{ "ml": { "v": "7", "eng": "2.3.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.015495539, "rte": "az", "prob": 0.015495539 }, { "cls": 0, "raw": 0.0018306673, "rte": "az/zip", "prob": 0.0018306673 } ], "prob": 0.015495539, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.015495538711547852, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00023376941680908203, "type": "php" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0007898807525634766, "type": "php" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.004769682884216309, "type": "composer.json" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "php" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.009066075086593628, "type": "php" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.009066075086593628, "type": "php" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.002678483724594116, "type": "php" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00020521879196166992, "type": "php" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.006124526262283325, "type": "php" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "php" } ], "version": "v18.18", "analyzed_at": "2026-07-12T05:26:09Z" }, "path": "github.com-filamentphp-upgrade-v3.3.24+incompatible.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awys2MK\u00268000000000000000003p8003UCBzb/ae[n*pfj[{mvqPN[Bz$]jflIkDA:-G\u0026kZ1}ogCgBtd}@)hz/6D4Bzki2wImIbzzbHuwNPW(eOnZkvqPN[Bs?U(ePtcowO-@qA=lbnwmY^lAa\u003cj6syl13i1*-nR@eA@xA-d-Xa-YwXIOmsRWko6}El{?a}hb\u003eg}5liQ^d\u002668AArw14=7IwgqIxObg8Z}i#(G84zw${I3{bi?pFC\u0026b=s(cUQ^HN8kE?y1pasWlFpoJE*Akwsl*oOJta0]Fva:18\u0026@oa=IEzOP+y\u003colt+vgXYM1-$dza6K.{1J2eemgc)ooK*7j)r0QO/", "n": [ { "c": 2, "d": "Zip archive path", "i": "metadata/package/files/included::zip-archive-path", "o": 0, "z": 55, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H₂(F₂Po₂)", "sha": "43a6420194a9522025f4ff63d07a41b9dc8b0d4ffd53b2fd7a91614abfdf87fc", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip", "risk": 5, "size": 14151, "type": "zip", "facts": { "metrics": { "file": { "size": 14151.0, "entropy": 7.82, "size_bytes": 14151.0 }, "binary": { "overall_entropy": 7.82, "peak_region_bytes": 12288.0, "peak_region_entropy": 7.79 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 8.0, "zip_bomb_ratio": 7.94, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 11545.0, "compression.ratio": 0.22, "hidden_file_count": 0.0, "total_uncompressed": 52439.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 94.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 10.0, "timing.sentinel_mtime_count": 10.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 10.0 } } }, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::php-exec", "atk": "T1059.006", "conf": 0.8999999761581421, "crit": 3, "desc": "PHP exec() function call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/rename::rename-call", "conf": 0.6000000238418579, "crit": 3, "desc": "Renames/moves file via rename()", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/write/file/direct::file-put-contents", "atk": "T1105", "mbc": "C0052", "conf": 0.800000011920929, "crit": 3, "desc": "Creates or overwrites a local file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/eval::dynamic-function-execution", "atk": "T1059.006", "mbc": "E1059", "conf": 1.0, "crit": 3, "desc": "PHP variable function invocation pattern" }, { "id": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "atk": "T1083", "conf": 1.0, "crit": 2, "desc": "Iterate dir contents via funcs in PHP", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/delete/file::php-unlink", "conf": 1.0, "crit": 3, "desc": "PHP unlink function symbol", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/included::github-module-zip-basename", "conf": 0.8600000143051147, "crit": 1, "desc": "GitHub versioned zip filename", "spans": [ [ 0, 55 ] ] } ] }, { "ctx": [ { "b": "ju)^#A0={$v@Dl%x\u003eFLKazbt7wNx1[x(!xqc)@IyzF0P}fj[{mvqPN[Bs}JCA3)7SkoKMLy?l%^wPRo?z/fVdzGG}FcU47jw[+)hw[=6\u0026zdNQbe]UGycN*f0aswJ#3jn4$vruf9jS(1Wz/ff3xiM:5vrufgt{8u@asyPdze0(ni%(ruAa9\u003c4p?T!\u003cjS[Y:wOkv!vru0)c){VMcVAHoxJ#]\u0026B1fsptYP", "ln": 0, "col": 1, "line": 1 }, { "b": "x(4i{wO#PqdjDx^3lQDlaz\u003e[8x(UQHvq{fsp\u0026ZF$x\u003eg^}B1Z0%y*?f(zGElSatt-kh.l7[A=\u003e}xi%{xyw[=6)uVpdfuT[1(By/uiB0@kvAbWEbA=lbnwmY!5fgGU(vqPN[Bt4$^v@bN{B53dXwQMgIxMbdDar\u0026{jAa\u003cg$3t%o?wPI*0v}u=GAbY5UA=lbnwmY!5tT\u0026BzvqPN[Buo*pB-RapmRMWEzdNQbtU5%UA9MaKwmPH/CvtJ6tTrHOxK#76x\u003e7N[wJHlwB7DE-x(4i{wO#P{now@)tUO{ywnC?3vrb{:l3mo.wO#Q7v{%E\u003cq!p2\u003ex(v(J3uZA3avZ6YvqPN[Bx?vUBz$FVx\u003eg:\u003cwP}N6wN4SqB75J]wKpiwwmXtxz/d{Xze:AhwO#Qhi%{aKwGTDRy*?f(zGGbOBAzFbo\u003e!cGy?m*0A+eGzx(!l4ByO#.wPz%dzF8BMy*?f(zGFr\u003cwO#PK3uZA3avZ6YvqPN[Bx?NHC4\u003eO$BzkVhtUXZJx\u003eH\u003c@x(v(VA=l8ti%{aKwGTDRy*?f(zGGbWvp%d)i%{aKwGTDRy*?f(zGGbWvqYT)i%{aKwGTDRy*?f(zGGbWvqYT)p\u0026ZF$x\u003eg^}i%{aKwGTDRy*?f(zGGbZB-qqrA=+LNz!%ujB6I7Jy\u0026stQ3uZA3avZ6YvqPN[Bx?)Ywm]E}B2%.KB7DE=y\u00261lhx(mv3wN4Pvz!\u003c5#tUO{ywnC?3vrb{:l1BI6B.bYbwj7oNyIvv3rbUVCB8V5nB7EAuB-RapnO\u0026i=ze0(@By!YAz/oA9wN4@zwmPH/CvtJ6tT-KuA^qRClVl)Ux\u003equE3uZA3aw3x=B.$\u0026gvru6=mSiA!wmoN]z/e/JBAzFbo\u003e!cGy?m*0A+eGRwPzG%C%=T[w(JX:wO%NpB-RapnO\u0026i=ze0(@By!YPz/{eozF9iGx\u003eg:\u003cwP}N6wN5eRvSMT9BAIXpltpsFx(mN8i%{aKwGTMXy\u0026%PezEES#tVkiPB7]MgtUO{ywnC?3vrb{:q/(C*Bw(:(B7]Mgi%{aKwGTMXy\u0026%PezEES#tVLMICu^\u003cRwmPH/CvtJ6tVkrAA+dWWA=k#tmSJA:q!p2\u003ex(v(J3jpoVvrlGjDN99qvrlG+vqPO7az2!twO#41aw=G:wO+g-z*2\u00269wPwc83lQDlaAhEjy?Wx4w{503BzkVhaAg+bwO-+\u003evqYT)ay3ghvqYT)dlnOFvqYT)3lQC", "ln": 3218, "col": 35, "line": 52 }, { "b": "z/{8gwPGnlzAn[!bYWEqz/{8gwPHWRBzaG:Ad6nWw]zYJaBtwOwPI^jA:@W4pgn0JB8UL$wL^5VEjkHCarR^HarR^HarR^Uk4FwGv@DK4A.{gSwPGnlzAn[!bYEe", "ln": 4423, "col": 26, "line": 87 }, { "b": "arR^HarR^HarR^Ht}4\u0026xarR^HEf$xDdlv\u003ezw[=6)uVpdfuT[1(By/uiB0@zCz/ff3xd)XjA4V9yA3)gVB98CfA+fiavpJ\u003c%3lQDlasxD]A9MTAA=lbnwmY!5tWgfBB-.g[wPz%dv}wFSz*2\u00269wPx*)v@bN{B1wW\u00263lQDlar\u003c9\u003cA9MTAA=lbnwmY!5tWf:jy*?f(zGGb*DN99qvrlG+vqPO7iYZ+!vrlGva%nGXp!jz\u0026mnDP1e*8I:arR^HarR^", "ln": 5441, "col": 1, "line": 110 }, { "b": "eIeLaeIeLaeIeLaeIeLaeIeKYarR^HD\u003cQ#sarV4Olu%X@zEWQ4zdNQbx(mMaBzbkdoKR%IC4CFjmpQ1Hay/tcw[+[2A::67z/d9GD2E*FzddYjv@Dm5wN/*8mRMWEzdNQb3lQDlaBCqNzY\u0026FaC{2}aB7/c9eN@ZoAa9\u003c5vR/P#Cv+l8z!0M]BAnNCwPz%9AXmXwarR!O3lQDlaBCqhxLzJgCwg(fayP85z*9sHz/{7yB-RbmB0bNyaAz46wODs0aAz44y+o:yzdK\u0026cz//Y9x\u003e7N[x(v)ge^-ZzarV4sarR^HdLzboarR^HtQK03z^^f^vrlK8zF9i4au.)", "ln": 6008, "col": 61, "line": 128 }, { "b": "z6hkXB88a9arR!OeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIdqLarR!O3lQDlaBCqhxLzJgx(+zsxK@rcBz(hdxjSh@x(!5jmRMWEzdNQbaA}Koy-)\u003ewwGV8kaAhEBaz\u003eX2x\u003c\u0026Rps-nB9zddYjB-RapvqZt$arR^HD)0utaARpday]hcyJyRewObT]wN(]$zxK4mwGUw\u003cz/ff3xd)\u003ehy?mWkB97#gB1RABA9$p9arR^HD\u003cQ#sarSc!3jm)#arT]pwmYvYB.(ebw[=6)B9R?GwO\u003e^+x(!5{cM\u003eMoaz2Clc%Ob?nLzAAmnu/?mOcoxq^03#mnmbSnMen!cOcxBcVBiqy?Wx:cN*ON3sb.vdlv(+3i", "ln": 6640, "col": 24, "line": 150 } ], "depth": 1, "facts": { "imp": [ [ "", "file_exists" ], [ "", "file_get_contents" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "trim" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "preg_match" ], [ "", "in_array" ], [ "", "preg_match" ], [ "", "file_exists" ], [ "", "mkdir" ], [ "", "file_put_contents" ], [ "", "file_put_contents" ], [ "", "str_replace" ], [ "", "file_get_contents" ], [ "", "file_exists" ], [ "", "file_put_contents" ] ], "mbr": [ "$config.path" ], "tgt": [ "file_exists", "file_get_contents", "file_put_contents", "in_array", "mkdir", "preg_match", "str_replace", "trim" ], "metrics": { "ast": { "op.eq": 5, "op.lnot": 1, "max_depth": 12, "op.concat": 2, "call_count": 25, "node_count": 1300, "op.coalesce": 1, "member_count": 1, "max_array_len": 2, "op_density.eq": 0, "op_density.lnot": 0, "member_depth_max": 2, "op_density.concat": 0, "op_density.coalesce": 0 }, "file": { "size": 6977, "entropy": 5.16 }, "text": { "lines": 161, "top_char": 101, "max_ws_run": 12, "digit_ratio": 0, "space_count": 1029, "char_entropy": 5.16, "unique_chars": 78, "top_char_null": 0, "string_density": 0.5, "top_char_ratio": 0.05, "ascii_art_lines": 4, "avg_line_length": 42.34, "max_line_length": 193, "empty_line_ratio": 0.16, "last_line_length": 1, "long_token_count": 1, "whitespace_ratio": 0.17, "identifier_density": 1.4, "line_length_stddev": 43.24, "encoded_string_ratio": 0.01, "normalized_string_count": 6.3, "repeated_char_sequences": 40, "suspicious_string_ratio": 0.05, "normalized_unique_identifiers": 6.14 }, "binds": { "count": 28 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 5.19 }, "strings": { "bytes": 4482, "count": 80, "shell": 1, "very_long": 1, "avg_length": 56.03, "max_length": 1122, "path_count": 13, "avg_entropy": 3.16, "empty_count": 7, "entropy_stddev": 1.14, "base64_candidates": 1, "embedded_code_candidates": 3 }, "identifiers": { "count": 226, "unique": 45, "avg_length": 12.67, "max_length": 40, "min_length": 2, "avg_entropy": 2.97, "reuse_ratio": 0.2, "length_stddev": 8.15, "high_entropy_count": 8, "high_entropy_ratio": 0.18, "all_lowercase_ratio": 0.29, "all_uppercase_ratio": 0.02 } } }, "id": 1, "mol": "K(Li)O(C₂)H₂(DbF₃)Md(In₅)", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/bin/create-filament-v3-panel-provider.php", "pid": 0, "risk": 7, "sha": "627c5e5c592e69d34fe37dd0f76fb996bee885fad86618afa4f156115f9c4e13", "size": 6977, "traits": [ { "id": "metadata/import/php/filament/http/middleware/authenticate::filament/http/middleware/authenticate", "conf": 0.95, "crit": 3, "desc": "imports Filament\\Http\\Middleware\\Authenticate", "spans": [ [ 3390, 37 ] ] }, { "id": "metadata/import/php/filament/http/middleware/authenticatesession::filament/http/middleware/authenticatesession", "conf": 0.95, "crit": 3, "desc": "imports Filament\\Http\\Middleware\\AuthenticateSession", "spans": [ [ 3433, 44 ] ] }, { "id": "metadata/import/php/filament/http/middleware/disablebladeiconcomponents::filament/http/middleware/disablebladeiconcomponents", "conf": 0.95, "crit": 3, "desc": "imports Filament\\Http\\Middleware\\DisableBladeIconComponents", "spans": [ [ 3483, 51 ] ] }, { "id": "metadata/import/php/filament/http/middleware/dispatchservingfilamentevent::filament/http/middleware/dispatchservingfilamentevent", "conf": 0.95, "crit": 3, "desc": "imports Filament\\Http\\Middleware\\DispatchServingFilamentEvent", "spans": [ [ 3540, 53 ] ] }, { "id": "metadata/import/php/filament/navigation/navigationgroup::filament/navigation/navigationgroup", "conf": 0.95, "crit": 2, "desc": "imports Filament\\Navigation\\NavigationGroup", "spans": [ [ 3599, 0 ] ] }, { "id": "metadata/import/php/filament/pages::filament/pages", "conf": 0.95, "crit": 2, "desc": "imports Filament\\Pages", "spans": [ [ 3640, 0 ] ] }, { "id": "metadata/import/php/filament/panel::filament/panel", "conf": 0.95, "crit": 2, "desc": "imports Filament\\Panel", "spans": [ [ 3660, 0 ] ] }, { "id": "metadata/import/php/filament/panelprovider::filament/panelprovider", "conf": 0.95, "crit": 2, "desc": "imports Filament\\PanelProvider", "spans": [ [ 3680, 0 ] ] }, { "id": "metadata/import/php/filament/support/colors/color::filament/support/colors/color", "conf": 0.95, "crit": 2, "desc": "imports Filament\\Support\\Colors\\Color", "spans": [ [ 3708, 0 ] ] }, { "id": "metadata/import/php/filament/widgets::filament/widgets", "conf": 0.95, "crit": 2, "desc": "imports Filament\\Widgets", "spans": [ [ 3743, 0 ] ] }, { "id": "metadata/import/php/illuminate/cookie/middleware/addqueuedcookiestoresponse::illuminate/cookie/middleware/addqueuedcookiestoresponse", "conf": 0.95, "crit": 2, "desc": "imports Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse", "spans": [ [ 3765, 0 ] ] }, { "id": "metadata/import/php/illuminate/cookie/middleware/encryptcookies::illuminate/cookie/middleware/encryptcookies", "conf": 0.95, "crit": 2, "desc": "imports Illuminate\\Cookie\\Middleware\\EncryptCookies", "spans": [ [ 3826, 0 ] ] }, { "id": "metadata/import/php/illuminate/foundation/http/middleware/verifycsrftoken::illuminate/foundation/http/middleware/verifycsrftoken", "conf": 0.95, "crit": 3, "desc": "imports Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken", "spans": [ [ 3875, 53 ] ] }, { "id": "metadata/import/php/illuminate/routing/middleware/substitutebindings::illuminate/routing/middleware/substitutebindings", "conf": 0.95, "crit": 2, "desc": "imports Illuminate\\Routing\\Middleware\\SubstituteBindings", "spans": [ [ 3934, 0 ] ] }, { "id": "metadata/import/php/illuminate/session/middleware/startsession::illuminate/session/middleware/startsession", "conf": 0.95, "crit": 2, "desc": "imports Illuminate\\Session\\Middleware\\StartSession", "spans": [ [ 3988, 0 ] ] }, { "id": "metadata/import/php/illuminate/view/middleware/shareerrorsfromsession::illuminate/view/middleware/shareerrorsfromsession", "conf": 0.95, "crit": 2, "desc": "imports Illuminate\\View\\Middleware\\ShareErrorsFromSession", "spans": [ [ 4036, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 4455, 0 ] ] }, { "id": "well-known/lib/web/laravel::laravel-illuminate-namespace", "conf": 0.9, "crit": 3, "desc": "Imports an Illuminate\\... Laravel namespace", "spans": [ [ 3761, 15 ] ] }, { "id": "metadata/file/string/count::few-string-literals", "conf": 0.4, "crit": 3, "desc": "File has very few string literals" }, { "id": "well-known/lib/web/laravel::laravel-context", "conf": 0.9, "crit": 3, "desc": "File runs inside the Laravel framework", "uses": [ 17 ], "spans": [ [ 3761, 15 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 6056, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 6175, 0 ] ] }, { "id": "micro-behaviors/data/string/replace::php-str-replace-call", "conf": 0.9, "crit": 3, "desc": "PHP replaces matched string content", "spans": [ [ 5505, 11 ] ] }, { "id": "micro-behaviors/fs/path/construct::php-script-path-suffix", "conf": 0.94, "crit": 3, "desc": "PHP script path suffix", "spans": [ [ 45, 5 ], [ 3336, 5 ] ] }, { "id": "micro-behaviors/fs/write/file/full::php-file-put-contents", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP file_put_contents()", "spans": [ [ 3282, 17 ] ] }, { "id": "objectives/command-and-control/backdoor/webshell/stager::file-put-target-php-ext", "atk": "T1105", "mbc": "B0030", "conf": 1.0, "crit": 3, "desc": "file_put_contents targets PHP extension", "spans": [ [ 3282, 17 ] ] }, { "id": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "atk": "T1505.003", "conf": 0.86, "crit": 3, "desc": "Very long embedded string" }, { "id": "objectives/command-and-control/dropper/execution/jphp::jphp-file-put-contents", "conf": 0.9, "crit": 3, "desc": "JPHP file write call", "spans": [ [ 3282, 17 ] ] }, { "id": "micro-behaviors/fs/write/file/handle::php-file-write", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Writes data using PHP file API", "uses": [ 24 ], "spans": [ [ 3282, 17 ] ] }, { "id": "objectives/command-and-control/backdoor/webshell/stager::write-executable-target-ext", "atk": "T1105", "mbc": "B0030", "conf": 1.0, "crit": 1, "desc": "Write targets PHP extension", "uses": [ 25 ], "spans": [ [ 3282, 0 ] ] } ], "type": "php" }, { "ctx": [ { "b": "boXZ.B8\u0026{yx(kOnzGWdwxMaqvkx7pP3jp]%wGTuUze:AmwPz3EzGx]dy\u00260V[r+lq)x(v)gi%{aKwGTMXy\u0026%PezEES#tVk=:AbP=stVk-+i%{aKwGUPczEW^5z/cW%wPzTix(mD^DTQ#hefF$AzE^s0Eld=yA+flkx(W=ccW66swn=GwvrDWgy\u0026r-)e]UGycP.UxA+fc0wPxgYjuK#Zr834l3lQDlauTgGC0llQarR^HarR^?wncifv@bN{B3gZ*Aa9l/eQn{5b0DtRarR^HarR^HarR^?wncifv@bN{B3gZ^C}y-[AcJ@\u003cayX$nvqPE+AXfg6fD+EGCYUJCzdm6%eJ2jaj{\u0026zPao", "ln": 0, "col": 1, "line": 1 }, { "b": "j{?StarR^HarR^HarR^?wnciJ3lQDlarR^HarR^HarR^HaxJb\u003cv@Di}aARJABzbkdjACQ+z/fhKmRMWEzdNQbaA/L6flqkQz/fhKaA.ToA:-G\u0026aAhvtv}x.5aQOM0arR^HarR^HarR^HarR^?vSAOAj{?StarR^HarR^HarR^HarR!axLzJgB7ol8Ac9jDx(4PdvruQ5ze:OtBz\u0026pnvqYQ(wGU\u0026dB95Kyw/#hewGUD5wNPv*zF784xKL^\u003ewPF#az/M$Cz/)Vt3lQDlarR^HarR^HarR^HauTaNatk[=3lQDlarR^HarR^HarR^Haw3e/D2E*FxKM6}ayPekaAqKnB98bmzGvuKAbo8]B7DFmwNP7ZaA8yAaARJAB-OWzzxI5Iazt!bw\u003c4tKBAzFyiXJc#x(4i{wO#QexMbOlz/4drx(^^5A+3vpv@bN{B3gZ\u0026zE^s0y?W=#azbLfBs*%uy?a.Nl${ZLz/PwJfjv3!z/M%.vixl7wOa7HxMOunB2\u003e%cxk8E3BZ=$kz/4dtx(4i{wO#QexMbRpx(4i{wO#Pywnc9{B-RRrz/fRHzE[2Rv{%E\u003cxk.*oj-J5Za%pxivrlGMb6v^lwPzQ3zE\u003c@5z/fUGvSc6[b0FIhBvZK-jtgbbe^-ZzarR^HarR^HarS^1wnciJ3jm)#arR^HarR^HarS^Sx)8VEarR^HarR^HarR^HarR^HrbS)*wOkZ{efF[FwNPT\u003eaz2CiB-I4oBzb98aBd)FayPq4aA.:tzF782aA?spB7]Mgay/tcBAhqoaAI*HBy/qiB9g#aayPslm})5$3jm)#arR^HarR^HarR^HarS^QAV^203jm)#arR^HarR^HarR^HarT-%aA}Koy-)O6yH[R#xKL^\u003ewPF#8x(W={BzMjBBz\u0026pEz/{7yw[=6)B1wCxzE:(nz/)gDx(4PdzE)x\u0026aARJAvR3V\u003cvR/P#Bz\u0026pxwP?T9BrCWswO\u0026M7w/#ekzdN*5x(mMaxk.v5aA}\u003cAzF7Ne3lQDlarR^HarR^HarR^HauTaNatk[=3lQDlarQ", "ln": 348, "col": 18, "line": 15 }, { "b": "j{\u003c?Wo?V#$3jpGVasH\u0026oy?l%+CXIkvB0@zCz/ff3xd)\u003ehy*?f(zGEEKB-qqrA=-{MxMbsFdiJ%AarR^HB-82fzFHTFv@Dl%x\u003eG8hx(4i{wO#PwB9hCvz/P}LAa\u003chrdlv\u003ezarR^HA+fc0wPxgYjuMelo?U)parR^HarR^?A6sQKarR^HarR^HarR!8wO(vewN(]CB98CvzF8dyz/ff3xd)\u003ehy*?f(zGEEKB-qqrA=-{MxMc6!B98CvzF5", "ln": 1762, "col": 8, "line": 65 }, { "b": "x(=\u003c-B97\u0026by?mc9cUv7evqPN[Bt4luy*?f(zGElPdiJ%AarR^HA+flkx(W=ccU4gdvru6jw[=6\u0026zdNQbeP@{4Aa9S}y+oQDz*2\u00269wPxzxxMbsX3jm)#arUYozE^s0c{fQOnk@qS3lQDlarR^HauTQb3lQDlarR^HarR^HavyfXvru6\u003eayMyivqYT)aAhvtC4\u003eF#AXmXwarR^HarR^?fk%8ZarR^Hnk@qSdf", "ln": 2903, "col": 24, "line": 108 }, { "b": "nP56MC4\u003eGfvqFzEy*?f(zGFY-v@2H=wPHBXB97\u0026by?mc1jS[uBy\u0026:eH3jpx-A+eV?xDOZc3lQDlatbo0xkzG}c)%4DB8Mhwv}xZmv@(YAdLtjLB0\u0026y/3lQDlatbo0xkzG}c)%4DB8Mhwv}xZmv@(YAdK)83e[n%zcN*ONt{9M%as7Mky?k4rDKp(rarR}wx(4uFz/fVdzGG}xjS[uJy?l%^wPRo?z/fVdzGG}FbXy+bwHPXF3lQDlazCBgd06GJuT[1(Byw)3B0@qCx(4uFz/fVdzGG}Jasy=ny*?f(zGEKzz/PYofjX^rBt4GHwozZ1e[G9ve[n%zcN*F!DKp(rarR^HarR}yvrk1Twncj3wozr%mRMWEzdNQbp*)\u003cHvp%d)nP5P\u003evqG:\u003ewfs2TBAhIni%(rqarR^HarR^Lw[=6)lVl\u003c:wO#QhauZ\u0026^A+e(\u003cA+fiavpJ\u003c%cOE84w[=6\u0026zdNQbtRxYcA=2(5fjX^rBx*Foz!a0bwN3\u003c0B8temv@(YzdQl\u003cAcOcw/cOcw=w[=6)lVl\u003c:wO#Qhdlv\u003ezarR^HarR^HA+fc0wPxgYjuMelo?U)parR^HarR^HarR^?A6sQKarR^HarR^HarR^HarR^", "ln": 3093, "col": 5, "line": 118 }, { "b": "zF8dWbXy+bwQMV]B98CvzF8c=3lQDlarR^HarR^HauRq@j{\u0026zParR^HarTiOo?V#$3lQDlaBKO7arR^Hw[=6)uVpdfuT[1(By/uiB0@qCx(4uias7Mky?k$LzGGDcBAn()3vJl*w]zZ3vpJ%[c%E33arR^Ve?Q^Mz^\u003eaxA+frgB-H#6B1.oHfdFO?B0\u0026y/3lQDlatbo0xkzG}c)%4DB8Mhwv}xZmyi83TdLAn7yi7:KedbV9vriLpw[=6)diJ%AarR^HbM", "ln": 3634, "col": 67, "line": 133 }, { "b": "arR!vw/@GBaAITBuT[1(Byw)3B0@qzz/ff3xdLeMwmoH]o(BMNcN*F!DKp(rarR^HarR}tz/ff3xcotWB98CfA+fiavpJ\u003c%cV9^jB.\u003eRwwQ5fjA==vBjS]80efDcNz!a0bwIdLsAbP=sB09Q*DT7CharR!qvrccTz!9AuasyVnvrlGqefVR/bX7+gw[+)bi%(rqarR^HarR!sx(4u/Aclnfv@DmbwO#Qhc)%aBx(50czE+wfz/ff3xd^}ucOcw", "ln": 4563, "col": 2, "line": 169 }, { "b": "arR!8wPhD]v}xf[jACQ+z/fhKjA@C\u0026x(4i{wO#PJi=FIuwJ\u0026jfB98CvzF8cQCwhejauTZ!A=k\u0026dk0j6ww[=6\u0026zdNQbePtcowO=AGi=FIuwJ\u0026jfB98CvzF8cQx(k4QB98CvzF8dWbXy+bwQMV]B98CvzF8c=3lQDlarR^HarR^HauRq@j{\u0026zParR^H", "ln": 5361, "col": 14, "line": 193 }, { "b": "DN9=yy\u0026%rqa$K\u0026ZwO#Vui%{x$3jpx-A+eV?xDOZccOw$FB%!*-cOw$FB$NoscOcw/e[F{ze[Gooze:r5cOcw/e[F{ze{7VCBzkS9cTv\u003c6B08-tzGXG-y?k4rDKp(rao", "ln": 7903, "col": 70, "line": 270 }, { "b": "BAhqqxfF^RoHR(.q=DgWuQN^-rZ/[GflqkQz/fhKatdkyB%7%pA+O@\u003ey?mVgCwhejayMylx(mN1wGT9RBAhqqxfF^RoHhxwpe\u003eN\u0026nLzMKsYno*o\u003cZpWq+GkaB98Cvzu", "ln": 8803, "col": 42, "line": 292 }, { "b": "CXIkvB0@zRwPI^jA:@W4flR5vCxkAXwO#3%AXz3sy*?f(zGEKvA:-\u0026@e[eT9wmWxjxMbsFdiJ%AarR^HA+fb%zdLa5arR^HarR^HcVS^tz/{8gwPGIFx\u003eqHfflQ]Awn=Gww[=6\u0026zdNQbfjF%gzE+wey**\u003c=e]UGycObPEarR^HarR^OA+frgB-H#6B1.YJwP@hGC4CM4z/NHyx(4i{wO#PwAa9S}y\u0026.mCz!A#vvR/E-wId}nA3)gzarQ", "ln": 10140, "col": 11, "line": 329 }, { "b": "xDPCXx(d*9z!9Acl}HoBlSu\u0026VsZL8@p^E#Br8lyyax{jpwO#3%AWJyXcT{!ccOcw/A+e:5z/Njhdlv\u003ezwQ4=@c)B0-A+e:5z/O=^A+PGmp*[DVEirGHz!0v1B0b/Pvq{fNx(W={Bz(hBEip9[v@Dl%x\u003eFMiwO#3%AXz3sy*?f(zGEKOAa:i1wmWAnA:{+ywN/?2AXqrAA3c.:v@bZ+AXg^fv}YA$dlv\u003ezA+fc0wPxgYjuMelo?U)parR^?A3eUbvrlGMb5?SQg9O)?arR^HarR^HmRM:OB7/b}aAhvtv}x.5x(mMajACP", "ln": 10684, "col": 17, "line": 350 }, { "b": "A^r6}flqkQz/fhKe^-ZzarS^1A6sR1r834ni%(ruA+flkx(W=Lz/6u1zE^/hjS)%mi%(sbz/Pz$v}V#kyiarhuU0.Tz!9Acw[=6)uUr}(uT[1(By/uiB0@zCz/6DiB7GwAyiarhcN*O?BAhIndo!fuwPq\u003cbA+cR7ayPslbYEg4yHH\u003c!au.[hbZ9:tB7]MgdiJ%AarR^Hx\u003ewFobYEg4yHH\u003c!au.\u003eJasy=ny*?f(zGEKOAa:i1wmWbqaBsCrarR^", "ln": 10949, "col": 50, "line": 356 } ], "depth": 1, "facts": { "imp": [ [ "", "render" ], [ "", "strtolower" ], [ "", "trim" ], [ "", "ask" ], [ "", "render" ], [ "", "render" ], [ "", "file_exists" ], [ "", "unlink" ], [ "", "render" ], [ "", "file_exists" ], [ "", "unlink" ], [ "", "render" ], [ "", "file_exists" ], [ "", "unlink" ], [ "", "render" ], [ "", "file_exists" ], [ "", "unlink" ], [ "", "render" ], [ "", "InstalledVersions" ], [ "", "render" ], [ "", "glob" ], [ "", "glob" ], [ "", "file_get_contents" ], [ "", "str_contains" ], [ "", "preg_replace" ], [ "", "render" ], [ "", "file_put_contents" ], [ "", "glob" ], [ "", "glob" ], [ "", "file_get_contents" ], [ "", "str_contains" ], [ "", "str_contains" ], [ "", "render" ], [ "", "preg_replace" ], [ "", "preg_replace" ], [ "", "file_put_contents" ], [ "", "file_exists" ], [ "", "file_get_contents" ], [ "", "str_contains" ], [ "", "str_replace" ], [ "", "file_put_contents" ], [ "", "render" ], [ "", "glob" ], [ "", "glob" ], [ "", "file_get_contents" ], [ "", "str_contains" ], [ "", "str_replace" ], [ "", "render" ], [ "", "str_contains" ], [ "", "str_replace" ], [ "", "render" ], [ "", "str_contains" ], [ "", "str_contains" ], [ "", "str_replace" ], [ "", "render" ], [ "", "str_contains" ], [ "", "str_contains" ], [ "", "str_replace" ], [ "", "render" ], [ "", "file_put_contents" ], [ "", "preg_match" ], [ "", "trim" ], [ "", "preg_match" ], [ "", "preg_replace" ], [ "", "preg_replace" ], [ "", "preg_replace" ], [ "", "file_exists" ], [ "", "file_get_contents" ], [ "", "$getEnvValue" ], [ "", "$getEnvValue" ], [ "", "$getEnvValue" ], [ "", "$removeEnvVariable" ], [ "", "$removeEnvVariable" ], [ "", "$removeEnvVariable" ], [ "", "render" ], [ "", "$hasEnvVariable" ], [ "", "$renameEnvVariable" ], [ "", "$setEnvVariable" ], [ "", "$removeEnvVariable" ], [ "", "$removeEnvVariable" ], [ "", "$hasEnvVariable" ], [ "", "$renameEnvVariable" ], [ "", "$setEnvVariable" ], [ "", "$removeEnvVariable" ], [ "", "$hasEnvVariable" ], [ "", "$renameEnvVariable" ], [ "", "$setEnvVariable" ], [ "", "file_put_contents" ], [ "", "file_exists" ], [ "", "rename" ], [ "", "render" ], [ "", "render" ], [ "", "implode" ], [ "", "exec" ], [ "", "render" ], [ "", "json_decode" ], [ "", "file_get_contents" ], [ "", "str_starts_with" ], [ "", "implode" ], [ "", "render" ], [ "", "Composer\\InstalledVersions" ], [ "", "Illuminate\\Support\\Str" ], [ "", "ask" ], [ "", "create-filament-v3-panel-provider.php" ], [ "", "render" ], [ "", "vendor/autoload.php" ] ], "mbr": [ "json_decode.require" ], "tgt": [ "$getEnvValue", "$hasEnvVariable", "$removeEnvVariable", "$renameEnvVariable", "$setEnvVariable", "InstalledVersions", "ask", "exec", "file_exists", "file_get_contents", "file_put_contents", "glob", "implode", "json_decode", "preg_match", "preg_replace", "rename", "render", "str_contains", "str_replace", "str_starts_with", "strtolower", "trim", "unlink" ], "metrics": { "ast": { "op.eq": 6, "op.lor": 1, "op.land": 2, "op.lnot": 5, "max_depth": 19, "call_count": 101, "node_count": 2697, "op.coalesce": 4, "member_count": 1, "max_array_len": 4, "op_density.eq": 0, "op_density.lor": 0, "op_density.land": 0, "op_density.lnot": 0, "member_depth_max": 2, "op_density.coalesce": 0 }, "file": { "size": 12254, "entropy": 4.96 }, "text": { "lines": 406, "top_char": 101, "max_ws_run": 4, "digit_ratio": 0.01, "space_count": 2745, "char_entropy": 4.96, "unique_chars": 83, "top_char_null": 0, "lines_over_200": 2, "string_density": 0.35, "top_char_ratio": 0.06, "avg_line_length": 29.18, "max_line_length": 272, "empty_line_ratio": 0.25, "last_line_length": 6, "whitespace_ratio": 0.26, "identifier_density": 1.09, "line_length_stddev": 37.71, "normalized_string_count": 7.05, "repeated_char_sequences": 89, "suspicious_string_ratio": 0.01, "normalized_unique_identifiers": 8.54 }, "binds": { "count": 33 }, "binary": { "peak_region_bytes": 10206, "peak_region_entropy": 5.04 }, "imports": { "count": 6, "third_party_count": 6, "third_party_ratio": 1 }, "strings": { "sql": 1, "bytes": 5379, "count": 142, "avg_length": 37.88, "max_length": 825, "path_count": 8, "avg_entropy": 3.24, "empty_count": 5, "entropy_stddev": 0.92, "embedded_code_candidates": 1 }, "identifiers": { "count": 442, "unique": 74, "avg_length": 10.64, "max_length": 39, "min_length": 3, "avg_entropy": 2.87, "reuse_ratio": 0.17, "length_stddev": 6.41, "high_entropy_count": 8, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.38, "all_uppercase_ratio": 0.01 } } }, "id": 2, "mol": "K(Li)O(C₂)H₄(Cm₂Db₂F₅Po)", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/bin/filament-v3", "pid": 0, "risk": 12, "sha": "63bdec288e9c18e48058f68d34e55dfe19361329aba0069fd915060433054de3", "size": 12254, "traits": [ { "id": "metadata/import/php/composer/installedversions::composer/installedversions", "conf": 0.95, "crit": 2, "desc": "imports Composer\\InstalledVersions", "spans": [ [ 30, 0 ] ] }, { "id": "metadata/import/php/illuminate/support/str::illuminate/support/str", "conf": 0.95, "crit": 2, "desc": "imports Illuminate\\Support\\Str", "spans": [ [ 62, 0 ] ] }, { "id": "metadata/import/php/ask::ask", "conf": 0.95, "crit": 2, "desc": "imports ask", "spans": [ [ 109, 0 ] ] }, { "id": "metadata/import/php/create-filament-v3-panel-provider/php::create-filament-v3-panel-provider/php", "conf": 0.95, "crit": 2, "desc": "imports create-filament-v3-panel-provider.php", "spans": [ [ 2951, 0 ] ] }, { "id": "metadata/import/php/render::render", "conf": 0.95, "crit": 2, "desc": "imports render", "spans": [ [ 114, 0 ] ] }, { "id": "metadata/import/php/vendor/autoload/php::vendor/autoload/php", "conf": 0.95, "crit": 2, "desc": "imports vendor/autoload.php", "spans": [ [ 132, 0 ] ] }, { "id": "metadata/file/catalog/service::service-name-discord", "conf": 0.6, "crit": 3, "desc": "Discord service name", "spans": [ [ 724, 7 ] ] }, { "id": "metadata/file/catalog/service::service-name-github", "conf": 0.6, "crit": 3, "desc": "GitHub service name", "spans": [ [ 846, 6 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 396, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 1079, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 936, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 608, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 551, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 5409, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 487, 0 ] ] }, { "id": "micro-behaviors/communications/http/client/file-read::php-file-get-variable-source", "conf": 0.88, "crit": 3, "desc": "PHP reads content from a variable source", "spans": [ [ 3259, 17 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 748, 19 ] ] }, { "id": "micro-behaviors/data/serialize/json::php-json-decode", "conf": 0.9, "crit": 3, "desc": "PHP JSON deserialization", "spans": [ [ 11013, 11 ] ] }, { "id": "micro-behaviors/data/string/replace::php-preg-replace-call", "conf": 0.9, "crit": 3, "desc": "PHP replaces strings with a regular expression", "spans": [ [ 3444, 12 ] ] }, { "id": "micro-behaviors/data/string/replace::php-str-replace-call", "conf": 0.9, "crit": 3, "desc": "PHP replaces matched string content", "spans": [ [ 4627, 11 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "atk": "T1083", "conf": 1.0, "crit": 2, "desc": "Enumerates directories with PHP functions", "spans": [ [ 3157, 0 ] ] }, { "id": "micro-behaviors/fs/file/rename::rename-call", "conf": 0.6, "crit": 3, "desc": "Renames/moves file via rename()", "spans": [ [ 10204, 6 ] ] }, { "id": "micro-behaviors/fs/path/construct::php-script-path-suffix", "conf": 0.94, "crit": 3, "desc": "PHP script path suffix", "spans": [ [ 148, 5 ] ] }, { "id": "micro-behaviors/fs/write/file/full::php-file-put-contents", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP file_put_contents()", "spans": [ [ 3698, 17 ] ] }, { "id": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "atk": "T1505.003", "conf": 0.86, "crit": 3, "desc": "Very long embedded string" }, { "id": "objectives/command-and-control/dropper/execution/jphp::jphp-file-put-contents", "conf": 0.9, "crit": 3, "desc": "JPHP file write call", "spans": [ [ 3698, 17 ] ] }, { "id": "well-known/lib/web/laravel::laravel-illuminate-namespace", "conf": 0.9, "crit": 3, "desc": "Imports an Illuminate\\... Laravel namespace", "spans": [ [ 58, 15 ] ] }, { "id": "micro-behaviors/fs/delete/file/library::php-unlink", "conf": 1.0, "crit": 3, "desc": "Calls PHP unlink()", "spans": [ [ 1826, 6 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::dotenv-filename-literal", "atk": "T1552.001", "conf": 0.85, "crit": 1, "desc": ".env filename literal", "spans": [ [ 7936, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::php-exec", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "PHP exec() function call", "spans": [ [ 10748, 4 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::php-dir-traverse", "atk": "T1083", "conf": 1.0, "crit": 2, "desc": "Iterate directory contents in PHP (micro-behavior, not suspicious alone)", "uses": [ 20 ], "spans": [ [ 3157, 0 ] ] }, { "id": "micro-behaviors/fs/write/file/handle::php-file-write", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Writes data using PHP file API", "uses": [ 23 ], "spans": [ [ 3698, 17 ] ] }, { "id": "well-known/lib/web/laravel::laravel-context", "conf": 0.9, "crit": 3, "desc": "File runs inside the Laravel framework", "uses": [ 26 ], "spans": [ [ 58, 15 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "uses": [ 30 ], "spans": [ [ 3157, 5 ] ] } ], "type": "php" }, { "ctx": [ { "b": "DJ", "ln": 1, "addr": 0 }, { "b": "arR^Hb5Q?awG\u003ceTb4+L9vqPN[Bt4=Qxl4A\u003ewG\u0026V", "n": [ { "c": 2, "d": "Composer package declares a name", "i": "metadata/package/manifest/ecosystem::composer-has-name", "o": 6, "z": 16, "cf": 0.949999988079071 } ], "ln": 2, "addr": 2 }, { "b": "arR^Hb4Lnav@=p5BzkVhb03?\u003crD8O\u003evpS{(mRMWEzdNQbaA/H.v@C)?aARJAmRMWEzdNQbaA/K[a$J", "ln": 3, "addr": 34 }, { "b": "arR^Hb5y$6wO#N2b03?\u003co?wqdec", "n": [ { "c": 2, "d": "Composer package declares a license", "i": "metadata/package/manifest/ecosystem::composer-license-declared", "o": 101, "z": 3, "cf": 0.949999988079071 } ], "ln": 4, "addr": 97 }, { "b": "arR^Hb4$[iwPh6\u003cwG\u003ceTb4#7uAc15[fk20vxMW=pv@Diqw[=6\u0026zdNQbAa\u003chzw[=6\u0026zdNQba$J", "ln": 5, "addr": 119 }, { "b": "arR^Hb6d)CAbP=sb03\u0026[", "ln": 6, "addr": 178 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 707.0, "entropy": 4.47, "size_bytes": 707.0 }, "binary": { "overall_entropy": 4.47, "peak_region_bytes": 707.0, "peak_region_entropy": 4.47 } } }, "id": 3, "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/composer.json", "pid": 0, "risk": 1, "sha": "d8f09e9aee7289a13b2cbe1781e382b1fcb15d9621346f5edcbf6fe9ae390167", "size": 707, "traits": [ { "id": "metadata/package/manifest/ecosystem::composer-has-name", "conf": 0.949999988079071, "crit": 2, "desc": "Composer package declares a name", "spans": [ [ 6, 16 ] ] }, { "id": "metadata/package/manifest/ecosystem::composer-license-declared", "conf": 0.949999988079071, "crit": 2, "desc": "Composer package declares a license", "spans": [ [ 101, 3 ] ] } ], "type": "composer.json" }, { "ctx": [ { "b": "ju)^#z#", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 6 }, { "b": "zEEx[B8UL$wGTDRy*?f(zGGb-Aa:i1wmY1zwN/?2AYT", "ln": 3, "addr": 7 } ], "depth": 1, "facts": { "imp": [ [ "", "PhpParser\\Node" ], [ "", "PhpParser\\Node\\Expr\\ArrowFunction" ], [ "", "PhpParser\\Node\\Expr\\Closure" ], [ "", "PhpParser\\Node\\Name" ], [ "", "Rector\\Rector\\AbstractRector" ], [ "", "Symplify\\RuleDocGenerator\\ValueObject\\CodeSample\\CodeSample" ], [ "", "Symplify\\RuleDocGenerator\\ValueObject\\RuleDefinition" ] ], "mbr": [ "$node.params", "$param.type", "$param.var", "$param.var.name" ], "tgt": [ "$this" ], "metrics": { "ast": { "op.eq": 2.0, "op.lor": 2.0, "op.land": 2.0, "op.lnot": 1.0, "max_depth": 17.0, "bind_count": 3.0, "call_count": 4.0, "node_count": 484.0, "member_count": 4.0, "op_density.eq": 0.0, "op_density.lor": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 28.0, "member_depth_max": 3.0, "string_literal_count": 11.0, "array_literal_max_length": 2.0 }, "file": { "size": 1631.0, "entropy": 4.66, "size_bytes": 1631.0 }, "text": { "space_count": 412.0, "total_lines": 54.0, "char_entropy": 4.66, "unique_chars": 63.0, "escape_density": 0.06, "string_density": 0.2, "avg_line_length": 29.2, "max_line_length": 136.0, "empty_line_ratio": 0.17, "last_line_length": 1.0, "whitespace_ratio": 0.29, "most_common_ratio": 0.07, "identifier_density": 1.81, "line_length_stddev": 31.19, "unicode_escape_count": 1.0, "normalized_string_count": 1.5, "repeated_char_sequences": 16.0, "suspicious_string_ratio": 0.27, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 5.56 }, "binds": { "count": 3.0 }, "calls": { "count": 4.0 }, "binary": { "overall_entropy": 4.66, "peak_region_bytes": 1024.0, "peak_region_entropy": 4.86 }, "source": { "class_count": 1.0, "function_count": 3.0 }, "imports": { "count": 7.0, "unique_modules": 7.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "members": { "count": 4.0 }, "strings": { "total": 11.0, "avg_length": 21.73, "max_length": 67.0, "avg_entropy": 3.06, "total_bytes": 239.0, "entropy_stddev": 0.84, "shell_command_strings": 1.0, "embedded_code_candidates": 2.0 }, "comments": { "chars": 37.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.02 }, "functions": { "count": 4.0, "avg_params": 0.33, "max_params": 1.0, "length_stddev": 6.94, "avg_name_length": 12.33, "no_params_count": 2.0, "avg_length_lines": 12.33, "max_length_lines": 21.0, "min_length_lines": 4.0, "avg_param_name_length": 5.0, "density_per_100_lines": 5.56, "code_in_functions_ratio": 0.69 }, "identifiers": { "count": 28.0, "total": 98.0, "avg_length": 8.22, "max_length": 27.0, "min_length": 3.0, "avg_entropy": 2.59, "reuse_ratio": 0.33, "unique_count": 32.0, "length_stddev": 5.07, "high_entropy_count": 1.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.28 } } }, "id": 4, "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/src/Rector/FixGetSetClosureTypesRector.php", "pid": 0, "risk": 1, "sha": "537b63e779f1aefe0248a12a31a80ca2a4cb93bc215088b6c42251dcd2b072e3", "size": 1631, "traits": [ { "id": "metadata/lang/scripted::php-open-tag", "conf": 0.949999988079071, "crit": 1, "desc": "PHP opening tag present", "spans": [ [ 0, 5 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.8999999761581421, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 24 ] ] } ], "type": "php" }, { "ctx": [ { "b": "ju)^#z#", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 6 }, { "b": "zEEx[B8UL$wGTDRy*?f(zGGb-Aa:i1wmY1zwN/?2AYT", "ln": 3, "addr": 7 } ], "depth": 1, "facts": { "imp": [ [ "", "PhpParser\\Node" ], [ "", "PhpParser\\Node\\Name" ], [ "", "PhpParser\\Node\\Stmt\\UseUse" ], [ "", "Rector\\Rector\\AbstractRector" ], [ "", "Symplify\\RuleDocGenerator\\ValueObject\\CodeSample\\CodeSample" ], [ "", "Symplify\\RuleDocGenerator\\ValueObject\\RuleDefinition" ] ], "mbr": [ "$node.name" ], "tgt": [ "$this" ], "metrics": { "ast": { "op.lor": 2.0, "max_depth": 15.0, "bind_count": 2.0, "call_count": 4.0, "node_count": 394.0, "member_count": 1.0, "op_density.lor": 0.01, "identifier_count": 23.0, "member_depth_max": 2.0, "string_literal_count": 9.0, "array_literal_max_length": 1.0 }, "file": { "size": 1335.0, "entropy": 4.64, "size_bytes": 1335.0 }, "text": { "space_count": 308.0, "total_lines": 45.0, "char_entropy": 4.64, "unique_chars": 61.0, "escape_density": 0.15, "string_density": 0.2, "avg_line_length": 28.67, "max_line_length": 139.0, "empty_line_ratio": 0.13, "last_line_length": 1.0, "whitespace_ratio": 0.26, "most_common_ratio": 0.09, "identifier_density": 1.6, "line_length_stddev": 30.62, "unicode_escape_count": 2.0, "normalized_string_count": 1.34, "repeated_char_sequences": 10.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 4.55 }, "binds": { "count": 2.0 }, "calls": { "count": 4.0 }, "binary": { "overall_entropy": 4.64, "peak_region_bytes": 1024.0, "peak_region_entropy": 4.85 }, "source": { "class_count": 1.0, "function_count": 3.0 }, "imports": { "count": 6.0, "unique_modules": 6.0, "third_party_count": 6.0, "third_party_ratio": 1.0 }, "members": { "count": 1.0 }, "strings": { "total": 9.0, "avg_length": 26.56, "max_length": 39.0, "avg_entropy": 3.61, "total_bytes": 239.0, "entropy_stddev": 0.21 }, "comments": { "chars": 20.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.02 }, "functions": { "count": 4.0, "avg_params": 0.33, "max_params": 1.0, "length_stddev": 4.03, "avg_name_length": 12.33, "no_params_count": 2.0, "avg_length_lines": 9.67, "max_length_lines": 13.0, "min_length_lines": 4.0, "avg_param_name_length": 5.0, "density_per_100_lines": 6.67, "code_in_functions_ratio": 0.64 }, "identifiers": { "count": 23.0, "total": 72.0, "avg_length": 8.64, "max_length": 25.0, "min_length": 4.0, "avg_entropy": 2.61, "reuse_ratio": 0.35, "unique_count": 25.0, "length_stddev": 5.14, "high_entropy_count": 1.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.2, "keyboard_pattern_names": 1.0 } } }, "id": 5, "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/src/Rector/MoveImportedClassesRector.php", "pid": 0, "risk": 1, "sha": "52f7a0ee87e1442dae0a7a43bae5e2ec5f756104ce194583fea5ca9900049861", "size": 1335, "traits": [ { "id": "metadata/lang/scripted::php-open-tag", "conf": 0.949999988079071, "crit": 1, "desc": "PHP opening tag present", "spans": [ [ 0, 5 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.8999999761581421, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 24 ] ] } ], "type": "php" }, { "id": 6, "sha": "f077401defe92fcfe05e6b79202d028e25299675ab6b4b0c854a8aaa23a41614", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/src/Rector/SecondaryToGrayColorRector.php", "risk": 1, "size": 1309, "type": "php", "depth": 1 }, { "id": 7, "mol": "H(Po)", "sha": "c9b75a10d082edbc02c7eff9d543d9491a2b566bb5768d15757cfb66bffcf8e7", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/src/Rector/SimpleMethodChangesRector.php", "risk": 1, "size": 14865, "type": "php", "depth": 1 }, { "id": 8, "mol": "H(Po)", "sha": "940ba569526f08700d8b34dce7a87cf8cc0db7efc447426708db0d718f156754", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/src/Rector/SimplePropertyChangesRector.php", "risk": 1, "size": 4280, "type": "php", "depth": 1 }, { "id": 9, "sha": "98d630f9baf9d937deb65569b875b63ffc2d86c03a205718dd37801cb5bac5a8", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/src/heroicon-changes.php", "risk": 1, "size": 4962, "type": "php", "depth": 1 }, { "id": 10, "sha": "42800c315e3378ad1163eb2b120d72bdb44f2b11727359804cd50d45c27281bd", "path": "/data/samples/unknown/foraged/go/googleusercontent.com/pkg.go.dev/github.com/filamentphp/upgrade/github.com-filamentphp-upgrade-v3.3.24+incompatible.zip!!github.com/filamentphp/upgrade@v3.3.24+incompatible/src/rector.php", "risk": 1, "size": 4119, "type": "php", "depth": 1 } ], "omitted_files": 5, "rev": "9c16f", "v": "8" } }