{ "ml": { "v": "7", "id": 238, "lvl": -1, "conf": 0, "prob": 0.000029255947083584033, "type": "python", "version": "v18.18", "analyzed_at": "2026-09-23T15:13:12Z" }, "path": "95d65864cacb523b1f3d928761523f9f77b08d5d", "raw": { "rev": "a041b", "files": [ { "id": 277, "mol": "K₂(Li₄Te₂)O₈(As₆C₅CaErEuI₂S₆Xe₂)H₈(Cm₄₀CrDb₃₇F₆MgOs₁₀Po₁₁U)Md₄(Bk₉In₃Pa₁₄)", "pid": 58, "rel": "fetched", "sha": "2aa2f8e3de496e79330e0a62e1b2e665bf5eedc46d77c189652825e4b6a8af60", "via": "https://codeload.github.com/gofiber/multi-labeler/tar.gz/95d65864cacb523b1f3d928761523f9f77b08d5d", "path": "pkg:github/gofiber/multi-labeler@95d65864cacb523b1f3d928761523f9f77b08d5d", "risk": 66, "size": 1141375, "type": "gz", "depth": 2, "facts": { "metrics": { "file": { "size": 1141375, "entropy": 8 }, "binary": { "peak_region_bytes": 1135231, "peak_region_entropy": 7.85 }, "consistency": { "self_dependency": 0, "unused_runtime_deps": 0 } } }, "traits": [ { "id": "metadata/lang/javascript-features::es6-class", "conf": 0.9, "crit": 2, "desc": "ES6 class declaration" }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-error-handler", "conf": 0.9, "crit": 3, "desc": "JavaScript emitter discards errors", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::architecture-parameter-assignment", "conf": 0.94, "crit": 2, "desc": "Architecture parameter assignment", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-method-preservation", "conf": 0.95, "crit": 3, "desc": "Preserves original JavaScript console methods", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-headers-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Headers header name", "from": [ { "file": 26 } ] }, { "id": "well-known/tool/detection/redaction::redacted-replacement-marker", "conf": 0.9, "crit": 3, "desc": "REDACTED replacement marker", "from": [ { "file": 26 } ] }, { "id": "metadata/package/scripts/develop::pkg-format-script-field", "conf": 0.6, "crit": 3, "desc": "\"format\": script in package.json" }, { "id": "metadata/lang/encoded/unicode-escape::javascript-benign-bundle-text", "conf": 0.95, "crit": 1, "desc": "Encoded JavaScript bundle context", "from": [ { "off": 40591, "file": 18, "line": 1 }, { "file": 23 } ], "uses": [ 89 ] }, { "id": "metadata/build/minifier::js-large-minified-bundle", "conf": 0.92, "crit": 2, "desc": "Large minified JavaScript bundle" }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "from": [ { "file": 26 } ] }, { "id": "objectives/command-and-control/beacon/network/json::base64-chunk-word", "atk": "T1071.001", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Base64 chunk sizing word", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/loop::c-family-full-byte-search-loop", "conf": 0.88, "crit": 3, "desc": "C-family loops over all byte values", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "from": [ { "file": 26 } ] }, { "id": "metadata/build/bundler/runtime::webpack-bundled--nmd-module-decorator", "conf": 0.93, "crit": 3, "desc": "Code bundled with webpack (nmd module decorator)", "from": [ { "file": 18 } ] }, { "id": "metadata/build/ci/step::actions-setup-node", "conf": 0.92, "crit": 3, "desc": "actions/setup-node workflow step" }, { "id": "micro-behaviors/data/decode/base64::node-base64-tostring-token", "conf": 0.86, "crit": 3, "desc": "Node base64 toString token", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/upload::form-data-append", "conf": 0.7, "crit": 3, "desc": "Appends data to FormData", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/fs/path/construct::script-dirname-ref", "conf": 0.6, "crit": 3, "desc": "References script directory path", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-auth-word", "conf": 0.45, "crit": 1, "desc": "auth route vocabulary word", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/presence/fixture::test-filename-pattern", "conf": 0.6, "crit": 2, "desc": "Common test filename pattern", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-http-url-literal-in-file-tail", "conf": 0.85, "crit": 3, "desc": "HTTP(S) URL literal in file tail", "from": [ { "file": 40 } ] }, { "id": "metadata/file/comment::source-at-most-two-comments", "conf": 0.88, "crit": 2, "desc": "Source has at most two comments", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/write/file/shell::shell-profile-append-call", "conf": 0.9, "crit": 3, "desc": "Appends with the appendFile API", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::payload-user-field", "conf": 0.9, "crit": 3, "desc": "Payload contains a user field", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Encoded URL references MDN documentation", "from": [ { "file": 26 } ] }, { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "metadata/import/npm/typescript-eslint/parser::typescript-eslint/parser", "conf": 0.95, "crit": 2, "desc": "imports @typescript-eslint/parser", "from": [ { "file": 54 } ] }, { "id": "metadata/import/npm/octokit/core::octokit/core", "conf": 0.95, "crit": 3, "desc": "imports @octokit/core", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/os/wmi/query::cim-instance-cmdlet", "conf": 0.8, "crit": 3, "desc": "Uses Get-CimInstance cmdlet", "from": [ { "file": 26 } ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "file": 18 }, { "file": 19 }, { "file": 20 }, { "file": 21 }, { "file": 22 }, { "file": 23 }, { "file": 24 }, { "file": 26 } ], "uses": [ 8, 288 ] }, { "id": "micro-behaviors/data/string/concat::join-empty-separator-call", "conf": 0.82, "crit": 3, "desc": "Joins values without a separator", "from": [ { "file": 18 } ] }, { "id": "metadata/import/npm/relative/2/config::relative/2/config", "conf": 0.95, "crit": 2, "desc": "imports ../config", "from": [ { "file": 2 } ] }, { "id": "metadata/import/npm/actions/github/lib/utils::actions/github/lib/utils", "conf": 0.95, "crit": 2, "desc": "imports @actions/github/lib/utils", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 18 } ] }, { "id": "metadata/import/npm/actions/github::actions/github", "conf": 0.95, "crit": 2, "desc": "imports @actions/github", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call", "conf": 0.95, "crit": 3, "desc": "Invokes preserved console method with arguments", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/scripted::coverage-marker-istanbul", "conf": 1.0, "crit": 2, "desc": "istanbul coverage marker" }, { "id": "micro-behaviors/os/env/vcs::github-token-name-reference", "conf": 0.9, "crit": 3, "desc": "References the GITHUB_TOKEN environment variable", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-ci", "conf": 0.75, "crit": 3, "desc": "Reads CI environment flag" }, { "id": "metadata/import/npm/io-ts-reporters::io-ts-reporters", "conf": 0.95, "crit": 2, "desc": "imports io-ts-reporters", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/process/fd/stdio::stdout-string", "conf": 0.3, "crit": 2, "desc": "References the stdout stream name" }, { "id": "micro-behaviors/os/env/cicd::github-actions-oidc-token-request-env", "conf": 0.96, "crit": 3, "desc": "Actions OIDC token request env vars", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/2/src/config::relative/2/src/config", "conf": 0.95, "crit": 2, "desc": "imports ../../src/config", "from": [ { "file": 29 } ] }, { "id": "metadata/package/files/runtime::typescript-source-tree-artifact", "conf": 0.95, "crit": 3, "desc": "Source file under src", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/command-network-surface::js-many-shell-command-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.86, "crit": 3, "desc": "Many shell command strings in JavaScript" }, { "id": "micro-behaviors/communications/http/response::http-403-forbidden", "conf": 0.75, "crit": 3, "desc": "HTTP 403 forbidden response text", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format", "conf": 0.9, "crit": 3, "desc": "Code formats a zero-padded integer", "from": [ { "file": 26 } ] }, { "id": "metadata/file/string/telemetry::last-name-field", "conf": 0.9, "crit": 3, "desc": "lastName field name" }, { "id": "micro-behaviors/communications/http/request/verb::http-post-method-condition", "conf": 0.95, "crit": 3, "desc": "Checks for an HTTP POST method", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/scripted::js-bdd-describe-text", "conf": 0.75, "crit": 2, "desc": "JavaScript describe() test call", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission", "conf": 0.82, "crit": 3, "desc": "Emits object through named JavaScript event" }, { "id": "micro-behaviors/os/telemetry/logging/llm::console-log-response-text-call", "mbc": "C0069", "conf": 0.82, "crit": 3, "desc": "Console logs response text variable", "from": [ { "file": 26 } ] }, { "id": "metadata/build/minifier::void-zero", "conf": 0.6, "crit": 2, "desc": "Uses minifier-style void 0 for undefined" }, { "id": "micro-behaviors/data/source/arithmetic::source-xor-operation", "conf": 1.0, "crit": 3, "desc": "Source references XOR syntax", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/buffer/integer-codec::uint16-be-buffer-write", "conf": 0.85, "crit": 3, "desc": "Writes 16-bit big-endian buffer value", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/socket/connect::net-connect", "conf": 0.86, "crit": 3, "desc": "Node net.connect or createConnection usage", "from": [ { "file": 26 } ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::unzip-tool-reference", "conf": 0.7, "crit": 3, "desc": "References unzip extraction tool" }, { "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program", "conf": 0.82, "crit": 3, "desc": "Node spawns a variable program path", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/socket/framing::node-be32-frame-length-read", "mbc": "C0001", "conf": 0.95, "crit": 3, "desc": "Reads BE32 frame length at offset zero", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "WebSocket class reference" }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/create/variable-spawn::spawn-destination-variable", "conf": 0.9, "crit": 3, "desc": "Node spawns destination path variable", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/env/read::process-env", "conf": 0.8, "crit": 2, "desc": "Node process.env access" }, { "id": "metadata/package/testing/scripted::js-bdd-suite", "conf": 0.85, "crit": 2, "desc": "JavaScript BDD test suite", "from": [ { "file": 29 } ], "uses": [ 52, 157 ] }, { "id": "metadata/import/npm/relative/2/src/matcher/files::relative/2/src/matcher/files", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/files", "from": [ { "file": 30 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-write-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents write endpoint path", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/lodash::lodash", "conf": 0.95, "crit": 2, "desc": "imports lodash", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/encode/char-code::long-numeric-array-literal", "conf": 0.9, "crit": 1, "desc": "Long numeric array literal", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "from": [ { "off": 2365, "file": 18, "line": 1 } ], "uses": [ 170 ] }, { "id": "metadata/build/ecosystem::artifact-integrity-verification-routine", "conf": 0.95, "crit": 3, "desc": "Checks artifact integrity before use", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/property/identity::repository-object-fields", "conf": 0.9, "crit": 3, "desc": "Repository identity object field keys", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/eslint-plugin-no-only-tests::eslint-plugin-no-only-tests", "conf": 0.95, "crit": 2, "desc": "imports eslint-plugin-no-only-tests", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/string/conversion::js-fromcharcode-alias", "conf": 0.9, "crit": 3, "desc": "Aliases String.fromCharCode conversion function", "from": [ { "file": 26 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-3f", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0x3f hex byte token", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/post::url-encoded-content-type", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses URL-encoded HTTP form content", "from": [ { "file": 26 } ] }, { "id": "objectives/credential-access/env/secrets/source-control::github-token-indicators", "atk": "T1552.001", "conf": 0.7, "crit": 3, "desc": "GitHub token variable indicators", "from": [ { "off": 115307, "file": 26, "line": 3104 } ], "uses": [ 39 ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/buffer/alloc::uint8array-constructor", "conf": 0.9, "crit": 2, "desc": "Constructs a Uint8Array buffer", "from": [ { "file": 18 } ] }, { "id": "metadata/file/string/telemetry::platform-profile-field", "conf": 0.95, "crit": 3, "desc": "Platform profile field name", "from": [ { "file": 26 } ] }, { "id": "metadata/package/config::excludes-identifier", "conf": 0.7, "crit": 3, "desc": "Uses an excludes identifier", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/response::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "from": [ { "file": 18 } ] }, { "id": "metadata/build/bundler/runtime::js-webpack-bundle", "conf": 0.95, "crit": 2, "desc": "Webpack bundled JavaScript module", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/crypto/hash/digest::digest-method-call", "conf": 0.8, "crit": 3, "desc": "Calls a digest() method", "from": [ { "file": 26 } ] }, { "id": "metadata/package/completeness::has-typescript", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript tooling", "from": [ { "file": 15 } ] }, { "id": "metadata/lang/javascript-features::use-strict-directive", "conf": 0.6, "crit": 2, "desc": "Contains a JavaScript use strict directive", "from": [ { "file": 18 } ] }, { "id": "metadata/import/npm/relative/1/matcher/branch::relative/1/matcher/branch", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/branch", "from": [ { "file": 11 } ] }, { "id": "metadata/package/testing/harness/runtime::correct-example-comment", "conf": 0.85, "crit": 3, "desc": "Standalone \"// correct\" example annotation", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-client-secret-field", "conf": 0.65, "crit": 3, "desc": "OAuth client_secret field", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connection-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket connection upgrade header", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/manipulation::log-redaction-option", "conf": 0.85, "crit": 3, "desc": "Log redaction option or call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/string/concat::js-loop-string-concat", "conf": 0.6, "crit": 2, "desc": "String concatenation in loop body using array", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/request/body::request-body-property-access", "conf": 0.84, "crit": 3, "desc": "Accesses a request body property" }, { "id": "micro-behaviors/communications/http/request/credentials::fetch-credentials-include", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Fetch sends browser credentials", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/fs/delete/file/library::js-repeated-unlink-call", "atk": "T1070.004", "mbc": "C0047", "conf": 0.6, "crit": 3, "desc": "Repeated Node unlink calls", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-origin-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Origin header name", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/url/fragment::location-hash-read", "conf": 0.85, "crit": 3, "desc": "Reads the URL fragment from location.hash", "from": [ { "file": 26 } ] }, { "id": "metadata/package/dependencies/lockfile::package-lock-resolved-url", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "Lockfile dependency resolved URL" }, { "id": "micro-behaviors/process/io/stream::stream-write-buffer-arg", "conf": 0.9, "crit": 3, "desc": "Writes a buffer argument to a stream" }, { "id": "metadata/package/testing/presence/fixture::wpt-security-features-resource", "conf": 0.9, "crit": 2, "desc": "WPT security-features resource helper", "from": [ { "file": 26 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/decode/base64::embedded-atob-call-text", "conf": 0.9, "crit": 3, "desc": "Data contains JavaScript atob call", "from": [ { "file": 19 } ] }, { "id": "metadata/import/npm/relative/1/config::relative/1/config", "conf": 0.95, "crit": 2, "desc": "imports ./config", "from": [ { "file": 10 } ] }, { "id": "metadata/package/scripts/develop::has-test-script", "conf": 1.0, "crit": 2, "desc": "package.json declares a test script" }, { "id": "micro-behaviors/communications/http/services/github::github-repository-archive-api-endpoint", "conf": 0.94, "crit": 3, "desc": "GitHub repository source-archive API endpoint", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/typescript-eslint/eslint-plugin::typescript-eslint/eslint-plugin", "conf": 0.95, "crit": 2, "desc": "imports @typescript-eslint/eslint-plugin", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/serialize/object::js-serialise", "conf": 0.85, "crit": 3, "desc": "References a serialization-related symbol", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-bracket-runner", "conf": 0.85, "crit": 3, "desc": "process.env bracket access for runner vars", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/unsafe::private-handle-member", "conf": 0.9, "crit": 3, "desc": "Accesses a private handle member", "from": [ { "file": 18 } ] }, { "id": "metadata/import/npm/deepmerge::deepmerge", "conf": 0.95, "crit": 2, "desc": "imports deepmerge", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-proxy-get-trap", "conf": 0.9, "crit": 3, "desc": "Proxy intercepts property reads", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-nested-concat-this-call", "conf": 0.94, "crit": 3, "desc": "Nested this-concat calls a computed member", "from": [ { "file": 26 } ] }, { "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-assignment-tail", "atk": "T1027", "mbc": "B0032", "conf": 0.97, "crit": 3, "desc": "Variable assigned reverse call result", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::content-type-header", "conf": 0.5, "crit": 3, "desc": "References an HTTP Content-Type header", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-lower", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "References the lowercase websocket keyword", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/1/matcher/comment::relative/1/matcher/comment", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/comment", "from": [ { "file": 11 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 55 } ] }, { "id": "micro-behaviors/mem/alloc/heap::megabyte-buffer-allocation", "conf": 0.86, "crit": 3, "desc": "Source allocates a megabyte-sized buffer", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/1/labeler::relative/1/labeler", "conf": 0.95, "crit": 2, "desc": "imports ./labeler", "from": [ { "file": 10 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/hook-file::process-env-report-field", "atk": "T1552.001", "conf": 0.94, "crit": 3, "desc": "Places process.env in report field", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-delete-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents delete endpoint path", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 3, "desc": "charCodeAt() method call", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/time/query::js-triple-new-date", "conf": 0.4, "crit": 3, "desc": "3+ new Date() calls" }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 26 } ], "uses": [ 217, 338, 362 ] }, { "id": "micro-behaviors/data/string/search::compiled-js-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of JavaScript regex patterns", "from": [ { "file": 1 } ] }, { "id": "metadata/import/npm/relative/2/src/matcher/utils::relative/2/src/matcher/utils", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/utils", "from": [ { "file": 28 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-suffix", "conf": 1.0, "crit": 2, "desc": "Node.js test filename suffix", "from": [ { "file": 28 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 28 } ], "uses": [ 362 ] }, { "id": "metadata/package/testing/presence/manifest::test-fixtures", "conf": 0.8, "crit": 3, "desc": "References to test fixture files", "from": [ { "file": 38 } ] }, { "id": "metadata/build/ci/secret::step-environment-secret-reference", "conf": 0.95, "crit": 3, "desc": "Step environment references an Actions secret" }, { "id": "micro-behaviors/communications/http/services/cloud::github-pages", "conf": 0.5, "crit": 3, "desc": "References a GitHub Pages host" }, { "id": "metadata/import/npm/relative/2/src/matcher/author::relative/2/src/matcher/author", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/author", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/communications/http/webdav::mkcol-method", "conf": 0.95, "crit": 3, "desc": "References the WebDAV MKCOL method", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-subprotocol-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket subprotocol header", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-darwin-branch", "conf": 0.7, "crit": 2, "desc": "Branches on macOS platform value", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::accounts-endpoint-path", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Accounts endpoint path", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-method-call", "conf": 0.75, "crit": 3, "desc": "Calls a Node OS platform method", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/body::request-write-raw-data-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "HTTP request writes a raw data variable", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-fill-call", "conf": 0.8, "crit": 3, "desc": "JavaScript array fill call", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/2/src/matcher/commits::relative/2/src/matcher/commits", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/commits", "from": [ { "file": 31 } ] }, { "id": "metadata/package/completeness::has-config-arg", "conf": 0.75, "crit": 3, "desc": "func parameter likely used as config/options" }, { "id": "metadata/import/npm/relative/2/src/matcher/base-branch::relative/2/src/matcher/base-branch", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/base-branch", "from": [ { "file": 35 } ] }, { "id": "objectives/anti-static/obfuscation/payload/data-file::data-file-js-decoder-runtime", "atk": "T1027", "mbc": "F0001", "conf": 0.88, "crit": 3, "desc": "JavaScript decoder runtime in data", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-url-origin-read", "conf": 0.94, "crit": 3, "desc": "Derives an origin from a URL", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/1/utils::relative/1/utils", "conf": 0.95, "crit": 2, "desc": "imports ./utils", "from": [ { "file": 2 } ] }, { "id": "objectives/exfiltration/http/agent::repo2skill-github-token-marker", "atk": "T1041,T1552.001", "conf": 0.99, "crit": 3, "desc": "GitHub token marker", "from": [ { "file": 41 } ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/backdoor::dnr-response-headers-marker", "conf": 0.86, "crit": 3, "desc": "DNR response headers marker", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/header/retry-after::retry-after-header-name-reference", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "References the Retry-After header name", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Module scope assigns zero-argument call", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/presence/scripted::it-call", "conf": 0.6, "crit": 3, "desc": "it() function call", "from": [ { "file": 28 } ] }, { "id": "metadata/package/completeness::has-config-assignment", "conf": 0.75, "crit": 3, "desc": "Code uses assigned configuration objects" }, { "id": "micro-behaviors/os/env/cicd::process-env-bracket-github", "conf": 0.8, "crit": 3, "desc": "process.env bracket access for github vars", "from": [ { "file": 26 } ] }, { "id": "objectives/impact/crypto-manipulation/weakening::commitment-before-generator", "atk": "T1565.001", "conf": 0.94, "crit": 3, "desc": "Orders commitment before generator", "from": [ { "file": 26 } ] }, { "id": "objectives/impact/ui/manipulation/traffic::hostname-includes-call", "atk": "T1176,T1185,T1041", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Branches on URL hostname.includes", "from": [ { "file": 26 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::test-basename-path", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 3, "desc": "Test file path or basename", "from": [ { "file": 28 } ] }, { "id": "metadata/import/npm/relative/2/src/matcher/branch::relative/2/src/matcher/branch", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/branch", "from": [ { "file": 33 } ] }, { "id": "objectives/execution/activex/com::js-length-bound-string-grow", "atk": "T1059.005", "mbc": "E1243", "conf": 0.86, "crit": 3, "desc": "Grows string past a length bound", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call", "conf": 0.72, "crit": 3, "desc": "Sorts a JavaScript array", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/encode/charcode::codepoint-at", "conf": 0.7, "crit": 3, "desc": "codePointAt() method call", "from": [ { "file": 26 } ] }, { "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps", "conf": 0.85, "crit": 3, "desc": "Package declares a runtime dependency", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-bounded-while-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript bounded while loop", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/request/client::xmlhttprequest-new", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Invokes the XMLHttpRequest constructor", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/process/hook/webextension::dnr-referer-header", "conf": 0.8, "crit": 3, "desc": "DNR rule names Referer header", "from": [ { "file": 26 } ] }, { "id": "well-known/tool/sysadmin/github-runner::worker", "conf": 0.95, "crit": 3, "desc": "GitHub Actions Runner.Worker identifier", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::helper-call-child-process-module-name", "conf": 1.0, "crit": 3, "desc": "Passes child-process module name to helper", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/url/navigation::js-url-host-read", "conf": 0.8, "crit": 3, "desc": "Reads hostname from URL variable", "from": [ { "file": 26 } ] }, { "id": "objectives/credential-access/env/secrets/source-control::github-token", "atk": "T1552.001", "conf": 0.7, "crit": 3, "desc": "GitHub token environment variable access", "from": [ { "file": 19 }, { "file": 20 }, { "file": 23 }, { "file": 26 } ], "uses": [ 68, 83 ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-charcode-decoder", "conf": 0.9, "crit": 3, "desc": "JavaScript hex escape decoder", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 18 } ] }, { "id": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "conf": 0.75, "crit": 3, "desc": "Indirect string replacement call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/env/secret-name::credential-env-read", "conf": 0.9, "crit": 3, "desc": "Reads a credential-bearing environment variable", "from": [ { "off": 115307, "file": 26, "line": 3104 } ], "uses": [ 39 ] }, { "id": "micro-behaviors/fs/read/file/full::read-node", "conf": 0.9, "crit": 3, "desc": "Reads files with Node.js", "from": [ { "file": 17 } ] }, { "id": "metadata/import/npm/js-yaml::js-yaml", "conf": 0.95, "crit": 2, "desc": "imports js-yaml", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/env/cicd::github-env-file", "conf": 0.85, "crit": 3, "desc": "GITHUB_ENV environment file", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "from": [ { "file": 26 } ] }, { "id": "well-known/lib/web/ecmascript::core-js-ie-proto-marker", "conf": 0.95, "crit": 3, "desc": "core-js legacy IE prototype fallback", "from": [ { "file": 26 } ] }, { "id": "metadata/file/format/structured::sourcemap-sources-content", "conf": 0.9, "crit": 3, "desc": "Source map sourcesContent array", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/request/verb::javascript-mutating-method-branch-cluster", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "Branches on mutating HTTP request methods", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/property/identity::host-user-object-fields", "conf": 0.9, "crit": 3, "desc": "Host or user object field keys", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::user-collection-path-token", "conf": 0.92, "crit": 3, "desc": "user collection URL path segment", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/fp-ts/either::fp-ts/either", "conf": 0.95, "crit": 2, "desc": "imports fp-ts/Either", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/os/module/require::dynamic-import-string-literal", "conf": 0.8, "crit": 3, "desc": "Dynamically imports a literal module path" }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-login-word", "conf": 0.45, "crit": 1, "desc": "login route vocabulary word", "from": [ { "file": 26 } ] }, { "id": "metadata/build/bundler/runtime::ncc-runtime-loader-identifier", "conf": 0.98, "crit": 3, "desc": "Code bundled with the ncc webpack runtime", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/fs/path/self::cwd-reference", "conf": 0.84, "crit": 3, "desc": "References the Node.js current working directory", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/url/reference::javascript-comment-url-reference", "conf": 0.9, "crit": 3, "desc": "JavaScript comment contains a URL", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/ui/help::command-run-instruction", "conf": 0.84, "crit": 3, "desc": "Command execution help instruction", "from": [ { "file": 26 } ] }, { "id": "objectives/command-and-control/dropper/delivery/http::bun-loader-build-id", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Bun loader build identifier", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call", "conf": 0.94, "crit": 3, "desc": "DirectoryEntry property write API call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/request/body::req-write", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Write data to HTTP request stream", "from": [ { "file": 26 } ] }, { "id": "metadata/build/bundler/runtime::webpack-bundled", "conf": 0.95, "crit": 3, "desc": "Code bundled with webpack", "from": [ { "file": 18 }, { "file": 23 }, { "file": 26 } ], "uses": [ 13 ] }, { "id": "micro-behaviors/data/source/prototype::return-this-body", "conf": 0.7, "crit": 3, "desc": "Function body returns this" }, { "id": "micro-behaviors/communications/http/client/xmlhttp::js-xmlhttp-open", "conf": 0.8, "crit": 3, "desc": "Opens an XMLHttpRequest connection", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::organization-path-token", "conf": 0.92, "crit": 3, "desc": "organization URL path segment", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/time/query::js-triple-date-now", "conf": 0.4, "crit": 3, "desc": "3+ Date.now() calls", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-github-repository", "conf": 0.78, "crit": 3, "desc": "Reads GITHUB_REPOSITORY CI variable", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-expose-headers-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Expose-Headers header name", "from": [ { "file": 26 } ] }, { "id": "well-known/lib/web/whatwg-encoding::encoding-get-spec-comment", "conf": 0.99, "crit": 3, "desc": "WHATWG encoding-get concept comment", "from": [ { "file": 26 } ] }, { "id": "metadata/package/scripts/build::has-build-script-build", "conf": 0.7, "crit": 3, "desc": "Package declares build script" }, { "id": "micro-behaviors/process/create/shell/bridge::silent-getexecoutput-text", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Silenced output-capturing exec call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-os-platform-alias-branch", "conf": 0.82, "crit": 3, "desc": "Node OS alias platform branch", "from": [ { "file": 20 }, { "file": 23 }, { "off": 68454, "file": 26, "line": 1913 } ], "uses": [ 142, 144, 260, 374 ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-trailing-iife-closure", "conf": 0.85, "crit": 3, "desc": "JavaScript file ends with an IIFE", "from": [ { "file": 18 } ] }, { "id": "metadata/import/npm/relative/2/src/checks::relative/2/src/checks", "conf": 0.95, "crit": 2, "desc": "imports ../src/checks", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-client-id-field", "conf": 0.65, "crit": 3, "desc": "OAuth client_id field", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/path::path", "conf": 0.95, "crit": 2, "desc": "imports path", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-typed-array-reconstruction", "conf": 0.96, "crit": 3, "desc": "Rebuilds Base64 data as typed bytes", "from": [ { "off": 524, "file": 18, "line": 1 }, { "off": 2195538, "file": 19, "line": 1 }, { "file": 20 }, { "file": 21 }, { "file": 22 }, { "off": 1758173, "file": 26, "line": 56999 } ], "uses": [ 85, 165, 345 ] }, { "id": "metadata/package/testing/presence/harness::spec-test-filename", "conf": 0.85, "crit": 2, "desc": "Spec or test filename markers", "from": [ { "file": 28 } ] }, { "id": "objectives/execution/exploit/network-service/exploit-automation::nuclei-remote-http-target-field", "conf": 0.93, "crit": 3, "desc": "Nuclei example hardcodes an HTTP target", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler", "conf": 0.85, "crit": 3, "desc": "Registers asynchronous named event handler" }, { "id": "micro-behaviors/os/module/require::cjs-require-in-try", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside a try block", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/decode/url::js-unescape-call-text", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript unescape in source text", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/1/matcher/body::relative/1/matcher/body", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/body", "from": [ { "file": 11 } ] }, { "id": "metadata/file/format/structured::sourcemap", "conf": 1.0, "crit": 3, "desc": "JavaScript source map", "from": [ { "file": 19 } ] }, { "id": "well-known/lib/stdlib/lodash::domain", "conf": 0.9, "crit": 3, "desc": "Lodash copyright domain reference", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/actions/core::actions/core", "conf": 0.95, "crit": 2, "desc": "imports @actions/core", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy", "conf": 0.8, "crit": 2, "desc": "Copies one indexed array element to another" }, { "id": "micro-behaviors/communications/socket/ssl::reject-unauthorized-false", "conf": 0.9, "crit": 3, "desc": "Node TLS check disabled by option", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript split()", "from": [ { "file": 12 } ] }, { "id": "metadata/package/dependencies/manifest/identity::npm-dep-lodash", "conf": 0.8, "crit": 3, "desc": "npm dependency on lodash" }, { "id": "micro-behaviors/data/string/concat::array-join-empty-separator-text", "conf": 0.78, "crit": 3, "desc": "Array expression joined without separator", "from": [ { "file": 26 } ] }, { "id": "objectives/supply-chain/install-hook/dropper/shell::github-ci-identity-fields", "atk": "T1195.002,T1574.007", "conf": 0.9, "crit": 3, "desc": "Reads GitHub CI actor and repository", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/create/shell/lang::powershell-keyword", "conf": 0.7, "crit": 3, "desc": "Invokes PowerShell with command-line options", "from": [ { "file": 26 } ] }, { "id": "metadata/package/scripts/build::pkg-build-script-field", "conf": 0.6, "crit": 3, "desc": "Package declares a build script" }, { "id": "objectives/supply-chain/trojanized/app/replace::vscode-host-main-file-reference", "atk": "T1195.002,T1608.004", "conf": 0.94, "crit": 3, "desc": "Extension targets VS Code main.js", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/communications/email/mime::mime-octet-stream", "conf": 0.85, "crit": 3, "desc": "Uses the application/octet-stream MIME type", "from": [ { "file": 26 } ] }, { "id": "metadata/package/dependencies/lockfile::resolved-registry-hostname", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Lockfile resolves through a registry host" }, { "id": "micro-behaviors/fs/read/file/full::readfilesync-call", "conf": 0.9, "crit": 3, "desc": "Calls readFileSync", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/communications/ipc/message::js-message-event-listener", "conf": 0.85, "crit": 3, "desc": "Registers an event listener for message events" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/fs/path/construct::invocation-root-path-join", "conf": 0.9, "crit": 3, "desc": "Builds a path under the invocation directory", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/buffer/record::slice-decimal-offset-pair", "conf": 0.8, "crit": 3, "desc": "Slice split at decimal offsets", "from": [ { "file": 26 } ] }, { "id": "metadata/file/catalog/unicode::escaped-unicode-codepoint", "conf": 0.99, "crit": 3, "desc": "Escaped Unicode codepoint in source", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/1/matcher/files::relative/1/matcher/files", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/files", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/http/webhook::webhook-registration-call", "conf": 0.86, "crit": 3, "desc": "Webhook registration call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "from": [ { "file": 18 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Very short domain in URL", "from": [ { "file": 26 } ] }, { "id": "metadata/file/catalog/service::service-name-github", "conf": 0.6, "crit": 3, "desc": "GitHub service name", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/serialize/yaml::javascript-yaml-load", "conf": 0.9, "crit": 3, "desc": "JavaScript parses YAML with yaml.load", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::xhr-sync-response-text", "conf": 0.92, "crit": 3, "desc": "Synchronous XMLHttpRequest reads response text", "from": [ { "off": 2365, "file": 18, "line": 1 } ], "uses": [ 170, 301, 314 ] }, { "id": "micro-behaviors/communications/http/services/github::github-api-host", "conf": 0.86, "crit": 3, "desc": "GitHub API host reference", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/wmi/query::query-os-info", "conf": 0.8, "crit": 3, "desc": "Queries OS information via WMI", "from": [ { "file": 26 } ] }, { "id": "metadata/lang/generated::automatically-generated-source-marker", "conf": 0.85, "crit": 2, "desc": "Generated source provenance marker", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-read-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents read endpoint path", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/string/replace::keyed-replacement-call", "conf": 0.96, "crit": 3, "desc": "Replaces text using a keyed replacement table", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-actions-api-client-import", "conf": 0.98, "crit": 3, "desc": "Imports the GitHub Actions API client", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/ipc/message::js-event-on-message", "conf": 0.8, "crit": 3, "desc": "JavaScript 'message' event listener", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "WebSocket protocol headers", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-app-installation-token-api", "conf": 0.88, "crit": 3, "desc": "GitHub App installation token endpoint path", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source", "conf": 1.0, "crit": 3, "desc": "Source contains low-bit mask syntax", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-win32-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Windows platform value", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/presence/fixture::expect-call", "conf": 0.6, "crit": 2, "desc": "expect() function call", "from": [ { "file": 28 } ] }, { "id": "metadata/build/ci/github-actions::workflow-definition-path", "conf": 0.99, "crit": 3, "desc": "GitHub Actions workflow definition path", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/process/create/shell/path::shell-executable-reference", "conf": 0.9, "crit": 3, "desc": "References a shell executable", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detaches a handle with unref()", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/post::request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Sets POST as an HTTP request method", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/header/custom::multipart-upload", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "Multipart form data upload", "from": [ { "file": 26 } ], "uses": [ 370 ] }, { "id": "micro-behaviors/communications/http/header/custom::file-upload-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "HTTP file upload header stack", "from": [ { "file": 23 }, { "off": 1750808, "file": 26, "line": 56755 } ], "uses": [ 82, 235, 266 ] }, { "id": "metadata/import/npm/relative/2/src/matcher/body::relative/2/src/matcher/body", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/body", "from": [ { "file": 34 } ] }, { "id": "metadata/build/ci/permission::contents-write-permission", "conf": 0.92, "crit": 3, "desc": "GitHub Actions contents write permission" }, { "id": "metadata/build/ci/permission::job-contents-write-permission", "conf": 0.92, "crit": 3, "desc": "Job grants contents write permission" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/response::http-401-unauthorized", "conf": 0.75, "crit": 3, "desc": "HTTP 401 unauthorized response text", "from": [ { "file": 26 } ] }, { "id": "metadata/build/ci/step::action-main-entrypoint", "conf": 1.0, "crit": 3, "desc": "Action declares a main entrypoint" }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-graphql-api-endpoint", "conf": 0.96, "crit": 3, "desc": "GitHub GraphQL API endpoint", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-percent-encoded-url-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JavaScript commented encoded URL context", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL public documentation", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-issue-label-api", "conf": 0.84, "crit": 3, "desc": "GitHub issue label endpoint path", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "metadata/import/npm/eslint/js::eslint/js", "conf": 0.95, "crit": 2, "desc": "imports @eslint/js", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster", "conf": 0.86, "crit": 3, "desc": "Dense computed-property call cluster (3+)" }, { "id": "metadata/build/ci/trigger::scheduled-workflow-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub scheduled workflow trigger" }, { "id": "metadata/build/ci/secret::step-token-input-secret-reference", "conf": 0.95, "crit": 3, "desc": "Step token input references an Actions secret" }, { "id": "metadata/import/npm/eslint-config-prettier::eslint-config-prettier", "conf": 0.95, "crit": 2, "desc": "imports eslint-config-prettier", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-host-port", "conf": 0.86, "crit": 3, "desc": "HTTP options contain hostname and port", "from": [ { "file": 26 } ] }, { "id": "metadata/file/string/telemetry::first-name-field", "conf": 0.9, "crit": 3, "desc": "firstName field name" }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/manipulation::replacement-redaction-marker", "conf": 0.8, "crit": 3, "desc": "Replaces data with a redaction marker", "from": [ { "file": 26 } ] }, { "id": "metadata/package/dependencies/manifest/count::npm-dependency-fanout", "conf": 0.85, "crit": 3, "desc": "Package has at least eight runtime deps" }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-session-word", "conf": 0.45, "crit": 1, "desc": "session route vocabulary word", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::commonjs-module-reexport", "conf": 0.92, "crit": 3, "desc": "CommonJS module re-exports required package", "from": [ { "file": 26 } ] }, { "id": "objectives/evasion/masquerade/traffic::browser-html-accept-header", "atk": "T1071.001", "mbc": "B0030", "conf": 0.8, "crit": 3, "desc": "Browser HTML Accept header literal", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/socket/send::node-socket-write", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node socket writes a data payload" }, { "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest", "atk": "T1195.002", "conf": 0.98, "crit": 3, "desc": "GitHub Action action.yml manifest", "from": [ { "file": 27 } ] }, { "id": "metadata/import/npm/io-ts::io-ts", "conf": 0.95, "crit": 2, "desc": "imports io-ts", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::helper-call-https-module-name", "conf": 1.0, "crit": 3, "desc": "Passes HTTPS module name to helper", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/webdav::propfind-method", "conf": 0.95, "crit": 3, "desc": "References the WebDAV PROPFIND method", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/url/host::url-host-property-assignment", "conf": 0.82, "crit": 3, "desc": "Assigns a request or URL host property", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::response-text", "conf": 0.7, "crit": 3, "desc": "Reads an XMLHttpRequest response body", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/os/env/cicd::github-path-file", "conf": 0.85, "crit": 3, "desc": "GITHUB_PATH environment file", "from": [ { "file": 26 } ] }, { "id": "metadata/build/bundler/asset::has-sourcemap", "conf": 0.9, "crit": 2, "desc": "Code has source map reference", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/user-agent::mobile-user-agent-header-map-read", "conf": 0.94, "crit": 3, "desc": "Reads User-Agent from a header map", "from": [ { "file": 26 } ] }, { "id": "metadata/build/bundler/wrapper::js-tsc-reexport-getter", "conf": 0.97, "crit": 2, "desc": "Transpiled re-export getter (tsc/babel barrel)" }, { "id": "micro-behaviors/data/serialize/schema-object::json-object-variable-field", "conf": 0.84, "crit": 3, "desc": "JSON object includes a variable-valued field", "from": [ { "file": 18 } ] }, { "id": "objectives/anti-static/obfuscation/string/array::js-string-split", "conf": 0.6, "crit": 3, "desc": "Split to empty-delimiter char array", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/response::http-versions", "conf": 0.75, "crit": 3, "desc": "HTTP protocol version strings", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-methods-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Methods header name", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/2/src/matcher/comment::relative/2/src/matcher/comment", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/comment", "from": [ { "file": 32 } ] }, { "id": "well-known/lib/network/public-suffix-list::psl-github-io", "conf": 0.9, "crit": 3, "desc": "Public suffix github.io" }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::xhr-sync-get", "conf": 0.94, "crit": 3, "desc": "Opens a synchronous XMLHttpRequest GET request", "from": [ { "file": 18 } ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json", "from": [ { "file": 15 } ] }, { "id": "metadata/import/npm/relative/1/checks::relative/1/checks", "conf": 0.95, "crit": 2, "desc": "imports ./checks", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-version-access", "conf": 0.72, "crit": 3, "desc": "Reads Node.js version through process.version", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/process/io/stream::process-stdout-data-listener", "conf": 0.9, "crit": 3, "desc": "Registers a process stdout data listener", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/probot/octokit-plugin-config/dist-types/types::probot/octokit-plugin-config/dist-types/types", "conf": 0.95, "crit": 2, "desc": "imports @probot/octokit-plugin-config/dist-types/types", "from": [ { "file": 12 } ] }, { "id": "metadata/import/npm/relative/1/matcher/commits::relative/1/matcher/commits", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/commits", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/decode/custom::js-indexof-charat-lookup", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Indexes characters in a custom alphabet", "from": [ { "file": 26 } ] }, { "id": "objectives/anti-static/obfuscation/eval/require::decode-named-function-decl", "atk": "T1059.007", "mbc": "B0024", "conf": 0.5, "crit": 3, "desc": "Function whose name contains Decode", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-before-await-or-require", "conf": 0.88, "crit": 3, "desc": "Catch block precedes await or require call", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::object-type-dispatch-switch", "conf": 0.93, "crit": 3, "desc": "Switch dispatches on an object type field", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/package-manager/install::build-npm-install", "conf": 0.9, "crit": 3, "desc": "Build installs local npm dependencies", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/data/source/syntax/assignment::indexed-call-assignment", "conf": 0.85, "crit": 3, "desc": "Indexed call assignment target", "from": [ { "file": 26 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/process/io/stream::js-stream-write-call", "conf": 0.88, "crit": 3, "desc": "Calls a write method on a stream" }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/decode/hex::js-parseint-radix-16", "conf": 0.85, "crit": 3, "desc": "JavaScript parseInt with radix 16", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/request/action-resource::named-other-principal", "conf": 0.92, "crit": 3, "desc": "Named other-principal variable", "from": [ { "file": 26 } ] }, { "id": "well-known/lib/stdlib/lodash::lodash-module-memberof", "conf": 0.9, "crit": 3, "desc": "Lodash modular source member marker", "from": [ { "file": 26 } ] }, { "id": "objectives/anti-static/obfuscation/eval/loader::nested-decoder-function-build", "atk": "T1027", "mbc": "B0032", "conf": 0.86, "crit": 3, "desc": "Nested decoder builds function", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key" }, { "id": "metadata/package/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "micro-behaviors/data/encode/char-code::js-high-surrogate-rebuild", "conf": 0.95, "crit": 3, "desc": "Builds a UTF-16 high surrogate code unit", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "from": [ { "file": 26 } ], "uses": [ 69, 107, 135, 366 ] }, { "id": "metadata/import/npm/eslint-plugin-import::eslint-plugin-import", "conf": 0.95, "crit": 2, "desc": "imports eslint-plugin-import", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-token-word", "conf": 0.45, "crit": 1, "desc": "token route vocabulary word", "from": [ { "file": 26 } ] }, { "id": "objectives/command-and-control/channel/tunnel/relay::node-cli-worker-env-flag", "atk": "T1090, T1572", "mbc": "B0030", "conf": 0.84, "crit": 3, "desc": "Node CLI worker environment guard", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/probot/octokit-plugin-config::probot/octokit-plugin-config", "conf": 0.95, "crit": 2, "desc": "imports @probot/octokit-plugin-config", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/data/source/property/attributes::define-property-variable-arguments", "conf": 0.92, "crit": 3, "desc": "Defines an object property using variables" }, { "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call", "conf": 0.88, "crit": 3, "desc": "Calls a matcher in a conditional expression", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment", "conf": 0.94, "crit": 3, "desc": "Assigns character code to array element", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/1/matcher/author::relative/1/matcher/author", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/author", "from": [ { "file": 11 } ] }, { "id": "objectives/supply-chain/hidden-payload/runtime::bun-data-child-process-reference", "atk": "T1195.002", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Bun data payload references child_process", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/server/route::javascript-get-route-condition-cluster", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Server defines several HTTP GET routes", "from": [ { "file": 26 } ] }, { "id": "metadata/build/ci/step::mutable-main-action-ref", "conf": 0.88, "crit": 3, "desc": "Workflow action uses mutable main ref" }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition" }, { "id": "micro-behaviors/fs/write/file/full::js-fs-write-sync", "conf": 1.0, "crit": 3, "desc": "Writes file via Node.js fs", "from": [ { "file": 26 } ] }, { "id": "objectives/command-and-control/channel/covert::port-443-constant-assignment", "atk": "T1573,T1043", "mbc": "C0022.002", "conf": 0.7, "crit": 3, "desc": "Assigns 443 to a port variable", "from": [ { "file": 26 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0xff hex byte token", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access" }, { "id": "metadata/import/package::dep-eslint", "conf": 0.9, "crit": 3, "desc": "Depends on ESLint", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-client-credentials", "conf": 0.86, "crit": 3, "desc": "OAuth client credential fields", "from": [ { "file": 23 }, { "file": 26 } ], "uses": [ 95, 214 ] }, { "id": "metadata/package/testing/presence/scripted::before-each-call", "conf": 0.6, "crit": 3, "desc": "beforeEach hook", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys" }, { "id": "metadata/build/ci/trigger::issue-opened-trigger", "conf": 0.95, "crit": 3, "desc": "GitHub issue-opened workflow trigger" }, { "id": "micro-behaviors/data/string/replace::url-target-replace-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns replaced text to a URL variable", "from": [ { "file": 26 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 2, "desc": "File path or name indicates test code", "from": [ { "file": 28 } ] }, { "id": "metadata/build/ci/trigger::pull-request-target-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub pull_request_target workflow trigger", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Gmail consumer email domain suffix", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/1/matcher/title::relative/1/matcher/title", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/title", "from": [ { "file": 11 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-pattern", "conf": 1.0, "crit": 2, "desc": "Node.js test filename pattern", "from": [ { "file": 28 } ], "uses": [ 134 ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors" }, { "id": "metadata/import/npm/relative/1/matcher/base-branch::relative/1/matcher/base-branch", "conf": 0.95, "crit": 2, "desc": "imports ./matcher/base-branch", "from": [ { "file": 11 } ] }, { "id": "metadata/package/scripts/build::has-build-script-1", "conf": 1.0, "crit": 3, "desc": "Package has compiled build script", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/header/custom::boundary-param", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 2, "desc": "Contains an HTTP multipart boundary parameter", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::structured-sequence-field", "conf": 0.9, "crit": 3, "desc": "Structured object names a sequence field" }, { "id": "micro-behaviors/os/module/require::dynamic-external-import-string-literal", "conf": 0.9, "crit": 3, "desc": "Dynamically imports a non-relative module path" }, { "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call", "conf": 0.9, "crit": 3, "desc": "Calls a computed this method", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-linux-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Linux platform value", "from": [ { "file": 26 } ] }, { "id": "metadata/build/minifier::js-min-or-map-basename", "conf": 0.9, "crit": 3, "desc": "JavaScript minified or map basename" }, { "id": "micro-behaviors/process/interpreter/wasm::webassembly-instantiate", "conf": 0.85, "crit": 3, "desc": "Instantiates a WebAssembly module", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-start", "conf": 0.86, "crit": 3, "desc": "Starts a synchronous function expression", "from": [ { "file": 26 } ] }, { "id": "metadata/file/invisible-unicode::webpack-bootstrap-text", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Webpack bootstrap bundle text", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/url/build::network-destination-function-binding", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Network destination assigned from call", "from": [ { "file": 26 } ] }, { "id": "metadata/build/ci/gate::dependabot-actor-gate", "conf": 0.95, "crit": 3, "desc": "PR target job restricted to Dependabot" }, { "id": "micro-behaviors/data/decode/base64::standard-base64-alphabet-table", "conf": 0.88, "crit": 3, "desc": "Embeds the standard Base64 alphabet table", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/string/concat::js-loop-string-concat-any", "conf": 0.6, "crit": 3, "desc": "String concatenation inside JavaScript loop", "from": [ { "file": 18 } ], "uses": [ 98 ] }, { "id": "micro-behaviors/fs/path/app-data::chromium-extensions-directory", "conf": 0.7, "crit": 3, "desc": "Chromium profile Extensions directory", "from": [ { "file": 19 } ] }, { "id": "metadata/package/dependencies/lockfile::package-lock-has-install-script", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Lockfile dependency has install script" }, { "id": "metadata/import/npm/fs::fs", "conf": 0.95, "crit": 3, "desc": "imports fs", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/communications/http/graphql::api-route", "conf": 0.92, "crit": 3, "desc": "GraphQL API route request", "from": [ { "file": 26 } ] }, { "id": "metadata/build/bundler/wrapper::js-tslib-reexport-helper", "conf": 0.97, "crit": 2, "desc": "Calls a tslib/TypeScript re-export helper" }, { "id": "well-known/lib/stdlib/lodash::lodash-template-print-helper", "conf": 0.95, "crit": 3, "desc": "Lodash template string builder helper", "from": [ { "file": 26 } ] }, { "id": "well-known/lib/stdlib/lodash::run-in-context", "conf": 0.95, "crit": 3, "desc": "lodash.runInContext API method", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 26 } ] }, { "id": "metadata/import/npm/relative/2/src/matcher/title::relative/2/src/matcher/title", "conf": 0.95, "crit": 2, "desc": "imports ../../src/matcher/title", "from": [ { "file": 29 } ] }, { "id": "metadata/import/npm/relative/2/src/labeler::relative/2/src/labeler", "conf": 0.95, "crit": 2, "desc": "imports ../src/labeler", "from": [ { "file": 38 } ] }, { "id": "metadata/file/string/cicd::github-workflow-file-path", "conf": 0.98, "crit": 3, "desc": "GitHub Actions workflow file path", "from": [ { "file": 42 } ] }, { "id": "metadata/import/npm/eslint-plugin-simple-import-sort::eslint-plugin-simple-import-sort", "conf": 0.95, "crit": 2, "desc": "imports eslint-plugin-simple-import-sort", "from": [ { "file": 54 } ] }, { "id": "metadata/import/npm/minimatch::minimatch", "conf": 0.95, "crit": 2, "desc": "imports minimatch", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/content-length::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-string-function", "conf": 0.9, "crit": 3, "desc": "Top-level non-require string call", "from": [ { "file": 26 } ] }, { "id": "metadata/package/testing/presence/fixture::mocha-describe-call", "conf": 0.6, "crit": 2, "desc": "Mocha describe() call", "from": [ { "file": 29 } ] }, { "id": "metadata/package/testing/scripted::go-fuzz-corpus-entry-basename", "conf": 0.96, "crit": 3, "desc": "Go fuzz corpus entry basename (sha1[-index])" } ] } ] } }