{ "llm": { "conf": 0.9999862, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "outcome": "hostile", "interpretation": "Malicious VSCode task executes hidden payload" }, "ml": { "v": "7", "eng": "2.8.0-beta.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 0, "raw": 0.99267054, "rte": "az", "prob": 0.99267054 }, { "cls": 2, "raw": 0.9999794, "rte": "az/tar", "prob": 0.9999794 } ], "prob": 0.9999794, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9999793767929077, "type": "tar.gz" }, { "id": 1, "lvl": 25, "conf": 92, "prob": 0.9950000047683716, "type": "javascript" }, { "id": 2, "lvl": 25, "conf": 92, "prob": 0.9800000190734863, "type": "json" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000010579824447631836, "type": "json" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.000007063150405883789, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-08-18T02:05:41Z" }, "path": "rounakkhanam06-GFG-Coding-Challenge.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zN[tw@rrA[kb\u00261KKvogRl!J\u003crl%jf7O\u003ekk\u003cMQI5Z96-zXx\u003ea[zPD(gN6(WesUeJCM)dS=Q3BU7Xj6^BPaJD]aSrE?oxe/OeB)y9CW!E/C.5l!Z-HGrAix=V^g*{@CVDEPc\u00266hx%+ewu{CLq2k*aS]!e-bhQ5)D8uP", "n": [ { "c": 2, "d": "GZIP compressed file magic", "i": "metadata/file/magic/identity::gzip", "o": 0, "z": 8, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₅(As₄C₂S₃ErXe)H₄(Cm₉Cr₂Db₇Po₄)Md₂(PtPa)", "sha": "4299554eaac198e1f1929061715e830047f8a6f535830e9b236b4999e53a65ed", "path": "rounakkhanam06-GFG-Coding-Challenge.tar.gz", "risk": 558, "size": 1353195, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 1353195.0, "entropy": 8.0, "size_bytes": 1353195.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 1346027.0, "peak_region_entropy": 7.85 } } }, "traits": [ { "id": "micro-behaviors/communications/http/request/configuration::node-http-request-configured", "conf": 0.8, "crit": 3, "desc": "Node HTTP request has hostname and port", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/telemetry::device-model-report-parameter", "conf": 0.86, "crit": 3, "desc": "HTTP query includes device model parameter", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::node-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js built-in http/https module usage", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/tasks::vscode-task-persistence", "atk": "T1547", "mbc": "C0032", "conf": 0.96, "crit": 4, "desc": "VSCode folder-open task runs a fetch or exec command", "from": [ { "file": 2 }, { "off": 758, "file": 3, "line": 21 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-client-usage", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses HTTP client APIs", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/javascript-features::global-campaign-tag", "conf": 0.85, "crit": 3, "desc": "Global campaign identifier assignment", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/delivery/blockchain::ethereum-blockchain-derived-node-stage", "atk": "T1102,T1105,T1027,T1059.007", "mbc": "B0024,B0032", "conf": 0.995, "crit": 5, "desc": "Ethereum history lookup derives network addresses for a remote Node stage", "from": [ { "off": 5017, "file": 1, "line": 1 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/tasks::tasks-run-on-open", "conf": 1.0, "crit": 3, "desc": "VSCode task runs on folder open", "from": [ { "file": 3 } ] }, { "id": "objectives/supply-chain/install-hook/dropper/setup-hook::js-detached-silent-payload-spawn", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Detached silent payload spawn", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn-minified::detached-bang-true", "atk": "T1059", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detached spawn minified true", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "from": [ { "file": 11 } ] }, { "id": "objectives/supply-chain/hidden-payload/trojan::global-campaign-require-alias2", "atk": "T1195.002", "mbc": "C0017", "conf": 0.96, "crit": 5, "desc": "Global campaign identifier with require alias", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn-minified::windowshide-bang-true", "conf": 0.86, "crit": 3, "desc": "Minified windowsHide true option", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-transaction-recipient-field", "conf": 0.9, "crit": 3, "desc": "Reads an Ethereum transaction recipient", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-trailing-iife-closure", "conf": 0.85, "crit": 1, "desc": "JavaScript file ends with an IIFE", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-transaction-byte-context", "conf": 0.9, "crit": 1, "desc": "Ethereum transaction byte context", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-import-time-hook-installation", "conf": 0.92, "crit": 3, "desc": "JS import-time or first-touch hook", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/response::response-payload-base64-header", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Reads base64 payload header", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::multiple-node-base64-decodes", "conf": 0.8, "crit": 3, "desc": "Multiple Node.js Base64 decodes", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-transaction-recipient-ip-split", "conf": 0.94, "crit": 3, "desc": "Splits Ethereum transaction bytes into IPv4-sized slices", "from": [ { "off": 7113, "file": 1, "line": 1 } ] }, { "id": "micro-behaviors/data/buffer::adjacent-four-byte-subarrays", "conf": 0.9, "crit": 2, "desc": "Reads adjacent four-byte subarrays", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::buffer-from-base64", "conf": 0.8, "crit": 3, "desc": "Base64 decoding via Buffer.from (JS)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/user-agent::hardcoded-windows-browser-ua-literal", "conf": 0.82, "crit": 3, "desc": "Hardcoded Windows browser User-Agent literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::blockscout-account-transaction-list-encoded", "conf": 0.9, "crit": 3, "desc": "Encoded Blockscout transaction-list API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "XOR loop uses repeating-key modulo indexing", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ipc/rpc::jsonrpc-2-protocol-object", "conf": 0.9, "crit": 3, "desc": "JSON-RPC 2.0 protocol object", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/javascript-features::global-alias-require", "conf": 0.95, "crit": 4, "desc": "Aliasing require to a global variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::multiple-node-hex-base64-decodes", "conf": 0.8, "crit": 3, "desc": "Multiple Node.js hex or Base64 decodes", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-bracket-require-alias", "atk": "T1027.002", "mbc": "B0032", "conf": 0.94, "crit": 4, "desc": "Obfuscated quoted global require alias", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-blockchain-history-lookup", "conf": 0.94, "crit": 3, "desc": "Looks up Ethereum blocks and account nonce state", "from": [ { "off": 5806, "file": 1, "line": 1 } ] }, { "id": "objectives/supply-chain/hidden-payload/trojan::obfuscated-global-require-loader", "atk": "T1027", "conf": 0.96, "crit": 5, "desc": "Obfuscated JavaScript loader aliases require through global state", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/tasks::tasks-command-exec-media", "conf": 0.95, "crit": 4, "desc": "VSCode task runs font file via node", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/tasks::tasks-auto-approve-setting", "conf": 0.9, "crit": 4, "desc": "Workspace pre-approves automatic tasks", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/url/rpc::ethereum-drpc-provider", "conf": 0.88, "crit": 3, "desc": "dRPC Ethereum JSON-RPC provider", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/infrastructure/blockchain/multi-chain::multi-chain-blockscout-hosts", "atk": "T1102", "conf": 0.95, "crit": 3, "desc": "Multiple Blockscout chain explorers", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-exec", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Node.js child_process execution", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-before-await-or-require", "conf": 0.88, "crit": 3, "desc": "Catch block precedes await or require call", "from": [ { "file": 1 } ] }, { "id": "metadata/package/config::vscode-task-shell-command", "conf": 0.8, "crit": 3, "desc": "VS Code task uses shell execution", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::spawn-node-eval", "atk": "T1059.007", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Spawns node with -e inline code", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-import-time-network-call", "conf": 0.97, "crit": 3, "desc": "Module import executes a network call", "from": [ { "off": 9124, "file": 1, "line": 1 } ] }, { "id": "objectives/supply-chain/install-hook/tasks::tasks-echo-disabled", "conf": 0.9, "crit": 1, "desc": "VSCode task with echo disabled", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/tasks::vscode-task-media-masquerade", "atk": "T1547, T1036.008", "conf": 0.98, "crit": 5, "desc": "VSCode autorun runs disguised media file", "from": [ { "file": 2 }, { "off": 758, "file": 3, "line": 21 } ] }, { "id": "micro-behaviors/process/create/spawn::stdio-ignore", "mbc": "F0005", "conf": 0.85, "crit": 3, "desc": "Spawns a child with standard I/O ignored", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-jsonrpc-block-by-number-method", "conf": 0.9, "crit": 3, "desc": "Ethereum JSON-RPC block lookup", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/xor::js-bytewise-xor-loop", "atk": "T1140", "conf": 0.94, "crit": 3, "desc": "JavaScript mutates bytes with XOR", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/masquerade/extension-mismatch::script-named-as-font", "atk": "T1036.008", "conf": 0.95, "crit": 4, "desc": "Script content under a font extension", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::spawn-node-eval-var", "atk": "T1059.007", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Spawns node -e with variable code", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-bracket-module-alias", "atk": "T1027.002", "mbc": "B0032", "conf": 0.88, "crit": 4, "desc": "Module aliased to global via bracket notation", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/xor::js-repeating-key-buffer-xor-loop", "atk": "T1140", "conf": 0.94, "crit": 3, "desc": "Repeating-key XOR byte loop", "from": [ { "off": 7554, "file": 1, "line": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/encoding::js-global-manipulation", "atk": "T1027.002", "conf": 0.85, "crit": 4, "desc": "Global object manipulation pattern", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::spawn-call", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "Calls spawn() to create a child process", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js http.request", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-jsonrpc-block-number-method", "conf": 0.9, "crit": 3, "desc": "Ethereum JSON-RPC block-number lookup method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-jsonrpc-transaction-count-method", "conf": 0.9, "crit": 3, "desc": "Ethereum transaction-count RPC", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/eval/dynamic::loader-iife-tail", "conf": 0.85, "crit": 1, "desc": "Loader IIFE follows dynamic loader code", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encoded::js-eval-child-process", "atk": "T1059.007", "mbc": "B0032", "conf": 0.95, "crit": 4, "desc": "Nearby dynamic eval and child-process execution", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "HTTP POST request with JSON content type", "from": [ { "off": 4161, "file": 1, "line": 1 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "from": [ { "file": 4 } ], "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::node-interpreter-target", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Spawns the Node.js interpreter", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/instruction/junk-insertion::leading-whitespace-padded-line", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 4, "desc": "Source line begins past column 150", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/url/rpc::ethereum-1rpc-provider", "conf": 0.88, "crit": 3, "desc": "1RPC Ethereum JSON-RPC provider", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/xor::js-xor-key-modulo", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "XOR key uses a modulo index", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-async-iife-import-hook", "conf": 0.9, "crit": 3, "desc": "Async IIFE executes at module end", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0", "conf": 0.7, "crit": 3, "desc": "References Mozilla/5.0 User-Agent prefix", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-global-require-alias", "conf": 0.9, "crit": 3, "desc": "Assigns require to computed global property", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/eval::js-eval-raw", "conf": 0.7, "crit": 3, "desc": "Executes JavaScript dynamically with eval()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/compress/library::node-zlib-import", "conf": 0.72, "crit": 3, "desc": "Imports the Node.js zlib module", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-require-module-aliasing", "atk": "T1027.002", "mbc": "B0024", "conf": 0.98, "crit": 5, "desc": "Global require and module aliasing", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/trigger/ide::ide-auto-run-task", "conf": 0.95, "crit": 3, "desc": "VS Code task runs on open", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/hex::buffer-from-hex-string", "conf": 0.85, "crit": 3, "desc": "Node.js Buffer.from decodes a hexadecimal string", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encoded::js-eval-base64-child-process", "atk": "T1059.007", "mbc": "B0032", "conf": 0.95, "crit": 5, "desc": "eval + base64 decode + child_process (JS trojan)", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/tasks::vscode-task-concealment", "conf": 0.9, "crit": 4, "desc": "VSCode task with concealment properties", "from": [ { "off": 680, "file": 2, "line": 25 }, { "off": 758, "file": 3, "line": 21 } ] }, { "id": "metadata/package/config::task-reveal-never", "conf": 0.86, "crit": 3, "desc": "VS Code task suppresses terminal reveal", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!ty\u0026r=\u003ey+xA+b0!gudKcc0xkzG}vqEMpj-UaNB.L(cj9k:!wP8f6zeS%cy?k:)jTa/NygQ)%a%[S+xkzG}vqEMkj-baFB.\u003eRrj7AhDB95KrBAzE+A+flkx(W=kb3YmAfG7)}BUCHdg*CeSfGg*[BUCHdfD}}%xMOunB3jLPADL#owHF:cBUCHci9ZOWfGg*[BUCHdg*CeSfGgW\u003cBUCHdgA[n0DtEq8j-UaNB.L(cc)z]sfFCBKtY?.OhBy.(fFCyBtY?.OhzME9epgw{oNP6AwPq\u003cbA+cTytY?.Oh-j\u0026.fFCBvtY?.OhBwVqephCSvrVQqj-UaNB.L(cc)z]sfFCyvtY?.OhAj@:fFCyBtY?.OhBy.(fFCywtY?.Ohay?[fFCBttY?.Oh.[SXfFCyOtY?.OhzXPXfFCyxtY?.Oh-1YYfFCBwa$k6fjUXSAfM5BujTacNfFCpptY?.Oh-L5+fFCyttY?.OgC-oUfFCprtY?.OgCSiTfFCsvtY?.OgC@AWfFCyytY?.OgC-oUfFCsutY?.OgC-oUfFCpqtY?.OgCJcSfFCsutY?.OgC-oUfFCpptY?.OgDnSZfFCpptY?.Ohz[-ZfFCpvtY?.OhA1/.fFCpptY?.OgCJcSfFCprtY?.OgCJcSfFCpptY?.OgD5GXfFCpstY?.Ohz[-ZfFCpytY?.OhzFDVfFCsutY?.Og=5xVfFCprtY?.OgC\u0026uVfFCpytY?.OgCA6RfFCsvtY?.OhA1/.fFCpqtY?.OhzDydBz\u003c\u0026\u003eCv+!Zvrl0ddj!4Nb3YmAfG7)}BUCHdg*CeSfGg*[BUCHdfKe-OfGg^)BUCH9l0OK^fFVa5BUCH8mQg6\u0026fG7^[BUCHdg*CeSfG7)}BUCH8mo\u003c%?fG7W\u003eBUCHclTj:/fG8y9BUCHcgHb5RfG8m5BUCHdgHb5RfG7Z(BUCHcmQg6\u0026fGg\u003c]BUCHdg*CeSfFV74BUCHcgHb5RfG8y9BUCHcl%K\u003c*fFVa5BUCHcf\u003cF\u0026PfGgW\u003cBUCHciu*1LjZfJ\u003ee]ClAax8\u0026[c%HUhz!0v1B1R3wB$Mi.nmbm\u003elTJ?\u003eoE}w)BUCHci9ZOWfGg*[BUCHdg*CeSfGgW\u003cBUCHdgHb5RfF=11BUCH8mQg6\u0026fFVa5BUCH9f\u003cF\u0026PfGg:(BUCHdfKe-OfG7Z(BUCH8mo\u003c%?fG7{@BUCHcmQg6\u0026fFVa5BUCHchc+nTfGg*[BUCHci3G)$tY?.OhAj@:fFCBxtY?.Oh-a=ZfFCBttY?.Oh-1YYfFCpGtY?.OgdCI\u003efFCmKtY?.Ohz[-ZfFCBxtY?.OhAj@:fFCmJtY?.Ohz!VYfFCBvtY?.Oh.XGVfFCyvtY?.OgdtC\u003cfFCyOtY?.Oh.[SXfFCyza$K{yBUCHci9ZOWfGg*[BUCHdg*CeSfGgW\u003cBUCHdgHb5RfF=11BUCH8mQg6\u0026fFVa5BUCHchc+nTfGg*[BUCHci9ZOWfG7^[BUCHdgf!@QfG7^[BUCHdhc+nTfG8s7BUCH8l%K\u003c*fGg:(BUCHdfKe-OfG7Z(BUCH8mo\u003c%?fGgW\u003cBUCHdhc+nTfG7W\u003eBUCHclTj:/fG7{@BUCHcgHb5RfG8v8BUCHcmQg6\u0026fG7:)BUCHchc+nTfFV74BUCHcgHb5RfG8y9BUCHcl)sfaxMOunB2\u003e%cwPRPqzddc@zE)]xAckSax\u003e5=8y*?ybvq]{kx(th3e[O*lBy/Fvlt{^UwNPE9dp1G2j:Q%QwPf}Kx)a5GaUUD.wO2*Dy?X67o(\u003c(QB2(9*g+rGLCVeJ\u003cyH}QeiYn*yei#BCb4#7uA5]g7zE[2mxMOune\u003cTbYzGEp5dj=VFBUCHci9ZOWfGg*[BUCHdg*CeSfGgW\u003cBUA", "ln": 0, "col": 1, "line": 1 }, { "b": "c[cPaBus[.B-7Yhx(v(ixMtIyephkBBzbP6i=m88m[3x3emJKdC@/H/B7]o8vqE#CElz}9dskMyzGx[xvlFHtCox)-oEL0iemQ?Ke]U\u0026HBz\u003eVcy=%{Ab3YmAfG7)}BUCHdg*CeSfGg*[BUCHdfKe-OfGg^)BUCH9k{wKbBAzFyi+SRSA4CY^DQhdKwPh-Lb3YmAfG7T\u003cBUCHdfKe-OfGgW\u003cBUCHclTj:/fG7{@BUCHcgHb5RfG7T\u003cBUCHdg*CeSfG7{@BUCHcmQg6\u0026fG8v8BUCH8mQg6\u0026fG8j4BUCHdgHb5RfG8y9BUCHcmiTobtY?.Og+\u0026lTfFCyvtY?.OhzXPXfFCyxtY?.Oh.XGVfFCBxtY?.Ogdkw\u0026fA", "ln": 2381, "col": 2382, "line": 1 }, { "b": "tY?.OhAt2+fFCyOtY?.OhBQ\u003e[fFCmKtY?.OhBgO\u003cfFCBwtY?.OhBZ}]fFCyNa$NCjb13o^By/uieLG.[xlm/ht%gI%w[CQ{e[f9FwLuVMxlm/nwHP5\u0026A+funA=91qwP]m[A=k/eB7D:Fz.b]TjWaj5z/fSraAP+Re]\u003eJyB.bSod0]SCB98qdzdL+pe[/fABz+J7wH}!sA=:uJe]U-HBBnD:vj(Itz//]cz!}N1jTacNfFCyAtY?.Oh-a=ZfFCBxtY?.Oh.XGVfFCBwtY?.OgEiiHg=d0Hi4#^jAa9\u003c4i:\u003cTWvrug2vqPNavj(Rjvrb\u003c\u003eenX%uxM4Axzy/jewO#PJl0E+IAb](sz!0Z4t}y5hxkRc]i==\u0026=wNPaXA=ToQEjPn0k6{^TzGx[xBuKeQc#HE+wJ:m6j9i8[zyuYlBUCHcg*CeSfG7T\u003cBUCHdg*CeSfG7TfeoB3swId}AB7=$zdjEu2e]LRQb4UU5a$Lb\u003ejWaj5z/fSraAP+kB.kk%AXp\u003cuzEW9%c$K?WBz\u003e91A+PA7c)z]sfFCBytY?.Oh-a=ZfFCyytY?.OgDlNce{8bFz73?{x\u003ew=he]#byBAIT(z!9Awgb7zfD#pMTByxolB3\u003c\u003eRwJ\u0026mkfFB}@wPS6nzxJ%FzE[2mmriA!AWUr^bZTzYB97\u0026jB-P]*wmZfIbZTR=B8kM2wHGk-i4#!fu[0J^x\u003ew+pBBnETtqftCjV%#]BUCH9lN3]9BxZC8aW4$jtY?.Oh:OYncuJDCt{hu]b3YmAfF#fvdro0wB-IvxAWU*pCoxs{A=k$Du}JE9DVQ(Yy?Wx\u003cc[)hifE.ATdjEu2A^r1Ic}WAlpa*G]A=U!uBswU2EpDYcv}Wojdsl7-zE[2mmriA!AWUr(iWx5]e]tfvB75Y)EpaGMjahJaj9i8[zyuYlBUCHchc+nTfGg:(BUCHdgf!@QfG8y9BUCHdg9On\u0026dlz@bj9i8[zyuYlBUCHchc+nTfGg:(BUCHdgf!@QfG8y9BUCHdg9On\u0026dlz8:j-kyUy:HGJe{ztIBy=\u003eidlzS7wO#3bdlz@bjagZ-zEW^5z/cXwAWUGIzyG{xz/fSraA6zve]t3oc[3Jck5K}QavfEPA=:V!zGG]qy\u00260W6c[cPbA+funA=91qcmiT-w]zYUvpJ$0BuI*9e[5p3mrSlWBwcy\u0026By/u3AWSbpBUCHcf\u003cF\u0026PfG7W\u003eBUCHcmQg6\u0026fA", "ln": 3042, "col": 3043, "line": 1 }, { "b": "vqZusqz8/{A40bRen=[1k4Mc:en[:gt}QhjxkRc]djDX#w[=c\u003ey\u00261wBc[dqyDUdhpc$vgkB95KDaA7\u003cmzZ/=XvpBd}BsnO1Ejmmaw{503BzkVhaAy%uBs.qXwH}:GDVAXtB-IvxxMtIyephkBBzbP6iWdx@q=B}(vSb!5i.AsDpa*QfA+PA7x\u003ezSsDUNRuzGoYaiWd*KfFCprtY?.OgdtC\u003cfFCppa$NCsiX-g5wPRQ7wiaPVAa9=}zf4:HEjlZ*x\u003eIr(y=VG.dk2ZQwO@]rjW9%uA+frmy\u0026?9/Ep^Rtv@#B6zxJ$ed0d1Tem*nSA+funA=91kAWV2XDU)toxM4Axb3YmAfF$K?BUCHamQg6\u0026fF$T\u003eBUCHbg:jFWz!abOn(FIXe]#bPx(mM$w{C!xe]t3oc[5qwen!-AwHP=ad0]YIz/fPmv(+/sBUCH9gf!@QfFV74BUCH9fD@5ZwiaoLf!vfMBzbP6i=(](vrb^[B2[h!djDX%B7]o8vqE#oEjl^\u003cxK#6fz-{phv@DmaBrCP!zE[2mo\u003c}#?z.t)nA42/\u003ek3JaYx\u003ee=pt}4i:A+funA=91qe]t3oc[6f*zyE.jAXq0oBsq2Sf!1.}wPJ0gBsxq1dlz@/z/fSrayY1EBuI/itY?.OgCA6RfFCBBa$E:/Bz\u003e91A+PA7c]0Rej7-RMv@#B6zxJLdd03?:A+funA=91qwP]m[A=k/eB7D+hjWajewPP5jj--k(wO#d5xGG{uc)rESA+funA=91hc#Kfzy:?CZwPP5kjS#Kwv@DmaBrCP!BuI*mx\u003ew=idro0wB-IvYz-]l$j7-zKc$vgkB95KxaA7\u003cmB17#Vv@DmbA=k=gwPxzivScpec[dk?d0c[1Elh4VAWUBozGx[xBrCHlaAF#Ne](8Lc[c=\u003cxK#6fBuI*mx\u003ew=idro0wB-IvYBu:^]Bsxm5eD", "ln": 4047, "col": 4048, "line": 1 }, { "b": "eoAEgeIRb]Bs/*gBs/*ff(ynHw[=76wPxhvjW9%KjUQ+5dp22EB-7Yhx(v(ivST2pdskMyzGx[xAY[qKCoxgXz/P}!z/fVqz!%l3AWSv#A+funA=cklz/fVqz!%l3AYOj(A=(mXc[dqyCxb8WBs.qUjW9)@d0d0:wPRP)xjVfKy\u0026r*0lu#sGzdm6%a$M@cxEE^FefMYMen=)/AXqAExkRc]dk2ZQwO@]rjWaj5z/fSraz%t:kq44#vqZc{v@#B6zGvvujWBaevr\u003cFtB3T?!vr\u003cnsdl?Y5w[=c[d0dQoBs}fCz/4Y\u003eBz\u003c\u0026\u003eCv+!Zvrl0ddlP*SqZ\u003c+BB.\u003e\u003eQA+funA=91hkyl\u003cQz!0MTB.$P0AYOa\u0026BA/\u0026TEl8m*y?#gYdsBpaw{503BzkVhaz$QoBs.qUDT*#iB95Koj-\u0026q[vq)SpjW96]tY?.Ohz[-ZfFCBxtY?.OhAj@:fFCvNtY?.OhAa(-fFCyxtY?.Oh-a=ZfFCvvtY?.Oh.[SXfFCyt", "ln": 4889, "col": 4890, "line": 1 }, { "b": "jW9)}d0d1Ken=)/zyEhWxK#6fBuI*fe]t3oc{?SXnP5S0dk2asByO#jc[dqyp\u0026ZF\u003ex(^\u0026rvqG:dwId?dA40bswH}+9dlP\u003esAWStTen=[1k5$cYBsZ#Oz.b=Pen=)=dk2ZQwO@]rjW9%uzddxiltp77zGErRdlz@\u0026B-7Yhx(v(iy\u0026.1ydskMyzGx[xAY[qKCoxgXz/P}!z/fVqz!%l3AWSv/CS^D7jW9)svpBd}BsnO1A+funA=90@A=k/eB7D$AwPI^aC4A7ukr\u003c4dy?$KMBzbl6c#RmjzY}nYB.\u003e\u003eUz-S8.c[6f*zyE.jA:{ItefXtwfFCyxtY?.Oh-a=ZfFCyAtY?.Ohay?[fFCyutY?.OhBy.(fFCyOtY?.OhzXPXfFCx", "ln": 5400, "col": 5401, "line": 1 }, { "b": "h.(Ndtu@^$dj/G(B7]o8vqEwBBzbl6d0dQoltp77zGEpGdjDX#Bzbl6d04KnCxb8WBs.qUjW9)@d0d0:wPRP)xjVf:A:-\u003cbvpKy[z/d{XB-8pBel=47vRvfhdp1Gxdj/G(B7]o8vqEwBBzbl6d0dQotxqtZx\u003eH1PBsqkWt}4iPBzbl6c[5qvemz*kjWaj5z/fSray^MyeIRc8y?mYhzAPNazy/uZB30(IzGx[xy=%f}jW9BezAH6pzA\u0026t=c[6f*zyE.jA:{ItefXT", "ln": 5742, "col": 5743, "line": 1 }, { "b": "i=]^iEjmi9BV?{nv@DmaBrCJ=ltp77zGEp3vrufnze0(of!$pPB.$P0AWV5VdjD/WjZhhNw]zYry?mYhBuIu@j9iOFA65d(jUZ?6w?F4BB7=$td%9l?wI4^Gfdp=\u0026f(wA?j91[OB-Ivxzu", "ln": 6208, "col": 6209, "line": 1 }, { "b": "c$K#FeIRb(j91[OB-Ivxy:Z.]Ejl^Xx(mu}y\u003cvBNdlz@\u0026B-7Yhx(v(iy?UpDDVAXtB-IvxxMtIebZSahkw+sHB.\u003eRLvpJ!=B-8pFvpKy[z/dZWCX?8nBs7Bbwo8m5B3g^}q**0lByxiivR/%)yDTu#wO#3/y\u0026r*0jVLI.ixo8WivnYNxjTjXcu0HdB7GCRgb74@z/P}.wmY*(ct3$dBy/G4C%b+Wz/5(he{7=rzyxP\u0026k6{^TzGx[xzAQpaA::kCx(=NXA::kwBu.x#wPJ0gBsxB@e]\u003eJAB.(dXtu@^\u003ej-h(:x(mDfBuI*fe[Pcxz9GT{z+L7[wPydDB7D:GjV$@bdlzMYBAIRwDTZ/fv@1?Zzdm6%iZNK[nP5R#wIdCdz!0MTB.$P0AW-LYCSGz:jaeLtEjeJBD2vaudlP\u003ewv@DmaBrCV*ltp77zGEpnCvticaA}\u0026Od0d1TdlP\u003env\u003c(BIb3YmAfG7^[BUCHdg*CeSfG7)}BUCHbmQg6\u0026fG7W\u003eBUCHclTj:/fG8y9BUCHcgHb5RfG8m5BUCHamo\u003c%?fGg\u003c]BUCHcl%K\u003c*fG7W\u003eBUCHchc+nTfGg:hel=yhzyE1-en^Q)eP-p9j8wFIaz0YACvticazbEsv}3\u003c7dk2ECA42gqdjEt\u0026E0^tNjZ\u0026Lyx(\u003eFlB0#bVe[nsiv}Wobx^\u003eF)v@DmaBrCDRjWKp6w[u0nw].*bc$L2MCRj8Re]\u003eJxy***+c[!)XCRr+Za%FD!b3YmAfG7)}BUCHchc+nTfGg%ndj/gLjZ{MrvP$J(d\u003cwkvfFCmJa$Ebbf\u003cMpNtY?.OgdrxqvP$P[d\u003cwkvfFCmJa$EbbgHhLoz.b{mjZhStc#H^)B9g@2A=LPlc[)hedjD/ZA42PVe]#eAvrcx%C{\u003eH2i4lpZen4aUy\u0026r=\u003ey==nZuSGs5e[)yWe)?dju$:U7A5]T9bZTDTiYF*3j7*fMnhrtoxMOuniXJciDVBJ}i51-4xd^LkuVOwrxMOuniXJciDVar[g=d0@j7*fMByfeNu$:U7A5]T9bZTDTiYF*3j7-RMv@#B6zxJO4c#gwRdskMyzGx[xvM/6Kz/Z2rvqPNpBUmuCB98qdzdLnqz/P}Xd%iE-z/P@ED]J/hAa9\u003c4i^05]vrug2vqPNaBUm-Dvrb\u003c\u003eeneQ6wmY!5i^S5JB7Gwzl1:+DBrS:\u0026o(Ct(y\u00260Jkh7*N9c%7b2wn=WkawL(Uf!+jlj0mQszz\u003cskaB2!3diH]}Abo8!wNXqDBt2Hch.D)AasG(Nr834qaz++cwGTGOv@30iavx*.z/65sf/7KpfFk4ifD:q5w)]Z]feUKAe\u0026byfefX27v\u003ey.9i+H6Lr^YoGEsiU\u003ejZ{MrDT*#iB95Koj.(V^wO#d5xGG*AAWU:nBrCV*fGTwsvLhFdzFa68j9h#6dpMI6u0YWfe[nN6AZK+QwKgz^Br$GEj91[OB-IvxvLh+vq/)4]zF7vwtY?.Oh-j\u0026.fFCBxtY?.OhA1/.fFCpxa$kQ4endg*jWaj5z/fSraz%t:e[!*8wmY!5toWr{fFCBBtY?.Ogdkw\u0026fFCBttY?.OhzFDVfFCBCtY?.OhBy.(fFCyOtY?.OhzFDVfFCywtY?.Ogdkw\u0026fFCyutY?.OgD5GXfFCptb3^oAw*!*udrGlzz*9swwP]m=A=M8sc)z]sfFCyNtY?.OhBZ}]fFCmotY?.OhzOJWfFCpvtY?.OgC*p8j91[OB-IvxCQL[3w[CQ{e[Pcxz76oMb4s#4wI#v?djEubeo9*]jW9:{Cox.5z/6ifwHF%Beoig5k6{^TzGx[xBuKqVBz@\u003cMwPq\u003c7B95*Se?O+=enX%uxM4AxBa2PSjWajbw*?Z-jV%#]BUCHai9ZOWfF\u003eT(BUCHaf\u003cF\u0026PfF\u003eQgdsleSD3:DTxEE:Edlz@/vru0)d0c[+AWV2Ujah00A+frmzdLaAj91[OB-IvYEpEhkB95KojZhhNzz2\u003cBc)AhgByuvABuI*0e]U@OxEE%KdlzA1z/c%EtY?.Ohz[-ZfFCyNtY?.Ohz=Qec[dqyDVTpNDT*#iB95KDjWKp6w[u0nv@Dl{vrr]edlzlQd0d7TwO#d5xEN$kBAIRwaA5VMd0c)!j85pPzz2QlvpS}\u0026B6x?[BUCHdi9ZOWfFV2", "ln": 6437, "col": 6438, "line": 1 }, { "b": "v{%E?xECnTjW9\u003clb3YmAfF\u003e:]BUCHahc+nTfF\u003eH?BUCHag:jv$jagKUD2vamw{503BzkVhaAzoDBs.qXwHR$FA^r1wz/fSraA6zKCvticazkgjzy/(Ueoi)YxkzG}vqGc}uSFKWjTRI4xd^K(E0^R@cP+%Sz^)c\u003etpgXywJ}wzBUCHbmQg6\u0026fF\u003e:kiWd*KfFCvNtY?.Oh-a=ZfFCvNtY?.Oh.#UacTw\u003e.bZT8!xd^KZi+H6LByf9qcP+%Sz^)c\u003etpgXywJ}wzBUCHbmQg6\u0026fF\u003e:]BUCH9g9O+6uVYT$b7g?AjTRI4wJ%/WuQ#}kxd^LkuV*=Aj7\u0026wFvQT7ScVQOuj-UaNB.L(cj7\u0026wFvQT7ScV7kpj-baFB.\u003eRJC42zluUsg[vQT7oxkzG}vqF2kj7S!!wP?G#c#{?RdlzP\u0026vrVPqb5RsfwG\u0026Wfa$WvIeoimVt}ytkwPRu\u003cxK$ZnaUUD*ByY97iWd*KfFCyBtY?.OhAa(-fFCyNtY?.OhBZ}]fFCBvtY?.Ohz(WfCwg@9z*cm[x\u003eg^oaUXr[e{h5LwO9ttjagQEByO#jBszM+Epmtdx(\u003eFry::gjCox)-oEKpZBAzE.fe1O$z*:V6g=3^sCRrMyB6{BFb3YmAfGgZ\u003eBUCH9g*CeSfF\u003eW)BUCHbl0OK^fG8m5BUCHdi9ZOWfF$*{BUCHdlr[T!fFUv/BUCHci9ZOWfFV12BUCHbgHb5RfGg:(BUCH9gHb5RfF=a4BUCHafD@4\u003ef!2g)CvticaAzoDzE[2mrz(Hsu$:U7A5]T9bZTDTiY5VHfedS7y\u0026-#kefXtwfFCBCtY?.Ogdkw\u0026fFCBttY?.Ohay?[fFCpKtY?.Ohz!VYfFCmstY?.OgCA6RfFCsstY?.Ogb-xWfFCsqtY?.Ohap+)fFCpqtY?.OhzFDVfFCvstY?.OhBnPsaUUubEjlM[i@", "ln": 8380, "col": 8381, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "Set" ], [ "", "http.Agent" ], [ "", "https.Agent" ], [ "", "t.pipe" ], [ "", "URL" ], [ "", "Buffer.byteLength" ], [ "", "Promise" ], [ "", "c.request" ], [ "", "ds" ], [ "", "t.on" ], [ "", "e.push" ], [ "", "t.on" ], [ "", "Buffer.concat.toString.trim" ], [ "", "Buffer.concat.toString" ], [ "", "Buffer.concat" ], [ "", "Error" ], [ "", "t.slice" ], [ "", "Error" ], [ "", "t.slice" ], [ "", "JSON.parse" ], [ "", "Error" ], [ "", "t.on" ], [ "", "t.on" ], [ "", "t.write" ], [ "", "t.end" ], [ "", "R.map" ], [ "", "AbortController" ], [ "", "o.forEach" ], [ "", "n.addEventListener" ], [ "", "t.abort" ], [ "", "Promise.any.finally" ], [ "", "Promise.any" ], [ "", "R.map" ], [ "", "t.abort" ], [ "", "hr.then" ], [ "", "hr" ], [ "", "JSON.stringify" ], [ "", "hr.then" ], [ "", "hr" ], [ "", "JSON.stringify" ], [ "", "n.map" ], [ "", "Map" ], [ "", "o.map" ], [ "", "n.map" ], [ "", "r.get" ], [ "", "t.toString" ], [ "", "Promise" ], [ "", "n.controller.abort" ], [ "", "t.run.then.catch" ], [ "", "t.run.then" ], [ "", "t.run" ], [ "", "Set" ], [ "", "AbortController" ], [ "", "wr.then" ], [ "", "wr" ], [ "", "rc" ], [ "", "bh" ], [ "", "Array.isArray" ], [ "", "n.find" ], [ "", "t.from.toLowerCase" ], [ "", "t.map" ], [ "", "bh" ], [ "", "wr.then.catch" ], [ "", "wr.then" ], [ "", "wr" ], [ "", "rb" ], [ "", "t.map" ], [ "", "Promise.all.then" ], [ "", "Promise.all" ], [ "", "e.map" ], [ "", "wr" ], [ "", "rc" ], [ "", "t.map" ], [ "", "AbortController" ], [ "", "r.abort" ], [ "", "Promise.resolve.then.then.then.finally" ], [ "", "Promise.resolve.then.then.then" ], [ "", "Promise.resolve.then.then" ], [ "", "Promise.resolve.then" ], [ "", "Promise.resolve" ], [ "", "wr.then" ], [ "", "wr" ], [ "", "rc" ], [ "", "BigInt" ], [ "", "wr.then" ], [ "", "wr" ], [ "", "rc" ], [ "", "bh" ], [ "", "BigInt" ], [ "", "wr.then" ], [ "", "wr" ], [ "", "rc" ], [ "", "bh" ], [ "", "m.from.toLowerCase" ], [ "", "BigInt" ], [ "", "BigInt" ], [ "", "BigInt" ], [ "", "BigInt" ], [ "", "Math.min" ], [ "", "Number" ], [ "", "f.push" ], [ "", "na.then" ], [ "", "na" ], [ "", "h.findIndex" ], [ "", "hr.then" ], [ "", "hr" ], [ "", "Array.isArray" ], [ "", "n.find" ], [ "", "t.from.toLowerCase" ], [ "", "BigInt" ], [ "", "BigInt" ], [ "", "wr" ], [ "", "rc" ], [ "", "fm" ], [ "", "cb.map" ], [ "", "cb" ], [ "", "ls.catch" ], [ "", "ls" ], [ "", "Buffer.from" ], [ "", "e.tx.to.replace" ], [ "", "ip" ], [ "", "n2.subarray" ], [ "", "ip" ], [ "", "n2.subarray" ], [ "", "k.charCodeAt" ], [ "", "b.toString" ], [ "", "Error" ], [ "", "Buffer.from" ], [ "", "Promise" ], [ "", "http.request" ], [ "", "n.resume" ], [ "", "n.on" ], [ "", "e.push" ], [ "", "n.on" ], [ "", "Buffer.concat" ], [ "", "Error" ], [ "", "n.on" ], [ "", "t.on" ], [ "", "t.end" ], [ "", "q.catch" ], [ "", "gc" ], [ "", "eval" ], [ "", "spawn.unref" ], [ "", "spawn" ], [ "", "rl" ], [ "", "URL" ], [ "", "rl" ], [ "", "URL" ], [ "", "\\u0063\\u0068\\u0069\\u006C\\u0064\\u005F\\u0070\\u0072\\u006F\\u0063\\u0065\\u0073\\u0073" ], [ "", "\\u0068\\u0074\\u0074\\u0070" ], [ "", "\\u0068\\u0074\\u0074\\u0070\\u0073" ], [ "", "\\u0075\\u0072\\u006C" ], [ "", "\\u007A\\u006C\\u0069\\u0062" ] ], "mbr": [ "Array.isArray", "Buffer.byteLength", "Buffer.concat", "Buffer.concat.toString", "Buffer.concat.toString.trim", "Buffer.from", "JSON.parse", "JSON.stringify", "Math.min", "Promise.all", "Promise.all.then", "Promise.any", "Promise.any.finally", "Promise.resolve", "Promise.resolve.then", "Promise.resolve.then.then", "Promise.resolve.then.then.then", "Promise.resolve.then.then.then.finally", "R.map", "a.hostname", "a.pathname", "a.port", "a.protocol", "a.search", "b.length", "b.toString", "c.request", "cb.map", "e.blockNumber", "e.map", "e.push", "e.tx", "e.tx.to", "e.tx.to.replace", "f.length", "f.push", "g._H", "g._H2", "g._V", "g._t_s", "g._t_u", "g.i", "global.i", "global.m", "global.r", "h.findIndex", "hr.then", "http.Agent", "http.request", "https.Agent", "i.transactions", "k.charCodeAt", "k.length", "ls.catch", "m.from", "m.from.toLowerCase", "m.nonce", "n.addEventListener", "n.controller", "n.controller.abort", "n.find", "n.headers", "n.map", "n.on", "n.resume", "n.statusCode", "n2.subarray", "na.then", "o.forEach", "o.map", "process.env", "process.env.ETH_RPC_URL", "q.catch", "r.abort", "r.get", "r.get.result", "r.signal", "s.length", "spawn.unref", "t.abort", "t.end", "t.from", "t.from.toLowerCase", "t.headers", "t.id", "t.length", "t.map", "t.message", "t.nonce", "t.on", "t.pipe", "t.result", "t.run", "t.run.then", "t.run.then.catch", "t.slice", "t.toString", "t.transactions", "t.write", "u.hostname", "u.pathname", "u.port", "u.search", "wr.then", "wr.then.catch", "zlib.createBrotliDecompress", "zlib.createGunzip", "zlib.createInflate" ], "tgt": [ "AbortController", "Array.isArray", "BigInt", "Buffer.byteLength", "Buffer.concat", "Buffer.concat.toString", "Buffer.concat.toString.trim", "Buffer.from", "Error", "JSON.parse", "JSON.stringify", "Map", "Math.min", "Number", "Promise", "Promise.all", "Promise.all.then", "Promise.any", "Promise.any.finally", "Promise.resolve", "Promise.resolve.then", "Promise.resolve.then.then", "Promise.resolve.then.then.then", "Promise.resolve.then.then.then.finally", "R.map", "Set", "URL", "b.toString", "bh", "c.request", "cb", "cb.map", "ds", "e", "e.map", "e.push", "e.tx.to.replace", "eval", "f", "f.push", "fm", "gc", "h", "h.findIndex", "hr", "hr.then", "http.Agent", "http.request", "https.Agent", "ip", "k.charCodeAt", "l", "ls", "ls.catch", "m.from.toLowerCase", "n.addEventListener", "n.controller.abort", "n.find", "n.map", "n.on", "n.resume", "n2.subarray", "na", "na.then", "o", "o.forEach", "o.map", "q", "q.catch", "r", "r.abort", "r.get", "rb", "rc", "require", "rl", "spawn", "spawn.unref", "t.abort", "t.end", "t.from.toLowerCase", "t.map", "t.on", "t.pipe", "t.run", "t.run.then", "t.run.then.catch", "t.slice", "t.toString", "t.write", "wr", "wr.then", "wr.then.catch", "x" ], "funcs": [ [ "ds", 2009 ], [ "hr", 2388 ], [ "anonymous", 3153 ], [ "n", 3348 ], [ "t", 3403 ], [ "anonymous", 3428 ], [ "wr", 3880 ], [ "anonymous", 3911 ], [ "t", 3958 ], [ "anonymous", 4013 ], [ "anonymous", 4057 ], [ "anonymous", 4091 ], [ "rc", 4127 ], [ "t", 4266 ], [ "rb", 4280 ], [ "anonymous", 4372 ], [ "o", 4459 ], [ "t", 4485 ], [ "anonymous", 4512 ], [ "t", 4551 ], [ "fm", 4584 ], [ "e", 4618 ], [ "t", 4675 ], [ "t", 4771 ], [ "anonymous", 4820 ], [ "t", 4862 ], [ "t", 4916 ], [ "bt", 4928 ], [ "anonymous", 4997 ], [ "anonymous", 5004 ], [ "t", 5068 ], [ "t", 5122 ], [ "na", 5197 ], [ "t", 5228 ], [ "anonymous", 5395 ], [ "t", 5420 ], [ "anonymous", 5444 ], [ "anonymous", 5466 ], [ "anonymous", 5478 ], [ "t", 5507 ], [ "ls", 5527 ], [ "anonymous", 5574 ], [ "o", 5625 ], [ "anonymous", 5641 ], [ "t", 5767 ], [ "s", 5787 ], [ "anonymous", 5793 ], [ "t", 5859 ], [ "anonymous", 5883 ], [ "anonymous", 5928 ], [ "anonymous", 5943 ], [ "i", 6007 ], [ "u", 6216 ], [ "h", 6340 ], [ "t", 6364 ], [ "li", 6472 ], [ "t", 6623 ], [ "t", 6681 ], [ "anonymous", 6763 ], [ "anonymous", 6797 ], [ "b", 7050 ], [ "gc", 7262 ], [ "b", 7506 ], [ "t", 7628 ], [ "s", 7832 ], [ "anonymous", 7847 ], [ "n", 7892 ], [ "t", 8001 ], [ "anonymous", 8041 ], [ "anonymous", 8386 ], [ "rl", 8422 ] ], "metrics": { "ast": { "op.eq": 15, "op.ge": 3, "op.gt": 1, "op.le": 3, "op.lt": 2, "op.ne": 6, "op.add": 19, "op.div": 1, "op.lor": 13, "op.mod": 2, "op.mul": 1, "op.sub": 15, "op.xor": 1, "op.land": 10, "op.lnot": 14, "max_depth": 34, "call_count": 184, "node_count": 4583, "op.coalesce": 1, "member_count": 108, "max_array_len": 6, "op_density.eq": 0, "op_density.ge": 0, "op_density.gt": 0, "op_density.le": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.mod": 0, "op_density.mul": 0, "op_density.sub": 0, "op_density.xor": 0, "sequence_count": 3, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 7, "member_depth_max": 6, "xor_mod_loop_count": 1, "op_density.coalesce": 0 }, "file": { "size": 9129, "entropy": 5.3 }, "text": { "lines": 1, "top_char": 48, "max_ws_run": 1, "digit_ratio": 0.35, "space_count": 630, "char_entropy": 5.3, "unique_chars": 89, "top_char_null": 0, "escape_density": 5.65, "lines_over_200": 1, "lines_over_500": 1, "string_density": 88, "top_char_ratio": 0.12, "avg_line_length": 9129, "lines_over_1000": 1, "max_line_length": 9129, "last_line_length": 9129, "long_token_count": 29, "whitespace_ratio": 0.07, "identifier_density": 791, "encoded_string_ratio": 0.01, "unicode_escape_count": 516, "normalized_string_count": 88, "repeated_char_sequences": 1, "suspicious_identifier_ratio": 0.19 }, "binds": { "count": 76 }, "binary": { "peak_region_bytes": 6057, "peak_region_entropy": 5.49 }, "source": { "function_count": 12 }, "imports": { "count": 5, "third_party_count": 5, "third_party_ratio": 1 }, "strings": { "hex": 1, "bytes": 1258, "count": 88, "url_count": 11, "avg_length": 14.3, "max_length": 178, "avg_entropy": 2.55, "empty_count": 2, "entropy_stddev": 1.2, "high_entropy_count": 1 }, "functions": { "count": 12, "nested": 31, "density": 7100, "anonymous": 59, "avg_params": 0.68, "code_ratio": 71, "max_params": 4, "one_liners": 71, "avg_name_length": 2, "no_params_count": 46, "avg_length_lines": 1, "max_length_lines": 1, "min_length_lines": 1, "avg_nesting_depth": 1.59, "max_nesting_depth": 5, "single_char_params": 47, "avg_param_name_length": 1.71 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_font": 1 }, "identifiers": { "count": 791, "unique": 146, "avg_length": 4.86, "max_length": 22, "min_length": 1, "avg_entropy": 1.7, "reuse_ratio": 0.18, "length_stddev": 3.62, "has_digit_ratio": 0.01, "sequential_names": 28, "single_char_count": 27, "single_char_ratio": 0.18, "high_entropy_count": 1, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.7, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 2, "underscore_prefix_count": 5 } } }, "id": 1, "mol": "K(Mc)O₄(C₄As₈ErS)H₆(BrCm₁₂Cr₃Db₁₂OsPo₉)Md₃(BkIn)", "path": "rounakkhanam06-GFG-Coding-Challenge.tar.gz!!GFG-Coding-Challenge-881f80a2280f6d7f62c74b4c391130d7def8a6e8/public/fonts/fa-solid-400.woff2", "pid": 0, "risk": 258, "sha": "9fbb31129c04e8eb1a50519fc864c74d1b20d57c07d4099348f8fbc9a1a1eae6", "size": 9129, "traits": [ { "id": "metadata/build/bundler/wrapper::umd-module-object-check", "conf": 0.9, "crit": 3, "desc": "UMD CommonJS guard", "spans": [ [ 0, 24 ], [ 541, 24 ] ] }, { "id": "metadata/file/extension/identity::script-content-extension-mismatch", "conf": 0.9, "crit": 3, "desc": "Script content mismatches extension", "spans": [ [ 0, 45 ] ] }, { "id": "metadata/file/padding::extreme-leading-whitespace-long-line", "conf": 0.9, "crit": 2, "desc": "Source line has extreme leading whitespace", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "spans": [ [ 765, 7 ] ] }, { "id": "metadata/import/builtin::require-http", "conf": 0.75, "crit": 3, "desc": "Imports the Node.js HTTP module", "spans": [ [ 596, 7 ] ] }, { "id": "metadata/import/builtin::require-https", "conf": 0.78, "crit": 3, "desc": "Imports the Node.js HTTPS module", "spans": [ [ 638, 7 ] ] }, { "id": "metadata/lang/javascript-features::global-underscore-v-assignment", "conf": 0.85, "crit": 2, "desc": "Assigns the global _V property", "spans": [ [ 0, 0 ], [ 8476, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 0, 0 ], [ 4096, 0 ] ] }, { "id": "micro-behaviors/browser-extension/lifecycle::external-url-io-domain", "conf": 0.8, "crit": 3, "desc": "References an .io-domain HTTP(S) URL", "spans": [ [ 1359, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/accept::accept-json-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Requests a JSON HTTP response", "spans": [ [ 0, 24 ] ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "spans": [ [ 0, 6 ], [ 4168, 6 ] ] }, { "id": "micro-behaviors/communications/http/post::request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Sets POST as an HTTP request method", "spans": [ [ 0, 13 ], [ 4161, 13 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js http.request", "spans": [ [ 7863, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-host-port", "conf": 0.86, "crit": 3, "desc": "HTTP options contain hostname and port", "spans": [ [ 0, 25 ], [ 3180, 25 ], [ 7288, 25 ] ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-object", "conf": 0.86, "crit": 3, "desc": "HTTP options object with host or port", "spans": [ [ 0, 34 ], [ 7279, 34 ] ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-request-configured", "conf": 0.8, "crit": 3, "desc": "Node HTTP request has hostname and port", "spans": [ [ 0, 41 ], [ 3170, 41 ] ] }, { "id": "micro-behaviors/communications/http/response::response-payload-base64-header", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Reads base64 payload header", "spans": [ [ 0, 54 ] ] }, { "id": "micro-behaviors/communications/http/response::x-payload-header-prefix", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "HTTP x-payload response header prefix", "spans": [ [ 0, 13 ] ] }, { "id": "micro-behaviors/communications/http/services/blockchain::explorer-module-account-fragment", "conf": 0.88, "crit": 3, "desc": "Block-explorer module=account query fragment", "spans": [ [ 0, 128 ], [ 6501, 10 ] ] }, { "id": "micro-behaviors/communications/http/url/rpc::ethereum-1rpc-provider", "conf": 0.88, "crit": 3, "desc": "1RPC Ethereum JSON-RPC provider", "spans": [ [ 0, 128 ] ] }, { "id": "micro-behaviors/communications/http/url/rpc::ethereum-blastapi-provider", "conf": 0.9, "crit": 3, "desc": "BlastAPI Ethereum JSON-RPC provider", "spans": [ [ 0, 128 ], [ 1820, 30 ] ] }, { "id": "micro-behaviors/communications/http/url/rpc::ethereum-blastapi-provider-unicode", "conf": 0.9, "crit": 3, "desc": "Unicode-escaped BlastAPI RPC provider", "spans": [ [ 0, 103 ] ] }, { "id": "micro-behaviors/communications/http/url/rpc::ethereum-drpc-provider", "conf": 0.88, "crit": 3, "desc": "dRPC Ethereum JSON-RPC provider", "spans": [ [ 0, 128 ] ] }, { "id": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0", "conf": 0.7, "crit": 3, "desc": "References Mozilla/5.0 User-Agent prefix", "spans": [ [ 0, 128 ], [ 7373, 13 ] ] }, { "id": "micro-behaviors/communications/http/user-agent::hardcoded-windows-browser-ua-literal", "conf": 0.82, "crit": 3, "desc": "Hardcoded Windows browser User-Agent literal", "spans": [ [ 7373, 106 ] ] }, { "id": "micro-behaviors/communications/rpc::jsonrpc-2-protocol-object", "conf": 0.9, "crit": 3, "desc": "JSON-RPC 2.0 protocol object", "spans": [ [ 0, 12 ] ] }, { "id": "micro-behaviors/communications/rpc::object-method-rpc-request", "conf": 0.9, "crit": 3, "desc": "Object request call with RPC method field", "spans": [ [ 0, 105 ], [ 3170, 135 ], [ 7867, 21 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::blockscout-account-transaction-list-encoded", "conf": 0.9, "crit": 3, "desc": "Encoded Blockscout transaction-list API", "spans": [ [ 0, 103 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::blockscout-host-fragment", "conf": 0.9, "crit": 3, "desc": "Split Blockscout Ethereum host fragment", "spans": [ [ 0, 128 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-jsonrpc-block-by-number-method", "conf": 0.9, "crit": 3, "desc": "Ethereum JSON-RPC block lookup", "spans": [ [ 0, 20 ], [ 5017, 20 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-jsonrpc-block-number-method", "conf": 0.9, "crit": 3, "desc": "Ethereum JSON-RPC block-number lookup method", "spans": [ [ 0, 15 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-jsonrpc-transaction-count-method", "conf": 0.9, "crit": 3, "desc": "Ethereum transaction-count RPC", "spans": [ [ 0, 23 ], [ 5806, 23 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-recipient-hex-encoding", "conf": 0.92, "crit": 3, "desc": "Recipient Buffer uses hex encoding", "spans": [ [ 0, 45 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-transaction-recipient-field", "conf": 0.9, "crit": 3, "desc": "Reads an Ethereum transaction recipient", "spans": [ [ 0, 5 ], [ 7000, 5 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/query::blockscout-ethereum-api-endpoint", "conf": 0.9, "crit": 3, "desc": "References a Blockscout Ethereum API endpoint", "spans": [ [ 1137, 30 ] ] }, { "id": "micro-behaviors/data/buffer::adjacent-four-byte-subarrays", "conf": 0.9, "crit": 2, "desc": "Reads adjacent four-byte subarrays", "spans": [ [ 0, 0 ], [ 7113, 0 ] ] }, { "id": "micro-behaviors/data/buffer::javascript-write-then-end-stream", "conf": 0.9, "crit": 3, "desc": "JavaScript writes then ends a stream", "spans": [ [ 0, 17 ], [ 3858, 17 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors", "spans": [ [ 8830, 2 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression", "spans": [ [ 0, 4 ], [ 9124, 4 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-trailing-iife-closure", "conf": 0.85, "crit": 3, "desc": "JavaScript file ends with an IIFE", "spans": [ [ 9124, 5 ] ] }, { "id": "micro-behaviors/data/decode/symbol-base64::buffer-from-base64", "conf": 0.8, "crit": 3, "desc": "Base64 decoding via Buffer.from (JS)", "spans": [ [ 7803, 11 ] ] }, { "id": "micro-behaviors/data/decode/xor::js-bytewise-xor-loop", "atk": "T1140", "conf": 0.94, "crit": 3, "desc": "JavaScript mutates bytes with XOR", "spans": [ [ 0, 18 ], [ 7554, 18 ] ] }, { "id": "micro-behaviors/data/decode/xor::js-xor-key-modulo", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "XOR key uses a modulo index", "spans": [ [ 0, 15 ], [ 7562, 15 ] ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 3, "desc": "charCodeAt() method call", "spans": [ [ 0, 128 ], [ 7561, 12 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::json-object-body-field", "conf": 0.9, "crit": 3, "desc": "Serializes an object into a body field", "spans": [ [ 0, 21 ], [ 4175, 21 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::json-object-variable-field", "conf": 0.84, "crit": 3, "desc": "JSON object includes a variable-valued field", "spans": [ [ 0, 64 ], [ 4180, 79 ], [ 4351, 101 ] ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access", "spans": [ [ 0, 8 ], [ 4269, 8 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "spans": [ [ 3441, 22 ], [ 4569, 10 ], [ 7585, 10 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 0, 8 ], [ 3458, 8 ] ] }, { "id": "micro-behaviors/process/create/minified-spawn::detached-bang-true", "atk": "T1059", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detached spawn minified true", "spans": [ [ 0, 11 ], [ 8739, 11 ] ] }, { "id": "micro-behaviors/process/create/minified-spawn::windowshide-bang-true", "conf": 0.86, "crit": 3, "desc": "Minified windowsHide true option", "spans": [ [ 0, 14 ], [ 8796, 14 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "child_process module name literal", "spans": [ [ 774, 13 ] ] }, { "id": "micro-behaviors/process/create/spawn::bare-spawn-call", "conf": 0.75, "crit": 3, "desc": "Bare spawn function call", "spans": [ [ 8714, 5 ] ] }, { "id": "micro-behaviors/process/create/spawn::node-interpreter-target", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Spawns the Node.js interpreter", "spans": [ [ 0, 12 ], [ 8714, 12 ] ] }, { "id": "micro-behaviors/process/create/spawn::stdio-ignore", "mbc": "F0005", "conf": 0.85, "crit": 3, "desc": "Spawns a child with standard I/O ignored", "spans": [ [ 0, 14 ] ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "spans": [ [ 0, 11 ], [ 7989, 11 ] ] }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "spans": [ [ 0, 10 ], [ 3417, 10 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/xor::eval-call-site", "atk": "T1027,T1059.007", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Calls eval on recovered source", "spans": [ [ 0, 5 ], [ 8704, 5 ] ] }, { "id": "objectives/anti-static/obfuscation/imports::escaped-require-module", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 4, "desc": "require module uses ASCII escapes", "spans": [ [ 596, 15 ], [ 685, 15 ], [ 727, 15 ], [ 765, 15 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/blockchain::blockchain-hex-stage-path", "atk": "T1105", "conf": 0.96, "crit": 4, "desc": "Blockchain C2 hex-prefixed stage path", "spans": [ [ 0, 11 ], [ 8862, 11 ], [ 9008, 10 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::json-cookie-hidden-stage-options", "atk": "T1105", "mbc": "E1105.016", "conf": 0.97, "crit": 3, "desc": "JSON cookie contains hidden stage", "spans": [ [ 0, 128 ], [ 8796, 11 ] ] }, { "id": "objectives/command-and-control/infrastructure/blockchain/ethereum::etherhiding-campaign-wallet-prefix", "atk": "T1102", "mbc": "B0030", "conf": 0.95, "crit": 4, "desc": "EtherHiding campaign Ethereum wallet prefix", "spans": [ [ 0, 128 ] ] }, { "id": "objectives/command-and-control/infrastructure/blockchain/ethereum::etherhiding-campaign-wallet-prefix-unicode", "atk": "T1102", "mbc": "B0030", "conf": 0.95, "crit": 4, "desc": "Unicode-escaped EtherHiding wallet prefix", "spans": [ [ 0, 103 ] ] }, { "id": "objectives/command-and-control/infrastructure/blockchain/multi-chain::ethereum-contract-address-literal", "atk": "T1102", "conf": 0.9, "crit": 3, "desc": "Ethereum smart contract address literal", "spans": [ [ 0, 42 ] ] }, { "id": "objectives/command-and-control/infrastructure/blockchain/multi-chain::multi-chain-blockscout-hosts", "atk": "T1102", "conf": 0.95, "crit": 3, "desc": "Multiple Blockscout chain explorers", "spans": [ [ 0, 18 ] ] }, { "id": "objectives/evasion/masquerade/extension-mismatch::script-named-as-font", "atk": "T1036.008", "conf": 0.95, "crit": 4, "desc": "Script content under a font extension", "spans": [ [ 0, 60 ] ] }, { "id": "objectives/supply-chain/hidden-payload/runtime::node-base64-buffer-decode", "atk": "T1027", "conf": 0.88, "crit": 3, "desc": "Node decodes a base64 buffer", "spans": [ [ 0, 23 ], [ 7803, 23 ] ] }, { "id": "well-known/malware/supply-chain/contagious-interview::etherhiding-global-i-marker", "atk": "T1195.001", "conf": 0.98, "crit": 3, "desc": "EtherHiding global.i assignment marker", "spans": [ [ 0, 13 ], [ 507, 13 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "spans": [ [ 2534, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 0, 32 ] ] }, { "id": "micro-behaviors/communications/http/request/client::generic-request-method-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.4, "crit": 3, "desc": "Generic .request() method call", "spans": [ [ 0, 13 ], [ 7863, 13 ] ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request", "spans": [ [ 4161, 6 ], [ 4168, 6 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "spans": [ [ 1137, 26 ], [ 1359, 15 ], [ 1476, 20 ], [ 1599, 35 ], [ 1812, 38 ] ] }, { "id": "micro-behaviors/communications/ip/endpoint::http-port-80", "conf": 0.6, "crit": 3, "desc": "HTTP service port number", "spans": [ [ 0, 14 ], [ 7174, 14 ], [ 7197, 14 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 0, 103 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-https-url", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL decoded to https", "spans": [ [ 0, 103 ] ] }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop", "conf": 0.8, "crit": 3, "desc": "Loop XORs through modulo-indexed accumulator", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-before-await-or-require", "conf": 0.88, "crit": 3, "desc": "Catch block precedes await or require call", "spans": [ [ 0, 82 ], [ 8822, 16 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "spans": [ [ 0, 10 ], [ 8822, 10 ] ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "spans": [ [ 0, 22 ], [ 7803, 22 ] ] }, { "id": "micro-behaviors/data/decode/base64::multiple-node-base64-decodes", "conf": 0.8, "crit": 3, "desc": "Multiple Node.js Base64 decodes", "spans": [ [ 0, 23 ], [ 7803, 23 ] ] }, { "id": "micro-behaviors/data/decode/hex::buffer-from-hex-string", "conf": 0.85, "crit": 3, "desc": "Node.js Buffer.from decodes a hexadecimal string", "spans": [ [ 0, 45 ] ] }, { "id": "micro-behaviors/data/source/property/computed::js-global-require-alias", "conf": 0.9, "crit": 3, "desc": "Assigns require to computed global property", "spans": [ [ 0, 67 ], [ 8578, 82 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "conf": 0.4, "crit": 2, "desc": "Windows platform string", "spans": [ [ 7373, 0 ] ] }, { "id": "micro-behaviors/process/create/inline-script::spawn-node-eval", "atk": "T1059.007", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Spawns node with -e inline code", "spans": [ [ 0, 18 ], [ 8714, 18 ] ] }, { "id": "micro-behaviors/process/create/inline-script::spawn-node-eval-var", "atk": "T1059.007", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Spawns node -e with variable code", "spans": [ [ 0, 19 ], [ 8714, 19 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "spans": [ [ 0, 30 ] ] }, { "id": "micro-behaviors/process/create/shell/git::git-head-ref-literal", "conf": 0.82, "crit": 1, "desc": "Git HEAD ref literal", "spans": [ [ 7904, 0 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detaches a handle with unref()", "spans": [ [ 0, 9 ], [ 8811, 9 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::node-spawn-result-unref", "mbc": "F0011", "conf": 0.9, "crit": 3, "desc": "Unrefs the child returned by spawn", "spans": [ [ 0, 76 ], [ 8714, 106 ] ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::js-eval-raw", "conf": 0.7, "crit": 3, "desc": "Executes JavaScript dynamically with eval()", "spans": [ [ 8704, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Last line is over 1000 chars", "spans": [ [ 0, 31 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Exactly one line exceeds 1000 chars", "spans": [ [ 0, 27 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/content::encoded-eval", "atk": "T1059", "conf": 0.95, "crit": 4, "desc": "Encoded eval() call", "spans": [ [ 0, 103 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-bracket-module-alias", "atk": "T1027.002", "mbc": "B0032", "conf": 0.88, "crit": 4, "desc": "Module aliased to global via bracket notation", "spans": [ [ 0, 86 ], [ 8641, 38 ] ] }, { "id": "objectives/anti-static/obfuscation/string/encoding::dense-unicode-escapes", "atk": "T1027", "mbc": "B0032", "conf": 0.88, "crit": 3, "desc": "Dense Unicode escape sequences", "spans": [ [ 605, 24 ], [ 647, 30 ], [ 694, 24 ], [ 736, 18 ], [ 774, 78 ], [ 866, 128 ], [ 1137, 128 ], [ 1359, 114 ] ] }, { "id": "objectives/anti-static/obfuscation/string/encoding::js-unicode-escape", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 2, "desc": "Unicode escape sequences in string", "spans": [ [ 8877, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "uses": [ 68, 71 ], "spans": [ [ 2534, 16 ], [ 4161, 6 ], [ 4168, 6 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js built-in http/https module usage", "uses": [ 12 ], "spans": [ [ 7863, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-client-imports", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Imports a Node.js HTTP client library", "uses": [ 5 ], "spans": [ [ 638, 7 ] ] }, { "id": "micro-behaviors/communications/http/url/rpc::ethereum-public-rpc-provider-pool", "conf": 0.9, "crit": 3, "desc": "Failover pool of public Ethereum RPC endpoints", "uses": [ 19, 20, 21, 22 ], "spans": [ [ 0, 128 ], [ 1820, 30 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-blockchain-history-lookup", "conf": 0.94, "crit": 3, "desc": "Looks up Ethereum blocks and account nonce state", "uses": [ 29, 31 ], "spans": [ [ 0, 23 ], [ 5017, 20 ], [ 5806, 23 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-transaction-byte-context", "conf": 0.9, "crit": 1, "desc": "Ethereum transaction byte context", "uses": [ 29, 33 ], "spans": [ [ 0, 0 ], [ 7000, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-async-iife-import-hook", "conf": 0.9, "crit": 3, "desc": "Async IIFE executes at module end", "uses": [ 39 ], "spans": [ [ 6763, 103 ], [ 9124, 5 ] ] }, { "id": "micro-behaviors/data/decode/xor::js-repeating-key-buffer-xor-loop", "atk": "T1140", "conf": 0.94, "crit": 3, "desc": "Repeating-key XOR byte loop", "uses": [ 41, 42 ], "spans": [ [ 0, 18 ] ] }, { "id": "micro-behaviors/os/module/require::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "uses": [ 3, 5 ], "spans": [ [ 765, 7 ] ] }, { "id": "micro-behaviors/process/create/exec::node-child-process-capability", "conf": 0.8, "crit": 3, "desc": "Imports or invokes Node.js child-process APIs", "uses": [ 3 ], "spans": [ [ 765, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::spawn-call", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "Calls imported Node child_process spawn", "uses": [ 3, 52 ], "spans": [ [ 765, 7 ], [ 8714, 5 ] ] }, { "id": "micro-behaviors/process/interpreter/runtime/eval::javascript-dynamic-evaluation", "conf": 0.8, "crit": 3, "desc": "Uses JavaScript dynamic evaluation APIs", "uses": [ 90 ], "spans": [ [ 8704, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/dynamic::loader-iife-tail", "conf": 0.85, "crit": 1, "desc": "Loader IIFE follows dynamic loader code", "uses": [ 39, 82, 90 ], "spans": [ [ 8704, 0 ], [ 9124, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-require-module-aliasing", "atk": "T1027.002", "mbc": "B0024", "conf": 0.98, "crit": 4, "desc": "Global require and module aliasing", "uses": [ 82, 94 ], "spans": [ [ 0, 67 ], [ 8578, 82 ], [ 8641, 38 ] ] }, { "id": "objectives/evasion/masquerade/extension-mismatch::font-named-file-is-not-a-font", "atk": "T1036.008", "conf": 0.96, "crit": 4, "desc": "Font-named file is not a font", "uses": [ 65 ], "spans": [ [ 0, 60 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-client-usage", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses HTTP client APIs", "uses": [ 98 ], "spans": [ [ 7863, 12 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-transaction-recipient-ip-split", "conf": 0.94, "crit": 3, "desc": "Splits Ethereum transaction bytes into IPv4-sized slices", "uses": [ 35, 102 ], "spans": [ [ 0, 5 ], [ 5017, 20 ], [ 7000, 5 ], [ 7113, 34 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-import-time-or-first-touch-init", "conf": 0.92, "crit": 3, "desc": "JS import-time or first-touch initialization", "uses": [ 103 ], "spans": [ [ 6763, 103 ], [ 9124, 5 ] ] }, { "id": "micro-behaviors/process/interpreter/runtime/eval::network-eval-child-process-chain", "conf": 0.9, "crit": 3, "desc": "HTTP, eval, and child-process APIs", "uses": [ 99, 106, 108 ], "spans": [ [ 638, 7 ], [ 8704, 4 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-import-time-network-call", "conf": 0.97, "crit": 3, "desc": "Module import executes a network call", "uses": [ 112, 114 ], "spans": [ [ 6763, 103 ], [ 7863, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "uses": [ 3, 86 ], "spans": [ [ 0, 30 ], [ 765, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 107 ], "spans": [ [ 765, 7 ], [ 8714, 5 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/loader::obfuscated-global-require-loader", "atk": "T1027", "mbc": "B0032", "conf": 0.96, "crit": 4, "desc": "Obfuscated JavaScript loader aliases require through global state", "uses": [ 6, 82, 109, 110 ], "spans": [ [ 0, 67 ], [ 8476, 13 ], [ 8578, 82 ], [ 8641, 38 ], [ 8704, 4 ], [ 9124, 5 ] ] }, { "id": "objectives/anti-static/obfuscation/instruction/insertion-junk::leading-whitespace-padded-line", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 4, "desc": "Extreme leading whitespace hides source code", "uses": [ 2 ], "spans": [ [ 0, 1407 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/blockchain::ethereum-blockchain-derived-node-stage", "atk": "T1102,T1105,T1027,T1059.007", "mbc": "B0024,B0032", "conf": 0.995, "crit": 5, "desc": "Ethereum history lookup derives network addresses for a remote Node stage", "uses": [ 15, 29, 40, 84, 90, 101, 104, 113 ], "spans": [ [ 0, 23 ], [ 3170, 41 ], [ 5017, 20 ], [ 5806, 23 ], [ 7000, 5 ], [ 7113, 34 ], [ 7803, 11 ], [ 8704, 4 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/blockchain::etherhiding-wallet-stage-payload-header", "atk": "T1102,T1105,T1027", "mbc": "B0024", "conf": 0.96, "crit": 5, "desc": "EtherHiding wallet dead-drop carries x-payload stage", "uses": [ 17, 59, 61, 62 ], "spans": [ [ 0, 13 ], [ 8862, 11 ], [ 9008, 10 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb6EKrB7]Mgb03?\u003cga\u003emkfD@4ParR\u003erz/ff3xlwl6BzkVhB0rT/tm8F}arV1rarR^HarR\u003eID2NssiV]R:z!9A6ed9HxarR^Hb64mmB.bSob03?\u003cy*?E7v/", "ln": 0, "col": 1, "line": 1 }, { "b": "x(v)gb03?\u003cz/xo9pI%9xB8#5lzC$T=A=-GjarR^HEf}8tt}us9ar\u003e]oB8b?viV}SlarR^HDKp(rarR^Hb5yW%wO-LKar\u003exry?W^eeN@E9v@0nt3lQDlarR^JBA}?pb03?\u003cB7/c3y:7zqarR^HarR\u003erz/6u1zE:}Lar\u0026jzz/6u1zE:\u003ewB%7WvwmV(EfjXTqfk+]Gy-\u003eF%cnuR\u0026clNhAwmV(ofk#5yy?Wxjw]zNeB1.clePU\u0026Dx\u003ee!LfFCb6z!rPpdiK1=asICEwPzu8zF%5%au\u003cW=y-\u003eF%cnuR\u0026clNhAwmV(ofk#5yy?Wxjw]zNeB1.clePU\u0026Dx\u003ee!LfFCb6z!rPpdiK1=az24@zY*zPa$K\u0026zarR^HarR\u003eEA=kA6wO\u003edIByO#}AW0K!tu@=!arR^HarR\u003exB3:qByIdWaB-7.liV@J+B.99harR^HarR\u003ewx\u003eg^0iV@J+B.99harR^HarR\u003eEA+fr6zGGrex(v(kiV@+RarR^HarR^Hb64mrwNPy0iV]R:wP?T9a$K6zarR^HarR^JAa9S}y:7[.b4Lm}x\u003e7N[wN(#o3lQDlarR^Har\u003eAov%8\u0026piV@3yy\u0026:es3lQDlarR^Har\u003eriwNPQ6iV@3yy\u0026:es3lQDlarR^Har\u003exbxM27Qazb4#B7D)farR^HarR^Hb4CCcB7DKRaARTDwEoL5arR^HEjLZFarR^Har\u003e\u0026GzCLj[x(v)gb03\u0026[3lQDlarR^Har\u003e\u0026GzCLc]iV]RUz!@@}A.*T=zxYAgarR^HaBKOtarR!Ped9Hxt)+#!", "ln": 179, "col": 26, "line": 9 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 799, "entropy": 4.42 }, "json": { "parsed_bytes": 799, "parse_limit_bytes": 76800 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 799, "peak_region_entropy": 4.42 } } }, "id": 2, "mol": "O₂(XeEr)H(Po)Md₃(PaPm)", "path": "rounakkhanam06-GFG-Coding-Challenge.tar.gz!!GFG-Coding-Challenge-881f80a2280f6d7f62c74b4c391130d7def8a6e8/.vscode/tasks.json", "pid": 0, "risk": 161, "sha": "f5c6be4753d6613c97f1b10c4d93a5d97a8f4fb21eb13da0ed04b23a8a61c2f6", "size": 799, "traits": [ { "id": "metadata/file/format/conformance::json-parse-error", "conf": 0.9, "crit": 3, "desc": "JSON document fails to parse" }, { "id": "metadata/package/config::task-command-noop-fallback", "atk": "T1564.003", "conf": 0.88, "crit": 3, "desc": "Task command swallows its failure", "spans": [ [ 297, 167 ] ] }, { "id": "metadata/package/config::task-definition-key", "conf": 0.9, "crit": 2, "desc": "VS Code task definition key", "spans": [ [ 473, 0 ] ] }, { "id": "metadata/package/config::task-hide-property", "conf": 0.9, "crit": 3, "desc": "JSON hide property set true", "spans": [ [ 529, 12 ] ] }, { "id": "metadata/package/config::task-reveal-never", "conf": 0.86, "crit": 3, "desc": "VS Code task suppresses terminal reveal", "spans": [ [ 575, 17 ] ] }, { "id": "metadata/package/config::tasks-echo-disabled", "conf": 0.9, "crit": 3, "desc": "VS Code task disables command echo", "spans": [ [ 680, 13 ] ] }, { "id": "metadata/package/config::vscode-task-shell-command", "conf": 0.8, "crit": 3, "desc": "VS Code task uses shell execution", "spans": [ [ 274, 15 ] ] }, { "id": "metadata/permission/activation::vscode-task-folder-open-activation", "conf": 1.0, "crit": 3, "desc": "VS Code task activates when folder opens", "spans": [ [ 756, 21 ] ] }, { "id": "micro-behaviors/process/create/shell/probe::posix-interpreter-lookup", "atk": "T1059", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "POSIX lookup of a script interpreter", "spans": [ [ 310, 15 ] ] }, { "id": "micro-behaviors/process/create/shell/probe::windows-interpreter-lookup", "atk": "T1059", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Windows lookup of a script interpreter", "spans": [ [ 389, 0 ] ] }, { "id": "objectives/evasion/masquerade/extension-mismatch::interpreter-command-on-font-path", "atk": "T1036.008", "conf": 0.94, "crit": 4, "desc": "Interpreter runs a font-named file", "spans": [ [ 345, 38 ] ] }, { "id": "objectives/evasion/masquerade/extension-mismatch::node-task-executes-font-named-file", "atk": "T1036.008", "conf": 0.95, "crit": 4, "desc": "Node task executes font-named file", "spans": [ [ 297, 154 ] ] }, { "id": "metadata/package/config::tasks-hidden", "conf": 0.9, "crit": 3, "desc": "VS Code task hidden from picker", "uses": [ 2, 3 ], "spans": [ [ 243, 8 ], [ 473, 17 ], [ 501, 15 ], [ 529, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/probe::cross-platform-interpreter-probe", "atk": "T1059", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Probes POSIX and Windows for interpreter", "uses": [ 8, 9 ], "spans": [ [ 310, 15 ], [ 389, 10 ] ] }, { "id": "objectives/evasion/masquerade/extension-mismatch::font-path-executed-by-interpreter", "atk": "T1036.008", "conf": 0.95, "crit": 4, "desc": "Font path handed to an interpreter", "uses": [ 10, 11 ], "spans": [ [ 297, 154 ], [ 345, 38 ] ] }, { "id": "objectives/execution/trigger/ide::vscode-task-concealment", "conf": 0.9, "crit": 4, "desc": "VSCode task with concealment properties", "uses": [ 1, 4, 5, 7 ], "spans": [ [ 297, 167 ], [ 575, 17 ], [ 680, 13 ], [ 756, 21 ] ] }, { "id": "objectives/execution/trigger/ide::vscode-task-media-masquerade", "atk": "T1204.002,T1036.008", "conf": 0.98, "crit": 3, "desc": "VSCode autorun runs disguised media file", "uses": [ 7, 10, 11 ], "spans": [ [ 297, 154 ], [ 345, 38 ], [ 756, 21 ] ] }, { "id": "objectives/execution/trigger/ide::vscode-concealed-media-masquerade-autorun", "atk": "T1204.002,T1036.008,T1564.003", "conf": 0.99, "crit": 5, "desc": "Folder-open task runs disguised media", "uses": [ 15, 16 ], "spans": [ [ 297, 154 ], [ 345, 38 ], [ 575, 17 ], [ 680, 13 ], [ 756, 21 ] ] }, { "id": "objectives/execution/trigger/ide::vscode-folder-open-fetch-or-exec", "atk": "T1204.002", "mbc": "C0032", "conf": 0.96, "crit": 4, "desc": "VSCode folder-open task runs a fetch or exec command", "uses": [ 7, 10, 11, 13, 14 ], "spans": [ [ 297, 154 ], [ 310, 15 ], [ 345, 38 ], [ 389, 10 ], [ 756, 21 ] ] } ], "type": "json" }, { "ctx": [ { "b": "DKp(rb6ds7A:@=nwQ4Z3B.25ciV@+RarR^Ha$t5}e]#8Qb03\u0026*A=\u003e}2arV7-3lQDnByxlae[5Njz*aG\u0026Bz(28Bzkk:vrlj9b03\u0026*A=\u003e}A3lQDnBA}?pB7ol8Ac9ZOB8$]kC4CXDwQ5f9A+Px4zGGr6e[F{evR/QLA=kY7v@$aMvp%E@B98baB0rT/BAhIned9Hxb4Uq0Bz(gLwmYvYB.(d?z/PY6BAz8mb03?\u003cwPIr(zG4jEA+fumx\u003eqrpC5}eiwmV@o3lQDnBA}?pB7ol8Ac9ZKA+e\u0026]A+fb#wPGFrze:AlBwlW:B.\u003eR/AaJJ[w[+*%b03?\u003cA+f5}Bzk]fa$K6zar\u003e[", "ln": 0, "col": 1, "line": 1 }, { "b": "z!9A^zeS%cy?mVvBA}?pB7ol8Ac9:Hx\u003c@nq3lQDnwmYj)xd!awwO%[EvS=rciV]R:wP?T9pJf(.a$K6zar\u003e=Bz^)J]zf4srB-.L1wP?S[y:7[.BAhIned9Hxb6mypze0(@y+xBtBy/99vru6\u003ee[!%fwLWhxByxiiB-nJ=ar\u003elgCvt=ra$K6zar\u003e]sA=2JdvqEMgzGGD5A::63wg?z7w)]*#BwN0@w[=6)e{z2Ewn=Wkb03?\u003clVl*UvqYP#p\u0026ZF\u003eAc9oP3lQDnBy/Gfx(mu}e[]iBwOl3(By!#nx(mP}A+PR:zGWi+azb4#B7D)farR\u003eywPI%lB-88dAXp\u003cuzF0P}p*[DVb03?\u003cygREde{h5CBs}6wzF0P}e[nTqa$K6zar\u003erlze:i9wI4ObA=iNvx(^Y(y?khdz/6Dcy?khgx(4v4ePkIUwnbNaB76l6eN@ZfwG\u003ceTBAhIned9Hxb6mmmyJyWXaBsCrarR^Jy**^:y:7[.b5y$hBrCHtaA8jgzxZRsarR^Hb6n9HwG\u003ceTb6dBey?$pD3lQDlar\u003erlzeAZ0wfK5Sb5RvpaAzQxaz++fBrSmyarR^Hb64*zpI}vqar\u003eAoy?d9$pJf(.a{]CnEf$xf", "ln": 294, "col": 24, "line": 9 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 786, "entropy": 4.72 }, "json": { "parsed_bytes": 786, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 786, "peak_region_entropy": 4.72 } } }, "id": 3, "mol": "O(Xe)Md₂(PaPm)", "path": "rounakkhanam06-GFG-Coding-Challenge.tar.gz!!GFG-Coding-Challenge-881f80a2280f6d7f62c74b4c391130d7def8a6e8/.vscode/settings.json", "pid": 0, "risk": 40, "sha": "c0450d71e0b6d06f4d02177c2e7f59444ab368676a807b1e5ba0697ac2ad1859", "size": 786, "traits": [ { "id": "metadata/package/config::vscode-settings-embedded-task", "conf": 0.9, "crit": 3, "desc": "Task defined in workspace settings", "spans": [ [ 662, 75 ] ] }, { "id": "metadata/package/config::vscode-task-shell-command", "conf": 0.8, "crit": 3, "desc": "VS Code task uses shell execution", "spans": [ [ 706, 15 ] ] }, { "id": "metadata/package/config::vscode-terminal-hidden-on-startup", "atk": "T1564.003", "conf": 0.9, "crit": 3, "desc": "Workspace hides integrated terminal", "spans": [ [ 390, 45 ] ] }, { "id": "metadata/permission/activation::vscode-auto-task-approval", "conf": 0.95, "crit": 3, "desc": "Workspace permits automatic VS Code tasks", "spans": [ [ 51, 32 ] ] }, { "id": "metadata/permission/activation::vscode-task-folder-open-activation", "conf": 1.0, "crit": 3, "desc": "VS Code task activates when folder opens", "spans": [ [ 758, 21 ] ] }, { "id": "objectives/execution/trigger/ide::vscode-workspace-preapproved-hidden-autorun", "atk": "T1204.002,T1564.003,T1059", "conf": 0.94, "crit": 4, "desc": "Pre-approves hidden folder-open task", "uses": [ 2, 3, 4 ], "spans": [ [ 51, 32 ], [ 390, 45 ], [ 758, 21 ] ] } ], "type": "json" }, { "id": 24, "mol": "Md", "sha": "e2a09b1116cda180834ebb588308b97314601db9dee384b3bb70b4e8593700ac", "path": "rounakkhanam06_gfg-coding-challenge.registry.json", "risk": 1, "size": 854, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "18b13", "v": "8" } }