{ "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00012990832, "rte": "az", "prob": 0.00012990832 }, { "cls": 0, "raw": 0.00086945295, "rte": "az/tar", "prob": 0.00086945295 } ], "prob": 0.026340166, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.026340166106820107, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00010295709216734394, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000014136235222395044, "type": "src_info" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000014851490959699731, "type": "registry" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000015020370483398438, "type": "registry" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000019957622498623095, "type": "registry" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000014851490959699731, "type": "registry" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00001998742482101079, "type": "registry" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.026340166106820107, "type": "gz" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00001980861088668462, "type": "systemd_service" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000024010738343349658, "type": "go" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.00010295709216734394, "type": "shell" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000014344851479108911, "type": "go.sum" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.00001286466886085691, "type": "go.mod" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.000013440847396850586, "type": "markdown" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.000014096498489379883, "type": "text" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.000013381242752075195, "type": "github_actions" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000021189451217651367, "type": "go" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000014851490959699731, "type": "registry" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.000014851490959699731, "type": "registry" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.000021596750229946338, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-15T12:59:00Z" }, "path": "airpods-battery-git-r5.c91f637-1.src.tar.gz", "raw": { "fetched": [ { "kind": "dependency", "size": 9192, "cached": false, "status": 200, "headers": [ [ "access-control-allow-origin", "https://render.githubusercontent.com" ], [ "content-disposition", "attachment; filename=airpods-battery-HEAD.tar.gz" ], [ "content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox" ], [ "content-type", "application/x-gzip" ], [ "cross-origin-resource-policy", "cross-origin" ], [ "etag", "\"2ad22fd616320bae656208ee6404dbdae34fbbaaa01558c62dd0aa4e469f3b77\"" ], [ "strict-transport-security", "max-age=31536000" ], [ "vary", "Authorization,Accept-Encoding" ], [ "x-content-type-options", "nosniff" ], [ "x-frame-options", "deny" ], [ "x-xss-protection", "1; mode=block" ], [ "date", "Wed, 15 Jul 2026 12:59:00 GMT" ], [ "transfer-encoding", "chunked" ], [ "x-github-request-id", "A834:346B66:2CDEED:562C1C:6A578414" ] ], "locator": "pkg:github/alwxsin/airpods-battery", "outcome": "ok", "final_url": "https://codeload.github.com/alwxsin/airpods-battery/tar.gz/HEAD", "fetched_at": 1784120340, "resolved_url": "https://codeload.github.com/alwxsin/airpods-battery/tar.gz/HEAD", "source_offset": 371, "source_sha256": "bd3d2a57135112f606a8a89c64b3ed9a5732a71bef0029aec67141ca237b25a4", "content_sha256": "e1c6dde365c5fcc8d6fe46d50cf7226011de7acd45cfb2eeb570a7c0af2c3a40" } ], "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zQ\u0026zeXe!5yawGs8.ENcM3w%WQd-%8S\u0026q.yCX+rRtA1R2Q\u003e?32$}0Tn@?w{%9Z^Yxo3uE0S", "n": [ { "c": 1, "d": "Gzip-compressed tar archive", "i": "metadata/package/files/system-package::tar-gz-archive-format", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "O(P)Md(Bk)", "sha": "51745ba95efa2c82c9ad8a4269072164bf2d1629293f87d3dbb54cec4b8ad6ce", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/airpods-battery-git/airpods-battery-git-r5.c91f637-1.src.tar.gz", "risk": 3, "size": 921, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 921.0, "entropy": 7.78, "size_bytes": 921.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.78, "peak_region_bytes": 921.0, "peak_region_entropy": 7.78 } } }, "traits": [ { "id": "micro-behaviors/os/service/config::systemd-keyword", "conf": 0.6000000238418579, "crit": 3, "desc": "References the systemd init system", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.699999988079071, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "from": [ { "file": 1 } ] }, { "id": "objectives/persistence/system/service/systemd::systemd-user-service-path", "atk": "T1543.002", "conf": 0.800000011920929, "crit": 3, "desc": "Systemd user service path reference", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV{.8wOVu}zE^=gq!Zb-v}YT(zxI5Iy?my6vqYQ@e]$-Ax\u003e7*(x(lgFy*?j6e[n*pj]", "n": [ { "c": 3, "d": "Recognized OS-specific execution marker", "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker", "o": 0, "z": 8, "cf": 0.8 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPNsvqf+3z!9]vvQTw2wPA5Fxk8C", "ln": 2, "addr": 66 }, { "b": "Abf9fwPx}Oh7\u0026x0f\u003eJs1hV", "ln": 3, "addr": 94 }, { "b": "Abf9bwO:H:", "ln": 4, "addr": 112 }, { "b": "Abf8%wPIuAcQzD!p\u0026x(=ayX=3By/Gray[[(zeTqmw]zYjoLFx!CP.fzviv)MB.a-0lsB$TwPA5)A=lbnwmY^ocJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 130, "z": 59, "cf": 0.6 } ], "ln": 5, "addr": 121 }, { "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z", "ln": 6, "addr": 191 }, { "b": "B-IpYcUNQzAc15[fk20vxMW=pv@Diql2p:\u0026q!Zb5vqf+3z!9]vvQTw2wPA5z", "n": [ { "c": 2, "d": "Contains an HTTPS URL prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 212, "z": 8, "cf": 0.9 }, { "c": 1, "d": "References a GitHub or Google domain", "i": "metadata/file/catalog/identity::platform-domain", "o": 220, "z": 10, "cf": 0.9 } ], "ln": 7, "addr": 207 }, { "b": "y?Wx\u003czGxwLc)}.Xr3%9", "ln": 8, "addr": 256 }, { "b": "wmYZ\u003ezE^/Kc)@FuB.b\u003eDaszqJz*b=kcN/", "ln": 9, "addr": 272 }, { "b": "Ab](ux\u003eg^@jT.W^x(XfhwoftivruQ5A^o2Y", "ln": 12, "addr": 343 }, { "b": "v@Dl%y?Wy3B3g{0vqf+3z!9]vvQTw2wPA5zdf", "ln": 13, "addr": 372 }, { "b": "B8Mhwv}v!Ka%.byxkRc{wJz\u003e+x(\u003e\u003cJB-IpJxk8Didf", "n": [ { "c": 1, "d": "References a hidden-directory path literal", "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "o": 429, "z": 4, "cf": 0.84 } ], "ln": 14, "addr": 402 }, { "b": "B7!#qh8YI#zf4\u0026*cSrVfp:WW", "n": [ { "c": 3, "d": "PKGBUILD skips source checksum verification", "i": "metadata/build/package::pkgbuild-checksum-skip", "o": 436, "z": 17, "cf": 0.7 } ], "ln": 15, "addr": 436 }, { "b": "", "n": [ { "c": 1, "d": "PKGBUILD defines a pkgver() function", "i": "metadata/build/package::pkgbuild-pkgver-fn", "o": 456, "z": 9, "cf": 0.9 } ], "ln": 16, "addr": 456 }, { "b": "Abf9fwPxgFaBs", "ln": 17, "addr": 457 }, { "b": "arR^Hv}lYabYEKizEEx[a]", "ln": 18, "addr": 468 }, { "b": "arR^HAb]VgBy(TtAWt=Vc37mMa%XNHx(\u003eFrwP/Uwx(!wseIgEJB-8pznjt*jdiY(UbQ^qtBrCQnB$EVwA=U!meIh3Sz/P}xnjt*jdiX", "ln": 19, "addr": 486 }, { "b": "Ee", "ln": 20, "addr": 569 }, { "b": "", "n": [ { "c": 1, "d": "PKGBUILD defines a build() function", "i": "metadata/build/package::pkgbuild-build-fn", "o": 571, "z": 8, "cf": 0.9 } ], "ln": 21, "addr": 571 }, { "b": "vS=y3wge(HDJ", "ln": 22, "addr": 572 }, { "b": "arR^Hv}lYabYEKizEEx[a]", "ln": 23, "addr": 582 }, { "b": "arR^Hv}lYabYEKizEEx[a]", "ln": 31, "addr": 735 }, { "b": "arR^Hx(n0lvqG:5eKTCmh8MH+x(XfhwoftivruQ5A^n=KbYEKiwnc6qB-RNRvRGZkvqf+3z!9]vvQTw2wPA5u", "n": [ { "c": 2, "d": "coreutils install stages a file", "i": "micro-behaviors/fs/write/copy::coreutils-install-file", "o": 756, "z": 11, "cf": 0.7 } ], "ln": 32, "addr": 753 }, { "b": "arR^Hx(n0lvqG:5eKTClg=cs?zGx]dy?$+kx(XfhwoftivruQ5A^ooUwPz%dv}u=/", "ln": 33, "addr": 822 }, { "b": "arR^HarR^Ha%.byxjLZ%flItRfkLuiflqzWBy/r1flItEAXy\u003cnA=t@cB1H\u003cfBAz8mC}KeHA=#ebwG?", "n": [ { "c": 3, "d": "User-level systemd service persistence", "i": "objectives/persistence/system/init/boot::linux-user-systemd", "o": 900, "z": 13, "cf": 0.85 } ], "ln": 34, "addr": 875 }, { "b": "arR^Hx(n0lvqG:5eKTClg=csGnKC{wq:?/MbYEKiwnc6qB-RNRB7/05wIm\u003elv}xL0wPGHIAbf97vqPNeoI4Pupe:O9", "ln": 35, "addr": 938 }, { "b": "Ee", "ln": 36, "addr": 1011 }, { "b": "", "ln": 37, "addr": 1013 } ], "depth": 1, "facts": { "imp": [ [ "", "cd" ], [ "", "cd" ], [ "", "printf" ], [ "", "printf" ], [ "", "git" ], [ "", "git" ], [ "", "git" ], [ "", "git" ], [ "", "cd" ], [ "", "cd" ], [ "", "go" ], [ "", "go" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "cd", "git", "go", "install", "printf" ], "metrics": { "ast": { "max_depth": 8.0, "bind_count": 15.0, "call_count": 10.0, "node_count": 237.0, "identifier_count": 40.0, "string_literal_count": 23.0, "array_literal_max_length": 2.0 }, "file": { "size": 1013.0, "entropy": 5.24, "size_bytes": 1013.0 }, "text": { "digit_ratio": 0.04, "space_count": 106.0, "total_lines": 36.0, "char_entropy": 5.24, "unique_chars": 74.0, "string_density": 0.64, "avg_line_length": 27.14, "max_line_length": 82.0, "empty_line_ratio": 0.08, "last_line_length": 1.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.06, "identifier_density": 1.89, "line_length_stddev": 22.79, "normalized_string_count": 3.83, "suspicious_string_ratio": 0.09, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 114.0, "normalized_unique_identifiers": 7.74 }, "binds": { "count": 15.0 }, "calls": { "count": 10.0 }, "binary": { "overall_entropy": 5.24, "peak_region_bytes": 1013.0, "peak_region_entropy": 5.24 }, "source": { "function_count": 3.0 }, "strings": { "total": 23.0, "url_count": 1.0, "avg_length": 17.65, "max_length": 59.0, "path_count": 1.0, "avg_entropy": 3.01, "total_bytes": 406.0, "entropy_stddev": 1.03, "shell_command_strings": 2.0 }, "comments": { "chars": 64.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.03 }, "functions": { "count": 3.0, "avg_params": 3.0, "max_params": 4.0, "length_stddev": 1.41, "avg_name_length": 6.0, "avg_length_lines": 6.0, "max_length_lines": 7.0, "min_length_lines": 4.0, "avg_param_name_length": 6.11, "density_per_100_lines": 8.33, "code_in_functions_ratio": 0.5 }, "identifiers": { "count": 40.0, "total": 68.0, "avg_length": 7.75, "max_length": 31.0, "min_length": 1.0, "avg_entropy": 2.49, "reuse_ratio": 0.59, "unique_count": 40.0, "length_stddev": 5.09, "has_digit_ratio": 0.1, "single_char_count": 1.0, "single_char_ratio": 0.03, "high_entropy_count": 3.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.53, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 3.0 } } }, "id": 1, "mol": "O(P)Md(Bk)", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/airpods-battery-git/airpods-battery-git-r5.c91f637-1.src.tar.gz!!airpods-battery-git/PKGBUILD", "pid": 0, "risk": 4, "sha": "7a84de02ce9f5c086ea4608418351c22e2f22c235e5a46ae243f016751e82b92", "size": 1013, "traits": [ { "id": "metadata/file/string/identity::pkgbuild-basename", "conf": 1.0, "crit": 2, "desc": "Arch PKGBUILD package recipe basename", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/file/metrics::comment-led-one-line", "conf": 0.99, "crit": 1, "desc": "One-line source begins with comment marker", "spans": [ [ 0, 65 ] ] }, { "id": "metadata/build/package::pkgbuild-pkgver-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a pkgver() function", "spans": [ [ 456, 9 ] ] }, { "id": "metadata/file/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/fs/path/location::hidden-dir-literal", "conf": 0.84, "crit": 1, "desc": "References a hidden-directory path literal", "spans": [ [ 429, 4 ] ] }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix", "spans": [ [ 212, 8 ] ] }, { "id": "micro-behaviors/fs/write/copy::coreutils-install-file", "conf": 0.7, "crit": 2, "desc": "coreutils install stages a file", "spans": [ [ 756, 11 ] ] }, { "id": "metadata/build/package::pkgbuild-build-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a build() function", "spans": [ [ 571, 8 ] ] }, { "id": "metadata/file/profile/identity::tiny-text-script", "conf": 0.75, "crit": 2, "desc": "Tiny multi-line text script", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/build/package::cloud-marketplace-cleanup-path", "conf": 0.95, "crit": 1, "desc": "Cloud marketplace cleanup path", "spans": [ [ 0, 8 ] ] }, { "id": "objectives/persistence/system/init/script::root-binary-launcher", "atk": "T1543", "conf": 0.82, "crit": 1, "desc": "Launch helper used with /root binary", "spans": [ [ 146, 7 ] ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/build/package::pkgbuild-vcs-source", "conf": 0.6, "crit": 2, "desc": "PKGBUILD uses a VCS (git/svn/hg) source" }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.7, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "spans": [ [ 436, 17 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "spans": [ [ 130, 59 ] ] }, { "id": "metadata/file/metrics::shell-multiple-local-assignments", "conf": 0.6, "crit": 2, "desc": "Several local variable assignments", "spans": [ [ 0, 19 ] ] }, { "id": "metadata/file/catalog/identity::platform-domain", "conf": 0.9, "crit": 1, "desc": "References a GitHub or Google domain", "spans": [ [ 220, 10 ] ] }, { "id": "objectives/persistence/system/service/systemd::systemd-user-service-path", "atk": "T1543.002", "conf": 0.8, "crit": 3, "desc": "Systemd user service path reference", "spans": [ [ 900, 13 ] ] }, { "id": "micro-behaviors/os/service/config::systemd-keyword", "conf": 0.6, "crit": 3, "desc": "References the systemd init system", "spans": [ [ 900, 7 ] ] } ], "type": "shell" }, { "id": 2, "sha": "bd3d2a57135112f606a8a89c64b3ed9a5732a71bef0029aec67141ca237b25a4", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/airpods-battery-git/airpods-battery-git-r5.c91f637-1.src.tar.gz!!airpods-battery-git/.SRCINFO", "size": 493, "type": "src_info", "depth": 1 }, { "id": 3, "sha": "a7fe1bcd922974c389ccb1d2560127a7f55922c7fb965d4a934f864d7450ee35", "path": "bluez@5.87-2.registry.json", "size": 801, "type": "registry", "depth": 2 }, { "id": 4, "sha": "907d0754afcca589caaa63fd11761ef7bc878f91a47448e3b023d578198021b8", "path": "upower@1.91.3-1.registry.json", "size": 884, "type": "registry", "depth": 2 }, { "id": 5, "mol": "Md", "sha": "88533595944496f6fa06a0b8b3f6a2d30346671e1ef13463ac12ef6ad7b6b12c", "path": "go@1.26.5-1.registry.json", "risk": 1, "size": 810, "type": "registry", "depth": 2 }, { "id": 6, "sha": "771af57e1c7db73daeca5d9729a000869282fddd14072ffc609ca252e4097c47", "path": "git@2.55.0-1.registry.json", "size": 804, "type": "registry", "depth": 2 }, { "id": 7, "mol": "Md", "sha": "4007259c4247435bdd3e6a9c534ec4096ac724f6020613781c16b2f7f3076da0", "path": "alwxsin_airpods-battery.registry.json", "risk": 1, "size": 925, "type": "registry", "depth": 2 }, { "depth": 2, "facts": { "metrics": { "file": { "size": 9192.0, "entropy": 7.98, "size_bytes": 9192.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 9192.0, "peak_region_entropy": 7.85 } } }, "id": 8, "mol": "O(P)H(Db)Md(Bk)", "path": "HEAD", "risk": 5, "sha": "e1c6dde365c5fcc8d6fe46d50cf7226011de7acd45cfb2eeb570a7c0af2c3a40", "size": 9192, "traits": [ { "id": "objectives/persistence/system/init/script::root-binary-launcher", "atk": "T1543", "conf": 0.82, "crit": 1, "desc": "Launch helper used with /root binary", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/window/notify/keywords::notification-config-word", "conf": 0.86, "crit": 1, "desc": "notify/sender vocabulary word", "from": [ { "file": 9 } ] }, { "id": "metadata/file/metrics::shell-multiple-local-assignments", "conf": 0.6, "crit": 2, "desc": "Several local variable assignments", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/service/config::exec-start-expected-core", "conf": 1.0, "crit": 2, "desc": "ExecStart from core system path" }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix", "from": [ { "file": 3 } ] }, { "id": "metadata/file/profile/identity::install-doc-basename", "conf": 0.85, "crit": 1, "desc": "Installation documentation basename", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/service/config::exec-start-kv", "conf": 1.0, "crit": 1, "desc": "Systemd unit declares an ExecStart command" }, { "id": "objectives/persistence/system/service/systemd::wanted-by-target-kv", "atk": "T1543.002", "conf": 1.0, "crit": 1, "desc": "WantedBy=default.target directive" }, { "id": "objectives/anti-analysis/debugger-detect/combined-checks::go-syscall-ptrace", "atk": "T1622", "mbc": "B0001.m01", "conf": 0.9, "crit": 1, "desc": "Go raw ptrace syscall", "from": [ { "file": 2 } ] }, { "id": "metadata/build/github-actions::actions-checkout-yaml", "conf": 0.92, "crit": 2, "desc": "actions/checkout workflow step" }, { "id": "metadata/file/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/service/legitimate::ci-cd-pipeline", "conf": 0.8, "crit": 2, "desc": "CI/CD pipeline HTTP usage", "from": [ { "file": 8 } ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "from": [ { "file": 6 } ] }, { "id": "metadata/build/github-actions::workflow-dispatch-trigger", "conf": 0.86, "crit": 2, "desc": "GitHub workflow_dispatch manual trigger", "from": [ { "file": 8 } ] }, { "id": "metadata/file/metrics::comment-led-one-line", "conf": 0.99, "crit": 1, "desc": "One-line source begins with comment marker", "from": [ { "file": 3 } ] }, { "id": "metadata/build/package::pkgbuild-vcs-source", "conf": 0.6, "crit": 2, "desc": "PKGBUILD uses a VCS (git/svn/hg) source" }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/write/direct::go-write-method-call", "conf": 1.0, "crit": 1, "desc": "Go Write/WriteAt method call", "from": [ { "file": 2 } ] }, { "id": "metadata/file/format::vocab-invalid", "conf": 0.97, "crit": 1, "desc": "String literal contains the word 'invalid'", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/write/copy::coreutils-install-file", "conf": 0.7, "crit": 2, "desc": "coreutils install stages a file", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/service/config::after-exists", "conf": 1.0, "crit": 1, "desc": "Unit After= exists" }, { "id": "objectives/persistence/system/service/systemd::systemd-user-service-path", "atk": "T1543.002", "conf": 0.8, "crit": 3, "desc": "Systemd user service path reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::go-unsafe-package-import", "conf": 0.95, "crit": 3, "desc": "Imports Go unsafe package", "from": [ { "file": 2 } ] }, { "id": "metadata/file/extension/identity::systemd-service", "conf": 1.0, "crit": 2, "desc": "Systemd service file extension", "from": [ { "file": 1 } ] }, { "id": "metadata/file/catalog/identity::platform-domain", "conf": 0.9, "crit": 1, "desc": "References a GitHub or Google domain", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/service/config::systemd-keyword", "conf": 0.6, "crit": 3, "desc": "References the systemd init system", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/time/sleep/interval::go-time-sleep", "conf": 0.75, "crit": 2, "desc": "Go time.Sleep delay call", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/identity::tiny-text-script", "conf": 0.75, "crit": 2, "desc": "Tiny multi-line text script", "from": [ { "file": 3 } ] }, { "id": "objectives/exfiltration/http/hardcoded-key::request-body-marker", "atk": "T1041", "mbc": "C0002", "conf": 0.75, "crit": 1, "desc": "HTTP request body field marker", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "Contains frequent English function words", "from": [ { "file": 2 } ], "spans": [ [ 46, 4 ], [ 133, 4 ] ] }, { "id": "micro-behaviors/process/thread/create::go-goroutine-launch-call", "conf": 0.75, "crit": 1, "desc": "Go goroutine launch call", "from": [ { "file": 2 } ] }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.7, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "from": [ { "file": 3 } ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "from": [ { "file": 6 } ] }, { "id": "metadata/package/documentation::package-doc-reference-basename", "conf": 0.9, "crit": 1, "desc": "Package documentation basename", "from": [ { "file": 6 } ] }, { "id": "metadata/build/package::pkgbuild-pkgver-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a pkgver() function", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/window/notify/keywords::notification-alert-word", "conf": 0.9, "crit": 1, "desc": "notification or alert vocabulary word", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/service/config::blank-line-separator", "conf": 1.0, "crit": 1, "desc": "Unit file blank line separator", "from": [ { "file": 1 } ] }, { "id": "metadata/package/quality/source::azion-cli-readme-basename", "conf": 1.0, "crit": 1, "desc": "Markdown README basename", "from": [ { "file": 6 } ] }, { "id": "metadata/file/string/identity::pkgbuild-basename", "conf": 1.0, "crit": 2, "desc": "Arch PKGBUILD package recipe basename", "from": [ { "file": 3 } ] }, { "id": "metadata/build/package::cloud-marketplace-cleanup-path", "conf": 0.95, "crit": 1, "desc": "Cloud marketplace cleanup path", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/service/config::install-wanted-by-exists", "conf": 1.0, "crit": 1, "desc": "Install WantedBy= exists" }, { "id": "objectives/persistence/system/service/systemd::wanted-by-target-text", "atk": "T1543.002", "conf": 0.7, "crit": 3, "desc": "WantedBy=default.target directive", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/location::hidden-dir-literal", "conf": 0.84, "crit": 1, "desc": "References a hidden-directory path literal", "from": [ { "file": 3 } ] }, { "id": "objectives/persistence/system/restart::restart-backoff-sleep", "atk": "T1053", "conf": 0.9, "crit": 1, "desc": "Restart backoff sleep", "from": [ { "file": 2 } ] }, { "id": "metadata/build/package::pkgbuild-build-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a build() function", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/mem/alloc/heap::go-byte-slice-make", "conf": 0.86, "crit": 2, "desc": "Go byte slice allocation", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/service/config::unit-description-exists", "conf": 1.0, "crit": 1, "desc": "Unit Description= exists" } ], "type": "gz" }, { "id": 9, "mol": "O(P)", "sha": "436ea9ed4c449d56aaee5014e77fee94ac645dd9d0c93870a12a589b37a7df28", "path": "HEAD!!airpods-battery-HEAD/install/airpods-battery.service", "risk": 1, "size": 234, "type": "systemd_service", "depth": 3 }, { "id": 10, "mol": "H(Db)", "sha": "3f7466f01e695cd17fe7782954d9bc567a8880219e2780586ebaa206da518c5e", "path": "HEAD!!airpods-battery-HEAD/aap.go", "risk": 1, "size": 9510, "type": "go", "depth": 3 }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV{.8wOVu}zE^=gq!Zb-v}YT(zxI5Iy?my6vqYQ@e]$-Ax\u003e7*(x(lgFy*?j6e[n*pj]", "n": [ { "c": 3, "d": "Recognized OS-specific execution marker", "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker", "o": 0, "z": 8, "cf": 0.8 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPNsvqf+3z!9]vvQTw2wPA5Fxk8C", "ln": 2, "addr": 66 }, { "b": "Abf9fwPx}Oh7\u0026x0f\u003eJs1hV", "ln": 3, "addr": 94 }, { "b": "Abf9bwO:H:", "ln": 4, "addr": 112 }, { "b": "Abf8%wPIuAcQzD!p\u0026x(=ayX=3By/Gray[[(zeTqmw]zYjoLFx!CP.fzviv)MB.a-0lsB$TwPA5)A=lbnwmY^ocJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 130, "z": 59, "cf": 0.6 } ], "ln": 5, "addr": 121 }, { "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z", "ln": 6, "addr": 191 }, { "b": "B-IpYcUNQzAc15[fk20vxMW=pv@Diql2p:\u0026q!Zb5vqf+3z!9]vvQTw2wPA5z", "n": [ { "c": 2, "d": "Contains an HTTPS URL prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 212, "z": 8, "cf": 0.9 }, { "c": 1, "d": "References a GitHub or Google domain", "i": "metadata/file/catalog/identity::platform-domain", "o": 220, "z": 10, "cf": 0.9 } ], "ln": 7, "addr": 207 }, { "b": "y?Wx\u003czGxwLc)}.Xr3%9", "ln": 8, "addr": 256 }, { "b": "wmYZ\u003ezE^/Kc)@FuB.b\u003eDaszqJz*b=kcN/", "ln": 9, "addr": 272 }, { "b": "Ab](ux\u003eg^@jT.W^x(XfhwoftivruQ5A^o2Y", "ln": 12, "addr": 343 }, { "b": "v@Dl%y?Wy3B3g{0vqf+3z!9]vvQTw2wPA5zdf", "ln": 13, "addr": 372 }, { "b": "B8Mhwv}v!Ka%.byxkRc{wJz\u003e+x(\u003e\u003cJB-IpJxk8Didf", "n": [ { "c": 1, "d": "References a hidden-directory path literal", "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "o": 429, "z": 4, "cf": 0.84 } ], "ln": 14, "addr": 402 }, { "b": "B7!#qh8YI#zf4\u0026*cSrVfp:WW", "n": [ { "c": 3, "d": "PKGBUILD skips source checksum verification", "i": "metadata/build/package::pkgbuild-checksum-skip", "o": 436, "z": 17, "cf": 0.7 } ], "ln": 15, "addr": 436 }, { "b": "", "n": [ { "c": 1, "d": "PKGBUILD defines a pkgver() function", "i": "metadata/build/package::pkgbuild-pkgver-fn", "o": 456, "z": 9, "cf": 0.9 } ], "ln": 16, "addr": 456 }, { "b": "Abf9fwPxgFaBs", "ln": 17, "addr": 457 }, { "b": "arR^Hv}lYabYEKizEEx[a]", "ln": 18, "addr": 468 }, { "b": "arR^HAb]VgBy(TtAWt=Vc37mMa%XNHx(\u003eFrwP/Uwx(!wseIgEJB-8pznjt*jdiY(UbQ^qtBrCQnB$EVwA=U!meIh3Sz/P}xnjt*jdiX", "ln": 19, "addr": 486 }, { "b": "Ee", "ln": 20, "addr": 569 }, { "b": "", "n": [ { "c": 1, "d": "PKGBUILD defines a build() function", "i": "metadata/build/package::pkgbuild-build-fn", "o": 571, "z": 8, "cf": 0.9 } ], "ln": 21, "addr": 571 }, { "b": "vS=y3wge(HDJ", "ln": 22, "addr": 572 }, { "b": "arR^Hv}lYabYEKizEEx[a]", "ln": 23, "addr": 582 }, { "b": "arR^Hv}lYabYEKizEEx[a]", "ln": 31, "addr": 735 }, { "b": "arR^Hx(n0lvqG:5eKTCmh8MH+x(XfhwoftivruQ5A^n=KbYEKiwnc6qB-RNRvRGZkvqf+3z!9]vvQTw2wPA5u", "n": [ { "c": 2, "d": "coreutils install stages a file", "i": "micro-behaviors/fs/write/copy::coreutils-install-file", "o": 756, "z": 11, "cf": 0.7 } ], "ln": 32, "addr": 753 }, { "b": "arR^Hx(n0lvqG:5eKTClg=cs?zGx]dy?$+kx(XfhwoftivruQ5A^ooUwPz%dv}u=/", "ln": 33, "addr": 822 }, { "b": "arR^HarR^Ha%.byxjLZ%flItRfkLuiflqzWBy/r1flItEAXy\u003cnA=t@cB1H\u003cfBAz8mC}KeHA=#ebwG?", "n": [ { "c": 3, "d": "User-level systemd service persistence", "i": "objectives/persistence/system/init/boot::linux-user-systemd", "o": 900, "z": 13, "cf": 0.85 } ], "ln": 34, "addr": 875 }, { "b": "arR^Hx(n0lvqG:5eKTClg=csGnKC{wq:?/MbYEKiwnc6qB-RNRB7/05wIm\u003elv}xL0wPGHIAbf97vqPNeoI4Pupe:O9", "ln": 35, "addr": 938 }, { "b": "Ee", "ln": 36, "addr": 1011 }, { "b": "", "ln": 37, "addr": 1013 } ], "depth": 3, "facts": { "imp": [ [ "", "cd" ], [ "", "cd" ], [ "", "printf" ], [ "", "printf" ], [ "", "git" ], [ "", "git" ], [ "", "git" ], [ "", "git" ], [ "", "cd" ], [ "", "cd" ], [ "", "go" ], [ "", "go" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "cd", "git", "go", "install", "printf" ], "metrics": { "ast": { "max_depth": 8.0, "bind_count": 15.0, "call_count": 10.0, "node_count": 237.0, "identifier_count": 40.0, "string_literal_count": 23.0, "array_literal_max_length": 2.0 }, "file": { "size": 1013.0, "entropy": 5.24, "size_bytes": 1013.0 }, "text": { "digit_ratio": 0.04, "space_count": 106.0, "total_lines": 36.0, "char_entropy": 5.24, "unique_chars": 74.0, "string_density": 0.64, "avg_line_length": 27.14, "max_line_length": 82.0, "empty_line_ratio": 0.08, "last_line_length": 1.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.06, "identifier_density": 1.89, "line_length_stddev": 22.79, "normalized_string_count": 3.83, "suspicious_string_ratio": 0.09, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 114.0, "normalized_unique_identifiers": 7.74 }, "binds": { "count": 15.0 }, "calls": { "count": 10.0 }, "binary": { "overall_entropy": 5.24, "peak_region_bytes": 1013.0, "peak_region_entropy": 5.24 }, "source": { "function_count": 3.0 }, "strings": { "total": 23.0, "url_count": 1.0, "avg_length": 17.65, "max_length": 59.0, "path_count": 1.0, "avg_entropy": 3.01, "total_bytes": 406.0, "entropy_stddev": 1.03, "shell_command_strings": 2.0 }, "comments": { "chars": 64.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.03 }, "functions": { "count": 3.0, "avg_params": 3.0, "max_params": 4.0, "length_stddev": 1.41, "avg_name_length": 6.0, "avg_length_lines": 6.0, "max_length_lines": 7.0, "min_length_lines": 4.0, "avg_param_name_length": 6.11, "density_per_100_lines": 8.33, "code_in_functions_ratio": 0.5 }, "identifiers": { "count": 40.0, "total": 68.0, "avg_length": 7.75, "max_length": 31.0, "min_length": 1.0, "avg_entropy": 2.49, "reuse_ratio": 0.59, "unique_count": 40.0, "length_stddev": 5.09, "has_digit_ratio": 0.1, "single_char_count": 1.0, "single_char_ratio": 0.03, "high_entropy_count": 3.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.53, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 3.0 } } }, "id": 11, "mol": "O(P)Md(Bk)", "path": "HEAD!!airpods-battery-HEAD/PKGBUILD", "pid": 0, "risk": 4, "sha": "7a84de02ce9f5c086ea4608418351c22e2f22c235e5a46ae243f016751e82b92", "size": 1013, "traits": [ { "id": "metadata/file/string/identity::pkgbuild-basename", "conf": 1.0, "crit": 2, "desc": "Arch PKGBUILD package recipe basename", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/file/metrics::comment-led-one-line", "conf": 0.99, "crit": 1, "desc": "One-line source begins with comment marker", "spans": [ [ 0, 65 ] ] }, { "id": "metadata/build/package::pkgbuild-pkgver-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a pkgver() function", "spans": [ [ 456, 9 ] ] }, { "id": "metadata/file/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/fs/path/location::hidden-dir-literal", "conf": 0.84, "crit": 1, "desc": "References a hidden-directory path literal", "spans": [ [ 429, 4 ] ] }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix", "spans": [ [ 212, 8 ] ] }, { "id": "micro-behaviors/fs/write/copy::coreutils-install-file", "conf": 0.7, "crit": 2, "desc": "coreutils install stages a file", "spans": [ [ 756, 11 ] ] }, { "id": "metadata/build/package::pkgbuild-build-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a build() function", "spans": [ [ 571, 8 ] ] }, { "id": "metadata/file/profile/identity::tiny-text-script", "conf": 0.75, "crit": 2, "desc": "Tiny multi-line text script", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/build/package::cloud-marketplace-cleanup-path", "conf": 0.95, "crit": 1, "desc": "Cloud marketplace cleanup path", "spans": [ [ 0, 8 ] ] }, { "id": "objectives/persistence/system/init/script::root-binary-launcher", "atk": "T1543", "conf": 0.82, "crit": 1, "desc": "Launch helper used with /root binary", "spans": [ [ 146, 7 ] ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/build/package::pkgbuild-vcs-source", "conf": 0.6, "crit": 2, "desc": "PKGBUILD uses a VCS (git/svn/hg) source" }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.7, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "spans": [ [ 436, 17 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "spans": [ [ 130, 59 ] ] }, { "id": "metadata/file/metrics::shell-multiple-local-assignments", "conf": 0.6, "crit": 2, "desc": "Several local variable assignments", "spans": [ [ 0, 19 ] ] }, { "id": "metadata/file/catalog/identity::platform-domain", "conf": 0.9, "crit": 1, "desc": "References a GitHub or Google domain", "spans": [ [ 220, 10 ] ] }, { "id": "objectives/persistence/system/service/systemd::systemd-user-service-path", "atk": "T1543.002", "conf": 0.8, "crit": 3, "desc": "Systemd user service path reference", "spans": [ [ 900, 13 ] ] }, { "id": "micro-behaviors/os/service/config::systemd-keyword", "conf": 0.6, "crit": 3, "desc": "References the systemd init system", "spans": [ [ 900, 7 ] ] } ], "type": "shell" }, { "id": 12, "sha": "7556b81d5e8726d4d82ddf008b6c89eab585731afaf27c4a6b27ee6a8ae3e8be", "path": "HEAD!!airpods-battery-HEAD/go.sum", "size": 322, "type": "go.sum", "depth": 3 }, { "id": 13, "sha": "71afc9610e65e35f76528b8ac74e604fdaa3d8e327905355289759caa4200851", "path": "HEAD!!airpods-battery-HEAD/go.mod", "size": 147, "type": "go.mod", "depth": 3 }, { "id": 14, "sha": "aa8aaf4598b77a5f8952a872ab77e095d3685a508d95d456333b268b27303ad7", "path": "HEAD!!airpods-battery-HEAD/README.md", "risk": 1, "size": 2370, "type": "markdown", "depth": 3 }, { "id": 15, "sha": "0357e1dab7ccf05ee33a316f5a70a9c2afa5c376d7f2423b29db62b7925bf279", "path": "HEAD!!airpods-battery-HEAD/LICENSE", "risk": 1, "size": 1076, "type": "text", "depth": 3 }, { "id": 16, "sha": "d63cd6a46c743e60567b74127a36aa4183d623448b0fb4f9ae453d4438dee153", "path": "HEAD!!airpods-battery-HEAD/.github/workflows/aur.yml", "risk": 1, "size": 602, "type": "github_actions", "depth": 3 }, { "id": 17, "sha": "0c0d6a0cd1cf1635bb369d5bb43869468493f60c8997bd196d3d166199630a72", "path": "HEAD!!airpods-battery-HEAD/main.go", "size": 10627, "type": "go", "depth": 3 }, { "id": 18, "sha": "9c92afc2a50e02ed64be4a4cdf5b7a2d7d490ab20f7550d13e57f815036592e6", "path": "github.com_godbus_dbus_v5@v5.2.2.registry.json", "size": 786, "type": "registry", "depth": 4 }, { "id": 19, "sha": "4f9bae1bd7008fa0af60077bb328eff4290f1d9076cd5d010ac2332b1958fc5b", "path": "golang.org_x_sys@v0.27.0.registry.json", "size": 779, "type": "registry", "depth": 4 }, { "id": 20, "mol": "Md", "sha": "f24ca83e99e24a0bf88413ada81231c564e7cb36d8b4b0ed23d8c1cd5c05faaf", "path": "airpods-battery-git@r5.c91f637-1.registry.json", "risk": 1, "size": 873, "type": "registry", "depth": 1 } ], "omitted_files": 17, "rev": "958ab", "v": "8" } }