{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.03585294, "rte": "az", "prob": 0.03585294 } ], "prob": 0.03585294, "skip": [ { "rte": "az/tar", "why": "unavailable" }, { "rte": "az/tar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.03585293889045715, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.010426104068756104, "type": "systemd" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.024424374103546143, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00003331899642944336, "type": "srcinfo" } ], "version": "v18.18", "analyzed_at": "2026-07-02T19:20:38Z" }, "path": "netbird-0.74.1-1.src.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zQ\u003czeXe*67jxnr$GlHc=0)gwj%jHT6TL\u003cN*RbGG1akSQ^mmqV}S}3Wwq)o", "n": [ { "c": 2, "d": "Archive parser reported errors", "i": "metadata/file/metrics::archive-parse-error", "o": 0, "z": 24, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "H₂(CmPo₂)", "sha": "4601c08fe7143e3aa7292aa6ecfcee9b36eb84bec8a9134c233c83036ef92b23", "path": "netbird-0.74.1-1.src.tar.gz", "risk": 2, "size": 2266, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 2266.0, "entropy": 7.91, "size_bytes": 2266.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.91, "peak_region_bytes": 2048.0, "peak_region_entropy": 7.8 } } }, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "from": [ { "off": 1228, "file": 2, "line": 48 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "off": 1228, "file": 2, "line": 48 } ] }, { "id": "micro-behaviors/communications/url/external/github::github-archive-ref-download", "atk": "T1105", "conf": 0.8399999737739563, "crit": 3, "desc": "GitHub archive refs download URL", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/local-exec::local-execution", "conf": 1.0, "crit": 3, "desc": "Executes a file from current directory", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/family::x11-ref", "crit": 2, "desc": "X11 windowing reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir", "conf": 0.699999988079071, "crit": 3, "desc": "Execution from current directory (./file)", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "A+w%93rHUNBAoP.wPScmA+^mBzFT38wIe7kA+w%93jp0owPz%dv}w{Mmr\u0026xNq/(C*BuIp1B8\u0026{yx(kOwwPRx}A+3+ywPz%9AV=}=v@Dl%x\u003eFLwwPRAnzE){0x(T", "ln": 118, "col": 38, "line": 4 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 812, "entropy": 4.75 }, "binary": { "peak_region_bytes": 812, "peak_region_entropy": 4.75 } } }, "id": 1, "mol": "O(P)", "path": "netbird-0.74.1-1.src.tar.gz!!netbird/netbird-server.service", "pid": 0, "risk": 2, "sha": "6e42973058b2db1a167ac110692d02c57b93d29ce6f68d8d5f8b91babcd856c9", "size": 812, "traits": [ { "id": "micro-behaviors/os/service/unit-field::documentation-exists", "conf": 1.0, "crit": 2, "desc": "Unit Documentation= exists" }, { "id": "micro-behaviors/os/service/dependency::after-exists", "conf": 0.9, "crit": 2, "desc": "Unit After= exists" }, { "id": "micro-behaviors/os/service/unit-field::install-wanted-by-exists", "conf": 1.0, "crit": 2, "desc": "Install WantedBy= exists" }, { "id": "micro-behaviors/os/service/unit-field::unit-description-exists", "conf": 1.0, "crit": 2, "desc": "Unit Description= exists" }, { "id": "objectives/persistence/system/service/systemd::systemd-has-dependency-or-env", "atk": "T1543.002", "conf": 1.0, "crit": 3, "desc": "Systemd unit declares dependencies or environment", "uses": [ 1, 2 ] }, { "id": "objectives/persistence/system/service/systemd::systemd-has-docs-or-comments", "atk": "T1543.002", "conf": 1.0, "crit": 3, "desc": "Systemd unit has documentation or comments", "uses": [ 0, 1, 3 ] } ], "type": "systemd_service" }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV@JMA:\u0026D[y-\u003e\u0026Hz/o-cBzKiPzddc{e[n*pj]", "n": [ { "c": 2, "d": "Arch PKGBUILD package recipe basename", "i": "metadata/file/string/identity::pkgbuild-basename", "o": 0, "z": 8, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "boPu(zGG]kvS=^hAYLsLA=kGlauT7Mv}YE.zA}VKz!9Nbe[wJS", "ln": 2, "addr": 42 }, { "b": "", "ln": 3, "addr": 83 }, { "b": "Abf9fwPx{/e\u0026LQtfA", "ln": 10, "addr": 155 }, { "b": "Abf9bwO:H:", "ln": 11, "addr": 169 }, { "b": "B-IpYcUNQzAc15[fk+uyvRG\u003c[e[]kK", "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 183, "z": 8, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 178 }, { "b": "vrb\u003c\u003ejT+25i5R)#wO#Q7B.@@TCSmP*hz=K+A+#}cA=2$UxDQ-7zfv*JayOY0v}W+SaAzgqv%f:!df", "ln": 13, "addr": 203 }, { "b": "uV*6\u0026wmYZ\u003ezE^/Kc\u0026", "ln": 14, "addr": 265 }, { "b": "arUGmvRoI2zE-", "ln": 15, "addr": 279 }, { "b": "arUGmvT6QZ", "n": [ { "c": 2, "d": "Graphics/OpenGL library markers", "i": "micro-behaviors/dylib/library/family::graphics-lib-marker", "o": 292, "z": 6, "cf": 0.6000000238418579 } ], "ln": 16, "addr": 290 }, { "b": "arUGmvT8y9A=Vet", "ln": 17, "addr": 299 }, { "b": "arUGmvT8O", "ln": 18, "addr": 312 }, { "b": "df", "ln": 22, "addr": 359 }, { "b": "zddi\u003ewmYZ\u003ezE^/Kc)@UCcM\u003cPUDTy]fuU0.!wO#41tr(Fxa$i", "ln": 23, "addr": 361 }, { "b": "B8Mhwv}v!Ka%.byxjtp\u003cwI2fDyId*4AXqDxAXq0JiYZ}@Bz#pZfe3%LBzb/ae[n*pfk+uyvRG\u003c[x(tUxwPRx}A+3?iA:@=%C4AsEwOc0pByw*6flOQWyId*4AXqDxAXq0Ja]", "n": [ { "c": 3, "d": "GitHub archive refs download URL", "i": "micro-behaviors/communications/url/external/github::github-archive-ref-download", "o": 442, "z": 47, "cf": 0.8399999737739563 } ], "ln": 24, "addr": 400 }, { "b": "arR^HarR^Hb5Q$lvRG\u003c[ePUGzC4CXDB7Gxnx\u003e7Y#df", "ln": 25, "addr": 506 }, { "b": "B7!#qh8YI#zf4\u0026*cP9Umv}xa7gHS3[h-9l$gH@EPh!1J$g+@GKgb?fDf/-=8g=Ng2vLP@NgCH:Ch.^rDhzD{Chdno}vQ?u9g:-", "ln": 26, "addr": 540 }, { "b": "arUrnayYFcy?aU[", "ln": 45, "addr": 1077 }, { "b": "arR^HePh+vB.LV5ay1", "ln": 46, "addr": 1090 }, { "b": "arR^HeO[%fy**%$ar\u0026yUat4^WeO]csyI!02wJ:QHBy/GgvqE5rsrIl\u003cBzb/ae[n*pfk+uyvRG\u003c[x(tUxwPRx}A+3?DwPz\u003caz/dgJwPz\u003caz/dY-Abf9fwPw[BwQ5rkwm/T^xlbh2a%Y\u0026ImOD9rq^pH\u003cay1", "n": [ { "c": 3, "d": "Executes a file from current directory", "i": "micro-behaviors/process/create/local-exec::local-execution", "o": 1227, "z": 13, "cf": 1.0 } ], "ln": 47, "addr": 1105 }, { "b": "arR^He?ZZJx\u003eqg7atbrSy?WD#Bt4=JatbrSz/5@$zE)t", "n": [ { "c": 3, "d": "Execution from current directory (./file)", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir", "o": 1228, "z": 12, "cf": 0.699999988079071 } ], "ln": 48, "addr": 1228 }, { "b": "", "ln": 49, "addr": 1264 }, { "b": "arUGsv{%f@B7/c3yY", "ln": 50, "addr": 1265 }, { "b": "Ee", "ln": 54, "addr": 1377 }, { "b": "", "ln": 55, "addr": 1379 }, { "b": "boRbFB98ClvqNcewPI@oB9hhswGV28ADL#owPF#mz/oZ", "n": [ { "c": 1, "d": "Source/test target word", "i": "objectives/impact/destroy/keywords::target-source-test", "o": 1391, "z": 10, "cf": 0.8799999952316284 } ], "ln": 56, "addr": 1380 }, { "b": "v}YB-yByRODJ", "ln": 57, "addr": 1416 }, { "b": "arUf8ar\u00267LA:@S]AXwXSyId9+B7D{GAbf9fwPxCkB.LV5a]", "ln": 58, "addr": 1426 }, { "b": "", "ln": 67, "addr": 1773 }, { "b": "Aa9l(vp%dUzE){0x(W-jdiJ%", "ln": 68, "addr": 1774 }, { "b": "arUGmv}xL0wJ.B?lq{o7gC7$gvrDT5cN/", "n": [ { "c": 2, "d": "BSD license reference", "i": "metadata/package/license::bsd-word", "o": 1806, "z": 3, "cf": 0.699999988079071 } ], "ln": 69, "addr": 1794 }, { "b": "arUc4v@3jajT:(-v\u003eRw7w)]*#Bt1[UyIdJ[zdLc", "ln": 70, "addr": 1821 }, { "b": "arUiaAaJ]$B3g{:y?Wu*df", "ln": 71, "addr": 1853 }, { "b": "", "ln": 82, "addr": 2224 }, { "b": "arUf8aAz4fwNPT\u003euUj1*wPGICD2[7szdCp", "ln": 83, "addr": 2225 }, { "b": "arUxoB97\u0026by-\u003eq$z8Kjcaz2Clar\u00267IyIdf(AXz0Cv\u003eRw7w)]*#Bt1[UyIdJ[zdK)", "n": [ { "c": 3, "d": "Environment dump command", "i": "objectives/supply-chain/install-hook/build/autotools::env-dump-cmd", "o": 2269, "z": 5, "cf": 0.6000000238418579 } ], "ln": 84, "addr": 2253 }, { "b": "arUxoB97\u0026by-\u003eq$z8Kjcaz$+jvRG\u003c[kRva?A=#ebwGSNDar\u00267IyIdf(AXzMRAXzlyvLq!FB97#gwg@1HB97#gfcQ", "ln": 85, "addr": 2305 }, { "b": "Ee", "ln": 86, "addr": 2376 }, { "b": "arUGmv}xL0wJ.B?k$s:BeI/1kePkJyC{+3", "ln": 89, "addr": 2406 }, { "b": "arUc4v@3jajT:(-v\u003eP9DyIdJ[zdLwgz/ff3xd!ErzepT", "ln": 90, "addr": 2434 }, { "b": "arUiaAaJ]$B3g{:y?Wu*ay!?iv}xX5x\u003ez6?vru74df", "n": [ { "c": 2, "d": "CA certificates reference", "i": "micro-behaviors/crypto/certificate/usage::ca-certificates", "o": 2487, "z": 15, "cf": 0.800000011920929 } ], "ln": 91, "addr": 2470 }, { "b": "arUPwByX%4wO#41jT.W#wN]H@iV}0Zp-%mRv}YA@B98tvwHw]", "ln": 92, "addr": 2504 }, { "b": "arUSsxjLN{v)8hvx(W=PBZYr3eN\u0026dfwN({4C4CYgvr\u0026#kwPScmA+^YUB7]J8y?khcx(mv1C{4ftA=#2mcJ", "ln": 93, "addr": 2544 } ], "depth": 1, "facts": { "imp": [ [ "", "cd" ], [ "", "cd" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "go" ], [ "", "go" ], [ "", "cd" ], [ "", "cd" ], [ "", "go" ], [ "", "go" ], [ "", "./build/client" ], [ "", "./build/client" ], [ "", "cd" ], [ "", "cd" ], [ "", "./client" ], [ "", "./client" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "completions" ], [ "", "completions" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "./build/client", "./client", "_completions", "cd", "go", "install", "mkdir" ], "metrics": { "ast": { "op.eq": 1.0, "max_depth": 9.0, "bind_count": 30.0, "call_count": 29.0, "node_count": 793.0, "op_density.eq": 0.0, "identifier_count": 105.0, "string_literal_count": 48.0, "array_literal_max_length": 8.0 }, "file": { "size": 3396.0, "entropy": 5.31, "size_bytes": 3396.0 }, "text": { "digit_ratio": 0.07, "space_count": 321.0, "total_lines": 119.0, "char_entropy": 5.31, "unique_chars": 78.0, "string_density": 0.4, "avg_line_length": 27.54, "max_line_length": 122.0, "empty_line_ratio": 0.15, "last_line_length": 1.0, "long_token_count": 1.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.07, "identifier_density": 2.09, "line_length_stddev": 26.51, "encoded_string_ratio": 0.04, "normalized_string_count": 4.4, "repeated_char_sequences": 1.0, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 15.23 }, "binds": { "count": 30.0 }, "calls": { "count": 29.0 }, "binary": { "overall_entropy": 5.31, "peak_region_bytes": 3072.0, "peak_region_entropy": 5.49 }, "source": { "function_count": 7.0 }, "strings": { "total": 48.0, "url_count": 1.0, "avg_length": 29.83, "max_length": 105.0, "path_count": 6.0, "avg_entropy": 3.76, "hex_strings": 2.0, "total_bytes": 1432.0, "entropy_stddev": 0.54, "shell_command_strings": 1.0 }, "comments": { "chars": 149.0, "lines": 4.0, "total": 4.0, "todo_count": 1.0, "to_code_ratio": 0.03 }, "functions": { "count": 7.0, "avg_params": 7.29, "max_params": 14.0, "length_stddev": 6.59, "avg_name_length": 12.0, "avg_length_lines": 12.0, "max_length_lines": 20.0, "min_length_lines": 4.0, "many_params_count": 4.0, "high_entropy_names": 3.0, "avg_param_name_length": 12.29, "density_per_100_lines": 5.88, "code_in_functions_ratio": 0.71 }, "identifiers": { "count": 105.0, "total": 249.0, "avg_length": 7.98, "max_length": 28.0, "min_length": 1.0, "avg_entropy": 2.43, "reuse_ratio": 0.42, "unique_count": 105.0, "length_stddev": 5.07, "has_digit_ratio": 0.16, "single_char_count": 6.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.43, "all_uppercase_ratio": 0.1, "numeric_suffix_count": 10.0, "underscore_prefix_count": 2.0 } } }, "id": 2, "mol": "H₂(CmPo₂)", "path": "netbird-0.74.1-1.src.tar.gz!!netbird/PKGBUILD", "risk": 2, "sha": "4957ecdf682a0a0649a5782240f8c700f4a0741453b5d4240bcce4ffd7f7a5e7", "size": 3396, "traits": [ { "id": "micro-behaviors/dylib/library/family::x11-ref", "crit": 2, "desc": "X11 windowing reference", "spans": [ [ 292, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir", "conf": 0.699999988079071, "crit": 3, "desc": "Execution from current directory (./file)", "spans": [ [ 1228, 12 ] ] }, { "id": "micro-behaviors/process/create/local-exec::local-execution", "conf": 1.0, "crit": 3, "desc": "Executes a file from current directory", "spans": [ [ 1227, 13 ] ] }, { "id": "micro-behaviors/communications/url/external/github::github-archive-ref-download", "atk": "T1105", "conf": 0.8399999737739563, "crit": 3, "desc": "GitHub archive refs download URL", "spans": [ [ 442, 47 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "spans": [ [ 1228, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 1228, 12 ] ] } ], "type": "shell" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1463.0, "entropy": 5.0, "size_bytes": 1463.0 }, "binary": { "overall_entropy": 5.0, "peak_region_bytes": 1463.0, "peak_region_entropy": 5.08 } } }, "id": 3, "path": "netbird-0.74.1-1.src.tar.gz!!netbird/.SRCINFO", "refs": [ { "to": "pkg:alpm/arch/glibc", "off": 780, "kind": "dependency" }, { "to": "pkg:alpm/arch/glibc", "off": 780, "kind": "dependency" }, { "to": "pkg:alpm/arch/ca-certificates", "off": 1022, "kind": "dependency" }, { "to": "pkg:alpm/arch/glibc", "off": 780, "kind": "dependency" }, { "to": "pkg:alpm/arch/netbird", "off": 10, "kind": "dependency" }, { "to": "pkg:alpm/arch/libglvnd", "off": 225, "kind": "dependency" }, { "to": "pkg:alpm/arch/libx11", "off": 249, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxcursor", "off": 271, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxi", "off": 297, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxinerama", "off": 318, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxrandr", "off": 345, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxxf86vm", "off": 370, "kind": "dependency" }, { "to": "pkg:alpm/arch/go", "off": 207, "kind": "dependency" }, { "to": "pkg:alpm/arch/libglvnd", "off": 225, "kind": "dependency" }, { "to": "pkg:alpm/arch/libx11", "off": 249, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxcursor", "off": 271, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxi", "off": 297, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxinerama", "off": 318, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxrandr", "off": 345, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxxf86vm", "off": 370, "kind": "dependency" }, { "to": "pkg:github/netbirdio/netbird", "off": 391, "kind": "dependency" } ], "sha": "0bbfb58b7320ae37386d983be1a1ef78210da7df791583e9ec7b024ff5163829", "size": 1463, "type": "srcinfo" } ], "rev": "868bd", "v": "8" } }