{ "llm": { "conf": 0.9933, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 25, "prob": 0.99, "class": "hostile" }, "outcome": "hostile", "interpretation": "Exfiltrates system data to hardcoded IP" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 12, "conf": 93, "mods": [ { "cls": 0, "raw": 0.9978675, "rte": "az", "prob": 0.9978675 }, { "cls": 0, "raw": 0.99128836, "rte": "az/zip", "prob": 0.99128836 } ], "prob": 0.99, "files": [ { "id": 0, "lvl": 12, "conf": 93, "prob": 0.9900000095367432, "type": "zip" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000017315149307250977, "type": "markdown" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00001523892115073977, "type": "php" }, { "id": 9, "lvl": 25, "conf": 92, "prob": 0.9900000095367432, "type": "php" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.000011682510375976562, "type": "php" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.00001136461924033938, "type": "php" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.000010907649993896484, "type": "php" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.000010659297004167456, "type": "php" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000010659297004167456, "type": "php" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.000010361273780290503, "type": "php" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.00001535812953079585, "type": "php" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.000016162792235263623, "type": "php" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.000013401110663835425, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-08T07:59:50Z" }, "path": "bfunky-http-parser-2.1.0.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([3ig5a001.VS9xr50000000000000@r2([BDB-7#ueOGlFA4M3qA=U/jeO3OChAb82fi7%P00cC]@B]830%w@h000o8f:KZ.iog$qkl7V-oAk4)b(!kKvRf+2yK4HBBAzENAa9^dwPxwkf\u003eia2vLPO?", "ln": 0 } ], "mol": "O₂(C₂Eu)H₆(Cm₁₂CrDb₃F₂Os₅Po)Md₂(Pa₂)", "sha": "1df229c816b795136159caffc3d15cff6a3e3b3b6c9868f6ffcd23b509d97814", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip", "risk": 321, "size": 21329, "type": "zip", "facts": { "metrics": { "file": { "size": 21329, "entropy": 7.55 }, "binary": { "peak_region_bytes": 16384, "peak_region_entropy": 7.79 }, "archive": { "file_count": 32, "has_comment": 1, "comment_size": 40, "member_count": 39, "script_count": 22, "zip_bomb_ratio": 3.97, "compressed_size": 13657, "directory_count": 7, "executable_count": 0, "extra_field_size": 351, "noise_file_count": 0, "compression.ratio": 0.39, "hidden_file_count": 3, "uncompressed_size": 35022, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 78, "rtlo_filename_count": 0, "format.regular_count": 32, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 7, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.03, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 39, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.stored": 7, "compression.method_counts.deflate": 32 } } }, "ident": { "name": { "value": "bfunky-http-parser", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "2.1.0", "source": "file.basename", "verified": false } }, "traits": [ { "id": "objectives/execution/automation/agent::skill-stage-encoding-target-reverse", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Staged content names an encoding action", "from": [ { "file": 4 } ] }, { "id": "metadata/package/testing/presence/fixture::php-test-file", "conf": 0.9, "crit": 3, "desc": "PHP test filename", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/communications/http/response-code::wire-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP response line returns status 200", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/data/serialize/object::json-encode", "conf": 0.6, "crit": 2, "desc": "JSON encoding for data output", "from": [ { "file": 9 } ] }, { "id": "metadata/package/testing/presence/harness::python-php-test-basename-suffix", "conf": 0.95, "crit": 1, "desc": "Python/PHP test filename suffix", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-url-script", "conf": 0.9, "crit": 3, "desc": "Script embeds external IPv4 URL", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/env/access::php-getenv-call", "conf": 0.85, "crit": 3, "desc": "Calls PHP getenv", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/curl::exec-symbol", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "References the PHP curl_exec() function", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/request/client::content-type-header", "conf": 0.5, "crit": 1, "desc": "References an HTTP Content-Type header", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/php-endpoint::url-php-endpoint-encoded", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Encoded URL targets .php endpoint", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/json::php-json-encode", "conf": 0.86, "crit": 3, "desc": "PHP JSON serialization", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/ip/direct::external-ipv4-http-endpoint", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "HTTP endpoint uses external IPv4", "from": [ { "file": 9 } ], "uses": [ 54 ] }, { "id": "objectives/command-and-control/backdoor/decoded-c2::encoded-c2-ssl-bypass", "atk": "T1573", "mbc": "B0032", "conf": 0.97, "crit": 5, "desc": "Encoded C2 URL with SSL bypass", "from": [ { "file": 9 } ], "uses": [ 7, 19 ] }, { "id": "micro-behaviors/data/format/html::markdown-remote-image-source", "conf": 0.9, "crit": 3, "desc": "Markdown references a remote image", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/env/access::php-server-superglobal", "conf": 0.85, "crit": 3, "desc": "Reads PHP $_SERVER execution environment data", "from": [ { "file": 9 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 22 }, { "file": 23 }, { "file": 24 }, { "file": 25 }, { "file": 26 }, { "file": 27 }, { "file": 28 }, { "file": 29 } ], "uses": [ 4, 45 ] }, { "id": "micro-behaviors/communications/http/header/content-type::text-xml-content-type", "conf": 0.8, "crit": 3, "desc": "HTTP text/xml media type", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/message::raw-http-body-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP body-capable request line", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::php-uname-symbol", "conf": 0.7, "crit": 3, "desc": "References the php_uname OS information function", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/curl::ssl-verify-disable", "atk": "T1553", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "SSL certificate verification disabled", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/cookies::set-cookie-header", "conf": 0.5, "crit": 3, "desc": "Set-Cookie header", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/communications/http/request/params::server-name", "conf": 0.8, "crit": 3, "desc": "Reads PHP SERVER_NAME request variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/stdio::error-suppress-prefix", "conf": 0.7, "crit": 3, "desc": "Suppresses errors with the PHP @ operator" }, { "id": "micro-behaviors/communications/http/curl::php-curl-request", "conf": 0.9, "crit": 3, "desc": "Executes a PHP cURL request", "from": [ { "off": 1008, "file": 9, "line": 36 } ], "uses": [ 40, 46 ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-http-url", "conf": 0.9, "crit": 1, "desc": "Text contains raw external-IP HTTP URL", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/curl::ssl-host-disable", "atk": "T1553", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "SSL host verification disabled", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/temp/directory::sys-get-temp-dir-symbol", "mbc": "E1083", "conf": 0.75, "crit": 2, "desc": "sys_get_temp_dir symbol present", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/lifecycle/auto-exec::require-dir-php-sibling", "conf": 0.85, "crit": 3, "desc": "require_once sibling helper file", "from": [ { "file": 8 } ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64" }, { "id": "micro-behaviors/fs/directory/cwd::php-getcwd", "conf": 0.6, "crit": 2, "desc": "Gets current working directory", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::php-gethostname-call", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 3, "desc": "Gets current host name in PHP", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/curl::url-from-method-call", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 3, "desc": "CURLOPT_URL set from method call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 9 } ] }, { "id": "objectives/command-and-control/infrastructure/ip-url-php::external-ip-php-endpoint-encoded", "atk": "T1071.001", "mbc": "C0002", "conf": 0.99, "crit": 5, "desc": "Encoded URL has IP and .php", "from": [ { "file": 9 } ], "uses": [ 9, 57 ] }, { "id": "micro-behaviors/os/env/dump::php-getenv-no-args", "mbc": "C0034", "conf": 0.95, "crit": 3, "desc": "Reads all process environment variables" }, { "id": "micro-behaviors/communications/http/post::post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "HTTP POST request line", "from": [ { "file": 28 } ] }, { "id": "metadata/package/testing/harness/unit::phpunit-method-test-prefix", "conf": 0.8, "crit": 2, "desc": "PHPUnit test_ method prefix", "from": [ { "file": 22 } ] }, { "id": "metadata/package/testing/harness/unit::phpunit-assertion-call", "conf": 0.9, "crit": 2, "desc": "PHPUnit assertion method call", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/communications/http/header/content-length::content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/crypto/hash/digest::md5-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "MD5 hash computation", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/curl::exec", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "cURL request execution", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/base64::php-base64-decode-call", "mbc": "C0053", "conf": 0.9, "crit": 3, "desc": "Calls PHP base64_decode()", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/file/write/direct::php-file-put-contents", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP file_put_contents()", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::php-uname-call", "conf": 0.75, "crit": 3, "desc": "Reads OS information via php_uname()", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/file/write/direct::php-file-write", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Writes data using PHP file API", "from": [ { "off": 1029, "file": 9, "line": 38 } ], "uses": [ 42 ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/communications/http/curl::init", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "cURL session initialization", "from": [ { "file": 9 } ] }, { "id": "objectives/exfiltration/oob/system-profile::host-profile-json-post", "atk": "T1041", "mbc": "B0030", "conf": 0.9, "crit": 4, "desc": "Host profile JSON-POSTed remote", "from": [ { "off": 1648, "file": 9, "line": 61 } ], "uses": [ 3, 7, 18, 21, 29, 30, 34 ] }, { "id": "micro-behaviors/data/decode/base64::const-decoder-classname", "atk": "T1027", "mbc": "B0032", "conf": 0.88, "crit": 3, "desc": "base64_decode of named class constant", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/curl::setopt", "conf": 0.7, "crit": 3, "desc": "cURL option configuration", "from": [ { "file": 9 } ] }, { "id": "objectives/execution/automation/agent::skill-stage-encoding-target-forward", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Encoding action names staged content", "from": [ { "file": 4 } ] }, { "id": "objectives/execution/automation/agent::skill-stage-encoding-agent", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Skill or agent mentions encoding action", "from": [ { "file": 4 } ] }, { "id": "metadata/package/testing/harness/unit::phpunit-testcase-extends", "conf": 0.97, "crit": 2, "desc": "Extends PHPUnit TestCase class", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/fs/write/state::hostname-keyed-temp-state", "mbc": "C0052", "conf": 0.95, "crit": 3, "desc": "Writes hostname-keyed temporary state file", "from": [ { "off": 1238, "file": 9, "line": 47 } ], "uses": [ 26, 30, 39, 44 ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url", "conf": 0.95, "crit": 3, "desc": "Contains an external-IP HTTP URL", "from": [ { "file": 9 } ], "uses": [ 24 ] }, { "id": "micro-behaviors/communications/http/request/cgi::server-name-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI SERVER_NAME variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/curl::post-data", "conf": 0.7, "crit": 3, "desc": "cURL POST data configuration", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/external-ip::url-external-ip-encoded", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 4, "desc": "Encoded URL pinned to external IPv4", "from": [ { "file": 9 } ] }, { "id": "metadata/package/testing/presence/harness::archive-test-directory-member-path", "conf": 0.98, "crit": 3, "desc": "Archive ships a root-level test tree" } ] }, { "ctx": [ { "b": "nk@L+aw=G!B7Gw0jV$}\u003ejV$}\u003ejV$}ntoNiHv@=Zlx(mThwPw[Xz!9A4qfuq-x([Sac$)ZAAc15[flpSzB-.tnx)KuheN@GEv@Diqxd).aB-7#ufkbDHA4M3qA=U/jfjFv2xjVcqADLYax([RLB7ocewId}txfP\u0026*zddHcwPxk9c$)ZAAc15[flpSzB-.tnx)KuheN@GEv@Diqxd).aB-7#ufkbDHA4M3qA=U/jff-]^vqYN*j-aRGBy/Fw3r[VTluN0Uwfs/)vruTkt{%xdBz#pZfe4xRA=(FrzFsAdAXg^ne[n*pfj#}Ew{50bC(", "ln": 0, "col": 1, "line": 1 }, { "b": "kvOUwzEWuyzddHcwPxjb3pb!Jx\u003c#9\u003eA^n^HzY\u003c1cA=U!mnk@L+azts{wmY^7vqYP#nk@L+azts{wmY^7w[+*)woe7+boQ0cvp%cU3l{=rp*[x=x(mMavixP4ADL\u0026lBp8z-u#P^#3lQDlarR^Has7#oCsV*$A3dp^juL-7l01y\u0026pG7jnfk$uwxDP\u0026Br8tk5e?)YkB7Gwzl1:+DBugKvnkH)ppEd/gtTA12x(d*9wN5eLvq[OIx\u003eqg73p]8RBugK!A+)vrz/4J{fBy9Qv}xR3iV][9dHFEKv}xR3eK:L!z!9N1xf4eCwOb:!By^0Cxl[oh3pw-HBy/uieMv1mwJB{ACYUP-zeqoRv}Yp\u003eB7GCRB-.jEi0@2\u003ezGGDcBs*f$zFa68iV{difGozdCYmk7BugK0fFC7*", "ln": 508, "col": 146, "line": 5 }, { "b": "xK@+.z/fVqz!}DSzF}aFBz(hhefF?GeN@j0xK@.qzfo]wePLACvqGT*vru6iaAhmuBs?0owN/HsfF1t=A+c?jxK$W?jUNi=arR^HarR!6A:-P$vlbJGz.kEcv}YAX", "ln": 1920, "col": 12, "line": 59 }, { "b": "arTY[A^oX*l1szoAc9W2zEWP}x(mL\u003carR^HarR^HlVl\u003c:wO#Pwmq=QNwnb{]iV@6Yx(Bz4arR^HarR^]z/fVdzGEE7wO#d5xGvm\u003ciwH{:arR^HarR^]z/fVdzGEEfD2NsQaARgtBt4(Q", "ln": 2026, "col": 7, "line": 61 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2757, "entropy": 4.98 }, "text": { "lines": 88, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 576, "char_entropy": 4.98, "unique_chars": 81, "top_char_null": 0, "top_char_ratio": 0.07, "avg_line_length": 30.33, "max_line_length": 176, "empty_line_ratio": 0.1, "last_line_length": 3, "long_token_count": 3, "whitespace_ratio": 0.24, "line_length_stddev": 30.79, "repeated_char_sequences": 1 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 5.18 } } }, "id": 4, "mol": "H(Db)", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/README.md", "pid": 0, "risk": 1, "sha": "876d922e4f27f260a720ce94787182c75d434627466c7acea8bc2b1e71056037", "size": 2757, "traits": [ { "id": "micro-behaviors/data/format/html::markdown-remote-image-source", "conf": 0.9, "crit": 3, "desc": "Markdown references a remote image", "spans": [ [ 25, 100 ] ] }, { "id": "objectives/execution/automation/agent::skill-stage-encoding-agent", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Skill or agent mentions encoding action", "spans": [ [ 668, 0 ] ] }, { "id": "objectives/execution/automation/agent::skill-stage-encoding-target-forward", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Encoding action names staged content", "spans": [ [ 741, 0 ] ] }, { "id": "objectives/execution/automation/agent::skill-stage-encoding-target-reverse", "atk": "T1059", "conf": 0.92, "crit": 1, "desc": "Staged content names an encoding action", "spans": [ [ 2058, 0 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "ju)^#A0!lFdHEpFavgc(xM4]LazLt0A=iNJz!9)5xlv^iauTyEx(XbSvRf+2yK4KIwPQ9yasY2K3t%o?wPI*0v}u=HmS\u0026P:D0A)ZBz$5+A=U/ji%(snwPq\u003cbA+eP@zEWlauTDh)qEr=Ne*8t\u003el2HaED30+gB1RABA3u.)3jp]%wGTreB-7#utU5%UA8o$-B7Gw%mq^iYBA}aZBAzE\u0026vrt{UvqGT*vruj4zAwhFB7DEXmS\u0026P:D0A)ZBz$5+A=U/jtT-KLx([S9now@)mRMBIwigcvB7DEXmS\u0026P:D0A)ZBz$5+A=U/jtT-KLx([S9now@)mG", "ln": 0, "col": 1, "line": 1 }, { "b": "p*[x=wPz3ACW\u003er7BzkVhtU5%UA8o$-B7GwUvpR\u0026CA=2lbmr\u0026rNAcb/jzAwgjvpBq1A:-E1ay/j@B8@D\u0026vSMTivpKyIBAzE#vrcB2AV/7kAbo95wO#Qhav{P@A8o$-B7Gw-zGGDgw)]gX3vra5arR^WdK\u003e=FarR^HdJ?01vr9GiBAh8kx9]+7arR^Rfa5*AarUSzz//M2", "ln": 401, "col": 16, "line": 15 }, { "b": "x(v(ibXRpwA7jLMy?b[Ky\u00260V)BzkVhauZ\u0026+B.\u003e\u003ey3lQDlaBsCrarR^HarR^LBzbxfeK0\u0026\u0026Bz%Y-wO+)Az!%l3v@#B6zxI7+bXRpwA7jLMy?b[Ky\u00260V)BzkVhau@7know@)mRMBIwj7oKy?m9#x(v(Ii+AzJzaF+\u003cA7jLMy?b?LA::kwtu@Wt3lQDl", "ln": 887, "col": 49, "line": 38 }, { "b": "arR}KxLzJtk4O$XA:-E1c[dj+arR^HEf{r7arR^WdK\u003e=FarR^HdJ?Vey?W#lBzbkdxMOunaAITBx(mL\u003carR^HasXH0BzbYkCxj($BAzE#vrcB2AZBhBmSir:vrs}.v}xR3x(v\u003e@arR^HasY2KarR^HAb](swN/*[wftGbzEW^5z/cXeCYW$mv@%a", "ln": 1827, "col": 7, "line": 77 } ], "depth": 1, "facts": { "imp": [ [ "", "explode" ], [ "", "trim" ], [ "", "preg_split" ], [ "", "array_merge" ], [ "", "strpos" ], [ "", "explode" ], [ "", "strpos" ], [ "", "explode" ], [ "", "BFunky\\HttpParser\\Entity\\HttpDataValidation" ], [ "", "BFunky\\HttpParser\\Entity\\HttpField" ], [ "", "BFunky\\HttpParser\\Entity\\HttpFieldCollection" ], [ "", "BFunky\\HttpParser\\Entity\\HttpHeaderInterface" ], [ "", "BFunky\\HttpParser\\Exception\\HttpFieldNotFoundOnCollection" ], [ "", "BFunky\\HttpParser\\Exception\\HttpParserBadFormatException" ] ], "mbr": [ "$this.httpFieldCollection", "$this.httpHeader", "$this.httpRaw" ], "tgt": [ "$httpField", "$this", "$this.httpFieldCollection", "HttpDataValidation", "HttpField", "HttpFieldCollection", "array_merge", "explode", "preg_split", "strpos", "trim" ], "funcs": [ [ "__construct", 843 ], [ "parse", 1089 ], [ "get", 1306 ], [ "getHeader", 1538 ], [ "process", 1728 ], [ "extract", 1947 ], [ "addHeader", 2474 ], [ "addField", 2836 ], [ "setHttpHeader", 3176 ], [ "splitRawLine", 3342 ], [ "setHttpRaw", 3760 ] ], "metrics": { "ast": { "op.eq": 1, "op.ne": 2, "max_depth": 16, "op.concat": 1, "call_count": 22, "node_count": 924, "op.coalesce": 1, "member_count": 3, "max_array_len": 3, "op_density.eq": 0, "op_density.ne": 0, "member_depth_max": 2, "op_density.concat": 0, "op_density.coalesce": 0 }, "file": { "size": 3899, "entropy": 4.66 }, "text": { "lines": 153, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0, "space_count": 924, "char_entropy": 4.66, "unique_chars": 71, "top_char_null": 0, "string_density": 0.14, "top_char_ratio": 0.08, "avg_line_length": 24.48, "max_line_length": 105, "empty_line_ratio": 0.11, "last_line_length": 1, "whitespace_ratio": 0.28, "identifier_density": 1.35, "line_length_stddev": 23.45, "normalized_string_count": 1.7, "repeated_char_sequences": 12, "suspicious_comment_ratio": 0.33, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 9.78 }, "binds": { "count": 9 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 4.84 }, "source": { "class_count": 1, "function_count": 11 }, "imports": { "count": 6, "third_party_count": 6, "third_party_ratio": 1 }, "strings": { "bytes": 89, "count": 21, "avg_length": 4.24, "max_length": 14, "path_count": 2, "avg_entropy": 2.06, "empty_count": 4, "entropy_stddev": 1.02 }, "comments": { "chars": 943, "count": 15, "lines": 55, "base64": 5, "to_code_ratio": 0.56 }, "functions": { "count": 12, "density": 7.19, "avg_params": 1, "code_ratio": 0.43, "max_params": 3, "one_liners": 1, "length_stddev": 3.59, "avg_name_length": 8.55, "no_params_count": 2, "avg_length_lines": 6, "max_length_lines": 14, "min_length_lines": 1, "avg_param_name_length": 9.82 }, "identifiers": { "count": 207, "unique": 71, "avg_length": 9.82, "max_length": 29, "min_length": 1, "avg_entropy": 2.67, "reuse_ratio": 0.34, "length_stddev": 5.74, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.01, "high_entropy_count": 5, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.28, "all_uppercase_ratio": 0.01, "double_underscore_count": 1, "underscore_prefix_count": 2 } } }, "id": 8, "mol": "H(Po)", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/src/AbstractHttpParser.php", "pid": 0, "risk": 1, "sha": "d241acdaedf1fdef8068ad13f453c5524f759611c3466b595018c57f8b1d9add", "size": 3899, "traits": [ { "id": "micro-behaviors/process/lifecycle/auto-exec::require-dir-php-sibling", "conf": 0.85, "crit": 3, "desc": "require_once sibling helper file", "spans": [ [ 91, 38 ] ] } ], "type": "php" }, { "ctx": [ { "b": "ju)^#A0=}9dHEpFaxi2*B0b7ey?j-6B0bBgA=-Bxw/%DVze:AmwPxygasWZvdJ*cHdiIx1y\u0026ZZ+wmY^#vqY%9jz[OrwPzS@zA@8FwmY^#vqWYdwJ*CzdJ/\u0026RarTo{A+5(blt{HHx\u003c\u003e)$auTx\u003evSb)(x\u003c\u003e)$kYZHMwg?t5j{\u0026zZ3lQ/vmSiq\u0026Bzbkdw{4{aay/teD2^RixMLw9zE:(ax\u003e7Z(B7DFdzF0*czddK2z/d9GAbo8]B7DFqx\u003eqGhBzbkdoI4Pupe:N*asXHCx(4u6Bzb98aA}mnay]hcBAh88B-.h9aA}KwxDRzgx(+zrz/{8gwGUG3wmWw2asY2K3ni\u003eoasXHkxLzJgw[=6)azC)tvrDWgzddK2v{%g\u0026C{3:hzE)\u0026%By!#9vTf7-z/6DiB7GwA3lQ/vl#Kh=z/^asz!9M]C{4ixx(+zex(4u6eIe8FpGppnlR6Hrm[3u0s4M7VavnHtmn=AImmnpaasY2K3t%o?wPI*0v}u=HmS\u0026P:D0A)ZBz$5+A=U/ji%(s8y*?yaavf)Ny\u003cybpv@\u0026=t3lQE3z/fSraxqrkauZ?\u003evqYH\u0026D30+gB1RAuv@2H=x(!wGz/PFmi%)8Mv@DmaBrBNYoKygVm[3uQauZ?\u003evmToIv[orLoNePKpd3\u003c-o\u0026KA3pGghlo)QC}v[f16vkpq\u0026vounUoM0gnv)Jmvb0cbsarUSCvR/:*azb+lv@#B6zxK1izE+dAaBsCrarR^Lv}V#Fay/Lmy*Q)]x(\u003e:Li%(rqarR!pB-Iq9B7GDiAc9GNv}WzolSE2TpF+1$nk@L+njt*jmn+VVtoVBMzGGDcBs*EqAaI6Mvq{g4x\u003e7N[x(v(xyiarhb3=SV3lQDlay/Lmy*Rl{Bz(buc)SqoefEqWqCo\u003e.r9@N5oKy*?qB%tXnkAe-efFLky\u0026:epi%)8MarUfpA+]97wPR\u003cfBsnzAxE\u003en[rz(H^p/H!2q+QL0mn=YDsX}KQqy\u0026@5vqH0@dlv\u003eVarR!pB-Iq9B7GDiAc9GNv}WzolSE2TpF+1$rz(Hwas85xx(+\u003c\u0026xjVf+qCnF/dlv\u003ezarR^HbXgt9vivYQyiarhuUaa+z!9AcbY)ZlB1GN=z!%l3v@%aFefEL-pFLm[qBKL:sZL06nLSkli%)8MarUfpA+]97wPR\u003cfBsnzAxE\u003en[rz(H^p/H^#pG7jZnKVrvq.f4pwmoN*dlv\u003eVarR!pB-Iq9B7GDiAc9GNv}WzolSE2TpF+1$qBKL+qCHg?k#7uFmn+VVBAhIndlv\u003ezarR^Hv%8*duUaE[v\u003c\u0026QjxEM1I3lQDlazbt7wNxz0ByeJ@zGGDcBAn\u0026QBzbxfeK0/UBw#**A7jLTwHF#Uar\u00260Ui%)8MEf{r7aAhEjy?Wx4w{503BzkVhazC)}wO#PrdiJ%AarR^HA+funA=91ix(4u/wQ4{gBAn\u0026QBzbxfeK0/UBw#**A7jLTwHF#Ri%)8MEf{r7aAhvnC42G7azb+lv@#B6zxJO6Bw#**A7jLTwHF#IDKp(rarR}KwO(xejS[/\u003eB6\u0026M\u003eByfc3ze-\u0026)x(UQJi%)8MarR}wx(4u6jS[PLh7g+dvqHjhx\u003e8iBi-P6KuQNEQmn)ede*a!rBzbPlBz+J7wHF#Ri%)8MarR}Gvruf9jS(1(wO(xee*9LNqBJ@LpF$t5q:\u003cIGqBanTqxNOmbXy+bwJHkwarR!EwPS6nzxHizvrufA3lQEt3jm)#Ab]Vovru66w{503BzkVhazkncrz(HsdiJ%AarR^HA+funA=91evrl0rg*:^8v@C)?c{.-Vy\u003cybpv@\u003cW(rz(H$l}G)qq=Chc3lQEt3jm)#Ab]Vovru66w{503BzkVhay/tay?m9#c[co=3lQDlaAz4nB-Ivxvrcx%C{\u003c1xarR^Har\u003e=kv@2H=wG\u0026lWj%jitpc?Pyq=2+EmpfyM3lQDlarR^JvqZ13D2mFxB0q.\u0026j%j@/B.99harR^HarR\u003ewz/Z1Aau.[htw4I?xM4%lzEEx[c[cX\u0026kQoYnmn^ePqD\u003etzmn^ePqErf+o*{miefEh6uSfx\u003erZ/[\u003cb2Z{drZ/[[k$1asb3!F93lQDlarR^Jv%qDcau.[hxjVf{CvS9Jed9HxarR^Hb5.JDau.[hAa\u003ch$B-7S8wHF#U3lQDlarR^JwO#Vnau.[hxjVf@zGWASed9HxarS9{3lQEt3vJl*bW\u003eO0y\u003cybpv@\u0026+Qaz$+mavf)Ny\u003cybpv@\u003c4Ei%]XlasFxUvqYH\u0026D30+gB1GN\u0026B5MT/BsnN!aBsCras7xkvqHjhx\u003e8iok67pMwge(*3vJl", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "curl_init" ], [ "", "curl_setopt" ], [ "", "curl_setopt" ], [ "", "curl_setopt" ], [ "", "curl_setopt" ], [ "", "json_encode" ], [ "", "curl_setopt" ], [ "", "curl_setopt" ], [ "", "curl_exec" ], [ "", "file_put_contents" ], [ "", "file_exists" ], [ "", "sys_get_temp_dir" ], [ "", "md5" ], [ "", "gethostname" ], [ "", "base64_decode" ], [ "", "gethostname" ], [ "", "getcwd" ], [ "", "php_uname" ], [ "", "getenv" ] ], "tgt": [ "$analytics", "$this", "base64_decode", "curl_exec", "curl_init", "curl_setopt", "file_exists", "file_put_contents", "getcwd", "getenv", "gethostname", "json_encode", "md5", "php_uname", "sys_get_temp_dir" ], "funcs": [ [ "send", 554 ], [ "isSent", 1081 ], [ "getTempFile", 1161 ], [ "getURL", 1356 ], [ "collect", 1440 ] ], "metrics": { "ast": { "op.lnot": 1, "max_depth": 13, "op.concat": 3, "call_count": 25, "node_count": 518, "max_array_len": 6, "op_density.lnot": 0, "op_density.concat": 0.01 }, "file": { "size": 1807, "entropy": 5.33 }, "text": { "lines": 71, "top_char": 101, "max_ws_run": 5, "digit_ratio": 0.01, "space_count": 277, "char_entropy": 5.33, "unique_chars": 80, "top_char_null": 0, "string_density": 0.15, "top_char_ratio": 0.05, "avg_line_length": 24.45, "max_line_length": 84, "empty_line_ratio": 0.2, "last_line_length": 1, "whitespace_ratio": 0.19, "identifier_density": 1.39, "line_length_stddev": 23.25, "encoded_string_ratio": 0.09, "normalized_string_count": 1.31, "suspicious_comment_ratio": 1, "normalized_unique_identifiers": 7.81 }, "binds": { "count": 6 }, "binary": { "peak_region_bytes": 1807, "peak_region_entropy": 5.4 }, "source": { "class_count": 1, "function_count": 5 }, "strings": { "bytes": 151, "count": 11, "avg_length": 13.73, "max_length": 48, "avg_entropy": 2.67, "domain_count": 1, "entropy_stddev": 1.07, "base64_candidates": 1 }, "comments": { "chars": 370, "count": 2, "lines": 13, "high_entropy": 2, "to_code_ratio": 0.22 }, "functions": { "count": 6, "density": 7.04, "code_ratio": 0.54, "length_stddev": 4.92, "avg_name_length": 6.8, "no_params_count": 5, "avg_length_lines": 7.6, "max_length_lines": 16, "min_length_lines": 3 }, "identifiers": { "count": 99, "unique": 48, "avg_length": 9.38, "max_length": 22, "min_length": 2, "avg_entropy": 2.66, "reuse_ratio": 0.48, "length_stddev": 5.48, "has_digit_ratio": 0.04, "high_entropy_count": 3, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.42, "all_uppercase_ratio": 0.25, "numeric_suffix_count": 1, "double_underscore_count": 1, "underscore_prefix_count": 2 } } }, "id": 9, "mol": "O₂(C₂Eu)H₅(Cm₈CrDb₂F₂Os₅)Md", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/src/Analytics.php", "pid": 0, "risk": 319, "sha": "f8f0914ff8690a26390cc5aee741bc6e12db439f669fcb5e643038fde9725ae4", "size": 1807, "traits": [ { "id": "micro-behaviors/communications/http/curl::exec", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "cURL request execution", "spans": [ [ 1008, 9 ] ] }, { "id": "micro-behaviors/communications/http/curl::exec-symbol", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "References the PHP curl_exec() function", "spans": [ [ 1008, 9 ] ] }, { "id": "micro-behaviors/communications/http/curl::init", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "cURL session initialization", "spans": [ [ 589, 9 ] ] }, { "id": "micro-behaviors/communications/http/curl::post-data", "conf": 0.7, "crit": 3, "desc": "cURL POST data configuration", "spans": [ [ 906, 11 ] ] }, { "id": "micro-behaviors/communications/http/curl::setopt", "conf": 0.7, "crit": 3, "desc": "cURL option configuration", "spans": [ [ 607, 11 ] ] }, { "id": "micro-behaviors/communications/http/curl::url-from-method-call", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 3, "desc": "CURLOPT_URL set from method call", "spans": [ [ 808, 27 ] ] }, { "id": "micro-behaviors/communications/http/request/client::content-type-header", "conf": 0.5, "crit": 1, "desc": "References an HTTP Content-Type header", "spans": [ [ 646, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/params::server-name", "conf": 0.8, "crit": 3, "desc": "Reads PHP SERVER_NAME request variable", "spans": [ [ 1581, 23 ] ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-url-script", "conf": 0.9, "crit": 3, "desc": "Script embeds external IPv4 URL", "spans": [ [ 498, 48 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::md5-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "MD5 hash computation", "spans": [ [ 1238, 3 ] ] }, { "id": "micro-behaviors/data/decode/base64::const-decoder-classname", "atk": "T1027", "mbc": "B0032", "conf": 0.88, "crit": 3, "desc": "base64_decode of named class constant", "spans": [ [ 1395, 26 ] ] }, { "id": "micro-behaviors/data/decode/base64::php-base64-decode-call", "mbc": "C0053", "conf": 0.9, "crit": 3, "desc": "Calls PHP base64_decode()", "spans": [ [ 1395, 13 ] ] }, { "id": "micro-behaviors/data/serialize/json::php-json-encode", "conf": 0.86, "crit": 3, "desc": "PHP JSON serialization", "spans": [ [ 852, 11 ] ] }, { "id": "micro-behaviors/data/serialize/object::json-encode", "conf": 0.6, "crit": 2, "desc": "JSON encoding for data output", "spans": [ [ 852, 0 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::php-file-put-contents", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP file_put_contents()", "spans": [ [ 1029, 17 ] ] }, { "id": "micro-behaviors/fs/temp/directory::sys-get-temp-dir-symbol", "mbc": "E1083", "conf": 0.75, "crit": 2, "desc": "sys_get_temp_dir symbol present", "spans": [ [ 1206, 0 ] ] }, { "id": "micro-behaviors/os/env/access::php-getenv-call", "conf": 0.85, "crit": 3, "desc": "Calls PHP getenv", "spans": [ [ 1700, 6 ] ] }, { "id": "micro-behaviors/os/env/access::php-server-superglobal", "conf": 0.85, "crit": 3, "desc": "Reads PHP $_SERVER execution environment data", "spans": [ [ 1582, 7 ] ] }, { "id": "micro-behaviors/os/env/dump::php-getenv-no-args", "mbc": "C0034", "conf": 0.95, "crit": 3, "desc": "Reads all process environment variables", "spans": [ [ 1700, 8 ] ] }, { "id": "micro-behaviors/os/stdio::error-suppress-prefix", "conf": 0.7, "crit": 3, "desc": "Suppresses errors with the PHP @ operator", "spans": [ [ 1580, 24 ], [ 1606, 24 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::php-gethostname-call", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 3, "desc": "Gets current host name in PHP", "spans": [ [ 1266, 11 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::php-uname-call", "conf": 0.75, "crit": 3, "desc": "Reads OS information via php_uname()", "spans": [ [ 1672, 9 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::php-uname-symbol", "conf": 0.7, "crit": 3, "desc": "References the php_uname OS information function", "spans": [ [ 1672, 9 ] ] }, { "id": "micro-behaviors/communications/http/curl::ssl-host-disable", "atk": "T1553", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "SSL host verification disabled", "spans": [ [ 685, 46 ] ] }, { "id": "micro-behaviors/communications/http/curl::ssl-verify-disable", "atk": "T1553", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "SSL certificate verification disabled", "spans": [ [ 738, 46 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 646, 30 ] ] }, { "id": "micro-behaviors/communications/http/request/cgi::server-name-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI SERVER_NAME variable", "spans": [ [ 1581, 23 ] ] }, { "id": "micro-behaviors/communications/http/url/external-ip::url-external-ip-encoded", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 4, "desc": "Encoded URL pinned to external IPv4", "spans": [ [ 498, 34 ] ] }, { "id": "micro-behaviors/communications/http/url/php-endpoint::url-php-endpoint-encoded", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Encoded URL targets .php endpoint", "spans": [ [ 498, 34 ] ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-http-url", "conf": 0.9, "crit": 1, "desc": "Text contains raw external-IP HTTP URL", "spans": [ [ 498, 48 ] ] }, { "id": "micro-behaviors/fs/directory/cwd::php-getcwd", "conf": 0.6, "crit": 2, "desc": "Gets current working directory", "spans": [ [ 1648, 0 ] ] }, { "id": "micro-behaviors/communications/http/curl::php-curl-request", "conf": 0.9, "crit": 3, "desc": "Executes a PHP cURL request", "uses": [ 0, 2 ], "spans": [ [ 589, 9 ], [ 1008, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::php-file-write", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Writes data using PHP file API", "uses": [ 14 ], "spans": [ [ 1029, 17 ] ] }, { "id": "objectives/command-and-control/backdoor/decoded-c2::encoded-c2-ssl-bypass", "atk": "T1573", "mbc": "B0032", "conf": 0.97, "crit": 5, "desc": "Encoded C2 URL with SSL bypass", "uses": [ 1, 24 ], "spans": [ [ 498, 34 ], [ 738, 46 ], [ 1008, 9 ] ] }, { "id": "objectives/command-and-control/infrastructure/ip-url-php::external-ip-php-endpoint-encoded", "atk": "T1071.001", "mbc": "C0002", "conf": 0.99, "crit": 5, "desc": "Encoded URL has IP and .php", "uses": [ 27, 28 ], "spans": [ [ 498, 34 ] ] }, { "id": "objectives/exfiltration/oob/system-profile::host-profile-json-post", "atk": "T1041", "mbc": "B0030", "conf": 0.9, "crit": 4, "desc": "Host profile JSON-POSTed remote", "uses": [ 1, 7, 13, 18, 20, 22, 30 ], "spans": [ [ 852, 11 ], [ 1008, 9 ], [ 1266, 11 ], [ 1581, 23 ], [ 1648, 6 ] ] }, { "id": "micro-behaviors/fs/write/state::hostname-keyed-temp-state", "mbc": "C0052", "conf": 0.95, "crit": 3, "desc": "Writes hostname-keyed temporary state file", "uses": [ 9, 15, 20, 32 ], "spans": [ [ 1029, 17 ], [ 1206, 16 ], [ 1238, 3 ], [ 1266, 11 ] ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url", "conf": 0.95, "crit": 3, "desc": "Contains an external-IP HTTP URL", "uses": [ 29 ], "spans": [ [ 498, 48 ] ] }, { "id": "micro-behaviors/communications/ip/direct::external-ipv4-http-endpoint", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "HTTP endpoint uses external IPv4", "uses": [ 37 ], "spans": [ [ 498, 48 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 498, 43 ] ] } ], "type": "php" }, { "ctx": [ { "b": "ju)^#A0!lFdHEpFavgc(xM4]Lawc6RA=i6#z!9[aT.h=/Dlts+vqf+2kW[tFzFKIIzE)]N3lQ/9asXH6z/M$xxK@q#B.\u003e\u003epv@DsiA+Pf1BrC1fwftY5v}xL0wGUY8w]zZbvruj4zy=]Hy?m3@wGVegwP]nsxK@qWnKC{wq:?3odJ\u0026tqy?j-hxKM09CvtLnwncabA+P09By!#9CwhejaARphB0bKxB-H#6ay/t2wIarjdLzbozEEx[B8UL$wGTreB-7#utVtoQBx?vUBz$5+A=U/jtT-KLx([RZ3jmb.B7DEXmS\u0026P:D0A)ZBz$5+A=U/jtT-KLx([S9now@)l\u0026", "ln": 0, "col": 1, "line": 1 }, { "b": "B0a1}Bz%SRBywiUy?WA*BzkVhraQb)az2!twO#41axh][BvfFTwEr+\u003earR^HAckSax\u003e5n$B-7Yhx(v(iBy/JnnPNvnwO+)TvqGT*vruj4zDyK]xHba4wO+)Jx(mGgdgdguarV1rarR^HarR^HbY4gjwGTbUcS1?(xkI6raz#9Hv{@\u003eXwHxLDarR^HarR^HbY)ZlB1GN:B8$]kBx0p6wHH8\u003eBz%SRBywiUy?WA*BzkVhiYZ$@mRMBIwgeZtx(mGhdlv\u003eVarR!P3jm)#arUSCvR/:*azb+lv@#B6zxK4jB96#{mRMBIwl9bPx\u003egT]x(v(\u003cx([2Onm=juwPxgF3lQDlaBsCrarR^HarR^Ly?W=#auZ?{nk@L+fek7latLS8awUSTi%)8MarR^HarR}KxLzJtk4eINwPz(ZvqH0@c}FD4A71bRvoc/Mx\u003egT]x(v(Ii+-U8x\u003eq9\u003ec)SRyzE\u003emCi%)8MarV7t3lQDlaAhEjy?Wx4w{503BzkVhaARgoBvf.Mv@1RDvpS}\u0026pJxuwx(^\u0026OA=M8ss7#+\u0026", "ln": 384, "col": 5, "line": 16 }, { "b": "wmoN]z/dP%v}YB-yE\u00262BwmY^SA-csWB7E^XA=k$DcS0Pqr3%jtcNQC/cNQu83lQDlaBKO7arR^HAckSax\u003e5n$B-7Yhx(v(iBy/JnlUH4vyE\u00262BwmY^SA-csWB7E^XA=g", "ln": 926, "col": 21, "line": 33 }, { "b": "BzkVhiYZ+:wN/HDwNPaXA.*ZNvqf^]mriA!AWSqipG7juefDq[Aa9\u003c4cOcw/nk@L+fek7lcN?a:arR^HarR^HbY)ZlB1GN:B8$]kBwu%{y:ZMHwPS6nzyETOarR^HEf$xf", "ln": 1088, "col": 33, "line": 38 } ], "depth": 1, "facts": { "imp": [ [ "", "BFunky\\HttpParser\\Entity\\HttpDataValidation" ], [ "", "PHPUnit\\Framework\\TestCase" ], [ "", "\\BFunky\\HttpParser\\Exception\\HttpParserBadFormatException" ] ], "tgt": [ "$this", "HttpDataValidation" ], "funcs": [ [ "testIsFieldValidationWithAFieldLine", 432 ], [ "testIsFieldValidationWithAHeader", 602 ], [ "testCheckHeaderOrRaiseErrorWithAWrongHeader", 769 ], [ "testCheckHeaderOrRaiseErrorWithACorrectHeader", 986 ] ], "metrics": { "ast": { "max_depth": 13, "call_count": 8, "node_count": 259 }, "file": { "size": 1192, "entropy": 5.03 }, "text": { "lines": 41, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 168, "char_entropy": 5.03, "unique_chars": 71, "top_char_null": 0, "string_density": 0.2, "top_char_ratio": 0.08, "avg_line_length": 28.07, "max_line_length": 91, "non_ascii_ratio": 0, "empty_line_ratio": 0.17, "last_line_length": 1, "whitespace_ratio": 0.18, "identifier_density": 1.34, "line_length_stddev": 28.24, "normalized_string_count": 1.25, "suspicious_comment_ratio": 1, "normalized_unique_identifiers": 5.23 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 1192, "peak_region_entropy": 5.02 }, "source": { "class_count": 1, "function_count": 4 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 52, "count": 8, "avg_length": 6.5, "max_length": 16, "path_count": 1, "avg_entropy": 2.63, "empty_count": 2, "entropy_stddev": 0.63 }, "comments": { "chars": 180, "count": 1, "lines": 6, "high_entropy": 1, "to_code_ratio": 0.17 }, "functions": { "count": 5, "density": 9.76, "code_ratio": 0.49, "avg_name_length": 38.75, "no_params_count": 4, "avg_length_lines": 5, "max_length_lines": 5, "min_length_lines": 5, "high_entropy_names": 4 }, "identifiers": { "count": 55, "unique": 28, "avg_length": 14.07, "max_length": 45, "min_length": 4, "avg_entropy": 2.84, "reuse_ratio": 0.51, "length_stddev": 11.88, "high_entropy_count": 5, "high_entropy_ratio": 0.18, "all_lowercase_ratio": 0.14 } } }, "id": 22, "mol": "H(Cm)", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/Entity/HttpDataValidationTest.php", "pid": 0, "risk": 2, "sha": "4bbd6d6b895067b968e0a7d03eafdc4389bc85a9f64eb0f9ea3fd204df2f4f82", "size": 1192, "traits": [ { "id": "metadata/package/testing/harness/unit::phpunit-assertion-call", "conf": 0.9, "crit": 2, "desc": "PHPUnit assertion method call", "spans": [ [ 536, 0 ] ] }, { "id": "metadata/package/testing/harness/unit::phpunit-method-test-prefix", "conf": 0.8, "crit": 2, "desc": "PHPUnit test_ method prefix", "spans": [ [ 432, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::python-php-test-basename-suffix", "conf": 0.95, "crit": 1, "desc": "Python/PHP test filename suffix", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/response-code::wire-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP response line returns status 200", "spans": [ [ 676, 12 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "uses": [ 2, 3 ], "spans": [ [ 0, 0 ] ] } ], "type": "php" }, { "id": 23, "mol": "Md(Pa)", "sha": "ed765d7bb83babd558e98176e1008d114a99089d2f92f6d5ab3ad06c1d47d602", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/Entity/HttpFieldCollectionTest.php", "risk": 1, "size": 2060, "type": "php", "depth": 1 }, { "id": 24, "mol": "Md(Pa)", "sha": "ca8a4252f28b5d74d06af5ee885d0b4122039750d2533306e2244144bde89fd5", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/Entity/HttpFieldTest.php", "risk": 1, "size": 895, "type": "php", "depth": 1 }, { "id": 25, "mol": "Md(Pa)", "sha": "a97b08c1514830c6cead726466ff937b9dc60b923efa7d685de15640689298b1", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/Entity/HttpRequestHeaderTest.php", "risk": 1, "size": 1158, "type": "php", "depth": 1 }, { "id": 26, "mol": "Md(Pa)", "sha": "94f64193d700002fa0ce6e829656e7bd46db4ddb2ad213b31d79b86780e2649f", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/Entity/HttpResponseHeaderTest.php", "risk": 1, "size": 1170, "type": "php", "depth": 1 }, { "id": 27, "mol": "Md(Pa)", "sha": "d8efac8e00de0ebd869db6c3bfd930c88e5354a01b003198016e7cbcc98e80a9", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/Exception/HttpParserBadFormatExceptionTest.php", "risk": 1, "size": 575, "type": "php", "depth": 1 }, { "ctx": [ { "b": "ju)^#A0!lFdHEpFavgc(xM4]Lawc6RA=i6#z!9[aT.h=/Dlts+vqf+2kW[tFzFKIIzE)]N3lQ/9asXH6z/M$xxK@q#B.\u003e\u003epv@DsiA+Pf1BrC1fwftY5v}xL0wGUY8w]zZbvruj4zy=]Hy?m3@wGVegwP]nsxK@qWnKC{wq:?3odJ\u0026tqy?j-hxKM09CvtLnwncabA+P09By!#9CwhejaARphB0bKxB-H#6ay/t2wIarjdLzbozEEx[B8UL$wGTreB-7#utVtoQBx?vUBz$5+A=U/ji%(sqB7DEXmS\u0026P:D0A)ZBz$5+A=U/jtT-KLx([S9now@)qE%\u0026\u003cwPI@:wD", "ln": 0, "col": 1, "line": 1 }, { "b": "B8@D{BAzF1wPq\u003c7B97k!A=U/jraQb)az2!twO#41axh][BvfFTwEr+\u003earR^HAckSax\u003e5n$B-7Yhx(v(iBy/Jnp*[x=wK{]+A8Hm!B.bSonm=juwPxgF3lQDlaBsCrarR^HarR^LAa9^dwPw[Raz$+mav{P@A8Hm!B.bSop*[x=wPxgFi%)8MarR^HarR}IvrS?SauR+GqBav\u003ep!$1?atmXxBz8^/r8=WEf!Lf/rDz.(eKs2XzGE]Zp!jzmq+]XQfi*?Pq!Z8/y?l\u003cIz^^PLy?WD#Bp7MSB96C=B-IpJv@DiBi4$X9v}f7?BugJ]fdEq{v}f7?Bs/}0v@C)(zF80MwmYv?vru6iazl1mA0!%JzGGDcBs*EqAaI7LwQ5qICX}mUay/7[A=U/lj-$\u003cUeJs88z/fVdzGEE7wO#d5xGvm\u003cf!+M]mr\u0026=.v@%:Of!+pkv@Dmbx(n683joV%s33:iarR^HarR^LAa9^dwPxv^Aa9^dwHF*AvrTdZ3lQDlarR^Has85xx(+\u003c\u0026vrlH3A=:-\u0026BZY9cc)S+uA=U/jeK0/UBsnIpB7Gwzl1:+DBseH*asx#Rp+tQwk#ojtls\u003c8fze:r5tVkMHA6[CQwO#Pqdlv\u003eVarR^HarR^LBzbxfeK0P:B7Gxlmr9DUy\u0026.0IAa9^dwD", "ln": 352, "col": 4, "line": 15 }, { "b": "vqH0kbXp\u003enx([R\u003ewNPaXAXfE/wPQTTBzbP6c[cX\u0026cS0Pqr3%aR3lQDlarR^Has85xx(+\u003c\u0026vrlH3A=:-\u0026BZY9cc)SwwBzk\u0026xnm=juwPxv^xjVfYvrufhdj=O?fk$uwxEr", "ln": 1508, "col": 25, "line": 44 }, { "b": "x(+\u003c\u0026vrlH3A=:-\u0026BZY9cc)SwwBzk\u0026xnm=juwPxv^xjVfYA=l5rv@Dfidj=O?nk@L+fek7lcN?a:arR^HEf{q*3lQDlatkh]3lQDlarScRkXkgVwN/*[wjp-MwPh:9z/cX5lpM9nyK6eQBAzE#vrcB2A:h4Tv}xR3x(v(]now@)p*[x=wPyaCwjyGTzddJP", "ln": 1624, "col": 12, "line": 46 } ], "depth": 1, "facts": { "imp": [ [ "", "BFunky\\HttpParser\\Entity\\HttpRequestHeader" ], [ "", "BFunky\\HttpParser\\HttpRequestParser" ], [ "", "PHPUnit\\Framework\\TestCase" ] ], "tgt": [ "$entityHeader", "$parser", "$this" ], "funcs": [ [ "testParseHttpRequestHeader", 400 ], [ "testThrownExceptionIfWrongRawData", 1797 ] ], "metrics": { "ast": { "max_depth": 13, "call_count": 24, "node_count": 512 }, "file": { "size": 2017, "entropy": 5.09 }, "text": { "lines": 64, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 289, "char_entropy": 5.09, "unique_chars": 71, "top_char_null": 0, "string_density": 0.31, "top_char_ratio": 0.08, "avg_line_length": 30.52, "max_line_length": 94, "non_ascii_ratio": 0, "empty_line_ratio": 0.13, "last_line_length": 1, "whitespace_ratio": 0.18, "identifier_density": 1.67, "line_length_stddev": 27.53, "normalized_string_count": 2.5, "suspicious_comment_ratio": 1, "normalized_unique_identifiers": 4.67 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 2017, "peak_region_entropy": 5.16 }, "source": { "class_count": 1, "function_count": 2 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 475, "count": 20, "avg_length": 23.75, "max_length": 201, "path_count": 1, "avg_entropy": 3.03, "entropy_stddev": 1.02, "high_entropy_count": 1 }, "comments": { "chars": 535, "count": 2, "lines": 17, "high_entropy": 2, "to_code_ratio": 0.36 }, "functions": { "count": 3, "density": 3.13, "code_ratio": 0.64, "length_stddev": 10.5, "avg_name_length": 29.5, "no_params_count": 2, "avg_length_lines": 20.5, "max_length_lines": 31, "min_length_lines": 10, "high_entropy_names": 1 }, "identifiers": { "count": 107, "unique": 28, "avg_length": 10.36, "max_length": 33, "min_length": 3, "avg_entropy": 2.67, "reuse_ratio": 0.26, "length_stddev": 7.05, "high_entropy_count": 1, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.18 } } }, "id": 28, "mol": "H(Cm₃)", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/HttpRequestParserTest.php", "pid": 0, "risk": 2, "sha": "de5ad8a7f0955f6458c29eefd6e7a9a1c65ac2aca32fa95686d7c22dbd20e099", "size": 2017, "traits": [ { "id": "metadata/package/testing/harness/unit::phpunit-assertion-call", "conf": 0.9, "crit": 2, "desc": "PHPUnit assertion method call", "spans": [ [ 761, 0 ] ] }, { "id": "metadata/package/testing/harness/unit::phpunit-method-test-prefix", "conf": 0.8, "crit": 2, "desc": "PHPUnit test_ method prefix", "spans": [ [ 400, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::python-php-test-basename-suffix", "conf": 0.95, "crit": 1, "desc": "Python/PHP test filename suffix", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-length::content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header", "spans": [ [ 675, 15 ] ] }, { "id": "micro-behaviors/communications/http/message::raw-http-body-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP body-capable request line", "spans": [ [ 516, 17 ] ] }, { "id": "micro-behaviors/communications/http/post::post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "HTTP POST request line", "spans": [ [ 516, 19 ] ] }, { "id": "micro-behaviors/communications/http/request/client::content-type-header", "conf": 0.5, "crit": 1, "desc": "References an HTTP Content-Type header", "spans": [ [ 638, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "uses": [ 2, 3 ], "spans": [ [ 0, 0 ] ] } ], "type": "php" }, { "ctx": [ { "b": "ju)^#A0!lFdHEpFavgc(xM4]Lawc6RA=i6#z!9[aT.h=/Dlts+vqf+2kW[tFzFKIIzE)]N3lQ/9asXH6z/M$xxK@q#B.\u003e\u003epv@DsiA+Pf1BrC1fwftY5v}xL0wGUY8w]zZbvruj4zy=]Hy?m3@wGVegwP]nsxK@qWnKC{wq:?3odJ\u0026tqy?j-hxKM09CvtLnwncabA+P09By!#9CwhejaARphB0bKxB-H#6ay/t2wIarjdLzbozEEx[B8UL$wGTreB-7#utVtoQBx?vUBz$5+A=U/ji%(sqB7DEXmS\u0026P:D0A)ZBz$5+A=U/jtT-KLx([S9now@)qE%]*z/fScnb", "ln": 0, "col": 1, "line": 1 }, { "b": "B0a1}Bz$b?B8V5nB7FfRA=U/jraQb)az2!twO#41axh][BvfFTwEr+\u003earR^HAckSax\u003e5n$B-7Yhx(v(iBy/Jnp*[x=wK{]+A8Hm*AbPSnwK{xvwmY^fdgdguarV1rarR^HarR^HbYEgjB7GwmjS[SNCoxB#Bz$b?B8V5nB7FfRA=U/jc[dj+arR^HarR^HbYWsqauZ\u0026fjuMIcr%?F$r8tk5e?[F6fFBRpz/fVhzGPH$3p[b}p+KKQf^5k9fD:d:3pFrAwJy@kB.99Df!%\u003eqAb)6RfFLEdf/7\u003cFi65-Fav/d93r7IRC4CXPavf%Pv}YBbga\u003esmf/g13rBQ8*BAG2tss)u/Cv+/awgZb[iV}l\u0026p+KWUgCgysax\u0026t]wk^5WC4CXEh7*M\u0026q!p55lVl)Ux\u003eosFt0$!EwNY^{xjV9WA+fr6zGF3XxMbIwxMO9ceo2owgDMZ#vrufCfa7S?Bs/\u003c#z!\u003c5#iV}l\u0026p/x!Yq+owuhGJE\u0026w))Vty\u00268dwg=eS:yCN+WxK+Q^Btb^0Aa9\u003c4jUF(tnow@)pI%#]3pPhUx(W^aiV}ynBU1T\u0026iuR7nB%5I1i58Kfi65]LiXSlgm[(}\u0026lT:FrwI3n/zGG]qy=SXRz.l3Lz/Pzuaz#9Hv{@\u003eXwH[%vB-RTRA+fA5y?WA*By^0CAbP/teN@E9v@1jYefF[LwI4z9wN/HsfByS%vp%B=iV@rUeN@j0xK}JKvrcSOavfHEwPh-ymq=QNwnb{]3pw-HBy/uieK:L!z!9N1xf4eFDtds9lVl\u003c:wO#PwoL59OBz9YTf/Z#@lVl\u003c:wO#Pwrc-B]iV@JQCYUP-zeoLSl03bParR^HarR^HbYEgjB7Gwzk5:}JB7D:BA::evi%)8MarR^HarR}KxLzJtk4eINwPz(YADLYaB0@qMvrcB2AXfE/wPPsFl$7gGcN*O?cSCk1efDV5avf%!atLS9hxT.giYe(TfFKXuo\u0026JF?i%)8MarR^HarR}KxLzJtk4eINwPz(YADLYaB0@qMvrcB2AXfE/wPN", "ln": 355, "col": 5, "line": 15 }, { "b": "gaaIj3lQDlarR^Has85xx(+\u003c\u0026vrlH3A=:-\u0026BZY9cc)S+uA=U/jeK0/UBsnI7z/fVdzGEEfD2Nsxdj=O?By/Ysfl?tIcN?a:arR^HarR^HfdFBUarR^HarR^HasXH0C42zlnow@)qE%]*z/fScnm=juwPw[swO#Q7BA{z*vpS}\u00263lQDlarR^HarSc!3lQDlarR^Has7JoBzk\u0026xnm=juwPw[Ras7]mA=U/jeK0/UBvY$KwmY^fdlv\u003eVarR^H", "ln": 1893, "col": 64, "line": 47 }, { "b": "x(+\u003c\u0026vrlH3A=:-\u0026BZY9cc)SwwBzk\u0026xnm=juwPxv^xjVfYA=l5rv@Dfidj=O?nk@L+fek7lcN?a:arR^HarR^HbY)ZlB1GN:B8$]kBvyg(vqH0kbXp\u003enx([R\u003ewNPaXAXfE/wPQpTwmWerefDq}fFB\u003e6i%)8MarR^HarR}KxLzJtk4eINwPz(YADLYaB0@qB", "ln": 2195, "col": 12, "line": 54 }, { "b": "AbPSnwL=/QB7Gwudlv\u003eVarR^HarR^LA::emjS(\u003cHjw[ED3q:I%r3i\u0026kvrue\u0026rDz.(eKs2XzGE]Zp!jzmq+]XQfi*?Pq!Z8/y?l\u003cIz^^PLy?WD#Bp5vMl03bParR^HarR^HbYEgjB7Gwzk5:}JB7D:BA::evi%)8MarV7tEf]", "ln": 2580, "col": 30, "line": 65 } ], "depth": 1, "facts": { "imp": [ [ "", "BFunky\\HttpParser\\Entity\\HttpResponseHeader" ], [ "", "BFunky\\HttpParser\\HttpResponseParser" ], [ "", "PHPUnit\\Framework\\TestCase" ] ], "tgt": [ "$entityHeader", "$parser", "$this" ], "funcs": [ [ "testParseHttpResponseHeader", 403 ], [ "testThrownExceptionIfWrongRawData", 2493 ] ], "metrics": { "ast": { "max_depth": 13, "call_count": 32, "node_count": 646 }, "file": { "size": 2714, "entropy": 5.27 }, "text": { "lines": 73, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.06, "space_count": 366, "char_entropy": 5.27, "unique_chars": 82, "top_char_null": 0, "string_density": 0.38, "top_char_ratio": 0.08, "avg_line_length": 36.18, "max_line_length": 125, "non_ascii_ratio": 0, "empty_line_ratio": 0.1, "last_line_length": 1, "whitespace_ratio": 0.16, "identifier_density": 1.79, "line_length_stddev": 30.99, "normalized_string_count": 3.28, "suspicious_comment_ratio": 0.67, "normalized_unique_identifiers": 4.52 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 2714, "peak_region_entropy": 5.34 }, "source": { "class_count": 1, "function_count": 2 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 962, "count": 28, "avg_length": 34.36, "max_length": 489, "avg_entropy": 3.06, "entropy_stddev": 1.11, "high_entropy_count": 1 }, "comments": { "chars": 331, "count": 3, "lines": 12, "base64": 1, "high_entropy": 1, "to_code_ratio": 0.2 }, "functions": { "count": 3, "density": 2.74, "code_ratio": 0.71, "length_stddev": 16, "avg_name_length": 30, "no_params_count": 2, "avg_length_lines": 26, "max_length_lines": 42, "min_length_lines": 10, "high_entropy_names": 1 }, "identifiers": { "count": 131, "unique": 28, "avg_length": 10.54, "max_length": 33, "min_length": 3, "avg_entropy": 2.66, "reuse_ratio": 0.21, "length_stddev": 7.25, "high_entropy_count": 1, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.18 } } }, "id": 29, "mol": "H(Cm₃)", "path": "/data/samples/incoming/forager/php/packagist.org/compendium/bfunky/http-parser/bfunky-http-parser-2.1.0.zip!!bfunky-http-parser-d1c67b2/test/HttpResponseParserTest.php", "pid": 0, "risk": 2, "sha": "ad595d8cfb4843e55eb8adbb598c108d1d810aa602bcc80bbae79dc6fc8d1666", "size": 2714, "traits": [ { "id": "metadata/package/testing/harness/unit::phpunit-assertion-call", "conf": 0.9, "crit": 2, "desc": "PHPUnit assertion method call", "spans": [ [ 1053, 0 ] ] }, { "id": "metadata/package/testing/harness/unit::phpunit-method-test-prefix", "conf": 0.8, "crit": 2, "desc": "PHPUnit test_ method prefix", "spans": [ [ 403, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::python-php-test-basename-suffix", "conf": 0.95, "crit": 1, "desc": "Python/PHP test filename suffix", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/cookies::set-cookie-header", "conf": 0.5, "crit": 3, "desc": "Set-Cookie header", "spans": [ [ 667, 53 ], [ 721, 66 ] ] }, { "id": "micro-behaviors/communications/http/header/content-length::content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header", "spans": [ [ 967, 15 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::text-xml-content-type", "conf": 0.8, "crit": 3, "desc": "HTTP text/xml media type", "spans": [ [ 1957, 8 ] ] }, { "id": "micro-behaviors/communications/http/request/client::content-type-header", "conf": 0.5, "crit": 1, "desc": "References an HTTP Content-Type header", "spans": [ [ 987, 0 ] ] }, { "id": "micro-behaviors/communications/http/response-code::wire-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP response line returns status 200", "spans": [ [ 544, 12 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "uses": [ 2, 3 ], "spans": [ [ 0, 0 ] ] } ], "type": "php" }, { "id": 30, "sha": "1940b8546a0cb119d997b17ab2dbf284cee4798ddeaf3bfec3b4f97b617367d5", "path": "bfunky_http-parser@2.1.0.registry.json", "size": 848, "type": "registry", "depth": 1 } ], "omitted_files": 6, "rev": "479f3", "v": "8" } }