{ "llm": { "conf": 0.99996954, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 0, "prob": 0.9999545, "class": "hostile" }, "outcome": "hostile", "interpretation": "Exfiltrates secrets via preinstall hook" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.9997864, "rte": "az", "prob": 0.9997864 }, { "cls": 2, "raw": 0.9999545, "rte": "az/npm", "prob": 0.9999545 } ], "prob": 0.9999545, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9999545216560364, "type": "npm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000008622805580671411, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.001432865858078003, "type": "javascript" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0005238354206085205, "type": "package.json" } ], "version": "v18.18", "analyzed_at": "2026-09-06T19:13:24Z" }, "path": "marginfi-client-v2-999.0.0.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000@}T??/4j55BIu7G{v#cIjcZ9U#kYSGkt1[1RFaRNX?Lx2E]qPi\u0026i5)@}z%7c#ENgDUs{7\u0026#O\u0026@ZvgN!E0mFC5kE/?\u003cqx5PF)MF5Uop1lr.sXeOzD/woB^996$m2rr9XH{1?dU^\u0026}}Tywfd^pQam[3necaA@ZQGC2j\u003cousvtGQN4ft\u0026}xQc^M\u0026xHGp5NM{7@]Kwpg7Zw@jh/H^lB=klBy1I/z/5Cc#^!WsGa?cZL57pLI\u003e7.vp@v\u003ejnZLul=yoG[Xx3hu\u0026=$o\u003crmU\u003c\u003cB?239B83hGB/a0HcC@yFv%iS\u003eyQYCgcPf+Rl!qQQt^9IA7uvF0W*Tax.-XafQ#}?[V^)I4lZzhZ\u003eiJ2(uJ/^Sp=?5Hx", "ln": 0 } ], "mol": "O₅(EuS₂CCaDy)H₄(Cm₅Db₂Os₂Po₃)Md₂(Pa₅In)", "sha": "4a990e3013afa312aaaf04ee09c51c14ac9bbfc61e748b789c77823357bed814", "path": "marginfi-client-v2-999.0.0.tgz", "risk": 325, "size": 814, "type": "npm", "facts": { "metrics": { "file": { "size": 814, "entropy": 7.74 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 814, "peak_region_entropy": 7.74 } } }, "ident": { "name": { "value": "marginfi-client-v2", "source": "npm.name", "verified": false }, "trust": "unsigned", "version": { "value": "999.0.0", "source": "npm.version", "verified": false }, "identifier": { "value": "marginfi-client-v2", "source": "npm.name", "verified": false } }, "traits": [ { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook" }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 2 } ], "uses": [ 23, 33 ] }, { "id": "metadata/import/builtin::require-os", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js os module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-script", "conf": 0.85, "crit": 3, "desc": "Hardcoded external IPv4 address", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/dropper/node-download-execute::node-helper-wrapped-https-name", "conf": 1.0, "crit": 1, "desc": "Helper resolves Node HTTPS module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-end-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request sends a body with end()", "from": [ { "file": 2 } ], "uses": [ 10, 42 ] }, { "id": "objectives/credential-access/env/secrets/filtered-access::env-filter-method", "atk": "T1552.001", "conf": 0.82, "crit": 1, "desc": "process.env adjacent to filter or match", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point" }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 2, "desc": "Package has install hooks", "from": [ { "file": 3 } ], "uses": [ 0 ] }, { "id": "micro-behaviors/communications/http/request/client::request-end-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 1, "desc": "Ends a request-like object with .end()", "from": [ { "file": 2 } ] }, { "id": "metadata/import/builtin::require-http", "conf": 0.75, "crit": 3, "desc": "Imports the Node.js HTTP module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "metadata/package/quality/version-sentinel::npm-version-major-40-plus", "atk": "T1195.002", "conf": 0.82, "crit": 3, "desc": "npm package version major 40+" }, { "id": "objectives/command-and-control/infrastructure/ip-port::hardcoded-js-ip-port-endpoint", "conf": 0.9, "crit": 4, "desc": "Hardcoded external IPv4 port endpoint", "from": [ { "off": 644, "file": 2, "line": 24 } ], "uses": [ 3, 44, 61 ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-host-port", "conf": 0.86, "crit": 1, "desc": "HTTP options contain hostname and port", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "from": [ { "off": 698, "file": 2, "line": 27 } ], "uses": [ 5, 24 ] }, { "id": "micro-behaviors/os/module/load::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "from": [ { "file": 2 } ], "uses": [ 2, 23, 59 ] }, { "id": "micro-behaviors/data/buffer::javascript-write-then-end-stream", "conf": 0.9, "crit": 3, "desc": "JavaScript writes then ends a stream", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/env/vars/access::js-object-entries-env", "conf": 0.75, "crit": 2, "desc": "JavaScript enumerates process.env entries", "from": [ { "file": 2 } ] }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook" }, { "id": "objectives/credential-access/theft/keywords::secret-upper", "conf": 0.45, "crit": 1, "desc": "SECRET credential label", "from": [ { "file": 2 } ] }, { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "micro-behaviors/communications/http/request/client::request-write-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "JavaScript writes HTTP request body", "from": [ { "file": 2 } ] }, { "id": "objectives/credential-access/env/secrets/filtered-access::js-secret-keyword-list", "atk": "T1552.001", "conf": 0.96, "crit": 3, "desc": "JavaScript environment secret-keyword filter", "from": [ { "file": 2 } ], "uses": [ 20, 58 ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Node sends an HTTP request body", "from": [ { "file": 2 } ], "uses": [ 6, 50 ] }, { "id": "metadata/import/builtin::runtime-api-import-set", "conf": 0.8, "crit": 3, "desc": "Imports at least three Node.js runtime APIs", "from": [ { "file": 2 } ], "uses": [ 2, 23, 59 ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "metadata/package/quality/version-sentinel::fake-version-number", "atk": "T1195.002", "conf": 0.9, "crit": 4, "desc": "Package has fake or inflated version number", "from": [ { "file": 3 } ], "uses": [ 37 ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-error-handler", "conf": 0.9, "crit": 3, "desc": "JavaScript emitter discards errors", "from": [ { "file": 2 } ] }, { "id": "objectives/exfiltration/sensitive-data::js-sensitive-env-source", "atk": "T1041", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Sensitive environment secret access (JS)", "from": [ { "off": 362, "file": 2, "line": 13 } ], "uses": [ 7, 26 ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::sparse-package-install-hook", "conf": 0.85, "crit": 3, "desc": "Sparse package metadata accompanies install hook", "from": [ { "file": 3 } ], "uses": [ 9 ] }, { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install" }, { "id": "metadata/package/quality/version-sentinel::npm-version-999", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version starts with 999" }, { "id": "metadata/package/manifest/freeform::pkg-skeleton-small", "conf": 0.7, "crit": 3, "desc": "Tiny package.json manifest", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/user/query::node-os-alias-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "Node os-alias user identity query", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::os-hostname-call", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "os.hostname() call", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::preinstall-runs-node-local-script", "atk": "T1195.002", "conf": 0.97, "crit": 3, "desc": "preinstall hook runs a local Node.js script" }, { "id": "micro-behaviors/communications/http/request/client::node-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js built-in http/https module usage", "from": [ { "file": 2 } ], "uses": [ 47 ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::js-port-field", "conf": 0.86, "crit": 1, "desc": "JavaScript port object field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-request-configured-variable", "conf": 0.86, "crit": 3, "desc": "Node HTTP request uses options object", "from": [ { "file": 2 } ], "uses": [ 15, 46, 64 ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-request-call", "conf": 0.86, "crit": 1, "desc": "HTTP request consumes an options identifier", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js http.request", "from": [ { "file": 2 } ] }, { "id": "objectives/exfiltration/stealer/credential/env::javascript-environ-json-http-exfil", "atk": "T1552.001,T1041", "mbc": "E1041", "conf": 0.98, "crit": 5, "desc": "JavaScript sends filtered environment secrets over HTTPS", "from": [ { "off": 362, "file": 2, "line": 13 } ], "uses": [ 16, 26, 27 ] }, { "id": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-credential", "atk": "T1552.001", "conf": 0.82, "crit": 3, "desc": "Env filtered for credential-keyword names", "from": [ { "file": 2 } ], "uses": [ 7, 22, 65 ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-stream-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request writes body", "from": [ { "file": 2 } ], "uses": [ 10, 25, 42 ] }, { "id": "metadata/package/quality/version-sentinel::npm-version-inflated-major", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version has inflated major number" }, { "id": "objectives/command-and-control/dropper/node-download-execute::node-helper-wrapped-child-process-name", "conf": 1.0, "crit": 1, "desc": "Helper resolves child process module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::node-os-alias-hostname-call", "atk": "T1082", "conf": 0.8, "crit": 3, "desc": "Node os-alias hostname query", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/post::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "from": [ { "file": 2 } ] }, { "id": "metadata/package/versioning::npm-unrealistic-major-version", "conf": 0.85, "crit": 3, "desc": "suspect major version (90+) for npm package" }, { "id": "micro-behaviors/data/serialize/object-schema::json-stringify-env-field", "conf": 0.88, "crit": 1, "desc": "JSON serialization includes an env field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/user/query::os-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "os.userInfo() user query", "from": [ { "file": 2 } ] }, { "id": "objectives/credential-access/theft/keywords::credential-label-upper", "conf": 0.9, "crit": 1, "desc": "Uppercase credential label", "from": [ { "file": 2 } ], "uses": [ 22 ] }, { "id": "metadata/import/builtin::require-https", "conf": 0.78, "crit": 3, "desc": "Imports the Node.js HTTPS module", "from": [ { "file": 2 } ] }, { "id": "objectives/discovery/system/fingerprint/user::small-node-host-user-query", "atk": "T1033,T1082", "conf": 0.9, "crit": 3, "desc": "Small Node script queries host and user", "from": [ { "file": 1 }, { "off": 229, "file": 2, "line": 9 } ], "uses": [ 43, 66 ] }, { "id": "micro-behaviors/communications/ip/endpoint::js-hostname-field", "conf": 0.86, "crit": 1, "desc": "JavaScript hostname object field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/quality/empty::tiny-commonjs-exports-object", "conf": 0.85, "crit": 3, "desc": "Tiny CommonJS stub exports object literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-post-json-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Node HTTP request posts a JSON body", "from": [ { "file": 2 } ], "uses": [ 16, 50 ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-object", "conf": 0.86, "crit": 1, "desc": "HTTP options object with host or port", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/env/access::process-env", "conf": 0.8, "crit": 2, "desc": "Node process.env access", "from": [ { "file": 2 } ] }, { "id": "objectives/discovery/system/fingerprint/user::node-host-user-query", "atk": "T1033,T1082", "conf": 0.85, "crit": 3, "desc": "Node queries host and user identity", "from": [ { "file": 2 } ], "uses": [ 40, 57 ] }, { "id": "metadata/package/quality/version-sentinel::archive-name-sentinel-version", "atk": "T1195.002", "conf": 0.88, "crit": 4, "desc": "archive name sentinel version", "spans": [ [ 0, 30 ] ] }, { "id": "objectives/supply-chain/credential-theft/package::npm-install-hook-environment-credential-exfil", "atk": "T1195.002,T1552.001,T1041", "mbc": "E1552,E1041", "conf": 0.99, "crit": 5, "desc": "NPM install hook exfiltrates environment credentials", "from": [ { "off": 306, "file": 2, "line": 12 }, { "file": 3 } ], "uses": [ 0, 48 ], "spans": [ [ 0, 41 ] ] } ] }, { "ctx": [ { "b": "zeS%cy?kkgCYmOwBAnM/aBwI#3i", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "mbr": [ "module.exports" ], "metrics": { "ast": { "max_depth": 4, "call_count": 0, "node_count": 12, "member_count": 1, "member_depth_max": 2 }, "file": { "size": 21, "entropy": 4.11 }, "text": { "lines": 1, "top_char": 111, "max_ws_run": 1, "space_count": 2, "char_entropy": 4.11, "unique_chars": 18, "top_char_null": 0, "top_char_ratio": 0.1, "avg_line_length": 20, "max_line_length": 20, "last_line_length": 20, "whitespace_ratio": 0.14, "identifier_density": 2 }, "binds": { "count": 1 }, "binary": { "peak_region_bytes": 21, "peak_region_entropy": 4.11 }, "identifiers": { "count": 2, "unique": 2, "avg_length": 6.5, "max_length": 7, "min_length": 6, "avg_entropy": 2.7, "reuse_ratio": 1, "length_stddev": 0.5, "all_lowercase_ratio": 1 } } }, "id": 1, "mol": "H(Db)Md(Pa)", "path": "marginfi-client-v2-999.0.0.tgz!!package/index.js", "pid": 0, "risk": 3, "sha": "8222b8169ee86f25cdccd84d340340060ae3f0cff55e2ea9d344d7c332733b71", "size": 21, "traits": [ { "id": "metadata/build/config::js-config-commonjs-export-object", "conf": 0.9, "crit": 2, "desc": "JavaScript config exports CommonJS object", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript source filename" }, { "id": "micro-behaviors/data/control-flow/module-exec::js-empty-module-exports", "conf": 0.8, "crit": 3, "desc": "CommonJS module exports an empty object", "spans": [ [ 0, 19 ] ] }, { "id": "metadata/package/placeholder::tiny-commonjs-exports-object", "conf": 0.85, "crit": 3, "desc": "Tiny CommonJS stub exports object literal", "spans": [ [ 0, 18 ] ] }, { "id": "metadata/build/config::js-config-default-export", "conf": 0.95, "crit": 2, "desc": "JavaScript config has default export", "uses": [ 0 ], "spans": [ [ 0, 0 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "v@DmaBrCmsBz#pzjS[=RADL#owHF{tBAzFycN?a:v@DmaBrCmsBz@u=aAz4kB.L(cc)@XIBz@PRi%]FozGx[xz/W3:aAz4kB.L(cc)@}OcN?a:v@DmaBrC]MwQ4=@q*Am\u003caBLv}aAz4kB.L(cc)@Irx(4r!Ab](bwPI]udlv\u003ezv@DmaBrCa5ByupPawbNdpa*QfA+PA7x\u003ezSsDKp(rBAoF=zE[2ml$7gGc[c=\u003cz+i(6q/)4]zF7vDed9HxxM4%liV@uZe[/fABz+J7wHF#U3lQElB7GwMaA8rNB-RbmnP5cUc[c=\u003eB7GxfvqPNb3lQE3CvS-SAb](bwPI]Bv%qDidj+/Gaz2CliV}jcygQ)%e[Pcxzaet:A+P9ac\u003c?7tarTD?ygQ)%e[F{xA+P9ac#:iBv}x.5e[F{zdk2jDy\u0026\u003clec[5qnt}3)Vj%ggParR^HatlwRs:TdplScuLD@J)mmnwkbk#QY-pF%Pdp/o\u003e=k#Zp2s3YINmo1Uepdm(MpdW*2q:\u003cbyD@r^dD{*n1k%^\u003eomsn04l}Hs8o\u00261IOpKCP8k#Q-OlWRf@nIs^gBy/Jnc#gmsarR^Hdgdgudj+/Gaz#dnuT[1(w[+)saBsCrarR!EwOkZ#BAhT/aAhvtv}x.5e[F{ze]CSBuT[1(w[+)+A+e($B98CFed9HxarU-nz/xnGaAhvtv}x.5e[F{ze]CSBuT[1(w[+)+B7occwH[fhaBL^FarUSsxf4dVzddD$x(mJ%eN@QhwO#PwB$$lGEjmk+3s!0(B95KyAcb/jzGu{-aBsCraztXmBz+J7wJy}Yh.)0zga\u003eHue\u00262ancObPEaAhmtBugK0i5ADFed9HxAa9\u003c4iV]!6zG6CAwQ4*3y:Q+varUJjBzbP6iV]!DpG7jued9HxxK$Q.wPz\u0026MaBtjUlVl\u003c:wO#Pwrc-B]cPSv$vq{g4x\u003e7N[x(v(xyiarhcOcw/lVl\u003c:wO#PwoL59OBz93.ay[]5vj(wczFa68aBL^FarU=uzdNTdBugK4fFCf/Eld=yBAhTHDKp(rv@DmaBrCQnAuEy!xMOune]\u003eJyB.bSoc#T6Dx(v)gefDt\u0026au.[hDWNt83lQEiwPotvzyu(zA=M8scOcw*diH=qaBwI=i%)8MA+fkyCxdztwHI7$ByuQW3lQEiwPotlzE+dAi%{xUv{%E?xEEBvaBwIz", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "https" ], [ "", "require" ], [ "", "http" ], [ "", "require" ], [ "", "os" ], [ "", "require" ], [ "", "require" ], [ "", "data" ], [ "", "JSON.stringify" ], [ "", "os.hostname" ], [ "", "os.userInfo" ], [ "", "process.cwd" ], [ "", "Object.fromEntries" ], [ "", "Object.entries.filter" ], [ "", "Object.entries" ], [ "", "options" ], [ "", "req" ], [ "", "http.request" ], [ "", "req.on" ], [ "", "req.write" ], [ "", "req.end" ], [ "", "child_process" ], [ "", "http" ], [ "", "https" ], [ "", "os" ] ], "mbr": [ "Date().toISOString", "JSON.stringify", "Object.entries", "Object.entries().filter", "Object.fromEntries", "data.length", "http.request", "os.hostname", "os.userInfo", "os.userInfo().username", "process.cwd", "process.env", "process.env.npm_config_registry", "process.env.npm_config_scope", "req.end", "req.on", "req.write" ], "tgt": [ "Date", "Date().toISOString", "JSON.stringify", "Object.entries", "Object.entries().filter", "Object.fromEntries", "http.request", "os.hostname", "os.userInfo", "process.cwd", "req.end", "req.on", "req.write", "require" ], "funcs": [ [ "anonymous", 341 ], [ "anonymous", 858 ], [ "anonymous", 887 ] ], "metrics": { "ast": { "max_depth": 15, "call_count": 18, "node_count": 377, "member_count": 17, "member_depth_max": 3 }, "file": { "size": 944, "entropy": 5.3 }, "text": { "lines": 37, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 115, "char_entropy": 5.3, "unique_chars": 74, "top_char_null": 0, "string_density": 0.32, "top_char_ratio": 0.06, "avg_line_length": 24.51, "max_line_length": 108, "empty_line_ratio": 0.08, "last_line_length": 13, "long_token_count": 1, "whitespace_ratio": 0.16, "identifier_density": 1.76, "line_length_stddev": 21.86, "normalized_string_count": 1.97, "trailing_whitespace_lines": 1, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 8.25 }, "binds": { "count": 6 }, "binary": { "peak_region_bytes": 944, "peak_region_entropy": 5.3 }, "imports": { "count": 4, "stdlib_count": 4, "stdlib_ratio": 1 }, "strings": { "bytes": 115, "count": 12, "ip_count": 1, "avg_length": 9.58, "max_length": 18, "path_count": 1, "avg_entropy": 2.51, "entropy_stddev": 0.88 }, "functions": { "density": 8.11, "anonymous": 3, "avg_params": 0.33, "code_ratio": 0.11, "max_params": 1, "one_liners": 2, "length_stddev": 0.47, "no_params_count": 2, "avg_length_lines": 1.33, "max_length_lines": 2, "min_length_lines": 1, "single_char_params": 1, "avg_param_name_length": 1 }, "identifiers": { "count": 65, "unique": 43, "avg_length": 5.93, "max_length": 19, "min_length": 1, "avg_entropy": 2.16, "reuse_ratio": 0.66, "length_stddev": 3.57, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.05, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.02 } } }, "id": 2, "mol": "O₄(EuCCaDy)H₄(Cm₅Db₂Os₂Po₂)Md(In)", "path": "marginfi-client-v2-999.0.0.tgz!!package/preinstall.js", "pid": 0, "risk": 164, "sha": "b23a60796b1284ca81d9458d2524c6085f12fc5c3340c75480ab44509e2a96d3", "size": 944, "traits": [ { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "spans": [ [ 109, 7 ] ] }, { "id": "metadata/import/builtin::require-http", "conf": 0.75, "crit": 3, "desc": "Imports the Node.js HTTP module", "spans": [ [ 45, 7 ] ] }, { "id": "metadata/import/builtin::require-https", "conf": 0.78, "crit": 3, "desc": "Imports the Node.js HTTPS module", "spans": [ [ 14, 7 ] ] }, { "id": "metadata/import/builtin::require-os", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js os module", "spans": [ [ 73, 0 ] ] }, { "id": "micro-behaviors/communications/http/post::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "spans": [ [ 763, 17 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js http.request", "spans": [ [ 836, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-end-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 1, "desc": "Ends a request-like object with .end()", "spans": [ [ 919, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-write-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "JavaScript writes HTTP request body", "spans": [ [ 900, 9 ] ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-host-port", "conf": 0.86, "crit": 1, "desc": "HTTP options contain hostname and port", "spans": [ [ 633, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-object", "conf": 0.86, "crit": 1, "desc": "HTTP options object with host or port", "spans": [ [ 613, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-request-call", "conf": 0.86, "crit": 1, "desc": "HTTP request consumes an options identifier", "spans": [ [ 836, 0 ] ] }, { "id": "micro-behaviors/communications/ip/endpoint::js-hostname-field", "conf": 0.86, "crit": 1, "desc": "JavaScript hostname object field", "spans": [ [ 633, 0 ] ] }, { "id": "micro-behaviors/communications/ip/endpoint::js-port-field", "conf": 0.86, "crit": 1, "desc": "JavaScript port object field", "spans": [ [ 661, 0 ] ] }, { "id": "micro-behaviors/data/buffer::javascript-write-then-end-stream", "conf": 0.9, "crit": 3, "desc": "JavaScript writes then ends a stream", "spans": [ [ 903, 25 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-error-handler", "conf": 0.9, "crit": 3, "desc": "JavaScript emitter discards errors", "spans": [ [ 874, 22 ] ] }, { "id": "micro-behaviors/data/serialize/object-schema::json-stringify-env-field", "conf": 0.88, "crit": 1, "desc": "JSON serialization includes an env field", "spans": [ [ 149, 0 ] ] }, { "id": "micro-behaviors/os/env/access::process-env", "conf": 0.8, "crit": 2, "desc": "Node process.env access", "spans": [ [ 321, 0 ] ] }, { "id": "micro-behaviors/os/env/vars/access::js-object-entries-env", "conf": 0.75, "crit": 2, "desc": "JavaScript enumerates process.env entries", "spans": [ [ 306, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::node-os-alias-hostname-call", "atk": "T1082", "conf": 0.8, "crit": 3, "desc": "Node os-alias hostname query", "spans": [ [ 206, 11 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::os-hostname-call", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "os.hostname() call", "spans": [ [ 206, 11 ] ] }, { "id": "micro-behaviors/process/user/query::node-os-alias-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "Node os-alias user identity query", "spans": [ [ 229, 11 ] ] }, { "id": "objectives/command-and-control/dropper/node-download-execute::node-helper-wrapped-child-process-name", "conf": 1.0, "crit": 1, "desc": "Helper resolves child process module", "spans": [ [ 109, 0 ] ] }, { "id": "objectives/command-and-control/dropper/node-download-execute::node-helper-wrapped-https-name", "conf": 1.0, "crit": 1, "desc": "Helper resolves Node HTTPS module", "spans": [ [ 14, 0 ] ] }, { "id": "objectives/credential-access/env/secrets/filtered-access::env-filter-method", "atk": "T1552.001", "conf": 0.82, "crit": 1, "desc": "process.env adjacent to filter or match", "spans": [ [ 321, 0 ] ] }, { "id": "objectives/credential-access/theft/keywords::secret-upper", "conf": 0.45, "crit": 1, "desc": "SECRET credential label", "spans": [ [ 362, 0 ] ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "spans": [ [ 744, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 728, 32 ] ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request", "spans": [ [ 698, 6 ], [ 706, 6 ] ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-script", "conf": 0.85, "crit": 3, "desc": "Hardcoded external IPv4 address", "spans": [ [ 644, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "spans": [ [ 94, 37 ] ] }, { "id": "micro-behaviors/process/user/query::os-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "os.userInfo() user query", "spans": [ [ 229, 11 ] ] }, { "id": "metadata/import/builtin::runtime-api-import-set", "conf": 0.8, "crit": 3, "desc": "Imports at least three Node.js runtime APIs", "uses": [ 0, 2, 3 ], "spans": [ [ 73, 7 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "uses": [ 26, 28 ], "spans": [ [ 698, 6 ], [ 706, 6 ], [ 744, 16 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js built-in http/https module usage", "uses": [ 5 ], "spans": [ [ 836, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-request-configured-variable", "conf": 0.86, "crit": 3, "desc": "Node HTTP request uses options object", "uses": [ 8, 9, 10 ], "spans": [ [ 613, 53 ], [ 633, 33 ], [ 836, 20 ] ] }, { "id": "micro-behaviors/os/module/load::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "uses": [ 0, 2, 3 ], "spans": [ [ 109, 7 ] ] }, { "id": "objectives/command-and-control/infrastructure/ip-port::hardcoded-js-ip-port-endpoint", "conf": 0.9, "crit": 4, "desc": "Hardcoded external IPv4 port endpoint", "uses": [ 11, 12, 29 ], "spans": [ [ 633, 9 ], [ 644, 12 ], [ 661, 11 ] ] }, { "id": "objectives/credential-access/theft/keywords::credential-label-upper", "conf": 0.9, "crit": 1, "desc": "Uppercase credential label", "uses": [ 24 ], "spans": [ [ 362, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-end-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request sends a body with end()", "uses": [ 6, 34 ], "spans": [ [ 836, 12 ], [ 919, 7 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-stream-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request writes body", "uses": [ 6, 7, 34 ], "spans": [ [ 836, 12 ], [ 900, 9 ], [ 919, 7 ] ] }, { "id": "objectives/credential-access/env/secrets/filtered-access::js-secret-keyword-list", "atk": "T1552.001", "conf": 0.96, "crit": 3, "desc": "JavaScript environment secret-keyword filter", "uses": [ 17, 38 ], "spans": [ [ 306, 26 ], [ 362, 6 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-post-json-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Node HTTP request posts a JSON body", "uses": [ 33, 40 ], "spans": [ [ 698, 6 ], [ 706, 6 ], [ 744, 16 ], [ 836, 12 ], [ 900, 9 ], [ 919, 7 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Node sends an HTTP request body", "uses": [ 39, 40 ], "spans": [ [ 836, 12 ], [ 900, 9 ], [ 919, 7 ] ] }, { "id": "objectives/exfiltration/stealer/credential/env::javascript-environ-json-http-exfil", "atk": "T1552.001,T1041", "mbc": "E1041", "conf": 0.98, "crit": 5, "desc": "JavaScript sends filtered environment secrets over HTTPS", "uses": [ 33, 41, 43 ], "spans": [ [ 306, 26 ], [ 362, 6 ], [ 698, 6 ], [ 706, 6 ], [ 744, 16 ], [ 836, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "uses": [ 0, 30 ], "spans": [ [ 94, 37 ], [ 109, 7 ] ] }, { "id": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-credential", "atk": "T1552.001", "conf": 0.82, "crit": 3, "desc": "Env filtered for credential-keyword names", "uses": [ 16, 23, 24 ], "spans": [ [ 321, 11 ], [ 362, 6 ] ] }, { "id": "objectives/discovery/system/fingerprint/user::node-host-user-query", "atk": "T1033,T1082", "conf": 0.85, "crit": 3, "desc": "Node queries host and user identity", "uses": [ 19, 31 ], "spans": [ [ 206, 11 ], [ 229, 11 ] ] }, { "id": "objectives/exfiltration/sensitive-data::js-sensitive-env-source", "atk": "T1041", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Sensitive environment secret access (JS)", "uses": [ 23, 41 ], "spans": [ [ 321, 0 ] ] }, { "id": "objectives/discovery/system/fingerprint/user::small-node-host-user-query", "atk": "T1033,T1082", "conf": 0.9, "crit": 3, "desc": "Small Node script queries host and user", "uses": [ 25, 47 ], "spans": [ [ 0, 21 ], [ 206, 11 ], [ 229, 11 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb5H+exk8l}x!r?hx\u003eqg7eP@([ed9Hxb6EKrB7]Mgb03?\u003cixo8LfFk46ed9Hxb4Lnav@=p5BzkVhb03?\u003co\u003c@6Px(lyOay/k4wO#PjB$$l)3lQDnzddc@b03?\u003cx(mD)CRi-La$K6zar\u003e(pA+PGmB0rT/DKp(rarR\u003eEA+e%5B97\u0026by:7[.b5RsfwGU@jwOD46Byx04e]2CIE0^5UA=\u003e}q3lQEted9Hxb5y$6wO#N2b03?\u003co?wqd3vJl", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 207, "entropy": 4.5 }, "binary": { "peak_region_bytes": 207, "peak_region_entropy": 4.5 } } }, "id": 3, "mol": "O(S)H(Po)Md(Pa₄)", "path": "marginfi-client-v2-999.0.0.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "index.js", "off": 108, "file": 1, "kind": "local" } ], "risk": 42, "sha": "aa041687c52522fbb49bfc53a3806bde4c75c73461540e3a08ccb6f38309da1c", "size": 207, "traits": [ { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field", "spans": [ [ 0, 21 ] ] }, { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install", "spans": [ [ 138, 26 ] ] }, { "id": "metadata/package/quality/version-sentinel::npm-version-999", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version starts with 999", "spans": [ [ 36, 7 ] ] }, { "id": "metadata/package/quality/version-sentinel::npm-version-inflated-major", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version has inflated major number", "spans": [ [ 36, 7 ] ] }, { "id": "metadata/package/quality/version-sentinel::npm-version-major-40-plus", "atk": "T1195.002", "conf": 0.82, "crit": 3, "desc": "npm package version major 40+", "spans": [ [ 36, 7 ] ] }, { "id": "metadata/package/manifest/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point", "spans": [ [ 99, 0 ] ] }, { "id": "metadata/package/manifest/freeform::pkg-skeleton-small", "conf": 0.7, "crit": 3, "desc": "Tiny package.json manifest", "spans": [ [ 0, 20 ] ] }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook", "spans": [ [ 138, 26 ] ] }, { "id": "metadata/package/versioning::npm-unrealistic-major-version", "conf": 0.85, "crit": 3, "desc": "suspect major version (90+) for npm package", "spans": [ [ 36, 7 ] ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter", "spans": [ [ 121, 26 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook", "spans": [ [ 138, 26 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook", "spans": [ [ 138, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::preinstall-runs-node-local-script", "atk": "T1195.002", "conf": 0.97, "crit": 3, "desc": "preinstall hook runs a local Node.js script", "spans": [ [ 138, 26 ] ] }, { "id": "metadata/package/quality/version-sentinel::fake-version-number", "atk": "T1195.002", "conf": 0.9, "crit": 4, "desc": "Package has fake or inflated version number", "uses": [ 2 ], "spans": [ [ 36, 7 ] ] }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 2, "desc": "Package has install hooks", "uses": [ 10 ], "spans": [ [ 138, 0 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::sparse-package-install-hook", "conf": 0.85, "crit": 3, "desc": "Sparse package metadata accompanies install hook", "uses": [ 14 ], "spans": [ [ 138, 0 ] ] } ], "type": "package.json" } ], "rev": "479f3", "v": "8" } }