{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.7465682029724121,
        "class": 0
      }
    ],
    "prob": 0.7465682,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.7465682,
        "class": 0
      },
      {
        "m": "az/config",
        "prob": 0.30872482,
        "class": 0
      },
      {
        "m": "az/package.json",
        "prob": 0.018518519,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-18T01:24:28Z"
  },
  "path": "package.json",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(S₂)Md(Pa₃)",
        "x": 3,
        "id": 0,
        "is": [
          "@modelcontextprotocol/sdk",
          "commander",
          "express",
          "ws",
          "typebox",
          "playwright-core",
          "@openclaw/plugin-sdk",
          "undici"
        ],
        "ms": {
          "file": {
            "size": 510.0
          }
        },
        "sz": 510,
        "ts": [
          {
            "c": 0.75,
            "d": "Package has meaningful description",
            "e": [
              "OpenClaw browser tool plugin"
            ],
            "i": "metadata/package/fields/description::has-description",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "npm package has name field",
            "e": [
              "@openclaw/browser-plugin"
            ],
            "i": "metadata/package/quality::npm-has-name",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "-sdk suffix",
            "e": [
              "-sdk"
            ],
            "i": "objectives/supply-chain/trojanized/library/framework::sdk-suffix",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Depends on modelcontextprotocol sdk",
            "e": [
              "1.29.0"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/manifest/npm::dep-modelcontextprotocol-sdk",
            "l": 3
          },
          {
            "a": "T1195.002",
            "c": 1.0,
            "d": "npm package declares dependencies field",
            "e": [
              "{\"@modelcontextprotocol/sdk\":\"1.29.0\",\"commander\":\"14.0.3\",\"express\":\"5.2.1\",\"playwright-core\":\"1.60.0\",\"typebox\":\"1.1.38\",\"ws\":"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/dependency/manifest::npm-has-runtime-dependencies-field",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "npm package has version field",
            "e": [
              "2026.5.14"
            ],
            "i": "metadata/package/fields/version::npm-has-version",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Package has devDependencies",
            "e": [
              "{\"@openclaw/plugin-sdk\":\"workspace:*\",\"undici\":\"8.3.0\"}"
            ],
            "i": "metadata/package/fields/dependencies::has-dev-deps",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "Major version is 1 or higher",
            "e": [
              "2026.5.14"
            ],
            "i": "metadata/package/fields/version::mature-version",
            "l": 3
          },
          {
            "c": 0.8399999737739563,
            "d": "Package uses npm scope name",
            "e": [
              "@openclaw/browser-plugin"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/manifest/npm::scoped-package-name",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.6499999761581421,
            "d": "npm devDependency uses workspace protocol",
            "e": [
              "\"workspace:"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/dependency/manifest::npm-workspace-devdependency",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Package marked as private",
            "e": [
              "true"
            ],
            "i": "metadata/package/fields/private::is-private",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "express library",
            "e": [
              "express"
            ],
            "i": "objectives/supply-chain/trojanized/library/framework::express-lib",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Uses standard version format",
            "e": [
              "2026.5.14"
            ],
            "i": "metadata/package/fields/version::conventional-version-base",
            "l": 2
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no build script entry",
            "e": [
              "field 'scripts.build' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-build",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no prepublishOnly script entry",
            "e": [
              "field 'scripts.prepublishOnly' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-prepublish-only",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no package-web script entry",
            "e": [
              "field 'scripts.package-web' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-package-web",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no prepare script entry",
            "e": [
              "field 'scripts.prepare' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-prepare",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no package script entry",
            "e": [
              "field 'scripts.package' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-package",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Package version is past 1.0",
            "e": [
              "2026.5.14"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/manifest/npm::version-mature",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no compile script entry",
            "e": [
              "field 'scripts.compile' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-compile",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no compile-web script entry",
            "e": [
              "field 'scripts.compile-web' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-compile-web",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no prepublish script entry",
            "e": [
              "field 'scripts.prepublish' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-prepublish",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Package name contains \"browser\"",
            "e": [
              "@openclaw/browser-plugin"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/naming::name-browser-target",
            "l": 3
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Package has no prepack script entry",
            "e": [
              "field 'scripts.prepack' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script-prepack",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "imports @modelcontextprotocol/sdk from 1.29.0",
            "e": [
              "@modelcontextprotocol/sdk"
            ],
            "i": "metadata/import/npm::modelcontextprotocol/sdk",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports commander from 14.0.3",
            "e": [
              "commander"
            ],
            "i": "metadata/import/npm::commander",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports express from 5.2.1",
            "e": [
              "express"
            ],
            "i": "metadata/import/npm::express",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports ws from 8.20.1",
            "e": [
              "ws"
            ],
            "i": "metadata/import/npm::ws",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports typebox from 1.1.38",
            "e": [
              "typebox"
            ],
            "i": "metadata/import/npm::typebox",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports playwright-core from 1.60.0",
            "e": [
              "playwright-core"
            ],
            "i": "metadata/import/npm::playwright-core",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports @openclaw/plugin-sdk from workspace:*",
            "e": [
              "@openclaw/plugin-sdk"
            ],
            "i": "metadata/import/npm::openclaw/plugin-sdk",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports undici from 8.3.0",
            "e": [
              "undici"
            ],
            "i": "metadata/import/npm::undici",
            "l": 2
          },
          {
            "a": "T1195.002",
            "c": 0.800000011920929,
            "d": "Package has no recognizable build pipeline",
            "e": [
              "field 'scripts.package' does not exist",
              "field 'scripts.build' does not exist",
              "field 'scripts.prepublishOnly' does not exist",
              "field 'scripts.prepare' does not exist",
              "field 'scripts.prepublish' does not exist",
              "field 'scripts.compile-web' does not exist",
              "field 'scripts.prepack' does not exist",
              "field 'scripts.package-web' does not exist",
              "field 'scripts.compile' does not exist"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::no-build-script",
            "l": 1
          }
        ],
        "sha": "48e138f023e9b42e06b389c5824f356e6f73ce526fb18dd3a54de7abdfb535db",
        "path": "package.json",
        "type": "package.json"
      }
    ],
    "tv": "60127"
  }
}