{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9408712983131409, "class": 0 } ], "prob": 0.9408713, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T17:42:35Z" }, "path": "pathMappingBasedModuleResolution_rootImport_aliasWithRoot_differentRootTypes.symbols", "raw": { "v": "4", "fs": [ { "f": "O₂(As₂S)Md(Pa)", "x": 1, "id": 0, "is": [ "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "Symbol", "Decl", "import" ], "ms": { "text": { "digit_ratio": 0.1, "space_count": 330.0, "total_lines": 83.0, "char_entropy": 4.94, "unique_chars": 59.0, "import_density": 78.31, "string_density": 0.48, "avg_line_length": 29.61, "max_line_length": 112.0, "empty_line_ratio": 0.25, "last_line_length": 39.0, "long_token_count": 1.0, "most_common_char": "o", "whitespace_ratio": 0.19, "most_common_ratio": 0.09, "identifier_density": 2.57, "line_length_stddev": 19.6, "normalized_import_count": 7.13, "normalized_string_count": 4.39, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.22, "imports_to_functions_ratio": 32.5, "strings_to_functions_ratio": 20.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 3.92, "identifiers_to_functions_ratio": 12.5 }, "imports": { "total": 65.0, "unique_modules": 3.0, "third_party_count": 65.0, "third_party_ratio": 1.0 }, "strings": { "total": 40.0, "url_count": 16.0, "avg_length": 9.8, "max_length": 17.0, "path_count": 10.0, "avg_entropy": 2.43, "total_bytes": 392.0, "entropy_stddev": 0.72 }, "comments": { "chars": 111.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.01, "base64_in_comments": 1.0 }, "functions": { "total": 2.0, "one_liners": 2.0, "avg_name_length": 3.0, "no_params_count": 2.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 2.41, "code_in_functions_ratio": 0.02 }, "identifiers": { "total": 213.0, "avg_length": 3.8, "max_length": 6.0, "min_length": 1.0, "avg_entropy": 1.66, "reuse_ratio": 0.12, "unique_count": 25.0, "length_stddev": 0.85, "has_digit_ratio": 0.72, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.2, "numeric_suffix_count": 18.0 } }, "ss": [ [ 352, "/foo" ], [ 353, "/foo" ], [ 472, "/bar" ], [ 473, "/bar" ], [ 592, "c:/foo" ], [ 593, "c:/foo" ], [ 714, "c:/bar" ], [ 715, "c:/bar" ], [ 836, "c:\\\\foo" ], [ 837, "c:" ], [ 841, "foo" ], [ 959, "c:\\\\bar" ], [ 960, "c:" ], [ 964, "bar" ], [ 1082, "//server/foo" ], [ 1083, "//server/foo" ], [ 1210, "//server/bar" ], [ 1211, "//server/bar" ], [ 1338, "\\\\\\\\server\\\\foo" ], [ 1343, "server" ], [ 1351, "foo" ], [ 1469, "\\\\\\\\server\\\\bar" ], [ 1474, "server" ], [ 1482, "bar" ], [ 1600, "file:///foo" ], [ 1601, "file:///foo" ], [ 1728, "file:///bar" ], [ 1729, "file:///bar" ], [ 1856, "file://c:/foo" ], [ 1857, "file://c:/foo" ], [ 1986, "file://c:/bar" ], [ 1987, "file://c:/bar" ], [ 2116, "file://server/foo" ], [ 2117, "file://server/foo" ], [ 2250, "file://server/bar" ], [ 2251, "file://server/bar" ], [ 2384, "http://server/foo" ], [ 2385, "http://server/foo" ], [ 2518, "http://server/bar" ], [ 2519, "http://server/bar" ] ], "sz": 2624, "ts": [ { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 83.00" ], "i": "metadata/package/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "JavaScript function keyword in non-code file", "e": [ "function foo(" ], "i": "objectives/anti-static/obfuscation/payload::js-function-in-noncode", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Path-like string pattern", "e": [ "c:\\\\foo\";" ], "i": "micro-behaviors/data/text/malware::path-like-pattern", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.48" ], "i": "objectives/anti-static/obfuscation/code-metrics::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Symbol constructor usage marker", "e": [ "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol", "Symbol" ], "i": "metadata/lang/javascript-features::has-symbols-base", "l": 2 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://", "http://", "http://", "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "pathMappingBasedModuleResolution_rootImport_aliasWithRoot_differentRootTypes.symbols" ], "i": "objectives/supply-chain/metadata-anomaly/markers/npm::small-file-5k", "l": 1 }, { "c": 0.949999988079071, "d": "imports import", "e": [ "import" ], "i": "metadata/import/npm::import", "l": 2 } ], "sha": "30e1d3f597bfe91d8535f120c743e651bb63e7c45f16eea3d0824dfe5dfe4ccb", "path": "pathMappingBasedModuleResolution_rootImport_aliasWithRoot_differentRootTypes.symbols", "type": "javascript" } ], "tv": "feb13" } }