{
  "ml": {
    "v": "7",
    "id": 371,
    "lvl": -1,
    "conf": 0,
    "prob": 0.00009391704952577129,
    "type": "gz",
    "version": "v18.18",
    "analyzed_at": "2026-09-23T16:06:40Z"
  },
  "path": "setup-dotnet@bb95ce727fd49ec1a65933419cc7c91747785302",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 371,
        "mol": "K₂(Li₅Te₃)O₈(As₄C₅Dy₂ErILa₃S₂Xe)H₇(Cm₃₇Cr₂Db₃₆F₂₁Os₁₁Po₁₇U₂)Md₉(Bi₄Bk₃He₂In₁₀Pa₁₉PtSiV)",
        "pid": 4,
        "rel": "fetched",
        "sha": "21ae712e62a7eede976f97cd9e23908a5ccc0dbbb209cc59b9ed563dc12c5990",
        "via": "https://codeload.github.com/actions/setup-dotnet/tar.gz/bb95ce727fd49ec1a65933419cc7c91747785302",
        "path": "pkg:github/actions/setup-dotnet@bb95ce727fd49ec1a65933419cc7c91747785302",
        "risk": 89,
        "size": 335433,
        "type": "gz",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 335433,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 331337,
              "peak_region_entropy": 7.84
            },
            "consistency": {
              "self_dependency": 0,
              "unused_runtime_deps": 0
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/ui/keywords::download-status-msg",
            "conf": 0.8,
            "crit": 3,
            "desc": "Download status message",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/os::os-release-path",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.5,
            "crit": 2,
            "desc": "/etc/os-release path",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "supply-chain/install-hook/prepare",
            "conf": 0.8,
            "crit": 3,
            "desc": "Package has 'prepare' hook that runs during install"
          },
          {
            "id": "metadata/package/testing/harness/runtime::joyent-copyright",
            "conf": 1.0,
            "crit": 2,
            "desc": "Joyent copyright header Node.js",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/path::shell-executable-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a shell executable",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "metadata/import/npm/actions/core::actions/core",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/core",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/read::result-dot-member-read",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads result through dot or arrow access",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-16-bits",
            "conf": 0.9,
            "crit": 2,
            "desc": "Source right-shifts by 16 bits",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/file/format/conformance::parse-error",
            "conf": 0.9,
            "crit": 3,
            "desc": "Structured document fails to parse",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/message::powershell-http-url-literal",
            "conf": 0.75,
            "crit": 3,
            "desc": "PowerShell HTTP/HTTPS URL literal",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/import/builtin::require-child-process",
            "conf": 0.8,
            "crit": 3,
            "desc": "require() of the child_process module",
            "from": [
              {
                "file": 75
              }
            ]
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path",
            "from": [
              {
                "file": 107
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/auth::access-token-field-reference",
            "conf": 0.96,
            "crit": 3,
            "desc": "Access-token field reference",
            "from": [
              {
                "file": 50
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::server-response-send-end",
            "mbc": "C0002",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls server response send/end method",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "metadata/import/builtin::require-fs",
            "conf": 0.7,
            "crit": 2,
            "desc": "Imports the Node.js fs module",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/package/testing/scripted::js-bdd-describe-text",
            "conf": 0.75,
            "crit": 2,
            "desc": "JavaScript describe() test call",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/io-util::relative/1/io-util",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./io-util",
            "from": [
              {
                "file": 75
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/os::linux-release-file-reference",
            "conf": 0.85,
            "crit": 3,
            "desc": "Linux OS release filename reference",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program",
            "conf": 0.82,
            "crit": 3,
            "desc": "Node spawns a variable program path",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "well-known/tool/development/cli/dev-cli/nx::nx-root-test-script",
            "conf": 0.99,
            "crit": 3,
            "desc": "Nx generated root-test script"
          },
          {
            "id": "metadata/import/npm/os::os",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports os",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/import/npm/net::net",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports net",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-variable-in-filename",
            "conf": 0.9,
            "crit": 3,
            "desc": "Arch variable spliced into a filename",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-command-position-script",
            "conf": 0.9,
            "crit": 1,
            "desc": "curl/wget in shell command position"
          },
          {
            "id": "metadata/package/testing/presence/harness::spec-test-filename",
            "conf": 0.85,
            "crit": 2,
            "desc": "Spec or test filename markers",
            "from": [
              {
                "file": 105
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::hex-string-arithmetic",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.78,
            "crit": 3,
            "desc": "Hex arithmetic in string operations",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/post::post",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "HTTP POST method string literal",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/interpreter::powershell-executable-token",
            "conf": 0.98,
            "crit": 3,
            "desc": "PowerShell executable name reference",
            "from": [
              {
                "file": 68
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::source-curl-output-option",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl output file source",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/reflection/runtime::csharp-reflection-invoke-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls a .NET Invoke member",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/handlers/bearertoken::relative/1/handlers/bearertoken",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./handlers/bearertoken",
            "from": [
              {
                "file": 50
              }
            ]
          },
          {
            "id": "metadata/import/npm/actions/tool-cache::actions/tool-cache",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/tool-cache",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/websocket/server::upgrade-handler",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "HTTP upgrade event handler",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/blob-azure::storage-url",
            "mbc": "C0002",
            "conf": 0.85,
            "crit": 3,
            "desc": "Azure Blob storage URL",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/chdir::shell-change-directory",
            "conf": 0.95,
            "crit": 3,
            "desc": "Shell changes working directory",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/hardening/missing::stripped-binary",
            "conf": 0.8,
            "crit": 3,
            "desc": "No full symbol table (likely stripped)",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/prototype::return-this-body",
            "conf": 0.7,
            "crit": 3,
            "desc": "Function body returns this",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "metadata/import/npm/actions/exec::actions/exec",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/exec",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/manifest::has-karma",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package uses Karma test runner",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::test-basename-pattern",
            "conf": 1.0,
            "crit": 2,
            "desc": "Node.js test filename pattern",
            "from": [
              {
                "file": 423
              },
              {
                "file": 476
              }
            ],
            "uses": [
              178,
              270
            ]
          },
          {
            "id": "metadata/file/comment::source-at-most-two-comments",
            "conf": 0.88,
            "crit": 2,
            "desc": "Source has at most two comments",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair",
            "conf": 0.8,
            "crit": 3,
            "desc": "password/passwd key with inline value",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory-path",
            "conf": 1.0,
            "crit": 2,
            "desc": "File is in common test directory",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::vendored-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "Vendored npm node-semver package path",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::bracketed-parameter-usage",
            "conf": 0.96,
            "crit": 3,
            "desc": "Usage text lists command-line parameters",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/binary/section/prose::rich-sentence-strings-20pct",
            "conf": 0.8,
            "crit": 2,
            "desc": "Binary has many sentence-like strings",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/import/npm/http::http",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports http",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/readdir::readdir-readdir64",
            "conf": 0.66,
            "crit": 3,
            "desc": "Uses readdir64",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::action-main-entrypoint",
            "conf": 1.0,
            "crit": 3,
            "desc": "Action declares a main entrypoint"
          },
          {
            "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest",
            "atk": "T1195.002",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Action action.yml manifest",
            "from": [
              {
                "file": 104
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.95,
            "crit": 3,
            "desc": "Shell command variable at a command boundary",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/binary/header/identity::shared-object-type",
            "conf": 1.0,
            "crit": 2,
            "desc": "ELF uses ET_DYN object type"
          },
          {
            "id": "metadata/package/error-handling::try-block-open",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains the opening of a try block",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/temp::get-temp-path",
            "conf": 0.9,
            "crit": 3,
            "desc": "Gets temp path",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-any",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "raw.githubusercontent.com URL",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/testing/http-fixtures::http-request-known-source-file",
            "conf": 0.99,
            "crit": 2,
            "desc": "File belongs to a known HTTP library or test suite",
            "from": [
              {
                "file": 423
              },
              {
                "file": 424
              },
              {
                "file": 425
              },
              {
                "file": 426
              },
              {
                "file": 427
              },
              {
                "file": 428
              },
              {
                "file": 485
              },
              {
                "file": 486
              }
            ],
            "uses": [
              42
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/ssl::reject-unauthorized-verification-mode-driven",
            "conf": 0.85,
            "crit": 3,
            "desc": "rejectUnauthorized on or mode-bound",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "metadata/import/npm/actions/exec/lib/exec::actions/exec/lib/exec",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/exec/lib/exec",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "metadata/import/builtin::require-https",
            "conf": 0.78,
            "crit": 3,
            "desc": "Imports the Node.js HTTPS module",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "objectives/execution/automation/agent::agent-target-operation-forward",
            "atk": "T1059,T1190,T1595",
            "conf": 0.88,
            "crit": 3,
            "desc": "Agent names target probing activity",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/enumerate/directory::fs-readdir",
            "conf": 0.6,
            "crit": 3,
            "desc": "Calls Node.js readdir at least twice",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::c-family-full-byte-search-loop",
            "conf": 0.88,
            "crit": 3,
            "desc": "C-family loops over all byte values",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "micro-behaviors/os/module/require::node-system-module-import-set",
            "conf": 0.88,
            "crit": 3,
            "desc": "Imports at least two Node system modules",
            "from": [
              {
                "file": 48
              }
            ],
            "uses": [
              10,
              14,
              58,
              380
            ]
          },
          {
            "id": "micro-behaviors/process/tty/terminal::tcsetattr",
            "atk": "T1059",
            "conf": 0.75,
            "crit": 3,
            "desc": "Set terminal attributes",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::read-node",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads files with Node.js",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-cmd",
            "atk": "T1105",
            "conf": 0.7,
            "crit": 2,
            "desc": "curl command includes URL or option",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::legacy-single-file",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver legacy single-file module",
            "from": [
              {
                "off": 515,
                "file": 433,
                "line": 20
              }
            ],
            "uses": [
              84,
              98,
              352
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-401-unauthorized",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP 401 unauthorized response text",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/package/files/dependency::node-modules-nested-package-json",
            "conf": 1.0,
            "crit": 3,
            "desc": "package.json nested under node_modules",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "micro-behaviors/data/decode/url::js-unescape-call-text",
            "atk": "T1140",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls JavaScript unescape in source text",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/flags::code-powershell-noninteractive-options",
            "conf": 0.96,
            "crit": 3,
            "desc": "Code invokes noninteractive PowerShell",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/connect::node-net-commonjs-import",
            "conf": 0.9,
            "crit": 3,
            "desc": "Imports the Node net module with require",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/os/random/crypto::node-random-bytes",
            "conf": 0.65,
            "crit": 3,
            "desc": "Node.js random byte generation",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/get::node-http-client-get",
            "conf": 0.75,
            "crit": 3,
            "desc": "Node HTTP client invokes get()",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "metadata/binary/section/prose::high-string-count-1000",
            "conf": 0.7,
            "crit": 2,
            "desc": "High string count over 1000",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/binary/instruction::x86-global-pointer-indirect-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "x86 indirect call through a global pointer",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::curl-command-call",
            "atk": "T1105",
            "conf": 0.96,
            "crit": 3,
            "desc": "Shell invokes the curl command",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/lang/scripted::function-blocks",
            "conf": 0.82,
            "crit": 2,
            "desc": "PowerShell function block syntax",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source",
            "conf": 1.0,
            "crit": 3,
            "desc": "Source contains low-bit mask syntax",
            "from": [
              {
                "file": 78
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::find-type-file",
            "atk": "T1083",
            "mbc": "E1083",
            "conf": 0.82,
            "crit": 3,
            "desc": "Runs find to enumerate regular files",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::upstream-repository",
            "conf": 0.98,
            "crit": 3,
            "desc": "Links to the npm node-semver repository",
            "from": [
              {
                "file": 63
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::node-write-file-sync-call",
            "conf": 1.0,
            "crit": 3,
            "desc": "Node calls imported writeFileSync",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/search::locate-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "locate file-search command token",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::semver-spec-version-export",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver SEMVER_SPEC_VERSION export",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/build::network-destination-function-binding",
            "mbc": "C0002",
            "conf": 0.94,
            "crit": 3,
            "desc": "Network destination assigned from call",
            "from": [
              {
                "file": 39
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/connect::net-connect",
            "conf": 0.86,
            "crit": 3,
            "desc": "Node net.connect or createConnection usage",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/dropper-script::js-target-architecture-selector",
            "conf": 0.94,
            "crit": 3,
            "desc": "Selects native stage architecture by platform",
            "from": [
              {
                "file": 72
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/client/managed::readasstringasync",
            "conf": 0.84,
            "crit": 3,
            "desc": ".NET asynchronous HTTP response body read",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::mutable-master-action-ref",
            "conf": 0.88,
            "crit": 3,
            "desc": "Workflow action uses mutable master ref"
          },
          {
            "id": "micro-behaviors/data/serialize/object::js-deserialise",
            "conf": 0.85,
            "crit": 3,
            "desc": "References a deserialization-related symbol",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/load/local::top-level-require-method-call",
            "atk": "T1059.007",
            "conf": 0.9,
            "crit": 3,
            "desc": "Top-level method call on require result",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/record::slice-decimal-offset-pair",
            "conf": 0.8,
            "crit": 3,
            "desc": "Slice split at decimal offsets",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/base64::tostring-base64",
            "conf": 0.8,
            "crit": 3,
            "desc": "Base64 encoding via toString (JS)",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/handlers/personalaccesstoken::relative/1/handlers/personalaccesstoken",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./handlers/personalaccesstoken",
            "from": [
              {
                "file": 50
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "Calls JavaScript toString conversion method",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::has-build-script-1",
            "conf": 1.0,
            "crit": 3,
            "desc": "Package has compiled build script",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/read::repeated-constructor-property-read",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads constructor properties repeatedly",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::comparator-prototype-test",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver Comparator.prototype.test",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux",
            "conf": 0.6,
            "crit": 2,
            "desc": "Linux platform string",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::parenthesized-command-literal",
            "conf": 0.98,
            "crit": 3,
            "desc": "Parenthesized shell command string",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter",
            "atk": "T1059",
            "mbc": "B0030",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package script invokes a language interpreter"
          },
          {
            "id": "micro-behaviors/communications/http/user-agent::mobile-user-agent-header-map-read",
            "conf": 0.94,
            "crit": 3,
            "desc": "Reads User-Agent from a header map",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/import/npm/events::events",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports events",
            "from": [
              {
                "file": 59
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/host::url-host-property-assignment",
            "conf": 0.82,
            "crit": 3,
            "desc": "Assigns a request or URL host property",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.92,
            "crit": 3,
            "desc": "Command-line usage text marker",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "objectives/impact/system/directory::windows-recursive-delete-rd",
            "atk": "T1485",
            "conf": 1.0,
            "crit": 3,
            "desc": "Windows recursive deletion via rmdir/rd",
            "from": [
              {
                "file": 75
              }
            ]
          },
          {
            "id": "metadata/package/repository::npm-name-repo-mismatch",
            "conf": 0.8,
            "crit": 3,
            "desc": "Package and repository names differ",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::chmod-symbol",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.66,
            "crit": 3,
            "desc": "References chmod permission-change API",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::mocha-describe-call",
            "conf": 0.6,
            "crit": 2,
            "desc": "Mocha describe() call",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "metadata/binary/section/ratio::inflated-data-section",
            "conf": 0.86,
            "crit": 3,
            "desc": "Data virtual size exceeds raw size"
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::powershell-new-item-directory",
            "conf": 0.9,
            "crit": 3,
            "desc": "PowerShell creates a directory with New-Item",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/v4::relative/1/v4",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./v4",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/index/js::relative/2/index/js",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../index.js",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::usage-label",
            "conf": 0.75,
            "crit": 1,
            "desc": "Command line usage text",
            "from": [
              {
                "file": 437
              },
              {
                "off": 40880,
                "file": 438
              }
            ],
            "uses": [
              353,
              368
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-data-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream data handler",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::shell-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "POSIX shell script extension"
          },
          {
            "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix",
            "conf": 0.55,
            "crit": 3,
            "desc": "Gmail consumer email domain suffix",
            "from": [
              {
                "file": 41
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::has-release-scripts-1",
            "conf": 1.0,
            "crit": 3,
            "desc": "Package has release script"
          },
          {
            "id": "metadata/signed/trust-level::unsigned-missing-signature-record",
            "conf": 0.9,
            "crit": 3,
            "desc": "PE lacks signature record"
          },
          {
            "id": "micro-behaviors/communications/http/response::wire-http-200-status",
            "atk": "T1190",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "HTTP response line returns status 200",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-fill-call",
            "conf": 0.8,
            "crit": 3,
            "desc": "JavaScript array fill call",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/process/info/commandline::check-argv",
            "conf": 0.8,
            "crit": 3,
            "desc": "Reads Node.js arguments through process.argv",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/load/local::cjs-local-require-call",
            "atk": "T1059.007",
            "conf": 0.9,
            "crit": 3,
            "desc": "CommonJS local-module require call",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/file/string/count::few-string-literals",
            "conf": 0.4,
            "crit": 3,
            "desc": "File has very few string literals",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript iterates enumerable object keys",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "metadata/lang/runtime::main-entry-symbol",
            "conf": 0.5,
            "crit": 3,
            "desc": "_main program entry symbol",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add",
            "conf": 0.85,
            "crit": 3,
            "desc": "Length-bounded loop uses compound addition",
            "from": [
              {
                "file": 16
              }
            ]
          },
          {
            "id": "metadata/lang/scripted::dts-declaration-file",
            "conf": 0.99,
            "crit": 2,
            "desc": "TypeScript declaration file",
            "from": [
              {
                "file": 32
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/client::https-get",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Node.js https.get",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-6",
            "atk": "T1036",
            "conf": 0.9,
            "crit": 3,
            "desc": "Downloads directory reference",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive",
            "conf": 0.75,
            "crit": 3,
            "desc": "Archive open or extract instruction",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/package/testing/scripted::js-bdd-suite",
            "conf": 0.85,
            "crit": 2,
            "desc": "JavaScript BDD test suite",
            "from": [
              {
                "off": 815,
                "file": 424,
                "line": 27
              },
              {
                "off": 834,
                "file": 425,
                "line": 27
              },
              {
                "off": 575,
                "file": 426,
                "line": 22
              },
              {
                "off": 569,
                "file": 427,
                "line": 21
              },
              {
                "off": 161,
                "file": 428,
                "line": 7
              },
              {
                "off": 787,
                "file": 476,
                "line": 30
              }
            ],
            "uses": [
              15,
              285
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::child-process-require",
            "atk": "T1059",
            "mbc": "C0017",
            "conf": 0.8,
            "crit": 3,
            "desc": "Imports the Node.js child_process module",
            "from": [
              {
                "off": 699,
                "file": 446,
                "line": 11
              },
              {
                "file": 453
              }
            ],
            "uses": [
              10
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::tests-path-filename",
            "conf": 0.85,
            "crit": 2,
            "desc": "File path or name indicates test code",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-json",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "raw.githubusercontent.com JSON URL",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::expect-call",
            "conf": 0.6,
            "crit": 2,
            "desc": "expect() function call",
            "from": [
              {
                "file": 105
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/url-computed::node-request-options-computed-path",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node request options build path by concatenation",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/arithmetic::source-xor-operation",
            "conf": 1.0,
            "crit": 3,
            "desc": "Source references XOR syntax",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "metadata/binary/code/complexity::many-huge-functions",
            "conf": 0.9,
            "crit": 3,
            "desc": "4+ functions with 50+ block control-flow graphs",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/auth::http-ntlm-auth-header",
            "conf": 0.96,
            "crit": 3,
            "desc": "HTTP NTLM authentication header",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "metadata/import/npm/tunnel::tunnel",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports tunnel",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::fchmod-symbol",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.66,
            "crit": 3,
            "desc": "References fchmod permission-change API",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decompress/bzip2::bz2-decompress",
            "conf": 0.9,
            "crit": 3,
            "desc": "BZ2_bzDecompress function",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-host-probe-normalization",
            "conf": 0.9,
            "crit": 1,
            "desc": "Normalizes uname -m to an arch token",
            "from": [
              {
                "off": 8671,
                "file": 471,
                "line": 320
              },
              {
                "off": 4285,
                "file": 474,
                "line": 162
              }
            ],
            "uses": [
              468
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/toolrunner::relative/1/toolrunner",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./toolrunner",
            "from": [
              {
                "file": 88
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-start",
            "conf": 0.86,
            "crit": 3,
            "desc": "Starts a synchronous function expression",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the Node.js process.platform value",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/post::client-wrapper-post-call",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "HTTP client wrapper POST call",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/self::cwd-reference",
            "conf": 0.84,
            "crit": 3,
            "desc": "References the Node.js current working directory",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/url::encode-uri-component-call",
            "conf": 0.7,
            "crit": 3,
            "desc": "URL-encodes data via encodeURIComponent",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl or wget references shell variable",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/readdir::readdir-closedir",
            "conf": 0.66,
            "crit": 3,
            "desc": "Uses closedir",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/binary/symbols/count::many-imports-50",
            "conf": 1.0,
            "crit": 2,
            "desc": "Binary has 50+ imports",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/http::suspicious-cloud-image-object--rx-2",
            "atk": "T1105",
            "mbc": "B0024",
            "conf": 0.86,
            "crit": 3,
            "desc": "Azure Blob Storage domain reference",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/url::js-unescape-call",
            "atk": "T1140",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls JavaScript unescape",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chown::lchown-fn",
            "conf": 0.66,
            "crit": 3,
            "desc": "Change ownership of symlink",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "DirectoryEntry property write API call",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment",
            "conf": 0.94,
            "crit": 3,
            "desc": "Assigns character code to array element",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/util::relative/1/util",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./Util",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::has-help",
            "conf": 0.85,
            "crit": 3,
            "desc": "Contains help or usage information",
            "from": [
              {
                "file": 437
              },
              {
                "off": 40880,
                "file": 438
              }
            ],
            "uses": [
              353,
              368
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/file/library::js-repeated-unlink-call",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.6,
            "crit": 3,
            "desc": "Repeated Node unlink calls",
            "from": [
              {
                "file": 75
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/client/managed::httpclient",
            "conf": 0.82,
            "crit": 3,
            "desc": "System.Net.Http.HttpClient type reference",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-403-forbidden",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP 403 forbidden response text",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/build/minifier::js-umd-wrapper-amd-minified",
            "conf": 0.9,
            "crit": 2,
            "desc": "Contains a minified UMD AMD branch",
            "from": [
              {
                "file": 26
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/hex::js-hex-number-parse",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript hex-to-integer conversion",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/handlers/ntlm::relative/1/handlers/ntlm",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./handlers/ntlm",
            "from": [
              {
                "file": 50
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/readdir::readdir-opendir",
            "conf": 0.66,
            "crit": 3,
            "desc": "Uses opendir",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/import/npm/should::should",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports should",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "metadata/lang/scripted::type-accelerator",
            "conf": 0.78,
            "crit": 2,
            "desc": "PowerShell type accelerator syntax",
            "from": [
              {
                "file": 68
              }
            ]
          },
          {
            "id": "metadata/package/publishing::npm-public-publish-access",
            "conf": 0.9,
            "crit": 3,
            "desc": "npm package is configured for public publishing"
          },
          {
            "id": "micro-behaviors/data/serialize/binary::buffer-slice-call-name",
            "conf": 0.9,
            "crit": 1,
            "desc": "slice method call name",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::image-file-url",
            "conf": 0.85,
            "crit": 3,
            "desc": "HTTP URL targets an image file",
            "from": [
              {
                "file": 21
              }
            ]
          },
          {
            "id": "well-known/tool/sysadmin/infozip::unzip-compiled-properly-message",
            "conf": 0.85,
            "crit": 3,
            "desc": "UnZip compiled properly diagnostic",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Invokes zero-argument function at module scope",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-darwin-check",
            "conf": 0.6,
            "crit": 2,
            "desc": "process.platform macOS check",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/llm/agent::agent-or-skill-http-url-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "Agent or skill references an HTTP URL",
            "from": [
              {
                "file": 61
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call",
            "conf": 0.84,
            "crit": 3,
            "desc": "Calls Node.js synchronous directory enumeration",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::test-basename-prefix",
            "conf": 1.0,
            "crit": 2,
            "desc": "Node.js test filename prefix",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/client::http-get-dup",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Node.js http.get",
            "from": [
              {
                "file": 56
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/content::batch-command-extension-literal",
            "conf": 0.95,
            "crit": 3,
            "desc": "Batch or command file extension literal",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::object-exec-method-call",
            "atk": "T1059",
            "conf": 1.0,
            "crit": 1,
            "desc": "Calls an object exec method",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls a matcher in a conditional expression",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/binary/layout/overlay::image-under-768kb",
            "conf": 0.9,
            "crit": 3,
            "desc": "PE mapped image under 768 KiB",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "metadata/package/homepage::homepage-monorepo-package-subdirectory",
            "conf": 0.95,
            "crit": 3,
            "desc": "Homepage points to monorepo package directory"
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl",
            "atk": "T1105",
            "conf": 0.66,
            "crit": 3,
            "desc": "Download via curl",
            "from": [
              {
                "file": 471
              }
            ],
            "uses": [
              65,
              230
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/command::relative/1/command",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./command",
            "from": [
              {
                "file": 93
              }
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap-typescript-sources",
            "conf": 0.9,
            "crit": 3,
            "desc": "Source map of TypeScript sources",
            "from": [
              {
                "file": 70
              }
            ]
          },
          {
            "id": "metadata/hardening/build::strcpy-chk",
            "conf": 0.85,
            "crit": 3,
            "desc": "FORTIFY_SOURCE strcpy bounds check",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/package/repository::has-repository-url",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json declares a repository URL"
          },
          {
            "id": "metadata/package/scripts/develop::has-test-script",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json declares a test script"
          },
          {
            "id": "micro-behaviors/communications/http/request/body::request-end-call",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.72,
            "crit": 3,
            "desc": "Ends a request-like object with .end()",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/download::curl-silent-output",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.75,
            "crit": 3,
            "desc": "Silent curl with output",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::write-file-sync",
            "conf": 0.95,
            "crit": 3,
            "desc": "Node fs writes to a file synchronously",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/proxy/tunnel::cloudflared-tunnel-subcommand",
            "atk": "T1090",
            "conf": 0.84,
            "crit": 3,
            "desc": "cloudflared tunnel subcommand",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::mocha-test-file",
            "conf": 0.9,
            "crit": 2,
            "desc": "Mocha test file",
            "from": [
              {
                "file": 423
              },
              {
                "file": 424
              },
              {
                "file": 425
              },
              {
                "file": 426
              },
              {
                "file": 427
              },
              {
                "file": 428
              },
              {
                "file": 476
              }
            ],
            "uses": [
              109,
              288
            ]
          },
          {
            "id": "metadata/package/scripts/build::has-build-script-build",
            "conf": 0.7,
            "crit": 3,
            "desc": "Package declares build script"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/os/linker/env::ld-library-path",
            "conf": 0.6,
            "crit": 3,
            "desc": "References the LD_LIBRARY_PATH search path",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::digest-update-string-literal",
            "conf": 0.85,
            "crit": 3,
            "desc": "Update call fed a string literal",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references",
            "conf": 0.94,
            "crit": 3,
            "desc": "References multiple CPU architecture names",
            "from": [
              {
                "off": 9275,
                "file": 471,
                "line": 349
              },
              {
                "file": 474
              }
            ],
            "uses": [
              233,
              336
            ]
          },
          {
            "id": "metadata/package/testing/presence/path::test-spec-path-benign-context",
            "conf": 1.0,
            "crit": 1,
            "desc": "Test or spec path context",
            "from": [
              {
                "file": 423
              },
              {
                "file": 424
              },
              {
                "file": 425
              },
              {
                "file": 426
              },
              {
                "file": 427
              },
              {
                "file": 428
              }
            ],
            "uses": [
              406
            ]
          },
          {
            "id": "micro-behaviors/fs/device/ioctl::ioctl",
            "conf": 0.66,
            "crit": 3,
            "desc": "Device control request via ioctl",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/src/installer::relative/2/src/installer",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../src/installer",
            "from": [
              {
                "file": 105
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::is-test",
            "conf": 0.9,
            "crit": 2,
            "desc": "Test, spec, or fixture file",
            "from": [
              {
                "file": 423
              },
              {
                "file": 424
              },
              {
                "file": 425
              },
              {
                "file": 426
              },
              {
                "file": 427
              },
              {
                "file": 428
              },
              {
                "file": 476
              }
            ],
            "uses": [
              39,
              132,
              395
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::multi-platform-branch",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.8,
            "crit": 3,
            "desc": "Multi-platform OS branching logic",
            "from": [
              {
                "file": 374
              },
              {
                "file": 442
              },
              {
                "file": 449
              },
              {
                "file": 453
              },
              {
                "file": 470
              },
              {
                "file": 476
              }
            ],
            "uses": [
              175,
              326
            ]
          },
          {
            "id": "micro-behaviors/data/encode/hex::js-to-string-hex",
            "conf": 0.95,
            "crit": 3,
            "desc": "Calls JavaScript toString with hex encoding",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/lib/tunnel::relative/1/lib/tunnel",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./lib/tunnel",
            "from": [
              {
                "file": 60
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/count::npm-many-dev-dependencies",
            "conf": 0.7,
            "crit": 2,
            "desc": "npm manifest has many devDependencies"
          },
          {
            "id": "micro-behaviors/os/telemetry/logging/llm::console-log-json-stringify-call",
            "mbc": "C0069",
            "conf": 0.86,
            "crit": 3,
            "desc": "Console logs JSON stringified payload",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::zipfile-openread",
            "conf": 0.96,
            "crit": 3,
            "desc": ".NET opens a ZIP archive for reading",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/content-type::json-header",
            "conf": 0.9,
            "crit": 3,
            "desc": "References HTTP Content-Type application/json",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/json::json-stringify-identifier",
            "conf": 0.85,
            "crit": 3,
            "desc": "Serializes an identifier as JSON",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/files/runtime::javascript-lib-tree-artifact",
            "conf": 0.95,
            "crit": 3,
            "desc": "JavaScript file under lib",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/package/files/package-json::files-array-present",
            "conf": 0.92,
            "crit": 3,
            "desc": "Package.json declares a files allowlist"
          },
          {
            "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Very short domain in URL",
            "from": [
              {
                "file": 105
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/semver::relative/2/semver",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../semver",
            "from": [
              {
                "file": 64
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::wget-command-call",
            "atk": "T1105",
            "conf": 0.96,
            "crit": 3,
            "desc": "Shell invokes the wget command",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chown::fchown-fn",
            "conf": 0.66,
            "crit": 3,
            "desc": "Change file ownership by fd",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-while-switch-loop",
            "conf": 0.95,
            "crit": 3,
            "desc": "JavaScript while loop contains switch dispatch"
          },
          {
            "id": "metadata/import/npm/relative/2/v5::relative/2/v5",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../v5",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/data/compress/bzip2::libbz2",
            "conf": 0.9,
            "crit": 3,
            "desc": "libbz2 library",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/package/json::relative/2/package/json",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../package.json",
            "from": [
              {
                "file": 64
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::embedded-powershell-while-true",
            "conf": 1.0,
            "crit": 3,
            "desc": "Code embeds unconditional PowerShell loop",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/lib/rng::relative/1/lib/rng",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./lib/rng",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/import/npm/assert::assert",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports assert",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.82,
            "crit": 3,
            "desc": "Packed loader largest section ratio above 0.65",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stdout-reference",
            "conf": 0.8,
            "crit": 3,
            "desc": "References Node.js stdout stream",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "micro-behaviors/dylib/library/family::libcurl-ref",
            "conf": 0.3,
            "crit": 2,
            "desc": "libcurl library reference",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-option-script",
            "conf": 0.85,
            "crit": 3,
            "desc": "curl/wget text includes output option",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/copy::powershell-copy-item-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "References the PowerShell Copy-Item command",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-amd64",
            "conf": 0.94,
            "crit": 3,
            "desc": "x86 or AMD64 architecture reference",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/package/scripts/develop::pkg-format-script-field",
            "conf": 0.6,
            "crit": 3,
            "desc": "\"format\": script in package.json"
          },
          {
            "id": "micro-behaviors/process/io/stream::process-stdout-data-listener",
            "conf": 0.9,
            "crit": 3,
            "desc": "Registers a process stdout data listener",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap-typescript-sources-raw",
            "conf": 0.85,
            "crit": 3,
            "desc": "TypeScript source map raw signature",
            "from": [
              {
                "file": 84
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/content-type::application-json",
            "conf": 0.65,
            "crit": 3,
            "desc": "References the application/json media type",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell recursively removes a path"
          },
          {
            "id": "well-known/lib/development/npm-semver::package-name",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver package.json name"
          },
          {
            "id": "well-known/lib/crypto/uuid::uuid-package-name",
            "conf": 0.98,
            "crit": 3,
            "desc": "uuid npm package manifest name"
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Sorts a JavaScript array",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/file/library::static-unlink-symbol-text",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.72,
            "crit": 3,
            "desc": "Static executable contains unlink symbol",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/package/description/presence::short-description",
            "conf": 0.7,
            "crit": 3,
            "desc": "Package manifest has very short description"
          },
          {
            "id": "metadata/file/format/structured::sourcemap-raw-signature",
            "conf": 0.95,
            "crit": 3,
            "desc": "JavaScript source map raw signature",
            "from": [
              {
                "file": 25
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/hex::js-parseint-radix-16",
            "conf": 0.85,
            "crit": 3,
            "desc": "JavaScript parseInt with radix 16",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/package/testing/scripted::js-bdd-functions",
            "conf": 0.6,
            "crit": 2,
            "desc": "JavaScript BDD test functions",
            "from": [
              {
                "off": 815,
                "file": 424,
                "line": 27
              },
              {
                "off": 834,
                "file": 425,
                "line": 27
              },
              {
                "off": 575,
                "file": 426,
                "line": 22
              },
              {
                "off": 569,
                "file": 427,
                "line": 21
              },
              {
                "off": 161,
                "file": 428,
                "line": 7
              },
              {
                "off": 787,
                "file": 476,
                "line": 30
              }
            ],
            "uses": [
              15,
              136,
              285
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::shift-string-literal",
            "conf": 0.6,
            "crit": 3,
            "desc": "String literal names the shift method",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/construct::script-dirname-ref",
            "conf": 0.6,
            "crit": 3,
            "desc": "References script directory path",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::sh-uname-fingerprint",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.8,
            "crit": 3,
            "desc": "Captures uname output in a shell substitution",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::command-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Command field or assignment key",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/domain::js-http-url-literal-in-file-tail",
            "conf": 0.85,
            "crit": 3,
            "desc": "HTTP(S) URL literal in file tail",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff",
            "mbc": "B0032",
            "conf": 0.5,
            "crit": 3,
            "desc": "0xff hex byte token",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/search::regexp-compiled-from-table-entry",
            "conf": 0.88,
            "crit": 3,
            "desc": "Builds regex from table entry",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section",
            "atk": "T1045",
            "mbc": "B0032",
            "conf": 0.6,
            "crit": 3,
            "desc": "Single section dominates file",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "well-known/lib/stdlib/underscore::package-name",
            "conf": 0.99,
            "crit": 3,
            "desc": "underscore npm package name"
          },
          {
            "id": "micro-behaviors/data/encode/charcode::charcode-at",
            "conf": 0.7,
            "crit": 3,
            "desc": "charCodeAt() method call",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/opensource/node-http-ntlm/ntlm::relative/2/opensource/node-http-ntlm/ntlm",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../opensource/node-http-ntlm/ntlm",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/eval/direct::shell-eval",
            "atk": "T1059",
            "conf": 0.5,
            "crit": 3,
            "desc": "Evaluates a shell command string",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/wsh-reconstruct::token-array-powershell-command",
            "atk": "T1059.007",
            "conf": 0.94,
            "crit": 3,
            "desc": "Token-array PowerShell command",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/import/npm/semver::semver",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports semver",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/body::request-write-call",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.72,
            "crit": 3,
            "desc": "JavaScript writes HTTP request body",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::plain-push-shift-self-rotation",
            "conf": 0.82,
            "crit": 3,
            "desc": "Plain array self-rotation with push and shift",
            "from": [
              {
                "file": 64
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/url::executable-url-reference-b",
            "conf": 0.88,
            "crit": 3,
            "desc": "URL ends in .cmd, .ps1 or .dll",
            "from": [
              {
                "file": 105
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--azure",
            "conf": 0.4,
            "crit": 3,
            "desc": "Public cloud provider name (Azure)",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/v1::relative/2/v1",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../v1",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-3f",
            "mbc": "B0032",
            "conf": 0.5,
            "crit": 3,
            "desc": "0x3f hex byte token",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::local-exec-function",
            "atk": "T1059",
            "conf": 0.9,
            "crit": 2,
            "desc": "Local function named exec",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::cli-help-banner",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver CLI help banner",
            "from": [
              {
                "file": 64
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::test-basename-suffix",
            "conf": 1.0,
            "crit": 2,
            "desc": "Node.js test filename suffix",
            "from": [
              {
                "file": 105
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/wget::wget-output-file",
            "atk": "T1105",
            "conf": 0.7,
            "crit": 3,
            "desc": "Uses wget output-document option",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/email/mime::mime-octet-stream",
            "conf": 0.85,
            "crit": 3,
            "desc": "Uses the application/octet-stream MIME type",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::pkg-build-or-test-helper-script",
            "conf": 0.95,
            "crit": 2,
            "desc": "Packaging build or test helper script",
            "from": [
              {
                "file": 423
              },
              {
                "file": 424
              },
              {
                "file": 425
              },
              {
                "file": 426
              },
              {
                "file": 427
              },
              {
                "file": 428
              },
              {
                "file": 485
              },
              {
                "file": 486
              }
            ],
            "uses": [
              42
            ]
          },
          {
            "id": "well-known/lib/stdlib/lodash::lodash-template-print-helper",
            "conf": 0.95,
            "crit": 3,
            "desc": "Lodash template string builder helper",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::readfilesync-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls readFileSync",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/modify::powershell-path-assignment",
            "conf": 0.82,
            "crit": 3,
            "desc": "PowerShell PATH environment assignment",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission",
            "conf": 0.82,
            "crit": 3,
            "desc": "Emits object through named JavaScript event",
            "from": [
              {
                "file": 59
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/reference::javascript-comment-url-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript comment contains a URL",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap",
            "conf": 1.0,
            "crit": 3,
            "desc": "JavaScript source map",
            "from": [
              {
                "file": 70
              }
            ]
          },
          {
            "id": "metadata/package/homepage::homepage-git-host",
            "conf": 0.9,
            "crit": 3,
            "desc": "Homepage points to major Git host"
          },
          {
            "id": "micro-behaviors/data/source/property/identity::host-user-object-fields",
            "conf": 0.9,
            "crit": 3,
            "desc": "Host or user object field keys",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/interfaces::relative/1/interfaces",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./interfaces",
            "from": [
              {
                "file": 83
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::digest-method-call",
            "conf": 0.8,
            "crit": 3,
            "desc": "Calls a digest() method",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "objectives/discovery/system/fingerprint/os::linux-distro-identification",
            "atk": "T1082",
            "mbc": "B0012",
            "conf": 0.8,
            "crit": 3,
            "desc": "Linux distro identification",
            "from": [
              {
                "file": 471
              },
              {
                "file": 474
              }
            ],
            "uses": [
              1
            ]
          },
          {
            "id": "metadata/package/testing/presence/scripted::it-call",
            "conf": 0.6,
            "crit": 3,
            "desc": "it() function call",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "metadata/hardening/build::memcpy-chk",
            "conf": 0.85,
            "crit": 3,
            "desc": "FORTIFY_SOURCE memcpy bounds check",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::js-stream-write-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls a write method on a stream",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::test-filename-pattern",
            "conf": 0.6,
            "crit": 2,
            "desc": "Common test filename pattern",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/handlers/basiccreds::relative/1/handlers/basiccreds",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./handlers/basiccreds",
            "from": [
              {
                "file": 50
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::has-release-scripts-2",
            "conf": 1.0,
            "crit": 3,
            "desc": "Package release management scripts (pre/post)",
            "from": [
              {
                "file": 63
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Joins array with a short delimiter",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "metadata/package/entrypoint::bin-field-declared",
            "conf": 0.95,
            "crit": 3,
            "desc": "Manifest declares a bin entry"
          },
          {
            "id": "micro-behaviors/fs/delete/file/library::unlink",
            "conf": 0.3,
            "crit": 3,
            "desc": "References unlink file-delete API",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/file/extension/executable::exe",
            "conf": 1.0,
            "crit": 2,
            "desc": "Windows executable extension",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multi-arch-target",
            "conf": 0.85,
            "crit": 3,
            "desc": "Script references multiple CPU architectures",
            "from": [
              {
                "off": 8789,
                "file": 471,
                "line": 326
              },
              {
                "off": 4403,
                "file": 474,
                "line": 168
              }
            ],
            "uses": [
              371,
              376,
              449
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/v4::relative/2/v4",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../v4",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::module-scope-string-function",
            "conf": 0.9,
            "crit": 3,
            "desc": "Top-level non-require string call",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member",
            "conf": 0.8,
            "crit": 3,
            "desc": "Reads the Node.js process.platform value",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "References the toString conversion method",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/index::relative/2/index",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../index",
            "from": [
              {
                "file": 54
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-end-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream end handler",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "metadata/vendor/string::microsoft-copyright-header",
            "conf": 0.9,
            "crit": 3,
            "desc": "Microsoft Corporation source copyright header",
            "from": [
              {
                "file": 41
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/reverse::split-reverse-join-string",
            "mbc": "C0019",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reverses string with split reverse join"
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::authorization-header-index-assignment",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.88,
            "crit": 3,
            "desc": "Authorization header property assignment",
            "from": [
              {
                "file": 31
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/unix-utils::sed-processing",
            "conf": 1.0,
            "crit": 2,
            "desc": "Uses sed for text processing",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::authorization-header-map-entry",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.88,
            "crit": 3,
            "desc": "Defines an HTTP Authorization header mapping",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/guard::node-temp-exec-benign-context",
            "conf": 0.9,
            "crit": 1,
            "desc": "Benign Node temp execution context",
            "from": [
              {
                "file": 32
              }
            ],
            "uses": [
              3,
              15,
              24,
              39,
              42,
              55,
              109,
              132,
              134,
              136,
              178,
              196,
              202,
              205,
              246,
              270,
              273,
              285,
              288,
              372,
              389,
              395,
              406,
              408
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::unzip-tool-reference",
            "conf": 0.7,
            "crit": 3,
            "desc": "References unzip extraction tool",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/concat::join-empty-separator-call",
            "conf": 0.82,
            "crit": 3,
            "desc": "Joins values without a separator",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/array::js-string-split",
            "conf": 0.6,
            "crit": 3,
            "desc": "Split to empty-delimiter char array",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/trojan::decoder-array-push-ast",
            "atk": "T1195.002",
            "mbc": "B0032",
            "conf": 0.76,
            "crit": 3,
            "desc": "Pushes indexed or character-coded decoder values",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::pkg-build-script-field",
            "conf": 0.6,
            "crit": 3,
            "desc": "Package declares a build script"
          },
          {
            "id": "metadata/import/npm/relative/1/bytestouuid::relative/1/bytestouuid",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./bytesToUuid",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/npm/actions/io::actions/io",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/io",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::iwr-response-content-access",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.88,
            "crit": 3,
            "desc": "PowerShell reads HTTP response content",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find",
            "conf": 0.85,
            "crit": 2,
            "desc": "Traverses directories using common APIs",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "metadata/build/bundler/wrapper::js-umd-wrapper-amd",
            "conf": 0.9,
            "crit": 2,
            "desc": "Contains a UMD wrapper's AMD branch",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::bearer-header-from-token",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.93,
            "crit": 3,
            "desc": "Bearer header from token",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::fetch-output-to-var",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "Output path comes from shell variable",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/import/package::dep-eslint",
            "conf": 0.9,
            "crit": 3,
            "desc": "Depends on ESLint",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "objectives/lateral-movement/brute-force/password::service-account-ubuntu",
            "atk": "T1110.001",
            "mbc": "E1110",
            "conf": 0.85,
            "crit": 3,
            "desc": "Service-account token ubuntu",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/file/comment::source-comment-bytes-over-300",
            "conf": 0.92,
            "crit": 2,
            "desc": "Source has over 300 comment bytes",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call",
            "conf": 0.95,
            "crit": 3,
            "desc": "Invokes preserved console method with arguments",
            "from": [
              {
                "file": 59
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/char-code::fromcharcode-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Builds characters with String.fromCharCode",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "well-known/lib/stdlib/lodash::modular-source",
            "conf": 0.9,
            "crit": 3,
            "desc": "Lodash modular source file",
            "from": [
              {
                "off": 49659,
                "file": 395,
                "line": 1450
              },
              {
                "off": 15262,
                "file": 397,
                "line": 5
              }
            ],
            "uses": [
              274
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-win32-check",
            "conf": 0.6,
            "crit": 2,
            "desc": "Checks whether Node.js runs on Windows",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/import/npm/crypto::crypto",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports crypto",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/eval/direct::powershell-variable-call-operator",
            "atk": "T1059.001",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "PowerShell invokes variable via call operator",
            "from": [
              {
                "file": 68
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/listen::node-tls-create-server",
            "mbc": "C0001",
            "conf": 0.86,
            "crit": 3,
            "desc": "Node TLS module creates a server",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "metadata/import/npm/typed-rest-client/httpclient::typed-rest-client/httpclient",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports typed-rest-client/HttpClient",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-8-bits",
            "conf": 0.9,
            "crit": 2,
            "desc": "Source right-shifts by 8 bits",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/import/npm/https::https",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports https",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file-command",
            "atk": "T1105",
            "conf": 0.94,
            "crit": 3,
            "desc": "Executes curl with output-path option",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/client::node-http",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Node.js built-in http/https module usage",
            "from": [
              {
                "file": 424
              },
              {
                "file": 425
              },
              {
                "file": 426
              },
              {
                "file": 427
              },
              {
                "file": 428
              },
              {
                "file": 442
              }
            ],
            "uses": [
              129,
              179
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-arm",
            "conf": 0.94,
            "crit": 1,
            "desc": "x86 or ARM architecture reference",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/eval/compile::js-new-function-constructor",
            "conf": 0.7,
            "crit": 3,
            "desc": "Calls JavaScript's new Function constructor"
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::powershell-http-transfer-command-reference",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "PowerShell HTTP transfer command reference",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/lib/md5::relative/1/lib/md5",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./lib/md5",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080",
            "conf": 0.7,
            "crit": 3,
            "desc": "HTTP URL uses alternate port 8080",
            "from": [
              {
                "file": 39
              }
            ]
          },
          {
            "id": "well-known/lib/ai/coding-assistant::opencode-name-reference",
            "conf": 0.88,
            "crit": 3,
            "desc": "References the OpenCode coding agent",
            "from": [
              {
                "file": 44
              }
            ]
          },
          {
            "id": "metadata/binary/layout/size::small-pe",
            "conf": 0.6,
            "crit": 3,
            "desc": "Small PE binary (\u003c100KB)",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url",
            "conf": 0.75,
            "crit": 3,
            "desc": "Contains a hardcoded remote HTTP(S) URL",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/import/npm/util::util",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports util",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/replace::chained-replace-calls",
            "conf": 0.9,
            "crit": 3,
            "desc": "Chains multiple JavaScript string replacements",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/presence::npm-no-runtime-dependencies",
            "conf": 0.9,
            "crit": 2,
            "desc": "npm manifest declares no runtime dependencies",
            "from": [
              {
                "file": 375
              },
              {
                "file": 380
              },
              {
                "file": 398
              },
              {
                "file": 429
              },
              {
                "file": 434
              },
              {
                "file": 444
              },
              {
                "file": 451
              },
              {
                "file": 462
              }
            ],
            "uses": [
              423
            ]
          },
          {
            "id": "micro-behaviors/os/package-manager/install::build-npm-install",
            "conf": 0.9,
            "crit": 3,
            "desc": "Build installs local npm dependencies",
            "from": [
              {
                "file": 107
              }
            ]
          },
          {
            "id": "metadata/binary/symbols/count::many-exports-20",
            "conf": 1.0,
            "crit": 2,
            "desc": "Binary has 20+ exports",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/user-paths::userprofile-var",
            "conf": 0.5,
            "crit": 3,
            "desc": "USERPROFILE path environment variable",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler",
            "conf": 0.85,
            "crit": 3,
            "desc": "Registers asynchronous named event handler",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/object::js-serialise",
            "conf": 0.85,
            "crit": 3,
            "desc": "References a serialization-related symbol",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::range-prototype-test",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver Range.prototype.test",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::usage-lower",
            "conf": 0.5,
            "crit": 2,
            "desc": "usage: label (lowercase)",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/package/repository::has-repository-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "package.json declares repository metadata"
          },
          {
            "id": "micro-behaviors/data/llm/agent::agent-or-skill-server-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "Agent or skill references a server endpoint",
            "from": [
              {
                "file": 61
              }
            ]
          },
          {
            "id": "metadata/import/npm/fs::fs",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports fs",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/binary::buffer-call-numeric-offset-pair",
            "conf": 0.85,
            "crit": 1,
            "desc": "Numeric offset pair in call parentheses",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::node-createhash-md4-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node.js createHash('md4') call",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/private-key::private-pem-suffix",
            "atk": "T1552.001",
            "conf": 0.8,
            "crit": 1,
            "desc": "Private PEM file suffix",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "metadata/package/files/runtime::typescript-source-tree-artifact",
            "conf": 0.95,
            "crit": 3,
            "desc": "Source file under src",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/ssl::node-tls-connect",
            "mbc": "C0001",
            "conf": 0.88,
            "crit": 3,
            "desc": "Node TLS module connects a socket",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "metadata/package/error-handling::catch-keyword",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains a catch error handler",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/app-data::windows-appdata-directory-path",
            "conf": 0.82,
            "crit": 3,
            "desc": "Windows AppData directory path reference",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/process/tty/terminal::tcgetattr",
            "atk": "T1059",
            "conf": 0.75,
            "crit": 3,
            "desc": "Get terminal attributes",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/lib/sha1::relative/1/lib/sha1",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./lib/sha1",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/keywords/identity::npm-keyword-browser",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares browser keyword"
          },
          {
            "id": "metadata/file/magic/identity::pe-dos-stub",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE/DOS MZ header at file start",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::usage-title",
            "conf": 0.5,
            "crit": 2,
            "desc": "Usage: label (title case)",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/symmetric/aes/runtime-library::createCipheriv",
            "mbc": "C0027",
            "conf": 0.85,
            "crit": 3,
            "desc": "Creates cipher with initialization vector",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/import/npm/uuid/v4::uuid/v4",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports uuid/v4",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-arm",
            "conf": 1.0,
            "crit": 1,
            "desc": "ARM architecture string",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-or-declaration-file",
            "conf": 0.85,
            "crit": 1,
            "desc": "File is a test or type-declaration source file",
            "from": [
              {
                "file": 32
              }
            ],
            "uses": [
              24,
              134,
              205,
              411
            ]
          },
          {
            "id": "micro-behaviors/data/string/search::compiled-js-pattern-set",
            "conf": 0.9,
            "crit": 3,
            "desc": "Compiles a set of JavaScript regex patterns",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::commonjs-module-reexport",
            "conf": 0.92,
            "crit": 3,
            "desc": "CommonJS module re-exports required package",
            "from": [
              {
                "file": 60
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.95,
            "crit": 3,
            "desc": "Encoded URL references MDN documentation",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-arm64",
            "conf": 1.0,
            "crit": 3,
            "desc": "arm64 architecture string",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-staging-path",
            "atk": "T1105",
            "conf": 0.82,
            "crit": 3,
            "desc": "References curl writing to an output path",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/wget::wget-output-stdout",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "wget writes downloaded content to stdout",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/alloc::buffer-from-utf8",
            "conf": 0.9,
            "crit": 3,
            "desc": "Creates Node.js Buffer from UTF-8 text",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "metadata/import/builtin::require-os",
            "conf": 0.7,
            "crit": 2,
            "desc": "Imports the Node.js os module",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "metadata/import/npm/child_process::child_process",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports child_process",
            "from": [
              {
                "file": 75
              }
            ]
          },
          {
            "id": "metadata/lang/locale::readme-language-nav-marker",
            "conf": 0.95,
            "crit": 3,
            "desc": "README links to a translated README",
            "from": [
              {
                "file": 21
              }
            ]
          },
          {
            "id": "metadata/import/npm/underscore::underscore",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports underscore",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::node-write-file-sync",
            "conf": 1.0,
            "crit": 3,
            "desc": "Node synchronously writes a file",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Auth-like constant assignment",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.9,
            "crit": 3,
            "desc": "Force-deletes a shell variable target",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file",
            "atk": "T1105",
            "conf": 0.7,
            "crit": 3,
            "desc": "References curl file-output option",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/lib/bytestouuid::relative/1/lib/bytestouuid",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./lib/bytesToUuid",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::any-test-presence-marker",
            "conf": 0.5,
            "crit": 2,
            "desc": "Package carries a test file, directory or harness import",
            "from": [
              {
                "file": 423
              },
              {
                "file": 424
              },
              {
                "file": 425
              },
              {
                "file": 426
              },
              {
                "file": 427
              },
              {
                "file": 428
              },
              {
                "file": 476
              }
            ],
            "uses": [
              395
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/lib/v35/js::relative/1/lib/v35/js",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./lib/v35.js",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/files/included::package-json-basename",
            "conf": 0.95,
            "crit": 3,
            "desc": "Filename is package.json",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/freeform::ci-badge-reference-b",
            "conf": 0.8,
            "crit": 3,
            "desc": "References GitHub Actions",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/files/dependency::node-modules-path",
            "conf": 1.0,
            "crit": 3,
            "desc": "File located under a node_modules directory",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-24-bits",
            "conf": 0.9,
            "crit": 2,
            "desc": "Source right-shifts by 24 bits",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory",
            "conf": 1.0,
            "crit": 2,
            "desc": "File identified as a test by path or name",
            "from": [
              {
                "file": 52
              }
            ],
            "uses": [
              42,
              134
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package declares a runtime dependency",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::github-raw-url",
            "conf": 0.92,
            "crit": 3,
            "desc": "GitHub raw-content URL",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/lang/javascript-features::cjs-exports-pattern",
            "conf": 0.6,
            "crit": 3,
            "desc": "Defines CommonJS named exports",
            "from": [
              {
                "file": 59
              }
            ]
          },
          {
            "id": "metadata/file/string/file::tmp",
            "conf": 0.2,
            "crit": 1,
            "desc": "tmp keyword",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/import/npm/path::path",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports path",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/repository::repo-url-git-host",
            "conf": 0.9,
            "crit": 3,
            "desc": "Repository identifies major Git host"
          },
          {
            "id": "metadata/import/npm/relative/1/httpclient::relative/1/httpclient",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./HttpClient",
            "from": [
              {
                "file": 42
              }
            ]
          },
          {
            "id": "metadata/package/scripts/develop::has-git-hooks",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package uses git hooks tooling",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/put::presigned-url-reference",
            "conf": 0.92,
            "crit": 3,
            "desc": "References a pre-signed upload URL",
            "from": [
              {
                "file": 46
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy",
            "conf": 0.8,
            "crit": 2,
            "desc": "Copies one indexed array element to another",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/path::test-path-basename",
            "conf": 1.0,
            "crit": 2,
            "desc": "Test path basename",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::source-digest-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "MD5 or SHA digest API call",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::jest-test-file",
            "conf": 0.9,
            "crit": 2,
            "desc": "Jest test file",
            "from": [
              {
                "file": 423
              },
              {
                "file": 476
              }
            ],
            "uses": [
              136,
              288
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "from": [
              {
                "file": 16
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::js-fs-write-sync",
            "conf": 1.0,
            "crit": 3,
            "desc": "Writes file via Node.js fs",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::declaration-file-extension",
            "conf": 1.0,
            "crit": 2,
            "desc": "File uses a source declaration extension",
            "from": [
              {
                "file": 32
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract",
            "atk": "T1560.001",
            "conf": 0.84,
            "crit": 3,
            "desc": "tar gzip extraction command usage",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "well-known/lib/stdlib/underscore::vendored-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "vendored underscore package path",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::actions-setup-node",
            "conf": 0.92,
            "crit": 3,
            "desc": "actions/setup-node workflow step"
          },
          {
            "id": "micro-behaviors/data/format/html::markdown-remote-image-source",
            "conf": 0.9,
            "crit": 3,
            "desc": "Markdown references a remote image",
            "from": [
              {
                "file": 21
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::command-substitution",
            "conf": 1.0,
            "crit": 2,
            "desc": "shell script command substitution",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::script-usage-screen",
            "conf": 0.9,
            "crit": 3,
            "desc": "Script prints a CLI usage screen",
            "from": [
              {
                "file": 64
              }
            ]
          },
          {
            "id": "metadata/import/builtin::require-http",
            "conf": 0.75,
            "crit": 3,
            "desc": "Imports the Node.js HTTP module",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::wget-var-reference",
            "atk": "T1105",
            "conf": 0.86,
            "crit": 3,
            "desc": "wget references variable",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path",
            "from": [
              {
                "file": 107
              }
            ]
          },
          {
            "id": "micro-behaviors/os/random/crypto::node-random-generation",
            "conf": 0.72,
            "crit": 3,
            "desc": "Node.js cryptographic random-value generation",
            "from": [
              {
                "file": 384
              }
            ],
            "uses": [
              73
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::cmd-exe-reference",
            "conf": 0.8,
            "crit": 3,
            "desc": "References Windows cmd.exe interpreter",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/presence::npm-no-dependencies-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "npm manifest omits dependencies field"
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::temp-mkdir-command--rx-1",
            "conf": 0.75,
            "crit": 3,
            "desc": "Local application data path reference",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "micro-behaviors/os/security/auth/ntlm::ntlmssp-marker",
            "atk": "T1550.002",
            "conf": 0.9,
            "crit": 3,
            "desc": "NTLMSSP authentication marker",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read",
            "conf": 0.8,
            "crit": 2,
            "desc": "Reads an array element into a variable",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/dynamic::node-http-module-get-url-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "Node HTTP GET receives URL variable",
            "from": [
              {
                "file": 71
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only",
            "conf": 0.88,
            "crit": 3,
            "desc": "Catch block only returns a constant",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/tar::tar-extract",
            "atk": "T1560.001",
            "conf": 0.78,
            "crit": 3,
            "desc": "tar extraction command usage",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell evaluates variable command",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::umask",
            "conf": 0.4,
            "crit": 3,
            "desc": "References umask file-creation mask API",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Encoded URL public documentation",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::shell-multi-arch-array",
            "atk": "T1082",
            "mbc": "Discovery",
            "conf": 0.85,
            "crit": 3,
            "desc": "Script maps host arch across several targets",
            "from": [
              {
                "off": 8740,
                "file": 471,
                "line": 323
              },
              {
                "off": 4354,
                "file": 474,
                "line": 165
              }
            ],
            "uses": [
              249,
              295
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/body::req-write",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Write data to HTTP request stream",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "objectives/lateral-movement/pass-the-hash/ntlm::node-ntlm-auth-payload",
            "atk": "T1550.002",
            "mbc": "B0030",
            "conf": 0.95,
            "crit": 3,
            "desc": "Node builds NTLM auth payload",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/beacon::embedded-node-https-get",
            "atk": "T1071.001",
            "conf": 0.94,
            "crit": 3,
            "desc": "Embeds Node HTTPS GET call",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/variable-spawn::spawn-destination-variable",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node spawns destination path variable",
            "from": [
              {
                "file": 82
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::source-http-200-status",
            "atk": "T1190",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Compares HTTP response status property to 200",
            "from": [
              {
                "file": 59
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/cwd::pwd-command",
            "conf": 0.8,
            "crit": 3,
            "desc": "Queries the current working directory",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/range::npm-wildcard-devdependency",
            "conf": 0.7,
            "crit": 3,
            "desc": "npm devDependency pinned to '*'"
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text",
            "conf": 0.92,
            "crit": 3,
            "desc": "Text has empty named-parameter catch",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/v3::relative/2/v3",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../v3",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::fetch-var-output-before-input",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "Variable output precedes variable input",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::semver-invalid-version-typeerror",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver invalid-version TypeError",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/installer::relative/1/installer",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./installer",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-versions",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP protocol version strings",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::powershell-extract-to-file",
            "conf": 0.96,
            "crit": 3,
            "desc": "PowerShell extracts a ZIP entry to file",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/v1::relative/1/v1",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./v1",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-aarch64",
            "conf": 1.0,
            "crit": 3,
            "desc": "AArch64 (ARM64) architecture string",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::node-child-process-capability",
            "conf": 0.8,
            "crit": 3,
            "desc": "Imports or invokes Node.js child-process APIs",
            "from": [
              {
                "off": 707,
                "file": 446,
                "line": 11
              },
              {
                "off": 760,
                "file": 453,
                "line": 13
              }
            ],
            "uses": [
              10,
              381
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::fetch-var-output-var",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl/wget uses variable input and output paths",
            "from": [
              {
                "off": 19278,
                "file": 471,
                "line": 711
              }
            ],
            "uses": [
              151,
              319
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/binary::fixed-offset-buffer-fields",
            "conf": 0.8,
            "crit": 3,
            "desc": "Buffer split at three fixed offsets",
            "from": [
              {
                "off": 455,
                "file": 390,
                "line": 15
              },
              {
                "file": 395
              },
              {
                "file": 397
              },
              {
                "file": 401
              },
              {
                "file": 433
              },
              {
                "off": 196,
                "file": 435,
                "line": 6
              },
              {
                "file": 459
              }
            ],
            "uses": [
              171,
              357
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/schema::username-object-key",
            "conf": 0.9,
            "crit": 3,
            "desc": "Object literal declares a username key",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "metadata/import/shell/etc/os-release::etc/os-release",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports /etc/os-release",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "metadata/import/npm/stream::stream",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports stream",
            "from": [
              {
                "file": 86
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::mkdir-command",
            "conf": 0.8,
            "crit": 3,
            "desc": "Shell invokes mkdir command",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::certificate-ref",
            "conf": 0.5,
            "crit": 2,
            "desc": "References certificate terminology",
            "from": [
              {
                "file": 54
              }
            ]
          },
          {
            "id": "metadata/import/npm/url::url",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports url",
            "from": [
              {
                "file": 39
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/ssl::reject-unauthorized-false",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node TLS check disabled by option",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::node-chmod-call",
            "conf": 0.85,
            "crit": 3,
            "desc": "Node calls chmod to change permissions",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-bracket-runner",
            "conf": 0.85,
            "crit": 3,
            "desc": "process.env bracket access for runner vars",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chown::chown-fn",
            "conf": 0.66,
            "crit": 3,
            "desc": "Change file ownership",
            "from": [
              {
                "file": 66
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/listen::node-server-listen-generic",
            "mbc": "C0001",
            "conf": 0.86,
            "crit": 3,
            "desc": "Node generic server listens on endpoint",
            "from": [
              {
                "file": 53
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/client/managed::getasync",
            "atk": "T1105",
            "conf": 0.86,
            "crit": 3,
            "desc": "HttpClient asynchronous HTTP response retrieval",
            "from": [
              {
                "file": 101
              }
            ]
          },
          {
            "id": "metadata/package/author/identity::author-microsoft-corporation",
            "conf": 0.95,
            "crit": 3,
            "desc": "Package author is Microsoft Corporation"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/body::request-write-raw-data-variable",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.84,
            "crit": 3,
            "desc": "HTTP request writes a raw data variable",
            "from": [
              {
                "file": 48
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-case-uname-normalization",
            "conf": 0.92,
            "crit": 3,
            "desc": "uname -m mapped in a case statement",
            "from": [
              {
                "file": 100
              }
            ]
          },
          {
            "id": "well-known/tool/development/ci/github-actions/actions-artifact::repository-url",
            "conf": 0.99,
            "crit": 3,
            "desc": "actions artifact repository URL"
          },
          {
            "id": "micro-behaviors/data/string/replace::keyed-replacement-call",
            "conf": 0.96,
            "crit": 3,
            "desc": "Replaces text using a keyed replacement table",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal",
            "conf": 0.86,
            "crit": 3,
            "desc": "Recursive directory traversal logic",
            "from": [
              {
                "file": 442
              }
            ],
            "uses": [
              316
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::node-createhash-call",
            "conf": 0.65,
            "crit": 3,
            "desc": "Node.js createHash call",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/tls::tls",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports tls",
            "from": [
              {
                "file": 52
              }
            ]
          },
          {
            "id": "metadata/build/artifact::stripped-toolchain-comment",
            "conf": 1.0,
            "crit": 3,
            "desc": "ELF omits compiler metadata (.comment)"
          },
          {
            "id": "metadata/package/completeness::has-typescript",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares TypeScript tooling",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.72,
            "crit": 3,
            "desc": "HTTP Bearer authorization header prefix",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/split::js-split-call",
            "conf": 0.8,
            "crit": 3,
            "desc": "Calls JavaScript split()",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::test-basename-path",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 1.0,
            "crit": 3,
            "desc": "Test file path or basename",
            "from": [
              {
                "file": 105
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::result-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Result field or assignment key",
            "from": [
              {
                "file": 24
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal",
            "atk": "T1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "child_process module name literal",
            "from": [
              {
                "file": 75
              }
            ]
          },
          {
            "id": "metadata/package/testing/scripted::go-fuzz-corpus-entry-basename",
            "conf": 0.96,
            "crit": 3,
            "desc": "Go fuzz corpus entry basename (sha1[-index])"
          },
          {
            "id": "fetch/dependency-verdict",
            "dep": {
              "sha": "fba4c30ba7663ae9c296c007ef000d3fd0c8499826ceadf4f124c8b830d77d52",
              "type": "",
              "locator": "pkg:npm/strip-ansi@5.2.0"
            },
            "conf": 0.0,
            "crit": 4,
            "desc": "Suspicious dependency: pkg:npm/strip-ansi@5.2.0 | fba4c30ba7663ae9c296c007ef000d3fd0c8499826ceadf4f124c8b830d77d52 — Cited as malicious by one threat intelligence feed."
          }
        ]
      }
    ]
  }
}