 0, 20 ] ] } ], "type": "python" }, { "ctx": [ { "b": "boXZHx(kOBxBk%\u003eboOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bNK(Smncfla%X\u0026^3q:w=pc?PyjT8daa{}mFk$svba%X]/3uG({w]]dJ3jo72ofBELB-RNRvRGZkvrVGh3pm3SmnucymlI?FB-RNRvRGZkvQTs?zEEx[a{{X6r6qAUvRGZkv{%E63pvuOqCYI2flItRfjFTkfjOWdA=riflR6{El{h.EvRGZkv}YZ$wfIvFnkAqZjT8L4B8\u0026{P", "n": [ { "c": 3, "d": "pkgsrc binary package maintainer script filename", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "o": 0, "z": 10, "cf": 0.9200000166893005 }, { "c": 3, "d": "pkgsrc maintainer script NetBSD header", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "o": 14, "z": 16, "cf": 0.9200000166893005 }, { "c": 3, "d": "pkgsrc maintainer script lifecycle variables", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "o": 77, "z": 23, "cf": 0.9200000166893005 }, { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 }, { "b": "jT8L4B8\u0026{yx(kOox(mD93p^#.p^30QB-RNRvRGZkxl4N5a{{?tk#G\u0026\u0026a{{\u003efk$0\u003cWflItRfjFTkfka{9wfIvLl{h.EB-RNRvRGZkx\u003eey{oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a{}1sjT8K*x(kOuzxYAYq-#rTvRGZky\u0026Z^co?N(CqAViSvRGZkzeiV@AV=@Ma{}4BjTa-^at4gH3q:e?oF[%SflItRfk$YtfjFTkfk$Gyy:6i.ogJtPl}{lFjT8L4B8\u0026{PvRGZkAbf8[vpTj?zxYA:ogF", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 }, { "c": 1, "d": "Contains the grep command keyword", "i": "micro-behaviors/fs/search::grep-keyword", "o": 417, "z": 4, "cf": 0.699999988079071 } ], "ln": 385, "col": 5, "line": 24 }, { "b": "a{}jxjT8K*x(kOAz6xr+o*?MJjT8K*x(kOAzdEv3a{}mql{h.EB-RNRvRGZkB7F(a3r6w)mnu(Da$[7WAXy)ozzbNsB%mn(niFdIvRGZkB7=:8q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z3r6}/a$[7WAXy)ozzc6Na{}prq=C[7By/Jna{}pBryoqua$[7WAXy)ozzc9IBZ]8e3rf[^a$[7WAXy)ozzc9La{}pEryG4{BAhIna{}BrqB:UGa$[7WAXy)ozzclyA+xCq3jl", "n": [ { "c": 3, "d": "References /bin/sh shell executable", "i": "micro-behaviors/process/create/shell/spawn::bin-sh", "o": 742, "z": 7, "cf": 0.6000000238418579 }, { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 663, "col": 18, "line": 37 }, { "b": "dLb-=e]UPsB8\u003e+kdLAz[yIdZev\u003chl!v{%B\u0026ar\u00267Tp!Kq=lR*DDnK\u003e/[sW=nqa%pPq3r{UUu0x:eu0ylGu3]\u003cQBx@9GA:q)HBZniuwNfW/pJ6JyphTu+f!0CouR\u003cx=uQEQ:mO9", "n": [ { "c": 1, "d": "Uppercase config environment variable", "i": "metadata/file/policy/config/env::uppercase-config-env", "o": 1204, "z": 10, "cf": 0.550000011920929 } ], "ln": 1172, "col": 39, "line": 64 }, { "b": "az\u003e?gB8bGbavQJ]as4ps3l{V\u003ewNY^@y?aV8B1HojwmoN*vQTs?B1N!A3jpoKB7DEtDS9)fm[4?Gx(jnOpG7jAl}6Wxq=D4RoEQqPflItRfk$YtfjFTkfkUGDwQ53jAV^2TA@", "n": [ { "c": 1, "d": "LLM destructive data target", "i": "objectives/impact/ransom/encrypt/runtime-generated::llm-destructive-data-target", "o": 1450, "z": 9, "cf": 0.949999988079071 } ], "ln": 1418, "col": 58, "line": 75 }, { "b": "A9)i\u003ey?mVJb1j**vrb^[z/f8qo\u003c@cSB1RrrA3tR}w]zYjzddxax(k4szddx\u003cw[=6)B09K!wn.!Y2{:\u003c/qBKAgat4:Vb3)#LA3cAMzddyia%ndTrzV7Tk#p]QmN}\u003eHj%j8q2)?Z%arR^Has8qlp^!2zp*VNVm$01izeZQAcjg4=bZSl^Eio!ZrzV7Tk#p]QmN}\u003eVBzU$tbZSJ/l}]%zuQEpMEf{o\u003ez/fa[32Ky3wN]T^A9)i\u003ey?mVJa%Ev2w]zYjzddxax(k4sze1lawnL:]uUj1*wPE", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 1910, "z": 3, "cf": 0.4000000059604645 }, { "c": 1, "d": "shell for loop over variable", "i": "micro-behaviors/data/control-flow/loop::shell-for-loop-over-var", "o": 1815, "z": 21, "cf": 0.8600000143051147 } ], "ln": 1783, "col": 4, "line": 96 }, { "b": "zep!ox(mD$x\u003c@X4arR)oarR}Rr7f.+EioWQeQex\u003cfdP*=k$$3WmOcuyoI4MTqBK8Eq=Dg-aBFLzarR^He?X.JlQsBuuQ^QZl}*fsuS6r.nMeOSqxO\u003eao\u00261!Uas8qflQsBuuQ^QZl}*fsuQNE-Ef{q/bmj-4axrr1wOkZ#By/Fnx(mK3azbt7wPGEh2{P=-bZSGVq=Fe/aS@vYatbq$nLR-JuQ^QXmn\u003esRD\u003cQe^e?X.Dpdw2^mOcoxqY[$bo\u00261!Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd{:2{QM\u003cwO(vewGUA0C{3*hz/cXtxK#3(ay!?\u0026xK#lq3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d[J97pg3%\u003emnliHaBFLz2)\u0026jqd[J97pg3%\u003emnliHaw$T5pGx[bbZSuXm{!$Vr6-]rr6:\u003eVnM6%z2{P=-boP(}zeTPeaAIjcy\u00261enw].*batmqFv\u003eR[pwO=g7e^.[f3jd#8r7f.+EioWQeQex\u003cfdP%(mncw$E0=nc2}^\u003eYq+ftJoDWk4o\u00261!Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd#8r7f.+EioWQeQex\u003cfdP%(mncw$E0=nc2}^\u003eYq+ftJoDVX[mmfZ1qBKqQrZ!bRDR^v9uRJ%*k$11rl0)2KqHF(V2{QM\u003cwO(vewGUG3zF0P}B-H]jx(v(iw[=6)A@", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 2554, "z": 25, "cf": 0.8799999952316284 }, { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2888, "z": 5, "cf": 0.5 } ], "ln": 2490, "col": 32, "line": 124 }, { "b": "w].*baARpday]4}vrDyd3jd}1v@Dl%x\u003eFM2x(4uk3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d[i97mn\u003esRD\u003cQe^e?X.AnLzMKaw$T5pGx[bbZSuXm{!$Vr6-]rr6:\u003eVnM6%z2%giQ3q:I%r4QHbnLSh-k$\u003c%33jd{:2{QM)AaAy0wGUA0C{3ZqzGG}xwmoN*vQTs?B1N!abmj-5DSiBjrdb(jat4*Xe?X.ApFK\u003e/aBFLz2)\u0026jqd[irfr8T[+DR^v9uRJ%*k$11rl0)2KqHF(Ubmj-4axrw\u003evru66vqZukx\u003e870aARpdzdK\u00261vpJ$ZB1N!abmj-5DSiBjrdb(jat4*Xe?X.DlR*D:r7GCLmn\u003esRD\u003cQe^e?X.DlR*D:r7GCLmn\u003esep^^PGmiA\u003e5p!Kq=o*@2El{Q", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 3121, "z": 8, "cf": 0.8799999952316284 } ], "ln": 3057, "col": 52, "line": 147 }, { "b": "wGU/6vSC)$C{4ftvrb\u003c\u003eaAg+hxDQ?]BywS!B7D%h2{P=-bZSGVq=Fe/aS@vYatbq$q+fONlq]1OD\u003cQe^e?X.Nnk8PwqY[$bo\u00261!Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd{:2{QM\u003cwO(vewGUM3AccvFwnc6}v@#Tfx\u003equdvqYP#B-8tywN({aB7Gxkfk2rzB-qyO3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d)#%bqY{En3jd1\u003efdPBZqD1YomnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ef{oaDSiBjrdb(jat4*Xe?X.Pq:\u003cOOqCQp?aBFLz2)\u0026jqd]/IpqB:RXrzT/omnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ef{o93jd}1lUH4vyANkcAV!!dC{3Wyx(!xgzF5", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 3483, "z": 9, "cf": 0.8799999952316284 } ], "ln": 3419, "col": 30, "line": 166 }, { "b": "gb7yufebmpgbf[bgDExEiX-Gmyhvr}avQJ]as4p3wQ4{hatscf", "n": [ { "c": 1, "d": "Returns or exits with status", "i": "objectives/anti-analysis/environment-detect/check::analysis-termination-shell", "o": 4068, "z": 6, "cf": 0.8999999761581421 } ], "ln": 4036, "col": 25, "line": 189 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "{GREP}" ], [ "", "{MV}" ], [ "", "{GREP}" ], [ "", "{MV}" ], [ "", "{GREP}" ], [ "", "{MV}" ], [ "", "/usr/pkg/bin/updmap-sys" ], [ "", "/usr/pkg/bin/updmap-sys" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${GREP}", "${MV}", "${PWD_CMD}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", "/usr/pkg/bin/updmap-sys", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 10.0, "bind_count": 59.0, "call_count": 40.0, "node_count": 1004.0, "identifier_count": 91.0, "string_literal_count": 59.0 }, "file": { "size": 4076.0, "entropy": 5.81, "size_bytes": 4076.0 }, "text": { "tab_count": 103.0, "digit_ratio": 0.04, "space_count": 305.0, "total_lines": 192.0, "char_entropy": 5.81, "mixed_indent": 1.0, "unique_chars": 88.0, "string_density": 0.31, "avg_line_length": 20.23, "max_line_length": 71.0, "empty_line_ratio": 0.09, "last_line_length": 6.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.04, "identifier_density": 1.33, "line_length_stddev": 17.25, "normalized_string_count": 4.26, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.12, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 12.52 }, "binds": { "count": 59.0 }, "calls": { "count": 40.0, "dynamic_target_count": 21.0 }, "binary": { "overall_entropy": 5.81, "peak_region_bytes": 3052.0, "peak_region_entropy": 5.8 }, "strings": { "total": 59.0, "avg_length": 10.85, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.91, "empty_count": 4.0, "total_bytes": 640.0, "entropy_stddev": 0.68, "shell_command_strings": 1.0 }, "comments": { "chars": 816.0, "lines": 19.0, "total": 43.0, "to_code_ratio": 0.11, "empty_comments": 24.0, "high_entropy_comments": 5.0 }, "identifiers": { "count": 91.0, "total": 255.0, "avg_length": 7.28, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.31, "reuse_ratio": 0.37, "unique_count": 95.0, "length_stddev": 5.55, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.05, "high_entropy_count": 10.0, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.07, "all_uppercase_ratio": 0.63, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "H(Po)Md(Pa)", "path": "tex-ebgaramond-maths-1.3.tgz!!+DEINSTALL", "pid": 0, "risk": 2, "sha": "ec89a2cba5e17d14b8bc636b0ad3b14c727e042707fe76f3c238c8bf268014e8", "size": 4076, "traits": [ { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "conf": 0.9200000166893005, "crit": 3, "desc": "pkgsrc maintainer script lifecycle variables", "spans": [ [ 77, 23 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "conf": 0.9200000166893005, "crit": 3, "desc": "pkgsrc maintainer script NetBSD header", "spans": [ [ 14, 16 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "conf": 0.9200000166893005, "crit": 3, "desc": "pkgsrc binary package maintainer script filename", "spans": [ [ 0, 10 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh shell executable", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "conf": 0.8799999952316284, "crit": 3, "desc": "Executes a local relative file", "spans": [ [ 2554, 25 ], [ 2674, 13 ], [ 2788, 14 ], [ 2899, 8 ], [ 3121, 8 ], [ 3243, 8 ], [ 3483, 9 ], [ 3606, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOBxBk%\u003eboOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bNK(Smncfla%X\u0026^3q:w=pc?PyjT8daa{}mFk$svba%X]/3uG({w]]dJ3jo72ofBELB-RNRvRGZkvrVGh3pm3SmnucymlI?FB-RNRvRGZkvQTs?zEEx[a{{X6r6qAUvRGZkv{%E63pvuOqCYI2flItRfjFTkfjOWdA=riflR6{El{h.EvRGZkv}YZ$wfIvFnkAqZjT8L4B8\u0026{P", "n": [ { "c": 3, "d": "pkgsrc binary package maintainer script filename", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "o": 0, "z": 8, "cf": 0.9200000166893005 }, { "c": 3, "d": "pkgsrc maintainer script NetBSD header", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "o": 14, "z": 16, "cf": 0.9200000166893005 }, { "c": 3, "d": "pkgsrc maintainer script lifecycle variables", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "o": 77, "z": 23, "cf": 0.9200000166893005 }, { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 }, { "b": "jT8L4B8\u0026{yx(kOox(mD93p^#.p^30QB-RNRvRGZkxl4N5a{{?tk#G\u0026\u0026a{{\u003efk$0\u003cWflItRfjFTkfka{9wfIvLl{h.EB-RNRvRGZkx\u003eey{oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a{}1sjT8K*x(kOuzxYAYq-#rTvRGZky\u0026Z^co?N(CqAViSvRGZkzeiV@AV=@Ma{}4BjTa-^at4gH3q:e?oF[%SflItRfk$YtfjFTkfk$Gyy:6i.ogJtPl}{lFjT8L4B8\u0026{PvRGZkAbf8[vpTj?zxYA:ogF", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 }, { "c": 1, "d": "Contains the grep command keyword", "i": "micro-behaviors/fs/search::grep-keyword", "o": 417, "z": 4, "cf": 0.699999988079071 } ], "ln": 385, "col": 5, "line": 24 }, { "b": "a{}jxjT8K*x(kOAz6xr+o*?MJjT8K*x(kOAzdEv3a{}mql{h.EB-RNRvRGZkB7F(a3r6w)mnu(Da$[7WAXy)ozzbNsB%mn(niFdIvRGZkB7=:8q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z3r6}/a$[7WAXy)ozzc6Na{}prq=C[7By/Jna{}pBryoqua$[7WAXy)ozzc9IBZ]8e3rf[^a$[7WAXy)ozzc9La{}pEryG4{BAhIna{}BrqB:UGa$[7WAXy)ozzclyA+xCq3jl", "n": [ { "c": 3, "d": "References /bin/sh shell executable", "i": "micro-behaviors/process/create/shell/spawn::bin-sh", "o": 742, "z": 7, "cf": 0.6000000238418579 }, { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 663, "col": 18, "line": 37 }, { "b": "dLb-=e]UPsB8\u003e+kdLAz[yIdZev\u003chl!v{%B\u0026ar\u00267Tp!Kq=lR*DDnK\u003e/[sW=nqa%pPq3r{UUu0x:eu0ylGu3]\u003cQBx@9GA:q)HBZniuwNfW/pJ6JyphTu+f!0CouR\u003cx=uQEQ:mO9", "n": [ { "c": 1, "d": "Uppercase config environment variable", "i": "metadata/file/policy/config/env::uppercase-config-env", "o": 1204, "z": 10, "cf": 0.550000011920929 } ], "ln": 1172, "col": 39, "line": 64 }, { "b": "B97\u0026by*?B1z/cXow/#hewGU@2v@2H=wIaq@bmj-5DSiBjrdb(jat4*Xe?X.Pq:\u003cOOqCQp?aBFLz2)\u003e@3e?X.Pq:\u003cOOqCQp?avey-as8qgogJt-mn#Mvk#ZcSl}Hp83jd1YazCBge?X.Pq:\u003cOOqCQp?avwW*lRx0%l{@dyDR^v9uRJ%*k$11rl0)2KqHHRHBzbl63jd1BiTMf1arUliB7CW+2)\u003ef/x(\u003eEL3jd1YazbsHaBKO6bZSGVq=Fe/aS@vYatbq$l}HoPaBFLz2)\u0026jqd)#%bqY[v]l)9+4p!Kq=o*@2El{T^ruQNE-Ef{oaDSiBjrdb(jat4*Xe?X.ynM5FfE0=nc2}^\u003eYl}HoPaw+H8o\u0026AeWDR^v9uRJ%*k$11rl0)2KqHF({arR^HarR^*i%(r\u003epG7jAnLSh-k$\u003c%33jd{:2{QM\u003cwNY^@y?aVgxA", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 1659, "z": 12, "cf": 0.8799999952316284 }, { "c": 1, "d": "Returns or exits with status", "i": "objectives/anti-analysis/environment-detect/check::analysis-termination-shell", "o": 1769, "z": 6, "cf": 0.8999999761581421 } ], "ln": 1595, "col": 6, "line": 85 }, { "b": "wO\u0026MgB-5^Mx(dA7y?Wv0vrcSoB7F^2v}W07vruf9wmoN*vQTs?e^.[f3jd#8r7f.+EioWQeQex\u003cfdP%(oI4MHaBFLz2)\u0026jqd]O#jnKut#k$19-bZSuXm{!$Vr6-]rr6:\u003eVnM6%z2{P=-boPu(AcSNoz/ff3xlwl6BzkVhflqnPAbP=sazbt7wPF#dzGG!tAbn@)wIaq@bmkLoarR^HarR}Rr7f.+EioWQeQex\u003cfdPH-oHR(5E0=nc2}^\u003eYmOcoxqY[v]l)9+4p!Kq=o*@2El{T^ruQNE-Ef}8tarR^HarR}Rr7f.+EioWQeQex\u003cfdPH-oHR(5E0=nc2}^\u003eYmOcoxqY[[9qCy7jbZSuXm{!$Vr6-]rr6:\u003eVnM6%z2{P=-boP]@BrCTzwN/B.y-)XdA=2JiB7]MgB0bysao", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 2028, "z": 9, "cf": 0.8799999952316284 }, { "c": 1, "d": "LLM destructive data target", "i": "objectives/impact/ransom/encrypt/runtime-generated::llm-destructive-data-target", "o": 1986, "z": 8, "cf": 0.949999988079071 } ], "ln": 1954, "col": 20, "line": 102 }, { "b": "x(4v4fjX^qwN/?2A+P9aaARp9BrCEjwN({9xK#3k3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d]nVjo\u0026AfZD\u003cQe^e?X.Kmn=\u0026Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd{:2{QM)AaAy0wGUA0C{3ZqzGG}xwmoN*vQTs?B1N!abmj-5DSiBjrdb(jat4*Xe?X.ApFK\u003e/aBFLz2)\u0026jqd[irfr8T[+DR^v9uRJ%*k$11rl0)2KqHF(V2{P=-boQ09wmoN\u003eayPekazCt7zxK4mwO(03v{@\u003eXwPGEh2{P=-bZSGVq=Fe/aS@vYatbq$nKDoGuSoM+o*}#6E0=nc2}^\u003eYnKDoGuSoM+o*}#6rzV7Hr7d]PDR^v9uRJ%*k$11rl0)2KqHF(V2{QMWxK$W?azbLjayPekaz\u003e?lB7]J8ayY5bB0a[6By/FnCv-dxwGUP0zFsf9wN(]$zGx]dy\u00260*6xd:I$bmj-5DSiBjrdb(jat4*Xe?X.ynM5FfE0=nc2}^\u003eYl}Hn", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 2356, "z": 8, "cf": 0.8799999952316284 } ], "ln": 2292, "col": 36, "line": 114 }, { "b": "aw#=-x(!xcAV/BpwO=g7azCZofj/lnflp/ry\u00261eB3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u003cQe^e?X.NnjuiCavey-as8qgogJt-mn#Mvk#ZcSl}Hp83jd#8r7f.+EioWQeQex\u003cfdP%(mncw$E0=nc2}^\u003eYq+ftJoDVX[mmfZ1k$19-bZSuXm{!$Vr6-]rr6:\u003eVnM6%z2{P=-boP(}xk8BewPw]czF0/fw[=6)B1N!abmj-5DSiBj", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 3000, "z": 8, "cf": 0.8799999952316284 }, { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2989, "z": 5, "cf": 0.5 } ], "ln": 2936, "col": 3, "line": 142 }, { "b": "A9)i\u003ey?mVJb1j**vrb^[z/f8qo\u003c@cSB1RrrA3tR}w]zYjzddxax(k4szddx\u003cw[=6)B09K!wn.!YarR^HwN/y(ar\u003cJ*A3cAMzddyia%o6kas8qlp^!2zp*VNVm%$ZJwn=u%3jgM-CX7A5vq]N=x-", "n": [ { "c": 1, "d": "shell for loop over variable", "i": "micro-behaviors/data/control-flow/loop::shell-for-loop-over-var", "o": 3778, "z": 21, "cf": 0.8600000143051147 } ], "ln": 3746, "col": 4, "line": 183 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "{SH}" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "exit" ], [ "", "exit" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+PERMS" ], [ "", "./+PERMS" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "/usr/pkg/bin/updmap-sys" ], [ "", "/usr/pkg/bin/updmap-sys" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${SH}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+PERMS", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", "/usr/pkg/bin/updmap-sys", ":", "echo", "exit", "shift" ], "metrics": { "ast": { "max_depth": 9.0, "bind_count": 59.0, "call_count": 47.0, "node_count": 1020.0, "identifier_count": 92.0, "string_literal_count": 59.0 }, "file": { "size": 4169.0, "entropy": 5.75, "size_bytes": 4169.0 }, "text": { "tab_count": 110.0, "digit_ratio": 0.04, "space_count": 343.0, "total_lines": 203.0, "char_entropy": 5.75, "mixed_indent": 1.0, "unique_chars": 85.0, "string_density": 0.29, "avg_line_length": 19.54, "max_line_length": 73.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.04, "identifier_density": 1.32, "line_length_stddev": 16.82, "normalized_string_count": 4.14, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.11, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 12.39 }, "binds": { "count": 59.0 }, "calls": { "count": 47.0, "dynamic_target_count": 19.0 }, "binary": { "overall_entropy": 5.75, "peak_region_bytes": 4096.0, "peak_region_entropy": 5.72 }, "strings": { "total": 59.0, "avg_length": 10.8, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.91, "empty_count": 4.0, "total_bytes": 637.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 844.0, "lines": 20.0, "total": 46.0, "to_code_ratio": 0.11, "empty_comments": 26.0, "high_entropy_comments": 5.0 }, "identifiers": { "count": 92.0, "total": 268.0, "avg_length": 7.17, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.3, "reuse_ratio": 0.35, "unique_count": 95.0, "length_stddev": 5.44, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.05, "high_entropy_count": 10.0, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.08, "all_uppercase_ratio": 0.63, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 3, "mol": "H(Po)Md(Pa)", "path": "tex-ebgaramond-maths-1.3.tgz!!+INSTALL", "pid": 0, "risk": 2, "sha": "4eaadda853246a016ae7143bb6f254521c7ae9a65700901a69dbaa8115924958", "size": 4169, "traits": [ { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "conf": 0.9200000166893005, "crit": 3, "desc": "pkgsrc maintainer script lifecycle variables", "spans": [ [ 77, 23 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "conf": 0.9200000166893005, "crit": 3, "desc": "pkgsrc maintainer script NetBSD header", "spans": [ [ 14, 16 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "conf": 0.9200000166893005, "crit": 3, "desc": "pkgsrc binary package maintainer script filename", "spans": [ [ 0, 8 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh shell executable", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "conf": 0.8799999952316284, "crit": 3, "desc": "Executes a local relative file", "spans": [ [ 1659, 12 ], [ 1813, 7 ], [ 2028, 9 ], [ 2151, 8 ], [ 2356, 8 ], [ 2450, 8 ], [ 2553, 14 ], [ 3000, 8 ] ] } ], "type": "shell" }, { "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 9.0, "call_count": 0.0, "node_count": 30.0, "identifier_count": 15.0 }, "file": { "size": 303.0, "entropy": 4.53, "size_bytes": 303.0 }, "text": { "digit_ratio": 0.01, "space_count": 38.0, "total_lines": 8.0, "char_entropy": 4.53, "unique_chars": 39.0, "avg_line_length": 36.88, "max_line_length": 61.0, "empty_line_ratio": 0.13, "last_line_length": 37.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.1, "identifier_density": 1.88, "line_length_stddev": 23.74, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 5.0 }, "binary": { "overall_entropy": 4.53, "peak_region_bytes": 303.0, "peak_region_entropy": 4.53 }, "comments": { "chars": 29.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.14 }, "identifiers": { "count": 15.0, "total": 15.0, "avg_length": 5.2, "max_length": 12.0, "min_length": 2.0, "avg_entropy": 2.05, "reuse_ratio": 1.0, "unique_count": 15.0, "length_stddev": 3.08, "has_digit_ratio": 0.07, "base64_like_names": 1.0, "all_lowercase_ratio": 0.73, "numeric_suffix_count": 1.0 } } }, "id": 4, "path": "tex-ebgaramond-maths-1.3.tgz!!+DESC", "sha": "44474153317a863a10107d387c0992cb36d71a4fab0498d177617c79f5d064b7", "size": 303, "type": "kotlin" } ], "v": "8" } }