{ "llm": { "conf": 0.9941535, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "outcome": "suspicious", "interpretation": "Shai-Hulud worm preinstall hook" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 3000, "conf": 54, "mods": [ { "cls": 0, "raw": 0.9912739, "rte": "az", "prob": 0.9912739 }, { "cls": 0, "raw": 0.98804307, "rte": "az/npm", "prob": 0.98804307 } ], "prob": 0.9941535, "files": [ { "id": 0, "lvl": 3000, "conf": 54, "prob": 0.9941534996032715, "type": "npm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00008112192153930664, "type": "package.json" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00000908970832824707, "type": "javascript" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000008761882781982422, "type": "javascript" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.0000095367431640625, "type": "javascript" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000008463859558105469, "type": "javascript" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000008573134437028784, "type": "javascript" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00000895063112693606, "type": "javascript" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000009208917617797852, "type": "javascript" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000008990366950456519, "type": "javascript" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000008930762305681128, "type": "javascript" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.00000961621572059812, "type": "javascript" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000008245308890764136, "type": "javascript" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.000009467204108659644, "type": "javascript" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.000009318192496721167, "type": "javascript" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.000009765227332536597, "type": "javascript" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.000015060107216413599, "type": "javascript" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000011056661605834961, "type": "javascript" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.00000945727060752688, "type": "javascript" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.000011841456398542505, "type": "javascript" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.000010112921700056177, "type": "javascript" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.00000667572021484375, "type": "javascript" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.000008275111213151831, "type": "javascript" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.000012606382369995117, "type": "javascript" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.000009646018042985816, "type": "javascript" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.000009953975677490234, "type": "javascript" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000010659297004167456, "type": "javascript" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.000011116266250610352, "type": "javascript" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.000010391076102678198, "type": "javascript" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.000009328126907348633, "type": "javascript" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.000010401010513305664, "type": "javascript" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.000008632739081804175, "type": "javascript" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.000009566545486450195, "type": "javascript" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.000011265277862548828, "type": "javascript" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.000008235375389631372, "type": "javascript" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.00000856320093589602, "type": "javascript" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.000010261933311994653, "type": "javascript" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.00001047054956870852, "type": "javascript" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.00001298387815040769, "type": "javascript" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.00000955661107582273, "type": "registry" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.00000908970832824707, "type": "" } ], "version": "v18.18", "analyzed_at": "2026-09-01T12:47:43Z" }, "path": "@7nohe-openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zS4*J84tWKwUT]+yQXPebU9FS.tl?lZ+5n%.2I/]/K4YsL]wu4^.NI4Q8!K!r$qNgYsc?SBj(N5q.{UK-1\u003cka*ngfRp57r:H(QnrzuudP:1?qdQuXD-*R:)KN)YgK?UKz$*X-{k:B%)q\u003exud\u003ew@$/9Rw!VA^%tYyH79//AnsD?I?#B[LO4M30fdk7ci9zrn9.-^kUa[BIclXPE", "ln": 0 } ], "mol": "K(Mc)O(S₂)H₃(Db₂F₂Po)Md(Pa₇)", "sha": "5654e2b3e19cf5e7f1d39d04ebdd3507d3349f76eeb8319de42b2fdb537b8a2d", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz", "refs": [ { "to": "pkg:github/7nohe/openapi-react-query-codegen", "off": 0, "kind": "repository" } ], "risk": 165, "size": 25337, "type": "npm", "facts": { "metrics": { "file": { "size": 25337, "entropy": 7.99 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 25337, "peak_region_entropy": 7.84 } } }, "ident": { "name": { "value": "@7nohe/openapi-react-query-codegen", "source": "npm.name", "verified": false }, "urls": [ { "url": "git+https://github.com/7nohe/openapi-react-query-codegen.git", "kind": "repository", "source": "npm.repository.url" }, { "url": "https://github.com/7nohe/openapi-react-query-codegen", "kind": "homepage", "source": "npm.homepage" } ], "trust": "unsigned", "authors": [ { "url": "@7nohe", "name": "Daiki Urata", "role": "author", "source": "npm.author" } ], "version": { "value": "0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab", "source": "npm.version", "verified": false }, "identifier": { "value": "@7nohe/openapi-react-query-codegen", "source": "npm.name", "verified": false } }, "traits": [ { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/workspace::has-workspaces", "conf": 0.9, "crit": 3, "desc": "Package uses workspaces (monorepo pattern)" }, { "id": "metadata/package/manifest/ecosystem::openapi-generated-keyword", "conf": 0.9, "crit": 3, "desc": "OpenAPI client or generator keyword" }, { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install" }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook" }, { "id": "metadata/package/files/package-json::files-array-present", "conf": 0.92, "crit": 3, "desc": "Package.json declares a files allowlist" }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook" }, { "id": "metadata/package/scripts/build::pkg-build-script-field", "conf": 0.6, "crit": 3, "desc": "Package declares a build script" }, { "id": "metadata/lang/javascript-features::arrow-function", "conf": 0.9, "crit": 1, "desc": "ES6 arrow function syntax", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Invokes zero-argument function at module scope", "from": [ { "file": 38 } ] }, { "id": "objectives/supply-chain/hidden-payload/worm::install-hook-self-targeting-worm-env", "atk": "T1195.002", "mbc": "F0001", "conf": 0.95, "crit": 4, "desc": "Hook exports package self-identity env", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::file-read-api-call", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript readFile API", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/fs/file/write/async::node-write-file-promise-destructured", "conf": 0.9, "crit": 3, "desc": "Node writes a file via destructured import", "from": [ { "off": 379, "file": 4, "line": 10 }, { "file": 7 }, { "off": 3786, "file": 33, "line": 92 }, { "off": 45, "file": 38, "line": 2 } ] }, { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 1, "desc": "File uses a source declaration extension", "from": [ { "file": 2 } ] }, { "id": "metadata/package/quality/profile::has-typescript", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript tooling", "from": [ { "file": 1 } ] }, { "id": "well-known/malware/supply-chain/shai-hulud::shai-hulud-self-targeting-preinstall", "atk": "T1195.002", "mbc": "F0001", "conf": 0.98, "crit": 5, "desc": "Preinstall declares Shai-Hulud worm config", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/entrypoint::has-exports-field", "conf": 0.85, "crit": 2, "desc": "package.json declares an exports map" }, { "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import", "conf": 0.95, "crit": 2, "desc": "Imports the Node fs/promises API", "from": [ { "file": 4 } ] }, { "id": "metadata/package/scripts/develop::has-test-script", "conf": 1.0, "crit": 1, "desc": "package.json declares a test script" }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/write/async::write-file-call-target", "conf": 0.9, "crit": 1, "desc": "Calls an unqualified writeFile function", "from": [ { "file": 4 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/javascript-features::spread-operator", "conf": 0.9, "crit": 1, "desc": "ES6 spread operator (in array/object context)", "from": [ { "file": 15 } ] }, { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb0X88z!JYnz/xo9vq]{jA+eV?Bs?GPwPA5Fv@C)?xjU%8ed9Hxb6EKrB7]Mgb03?\u003cfFk4ifFc\u003cCh-J-OwhW{Tf/JSKwhM81vQRePvQ-}Tw[9?Tias\u003c6g?75JvpyAi3lQDnwmY*(A+PGmx(v(kiV]RxAaJ]Mp!q^cwNP7\u003caw)n)A^n={z!9A(wO@Xy3lQDnvRGZ7iV@+RarR^Hb5.BizEEG#ePL?PiV]RSx(!wHv@b\u003cizeabo3lQEted9Hxb5?NpC42G7b03\u0026UvqH0@ed9Hxb6n9HwG\u003ceTb5ImeB.\u003eRked9Hxb6N%CyJBD6v}xZ9iV}SlarR^Hb4V1cze:r5B1Y0!3lQD%ed9Hxb4V1rz/P@vb03\u0026J3lQDlaBsCrarR^Har\u003eJpAbP=sb03?\u003ce?Z:HB966FwO#71vru6kzeaboed9HxarR^Hb64mmB.L(cb03?\u003ce?Z:HB966FwO#71vru6kzeaboed9HxarR^Hb6n9HwPG4Rar\u0026A\u003ewncabfk1\u003clwPzj3wIdHCzff?y3lQDlaBKOtaycJ9arR\u003eGwPhNex([olC{ko(DKp(rarR\u003eID2NssiV]RVx(\u003eKI3lQDlar\u003e@Gy:7[.b4\u003eRid}\u003c3DAc15[fk20vxMW=pv@Diqh/rLEwIm$vwO${}x!svpvpKyhADL\u0026kC}AJAwmYy+zz2NoBrR5maBL^FarR\u003ewz/668vp%c}iV]RWBAzFyiXJd0x([3hvLheez7^?=z!JYnz/xo9vq]{jA+eV?Bs?GPwPA5Fv@C)?xjU%8ed9Hxb4tXcB0rT/b4#7uAc15[fk20vxMW=pv@Diqh/rLEwIm$vwO${}x!svpvpKyhADL\u0026kC}AJAwmYy+zzbZBB9h5na$K6zar\u003eAiy?mViiV}SlarR^Hb4LzeBrR5maycJ9arR\u003ezwQeGrA+6kniV}SlarR^Hb4CL4wOkN(a$K6zarR^JA+eV?Bs?GPwPA5ued9HxarR\u003eGwNP7\u003ca$K6zarR^Jz/xo9vq]{8ed9HxarR\u003eHCvtb%wPw$C3lQDlar\u003e]MAaK92A+PGma$K6zarR^Jz/xo9vq]{jBA}?pB7ol8Ac9Wwz!9A(wO@Xy3lQDlar\u003c6:wQb\u003eoAa{$zAaJ]}Aa{[CB0p@laycJ9arR\u003eAx\u003e7Z(B7DKRar\u003cJKr3A\u003e2arR\u003epB-.qnAW0K!b1b\u003cNyIs[\u003eA::5#asGGlzF%i1diZqIarR\u003eswPhi#wmYT*x\u003equfiV@+RarR^Hb0Y*MC}ADzx!KyzwO${}x!sBFb03?\u003cfFkvCe?!F23lQDlar\u003eroz/Y$KB8UMizx.a:b3)hXfFkd93lQEted9Hxb4Lndl$HsGzE^r@v}/H}b03\u0026[3lQDlar\u003c6Wx(v\u003c1yi84qx(v\u003c1b03?\u003cunsb\u003ce\u0026j+63lQDlar\u003c6)D2NtofjP3vB8@{OAa9%db03?\u003cun:z\u0026e\u0026B[83lQDlar\u003c6)D2Ntofk+YswG\u003ceTb3)2We\u00262akf^ndQarR^Hb0Zl}AaK8zB7GiiwPw$Qar\u003ebJe\u0026Lyqa$K6zarR^JkZ3\u003c-wPI@Dv@DK4A:-P(eP%8$iV]RMg+HHnf!:!53lQDlar\u003erlzeAZ0wmY^9iV]RMf/pNqe?!F23lQDlar\u003eSkw]}Z8z!*KTar\u003ebEe?[$kfD@4ParR^Hb64ymA:-M7iV]RMhzcZpgA[vSarR^Hb6m(TzeTDlxD/FW", "ln": 0, "col": 1, "line": 1 }, { "b": "E0^4{e{FMEarV7-3lQDnwO#c{zE)(kiV@+RarR^Hb5RsfwG\u003ceTb0FdBga\u003epve?!F23lQDlar\u003e=xAbu^War\u003c0jiu!!MaBL^FarR\u003eHv@=p5BAnS!aBsCrarR^JvS=y3wfK5Sb64ymA:-M5wncabasnATBAp}mePq?OB7ocaw[+)gyiarha$K6zarR^Jy?W^eb03?\u003cvRG:$wGUF@wN/G#e*q?NarR^Hb5?Nlx(n0lvqG:7iV]RFpF%?PoIX.%nKLZZwO+{^B7D$Hzeps)mnM=!nKM]:ryPCHsuOPXz!JYnz/xo9vq]{jA+eV?Bs?GPwPA5Fv@C)?xjU%6r6:zLmo0R\u003ck%[phm[3utkSrO0xK@\u0026nAaJ]}Aa{[AwNP7\u003cePC]AA^olDz!9A(wO@Sdz!9A4zGNNDB0rdxarR^Hb5y$hBuj2FCP]f\u003eb4tn8zdK\u00261xK$W?at2f?A+PSbata\u0026?3lQDlar\u003e=BwP?^0Crf+QvpKy6iV]R:Abu.rB-5shB.LV5asnATzG6CneKHT(CWUDdy?mVvA+eV?Bs*{uA3fgzzxJO6zE)\u0026%By^HwAa{HE3lQDlar\u003e=BwP?^0CrfRMCYWXwb03?\u003czG6CnA=(mxvS=y3wfriCaz#dnat2@6wQ4T2Abo9bfk+uCBzt\u003eGvq{fdA=(mxxjU%(A::63i:(#wa$K6zarR^JAb]Jkx\u003eqGHByx6dBywV{ePL=LBy+", "ln": 1581, "col": 24, "line": 63 }, { "b": "wfriCaz#dnat2@6wQ4T2Abo9bflySuB97\u00262yB%NBB-.hneN-QqaAzQxazkn6wPzj3wJBmsx^b8narR^Hb64mhwNPT\u003eb03?\u003czG6?yxk8DtwO#NiA+cvBviu)zaz#dyayYFgAbV{KeN@Zoze18meIh6Mxcn=TAclkna$K6zarR^JBy/Jnb03?\u003cC4(5fB95JReN@ZxwPzi(wIdLivpB4:wft#mB.8:F3lQDlar\u003e(Avq{p3z/^f:ar\u003e#yBy/Jnat2f/AaAy0wG?E7aBKPB", "ln": 2164, "col": 45, "line": 76 } ], "depth": 1, "facts": { "imp": [ [ "0.99.0", "@hey-api/openapi-ts" ], [ "^7.0.3", "cross-spawn" ], [ "^15.0.0", "commander" ], [ "^6.0.6", "@types/cross-spawn" ], [ "^6.1.3", "rimraf" ], [ "^2.1.10", "lefthook" ], [ "^6.0.3", "typescript" ], [ "^7", "vite" ], [ "^22.20.1", "@types/node" ], [ "^2.5.4", "@biomejs/biome" ], [ "^7.7.1", "@types/semver" ], [ "^4.1.10", "@vitest/coverage-v8" ], [ "^28.0.0", "ts-morph" ], [ "^4.1.10", "vitest" ], [ "5.x || 6.x", "typescript" ], [ "28.x", "ts-morph" ], [ "12.x || 13.x || 14.x || 15.x", "commander" ], [ "^5.0.0", "@tanstack/react-query" ] ], "metrics": { "file": { "size": 2380, "entropy": 4.96 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 5.02 } } }, "id": 1, "mol": "K(Mc)O(S₂)H(Po)Md(Pa₆)", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "pkg:github/7nohe/openapi-react-query-codegen", "off": 489, "kind": "repository" }, { "to": "pkg:npm/%40hey-api/openapi-ts@0.99.0", "off": 878, "kind": "dependency" }, { "to": "pkg:npm/cross-spawn", "off": 1022, "kind": "dependency" }, { "to": "./dist/generate.mjs", "off": 328, "file": 33, "kind": "local" }, { "to": "./dist/generate.d.mts", "off": 406, "file": 32, "kind": "local" }, { "to": "dist/cli.mjs", "off": 191, "file": 38, "kind": "local" } ], "risk": 162, "sha": "0db30c3617af2d93c261d6a7f70566e9d4aa087060bd95802d2e2355c8942cf7", "size": 2380, "traits": [ { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install" }, { "id": "metadata/package/files/package-json::files-array-present", "conf": 0.92, "crit": 3, "desc": "Package.json declares a files allowlist", "spans": [ [ 701, 6 ] ] }, { "id": "objectives/supply-chain/hidden-payload/worm::install-hook-self-targeting-worm-env", "atk": "T1195.002", "mbc": "F0001", "conf": 0.95, "crit": 4, "desc": "Hook exports package self-identity env" }, { "id": "metadata/package/manifest/entrypoint::has-exports-field", "conf": 0.85, "crit": 2, "desc": "package.json declares an exports map", "spans": [ [ 292, 0 ] ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host", "spans": [ [ 481, 60 ] ] }, { "id": "metadata/package/scripts/develop::has-test-script", "conf": 1.0, "crit": 1, "desc": "package.json declares a test script", "spans": [ [ 2299, 0 ] ] }, { "id": "metadata/package/manifest/ecosystem::openapi-generated-keyword", "conf": 0.9, "crit": 3, "desc": "OpenAPI client or generator keyword" }, { "id": "metadata/package/manifest/workspace::has-workspaces", "conf": 0.9, "crit": 3, "desc": "Package uses workspaces (monorepo pattern)", "spans": [ [ 252, 12 ] ] }, { "id": "metadata/package/quality/profile::has-typescript", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript tooling" }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook", "spans": [ [ 1757, 134 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook", "spans": [ [ 1757, 134 ] ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook" }, { "id": "metadata/package/scripts/build::pkg-build-script-field", "conf": 0.6, "crit": 3, "desc": "Package declares a build script" }, { "id": "well-known/malware/supply-chain/shai-hulud::shai-hulud-self-targeting-preinstall", "atk": "T1195.002", "mbc": "F0001", "conf": 0.98, "crit": 5, "desc": "Preinstall declares Shai-Hulud worm config" } ], "type": "package.json" }, { "ctx": [ { "b": "x(d*cA=-BCD2NsqDMVc[BzauZyH[SpazbUjz6g3uz!9Auw]/dT3tBu@z/P}xDMWAQAaHdVy*?yal$G\u003eAvrb^#x(v(uaAR)FwGT/TA:-/@By/FXwN/K+A::67z/d9GBA}?pax9i3A:@VIx(4uiaAR)FwGU2ZA+O@\u003ey?l1Cv@bN]vruj4zxKuIw].*bar\u003e]GeD", "ln": 0, "col": 1, "line": 1 }, { "b": "i%)R\u003cdHEpFavpi+y?aU%ay/tbzeTqmBA}?paz$R8wGUDcaAhvjAaJ]$x(mMaBzbkdlVl*Uz/cXnvqPN%Aa9l/e^-ZJfa8onAbP=say]4[y*?u}azb+lv@#B6zxIn*x(4rEz/6ufzD7[2wLMVJwHIC8zdL:JB98CpzF78taARVSnN#yIBzku3wPxj", "ln": 837, "col": 62, "line": 17 }, { "b": "dHEpFax8YXwO=SmAa9^dwGUz7C42ifwGUY8Bz\u0026pgaz#ssvR6Njavx*Nv@3cdw]zYjpgl)uvqYP#nP5cOzFsire^-ZJaw#=)B-IwvawMuuazCBgBzbkdB98CpzF78aB0bvsBrC0mC42i3wft=jzdm6%e^-ZJav6)OA:-/cC42ifwGT@=wGVe8y\u0026%qiBz\u0026pvvrcz", "ln": 1003, "col": 3, "line": 22 }, { "b": "wJTWzAbP=sc)A+OeP2ADAa*BAe{8d!rc-B]j%kj}B-7-3w[=c]wigcDtu%q$fdFBUasXHiwPhD]v}u^8xK@r2ze:AlBsns=e?Os%aAIWCA=l8rwnb{]aARpdaAR)FwGUY0aARpdA+cwcB0byswIarjdJ?Y7x(+zbvqWi3vq{f%zxKdpwO@SjxK@rdD2Nsqx(+zhze:AlBy!#9w].*bayPeaBzblaazbt7wH[%kB-W%kdJ\u0026}DayPq4ayP8bwNPa{azCXiz/P@lzF782y?$koxK@rdD2NtoazbUjz6i}lvrrS7x(4uk3lQ/9asXHEBAzFyiXJdbwOkO0f!+smv@DiqAXxjpC$qvvfei!RdHEpFaxhc8pDxQ@wPhD]v}u^bx([2hvixA9A+cwlz^)\u003cgBrCTyy\u0026%\u0026lz/dfmasY2KwQ5fjA=-BmwN/K+A+cw9B-7Yhx(v(ixjVf-xM4{krc-B]d0f-NwJy@PBAh8kxdk\u003e:B98CpzF83rwQ5fjA=-A", "ln": 1465, "col": 33, "line": 32 } ], "depth": 1, "facts": { "imp": [ [ "", "./cli.mjs" ], [ "", "node:fs" ], [ "", "ts-morph" ], [ "", "typescript" ] ], "metrics": { "ast": { "max_depth": 15, "call_count": 2, "node_count": 514 }, "file": { "size": 2308, "entropy": 4.87 }, "text": { "lines": 51, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0, "space_count": 275, "char_entropy": 4.87, "unique_chars": 69, "top_char_null": 0, "string_density": 0.45, "top_char_ratio": 0.09, "avg_line_length": 44.25, "max_line_length": 119, "last_line_length": 75, "whitespace_ratio": 0.14, "identifier_density": 1.35, "line_length_stddev": 31.66, "normalized_string_count": 3.22, "suspicious_comment_ratio": 0.67, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 7.76 }, "binary": { "peak_region_bytes": 2308, "peak_region_entropy": 4.83 }, "imports": { "count": 4, "relative": 1, "stdlib_count": 1, "stdlib_ratio": 0.25, "relative_ratio": 0.25, "third_party_count": 3, "third_party_ratio": 0.75 }, "strings": { "bytes": 152, "count": 23, "avg_length": 6.61, "max_length": 10, "path_count": 1, "avg_entropy": 2.68, "entropy_stddev": 0.16 }, "comments": { "chars": 582, "count": 3, "lines": 18, "base64": 1, "todo_count": 1, "high_entropy": 1, "to_code_ratio": 0.55, "url_in_comments": 1 }, "identifiers": { "count": 69, "unique": 44, "avg_length": 12.27, "max_length": 34, "min_length": 1, "avg_entropy": 2.83, "reuse_ratio": 0.64, "length_stddev": 7.99, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.02, "high_entropy_count": 9, "high_entropy_ratio": 0.2, "all_lowercase_ratio": 0.32 } } }, "id": 2, "mol": "Md(Pa)", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/common.d.mts", "pid": 0, "refs": [ { "to": "./cli.mjs", "off": 230, "file": 39, "kind": "local" }, { "to": "...", "off": 1540, "kind": "local" } ], "risk": 2, "sha": "78c965f5b174f844a00a359ac2fce911a232cc8990c62a31c645b0a8974d50c5", "size": 2308, "traits": [ { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 1, "desc": "File uses a source declaration extension" }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "spans": [ [ 0, 25 ] ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "spans": [ [ 0, 0 ] ] } ], "type": "javascript" }, { "id": 3, "mol": "Md(Pa)", "sha": "74471ac05a51e72587f0b5e1852afb90a514a2a59bd4d034ba456b6583bafd0d", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/constants.mjs", "risk": 1, "size": 486, "type": "javascript", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BJaz\u003e[8x(U:ECxdztwKZxIwGVyzw].*bar\u003eYwwmW/lB1.GMz/6ifwPG4S3tBu@z/P}xAa9\u003c4azbUjz6g3uz!9AuAa9\u003c4b0ccCze:AlBrC]MvS=y3wkNFXA+P9apJZ+#B-ZC*Bz9iFwQ4{gBAnNMazbUjz6g2PfjO{qzeTqAzeaboi%]zqD2vamw{503BzkVhaAhvnzGFxWzE)\u0026%By!#ZqV", "ln": 0, "col": 1, "line": 1 }, { "b": "3lQDlarR^HayPF5x(\u003eFmyH?d1c$E4jefGoZA+e:6A=U@rwJy@QA=\u003e}oEjmk+arR^HEf}8tarU9pvqf*aCxdztwKZxIwHIIaBz9pwz!T8qwnc6naAz4mB.(dLzEEx[dj=PZwPJ0gBs}6wzGGDcBsxoUEf%LgAbP=sayPtpzET/3B-7Yhx(v(iAb]VgBsqfvB9hqvB1wCLAcb/jzGvlHDKp(rarUfjzGx[xz/{evB-ZC*Bz8^WaA8jvx(v)ge=", "ln": 315, "col": 22, "line": 7 }, { "b": "m}DNHA::63wk(FQA+frmy\u0026?iJz/x/jz/fRBi%)8MarV7Yi%)8MarU9pvqf*ap\u0026ZF\u003ex(^\u0026rvqG:dAb](lx(^\u003cbdlv(+3i", "ln": 705, "col": 20, "line": 19 } ], "depth": 1, "facts": { "imp": [ [ "", "dir" ], [ "", "buildQueriesOutputPath" ], [ "", "dirExists" ], [ "", "exists" ], [ "", "mkdir" ], [ "", "writeFile" ], [ "", "path.join" ], [ "", "outputPath" ], [ "", "dirExists" ], [ "", "exists" ], [ "", "mkdir" ], [ "", "promises" ], [ "", "results.map" ], [ "", "printGeneratedTS" ], [ "", "Promise.all" ], [ "", "./common.mjs" ], [ "", "node:fs/promises" ], [ "", "node:path" ] ], "mbr": [ "Promise.all", "options.output", "path.join", "result.content", "result.name", "results.map" ], "tgt": [ "Promise.all", "buildQueriesOutputPath", "exists", "mkdir", "path.join", "printGeneratedTS", "results.map", "writeFile" ], "funcs": [ [ "printGeneratedTS", 146 ], [ "print", 444 ], [ "anonymous", 666 ] ], "metrics": { "ast": { "op.lnot": 2, "max_depth": 14, "call_count": 10, "node_count": 253, "member_count": 6, "op_density.lnot": 0.01, "member_depth_max": 2 }, "file": { "size": 778, "entropy": 4.61 }, "text": { "lines": 22, "top_char": 116, "max_ws_run": 1, "space_count": 132, "char_entropy": 4.61, "unique_chars": 46, "top_char_null": 0, "string_density": 0.14, "top_char_ratio": 0.09, "avg_line_length": 34.36, "max_line_length": 65, "last_line_length": 1, "whitespace_ratio": 0.2, "identifier_density": 2.23, "line_length_stddev": 19.97, "normalized_string_count": 0.64, "normalized_unique_identifiers": 4.93 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 778, "peak_region_entropy": 4.61 }, "source": { "function_count": 2 }, "imports": { "count": 3, "relative": 1, "stdlib_count": 1, "stdlib_ratio": 0.33, "relative_ratio": 0.33, "third_party_count": 2, "third_party_ratio": 0.67 }, "strings": { "bytes": 37, "count": 3, "avg_length": 12.33, "max_length": 16, "path_count": 1, "avg_entropy": 3.16, "entropy_stddev": 0.24 }, "functions": { "count": 2, "nested": 1, "density": 13.64, "anonymous": 1, "avg_params": 1.67, "code_ratio": 1, "max_params": 2, "length_stddev": 3.3, "avg_name_length": 10.5, "avg_length_lines": 7.33, "max_length_lines": 11, "min_length_lines": 3, "avg_nesting_depth": 0.33, "max_nesting_depth": 1, "avg_param_name_length": 6.6 }, "identifiers": { "count": 49, "unique": 22, "avg_length": 7.27, "max_length": 22, "min_length": 3, "avg_entropy": 2.37, "reuse_ratio": 0.45, "length_stddev": 4.33, "high_entropy_count": 1, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.73 } } }, "id": 4, "mol": "H(F)Md(Pa)", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/print.mjs", "pid": 0, "refs": [ { "to": "./common.mjs", "off": 131, "file": 8, "kind": "local" } ], "risk": 2, "sha": "d474cbf5835d6ecda4780d9cc388ae70cc6cec26cab4f8f575acc0b5a37653ce", "size": 778, "traits": [ { "id": "micro-behaviors/fs/file/write/async::write-file-call-target", "conf": 0.9, "crit": 1, "desc": "Calls an unqualified writeFile function", "spans": [ [ 379, 0 ] ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import", "conf": 0.95, "crit": 2, "desc": "Imports the Node fs/promises API", "spans": [ [ 33, 0 ] ] }, { "id": "micro-behaviors/fs/file/write/async::node-write-file-promise-destructured", "conf": 0.9, "crit": 3, "desc": "Node writes a file via destructured import", "spans": [ [ 33, 16 ], [ 379, 9 ] ] } ], "type": "javascript" }, { "id": 5, "mol": "Md(Pa)", "sha": "a466cbddea9864f691bc9521728ccad1e564fae8bbcbf6d50b9865020563d73b", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/createSource.d.mts", "risk": 2, "size": 548, "type": "javascript", "depth": 1 }, { "id": 6, "mol": "Md(Pa)", "sha": "22ab66af35b08d01547c48e9191516f5d5f5e74cd06d4688d7e5410069d8f90a", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/service.d.mts", "risk": 2, "size": 361, "type": "javascript", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BJaAITkBrC#Ow].*bar\u003eYwwmW/lB1.GMz/6ifwPG4S3tBu@z/P}xAa9\u003c4azbUjz6g3uz!9AuAa9\u003c4b0ccCze:AlBrC]Ml2}0:CsDZ)v@#B6zy=]UazbUjz6g3AB1IlEA=tXoi%]XsAbP=saARVEw].*bar\u003e]MAaK92A+PGmb0ccCze:AlBrC]", "ln": 0, "col": 1, "line": 1 }, { "b": "BrC74Aa%A5y?XibmRM):Bwcm/By/FnjS(d]BAe/MjW70n3lQDlaAz4nB-IvxB98BPv}Yp\u003el3aIedk2ZXrD8[*AZKnRwHF#Id\u003ce[PAXqAHx\u003e7Z5f!2f\u003eEld^ECYmOwBrC7izGx[xy\u0026sJeA:@K0wKZxOB978!BAz8mauZ?}B98BKau.[hDKp(rarUYoBAIRwaAITBe[nN6AZs^}fEXR@z+L7[wPydDB7D:Gas!M", "ln": 227, "col": 12, "line": 6 }, { "b": "arR^HBAhTHDKp(rarR^HarU9pvqf*aB97\u0026jc$T[\u00263lQDlarR^HaAz4nB-IvxBAhIni%)8MarV7tarR^Hv{%E?xDRTearR^HarR^HA+funA=91ivqH0@i%)8MarV7tEf%F5zGx[xlVl*Uz/cWXar\u003cf\u003ezeBieb0cb+dK\u003e=FdJ?62x(4r5vix5#zeBieaAR)FwGU(0zdK\u00260C{46DwPhi#wnb{]aARpdavy6:zeTqmzEEx[B8UL$wIarjdLzcuCYmOwBrCgrzEW^5z/cW:B.LV5lVl*Uz/eK1AaI^MzdLbkvqPN8aBsCrarR!vw/@HzD2Ntkw/$#1zdK?MjV%]iB98CpzF7dxaBsCrarR^HarR!EwPS6nzxK4xe[OK4Bz(hBe[n{kvru6LwmYU2x\u003ez6\u003cAWUrvDQzZ*zeTrue*L^YvqPO7u[1eAarR^HEf}8tarUYoBAIRwaARVSw)]g\u003ez/QaQv@=c?By!3OwO#Q7w[+*%c$1rElVl*Uz/f$QbZTAq", "ln": 1034, "col": 1, "line": 30 }, { "b": "dHEpFax8YXwO=SmAa9^dwGUz7C42ifwGUY8Bz\u0026pgaz#ssvR6Njavx*Nv@3cdw]zYjpgl)uvqYP#nP5cOzFsire^-ZJaw#=)B-IwvawMuuazCBgBzbkdB98CpzF78aB0bvsBrC0mC42i3wft=jzdm6%e^-ZJav6)OA:-/cC42ifwGT@=wGVe8y\u0026%qiBz\u0026pvvrcz", "ln": 1454, "col": 3, "line": 48 }, { "b": "a$+G2a$jTQB-IIvB-7-7zF78lxK@rdD2Nsqx\u003ewGfxK#i}azC)tz/fbs3lQ/vra]#!ay!?$azth5AaJ]fCw7M9aARpdaAR)FwGUYdazCXiz/P@hwftG8z/3R9zF%SgwPw]9x(4uiayYFn3lQ/vCv.[9A+cw4y\u0026T8}wo/qize:AlBzkS9ayP85aARpdaAR)FwPF#aA=k!qBzb98azbt7wIarjdHEpFazt\u003esAc15[flgSpwQ2{-f!M%Oz7/].gEMHVvnOWj3lQ/9asXHkpEE#taw#=\u0026y***+aA}KwxDQ.azeTDaaAzyfB-RTEB8L(qBzkVhe^-ZJfa8onAbP=sazb+lv@#B6zxJO6Bw(\u003c\u003eA=+oaAaHCtD2NszaBsCrarR!EwPS6nzxK4DAaHUxwPhD]v}v@xy:Z@Jz2", "ln": 2716, "col": 23, "line": 85 }, { "b": "e[X:qlU{gLB7Gzvdlv\u003eVarR!vw/@GByIWB2B7GzBy?mG%Bz99CDKp(rarR^HarU=tA=ldAzE[2mmriA!AWSbbzY\u0026LavrlH3B0b7kB-7.ldlv\u003eVarR!P3lQDlaAz4nB-E", "ln": 3141, "col": 25, "line": 97 }, { "b": "yH}=xaA?gfB.a\u0026cau.[hDKp(rarR^HarUfjzGx[xBA}?pwj{GVauZ\u0026.wQcuAarR^HarR^Hv@DmaBrCWJAaJMXvqH6$auZ\u0026\u003cvqH6$i%)8MarR^HarUfjzGx[xAa9^dwN[LUzdm6%auZ?", "ln": 3982, "col": 68, "line": 123 } ], "depth": 1, "facts": { "imp": [ [ "", "capitalizeFirstLetter" ], [ "", "str.charAt.toUpperCase" ], [ "", "str.charAt" ], [ "", "str.slice" ], [ "", "lowercaseFirstLetter" ], [ "", "str.charAt.toLowerCase" ], [ "", "str.charAt" ], [ "", "str.slice" ], [ "", "getVariableArrowFunctionParameters" ], [ "", "initializer" ], [ "", "variable.getInitializer" ], [ "", "ArrowFunction.isArrowFunction" ], [ "", "initializer.getParameters" ], [ "", "getNameFromVariable" ], [ "", "variableName" ], [ "", "variable.getName" ], [ "", "stat" ], [ "", "Common" ], [ "", "ts.factory.createIdentifier" ], [ "", "ts.factory.createIdentifier" ], [ "", "value.trim" ], [ "", "parsed" ], [ "", "Number" ], [ "", "Number.isNaN" ], [ "", "Number.isFinite" ], [ "", "referenced" ], [ "", "param.findReferences" ], [ "", "def" ], [ "", "referenced.getDefinition" ], [ "", "paramNodes" ], [ "", "def.getNode.getType.getProperties.filter.map" ], [ "", "def.getNode.getType.getProperties.filter" ], [ "", "def.getNode.getType.getProperties" ], [ "", "def.getNode.getType" ], [ "", "def.getNode" ], [ "", "prop.getValueDeclaration.getType" ], [ "", "prop.getValueDeclaration" ], [ "", "prop.getName" ], [ "", "prop.isOptional" ], [ "", "prop.getValueDeclaration.getType" ], [ "", "prop.getValueDeclaration" ], [ "", "type.replaceAll" ], [ "", "klasses" ], [ "", "node.getClasses" ], [ "", "klasses.map" ], [ "", "className" ], [ "", "klass.getName" ], [ "", "className" ], [ "", "klass.getName" ], [ "", "formattedOptions" ], [ "", "Object.entries.reduce" ], [ "", "Object.entries" ], [ "", "typedKey" ], [ "", "typedValue" ], [ "", "parsedNumber" ], [ "", "safeParseNumber" ], [ "", "acc.typedKey" ], [ "", "acc.typedKey" ], [ "", "Number.isNaN" ], [ "", "acc.typedKey" ], [ "", "acc.typedKey" ], [ "", "path.join" ], [ "", "path.join" ], [ "", "./constants.mjs" ], [ "", "node:fs/promises" ], [ "", "node:path" ], [ "", "ts-morph" ], [ "", "typescript" ] ], "mbr": [ "ArrowFunction.isArrowFunction", "Number.NaN", "Number.isFinite", "Number.isNaN", "Object.entries", "Object.entries().reduce", "def.getNode", "def.getNode().getType", "def.getNode().getType().getProperties", "def.getNode().getType().getProperties().filter", "def.getNode().getType().getProperties().filter().map", "initializer.getParameters", "klass.getName", "klasses.length", "klasses.map", "name.text", "node.getClasses", "param.findReferences", "path.join", "prop.getName", "prop.getValueDeclaration", "prop.getValueDeclaration().getType", "prop.isOptional", "referenced.getDefinition", "str.charAt", "str.charAt().toLowerCase", "str.charAt().toUpperCase", "str.slice", "ts.factory", "ts.factory.createIdentifier", "type.replaceAll", "value.trim", "variable.getInitializer", "variable.getName" ], "tgt": [ "ArrowFunction.isArrowFunction", "Error", "Number", "Number.isFinite", "Number.isNaN", "Object.entries", "Object.entries().reduce", "def.getNode", "def.getNode().getType", "def.getNode().getType().getProperties", "def.getNode().getType().getProperties().filter", "def.getNode().getType().getProperties().filter().map", "initializer.getParameters", "klass.getName", "klasses.map", "node.getClasses", "param.findReferences", "path.join", "prop.getName", "prop.getValueDeclaration", "prop.getValueDeclaration().getType", "prop.isOptional", "referenced.getDefinition", "safeParseNumber", "stat", "str.charAt", "str.charAt().toLowerCase", "str.charAt().toUpperCase", "str.slice", "ts.factory.createIdentifier", "type.replaceAll", "value.trim", "variable.getInitializer", "variable.getName" ], "funcs": [ [ "anonymous", 253 ], [ "anonymous", 358 ], [ "anonymous", 477 ], [ "anonymous", 828 ], [ "exists", 1007 ], [ "BuildCommonTypeName", 1240 ], [ "safeParseNumber", 1696 ], [ "extractPropertiesFromObjectParam", 2172 ], [ "anonymous", 2423 ], [ "anonymous", 2485 ], [ "getShortType", 2985 ], [ "getClassesFromService", 3078 ], [ "anonymous", 3257 ], [ "getClassNameFromClassNode", 3489 ], [ "formatOptions", 3680 ], [ "anonymous", 3975 ], [ "buildRequestsOutputPath", 4558 ], [ "buildQueriesOutputPath", 4668 ] ], "metrics": { "ast": { "op.eq": 7, "op.add": 2, "op.lor": 2, "op.land": 2, "op.lnot": 8, "max_depth": 20, "call_count": 47, "node_count": 1190, "member_count": 34, "op_density.eq": 0.01, "op_density.add": 0, "op_density.lor": 0, "op_density.land": 0, "op_density.lnot": 0.01, "max_concat_chain": 2, "member_depth_max": 6 }, "file": { "size": 4769, "entropy": 4.71 }, "text": { "lines": 148, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0, "space_count": 1028, "char_entropy": 4.71, "unique_chars": 75, "top_char_null": 0, "string_density": 0.14, "top_char_ratio": 0.07, "avg_line_length": 31.22, "max_line_length": 84, "last_line_length": 1, "whitespace_ratio": 0.25, "identifier_density": 1.28, "line_length_stddev": 22.29, "normalized_string_count": 1.64, "repeated_char_sequences": 10, "suspicious_string_ratio": 0.1, "suspicious_comment_ratio": 0.22, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 11.24 }, "binds": { "count": 18 }, "binary": { "peak_region_bytes": 4769, "peak_region_entropy": 4.73 }, "source": { "function_count": 10 }, "imports": { "count": 5, "relative": 1, "stdlib_count": 1, "stdlib_ratio": 0.2, "relative_ratio": 0.2, "third_party_count": 4, "third_party_ratio": 0.8 }, "strings": { "bytes": 260, "count": 20, "avg_length": 13, "max_length": 36, "path_count": 1, "avg_entropy": 3.08, "empty_count": 2, "entropy_stddev": 0.56, "embedded_code_candidates": 2 }, "comments": { "chars": 935, "count": 9, "lines": 24, "base64": 1, "todo_count": 1, "high_entropy": 1, "to_code_ratio": 0.19, "url_in_comments": 1 }, "functions": { "count": 10, "nested": 3, "density": 12.16, "anonymous": 8, "avg_params": 1.06, "code_ratio": 1.08, "max_params": 2, "one_liners": 1, "length_stddev": 6.24, "avg_name_length": 18.8, "avg_length_lines": 8.89, "max_length_lines": 24, "min_length_lines": 1, "avg_nesting_depth": 0.22, "max_nesting_depth": 1, "high_entropy_names": 6, "single_char_params": 1, "avg_param_name_length": 5.05 }, "identifiers": { "count": 189, "unique": 81, "avg_length": 10.06, "max_length": 34, "min_length": 1, "avg_entropy": 2.59, "reuse_ratio": 0.43, "length_stddev": 6.71, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.01, "high_entropy_count": 10, "high_entropy_ratio": 0.12, "all_lowercase_ratio": 0.41 } } }, "id": 7, "mol": "H(Db)Md(Pa)", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/common.mjs", "pid": 0, "refs": [ { "to": "./constants.mjs", "off": 198, "file": 4, "kind": "local" }, { "to": "...", "off": 2717, "kind": "local" } ], "risk": 3, "sha": "7d221e57ec47b6093c664cee24447cae61e1dbb3b19043fad8ee88b249013f68", "size": 4769, "traits": [ { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "spans": [ [ 0, 23 ] ] }, { "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import", "conf": 0.95, "crit": 2, "desc": "Imports the Node fs/promises API", "spans": [ [ 21, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant" } ], "type": "javascript" }, { "id": 8, "mol": "Md(Pa)", "sha": "cbd1f3923fa0469a03aa54c0d8a6760aa170e63c8b8b990a4111294aae8644f2", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/util.mjs", "risk": 1, "size": 754, "type": "javascript", "depth": 1 }, { "id": 9, "mol": "Md(Pa)", "sha": "b3a39db86c8383c0361499b5d5e87dde5864fa782adc0ddce449a5870d85b608", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/createSource.mjs", "risk": 1, "size": 1049, "type": "javascript", "depth": 1 }, { "id": 10, "mol": "Md(Pa)", "sha": "31a3906c96de7c43bc6163f9f146087b3b60e40d0a7b4a9b79967ceb8df13ef9", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/format.mjs", "risk": 1, "size": 1967, "type": "javascript", "depth": 1 }, { "id": 11, "mol": "Md(Pa)", "sha": "c1865b132095679c1b8d39725f0e14a9c97f0a2962de76d6706c288267412380", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/parseOperations.mjs", "risk": 1, "size": 6859, "type": "javascript", "depth": 1 }, { "id": 12, "mol": "Md(Pa)", "sha": "ae2b92a06cc881cebf46bb2f05670851cd4dac34ff68dfea02ab12e65b9ac8fd", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/constants.d.mts", "risk": 2, "size": 605, "type": "javascript", "depth": 1 }, { "id": 13, "mol": "Md(Pa)", "sha": "addc2479d7e189d11a7ad8d03f998350aca469d7f40d8782eea8c7b4b73c6e17", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/print.d.mts", "risk": 2, "size": 197, "type": "javascript", "depth": 1 }, { "id": 14, "mol": "Md(Pa)", "sha": "1f8a1fc138e1a78f963deaef56fc4f2e14cca73810eaeb602189c0c9e58a34c7", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/format.d.mts", "risk": 2, "size": 247, "type": "javascript", "depth": 1 }, { "id": 15, "mol": "Md(Pa)", "sha": "d94306dec12ef773092cfdd82a27adddad8be5db94bc46043656c85a22aacd6f", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildQueryHooks.mjs", "risk": 1, "size": 17315, "type": "javascript", "depth": 1 }, { "id": 16, "mol": "Md(Pa)", "sha": "61deb37a8282f465a1c1ad7eb5102d9c217207d8cbad4143cefbbcde65bae343", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildQueryHooks.d.mts", "risk": 2, "size": 7353, "type": "javascript", "depth": 1 }, { "id": 17, "mol": "Md(Pa)", "sha": "8ef300ff2a0579a75265fe6d559a95397655461636d9fdfab2c759d2dd73ae6a", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildCommon.d.mts", "risk": 2, "size": 3451, "type": "javascript", "depth": 1 }, { "id": 18, "mol": "Md(Pa)", "sha": "72d04d3f56a9f3b1a99b6a41d7ddafee48da58655b8f38a6141e02d866016482", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildCommon.mjs", "risk": 1, "size": 6818, "type": "javascript", "depth": 1 }, { "id": 19, "mol": "Md(Pa)", "sha": "f7d98147177361bae712cc7a97761e132c9ed69372f910aad66eb27c080f53e1", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/index.d.mts", "risk": 2, "size": 236, "type": "javascript", "depth": 1 }, { "id": 20, "mol": "Md(Pa)", "sha": "af5a4fd8c1fffe4b40e4e1ea0514a70a4876dc9e111f5293089fb380bd2d9999", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/operationNames.d.mts", "risk": 2, "size": 869, "type": "javascript", "depth": 1 }, { "id": 21, "mol": "Md(Pa)", "sha": "76594673b56353c1fd93b55e1700cc113a955a733b9c2ff2a4f57b08e6466b75", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildMutationHooks.d.mts", "risk": 2, "size": 838, "type": "javascript", "depth": 1 }, { "id": 22, "mol": "Md(Pa)", "sha": "0485a90b609e48a7f16261670f5aec0fbd421a134510c1547c81675b0ec69c11", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildQueryOptions.d.mts", "risk": 2, "size": 1953, "type": "javascript", "depth": 1 }, { "id": 23, "mol": "Md(Pa)", "sha": "f7d98147177361bae712cc7a97761e132c9ed69372f910aad66eb27c080f53e1", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/index.mjs", "risk": 1, "size": 236, "type": "javascript", "depth": 1 }, { "id": 24, "mol": "Md(Pa)", "sha": "1aaf606a7dacaacf383197c78714bd6ec73b563b67d68bc8fcc90754bcabbffd", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/generateFiles.d.mts", "risk": 2, "size": 243, "type": "javascript", "depth": 1 }, { "id": 25, "mol": "Md(Pa)", "sha": "548de666ab5a1961cd4d71f189e277f84c2e7a61daea3db0c8a322ff4f63c3e2", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/projectFactory.mjs", "risk": 1, "size": 5200, "type": "javascript", "depth": 1 }, { "id": 26, "mol": "Md(Pa)", "sha": "b6c0f43a359581008d7c23e347a8d1182ab4435177320d3a62806dbe1e6a0559", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/generateFiles.mjs", "risk": 1, "size": 9413, "type": "javascript", "depth": 1 }, { "id": 27, "mol": "Md(Pa)", "sha": "236a2ea47901ed2930f4e33e26cd49a2353a15c29d171cd3d63e3e08b2fb5f60", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/projectFactory.d.mts", "risk": 2, "size": 2229, "type": "javascript", "depth": 1 }, { "id": 28, "mol": "Md(Pa)", "sha": "591f0d4e76f316c33bccd9c256d0c326a3141fd35ecf97b53ce18f1f99056e4d", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildQueryOptions.mjs", "risk": 1, "size": 4206, "type": "javascript", "depth": 1 }, { "id": 29, "mol": "Md(Pa)", "sha": "f35446742443a6bf2ab29667e5ace65da59b452b0e896f66136dda30f80f929e", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/operationNames.mjs", "risk": 1, "size": 1150, "type": "javascript", "depth": 1 }, { "id": 30, "mol": "Md(Pa)", "sha": "c1b703cb9389f9e73b773a2f87e1912e4d1a581d091b49b2afc5de808cbaa770", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/tsmorph/buildMutationHooks.mjs", "risk": 1, "size": 2063, "type": "javascript", "depth": 1 }, { "id": 31, "mol": "Md(Pa)", "sha": "a42e849affbfbcd80500a0d56d7df7b551a39491920dbfcec1e2ffe6fb64bf32", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/types.d.mts", "risk": 2, "size": 3249, "type": "javascript", "depth": 1 }, { "id": 32, "mol": "Md(Pa)", "sha": "548b26cce5af34192f60b7ac1332a6e66ba923cf2d047acc3cd79d5937c72b42", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/generate.d.mts", "risk": 2, "size": 233, "type": "javascript", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BJaAz44wmPy{q*Am\u003caBLwAA=k!qb5RsfwJBBAb0ccCze:AlBrC]MA+eV\u0026mRMWIefGdSx()]Qx(4u6Eircxz/3QvzF%5%i+AB^Ab](lx(^\u003cbb0ccCze:AlBrCKhBz8!eA=k!qb5RsfwJB^sBz8\u003cW3tBu@z/P}xDMV*swNPW(lU{EFzGE1HazbUjz6g2/xK#Dvvq]{lz/xo9vq]{jBAnS/3tBu@z/P}xDMV^ux(4rSB.bPcwPHT\u0026Bz#wAp*[DVefFzAx(4rTwPq\u003c7B98F0B-.OBBwMy/xE\u003eorz/PY6BwD\u003c$x(v)gefGu-w].*bar\u0026A\u003ev@Dj3z/dgAy5", "ln": 0, "col": 1, "line": 1 }, { "b": "y?[8mB-nEnA=k!qx([zsdRS^wByx04dHE*Zaz+$avruj4zy=]OxLy%\u0026azCZoBzbxfaz(4mz/PAdzY\u003c7ivpJ$ZB0bNrx(+zqwPhMnB0byBzxJ$rz/^azB7ocaw[+(+fe1B@ph:VOpgXV(diJtxB97#4wft/5aARpday!?@y?mSmB0bBxz!-\u0026[BrC7izF0P}e*9C$v}Y!3x(mMaBzbkdB7F^2v}Vi5fcBXBay/RaazC.mBy!(\u003eazbt9woe(nxK@rdB7ocaw[+)2Bzb98ayO=4BZY95C{3KmAbol1B0bNyaARpdazkn6wPzj3wN(c3fcCgQBz#wAefF!rByO##zF78lxK@rbwPI^aB-.tozxK4mwGUF\u003ey\u00260W6cVZzGCwXKhBAp@1aA}Ko", "ln": 467, "col": 47, "line": 9 }, { "b": "B3\u003c\u003e-w[+)OvrufhB97\u0026hBvo?-diJ%AarR^Hy?mYhwnc6bjS[//vrcDTx(VoxarR^HCw7YbwGSyyA=\u003e}xaBsCrarR^HarR!pz/fSray!?$wnbN.By/IojS[=RvpS[.A-mm3v\u003c\u003e(4AW-RMx(4)5AWStFx(4ufau.[hw[=6)e]#byA==w7x([2pb6m)oz/ff3xcF=Ecmf\u003cEx(4ukwO#41s7#+\u0026c)yoUB8L}udjEs=arR^HarR^Hx\u003ewFov{%m=x\u003egT]wPGFuwO#d5xDPFYfEXb\u003e3lQDlarR^HarR^Hay!?$wnbN.By/ICB8M8vc[5HMau.[hc$akYjV%]iBAp@gzF0P}e]2DCzxZh/at2q\u003ciV{dadlv\u003eVarR^HarR^HarR!EwPS6nzxJ[bBz9pwz!T8qwnc6nay!?$wnbN.By/I$fKla?3lP", "ln": 814, "col": 29, "line": 14 }, { "b": "wO#PjjV$}Jwnc6k3lQDlarR^HarR^HaAz4nB-IvxB-7-3w[=c]wigbvarR^HarR!qx(UsVaAg+fwO#PK3lQDlaBKPB3t1E3z/P}xvrlZiv\u003c2xazEW^5z/cXgwO#71vru6ezV", "ln": 1222, "col": 16, "line": 23 }, { "b": "x(w5p3lQDlarR^HauyR?kXK.OeN-QjfjO*jwO#Pww[u6]xD/IBarR^Hv@DmaBrCWJAaK92A+PGmp\u00267n!x(k4RazbLjzddKdwN[OQBzkVhB1R3wB.#gbarR^HarR^Hkl", "ln": 1621, "col": 30, "line": 33 }, { "b": "arR^HarR^HarU=ElVl\u003cOx\u003eHmJBz9YTw[=c[pgW\u003cOwPI@)B3\u003c\u003e-w[+)OvrufhAb](bwPI]Bv%qDidjDx7koK\u0026^y?$TfarR^HarR^HEjLZFarR^HarR!Cy\u0026%x8zGvuoarR^HEld=UarR!nCvticay/C6vru6Fy?WD#BspTqzF0P}dlv\u003eVarR^WfcA+@zE)\u0026%By=O7ve", "ln": 2971, "col": 3, "line": 80 }, { "b": "AV/Ntvru77wPw]8CYWImB7]Mgay/tcC4CMkx(v(iz/xo9vq]{jBAnNEB7F(8w]zYjx([zsz*c7aarR^Hfe1CTA=l2ueOnZkwGUY7AbP=sB08(xe[V^Vu[Mhnu)661AV!a}wmXIECYUFVzF%A7azbLjayYFhwnC*$aAz4mz!%Mrx(v(re^-ZzarUfjzGx[xB7x5RwO%\u003eNzGGDcBrAZ?vrVc]BrCQnvpR\u0026wy?k2lvrufnyhW*7c#T6ozB5kQpJZ+#B-ZC*Bz9iFb6dpge[X:ke{8dUdj=O=B-.jEi3G!k3lQDlay/tcB95Ksze:AlBvyB@wO#N6z/cWXaAI7em}DN9z/fVdzGEHFvru0)c[/gMz/3R3cN8\u00263e)H5ty?WD#Bx*ChwO}", "ln": 3257, "col": 13, "line": 87 }, { "b": "Ej49YzE[6iz/P}xdJ\u0026tzz/3QAe?.oRyC6mhzx%Nyze:AlBvyB@wO#N6z/f$Jj6VVhi%)8MarU9pvqf*aCxdztwKZxIwHIIaBz9pwz!T8qz/xo9l2ZKlB-.OBBwMy/xE\u003enIB7Gxnx\u003e7Z}e[X:ke{8dUdj=P.xLzrJz/fVdzGEr?3lQDlay/tcB95KCz/{8gwGTbUvrVc]BrC7lwNPW(q/u/0v}v6n3lQDlarR^HaA8yAAcln0vrufzaA8jgzu", "ln": 3722, "col": 129, "line": 91 }, { "b": "z/PY6BAz88pJgz\u0026z/fRGx(mTbx\u003c\u003e*Ovp%dFvrb^[e{82gBAh8kxdbhW3lQDlarR^HaA8ahBv*v:Bzkf1p*[0Fp*[xMz8@!Kz/PY6BAz88pJgz\u0026z/fRGz/6ignP5l:x\u003c\u003e*Ovp%c", "ln": 4114, "col": 28, "line": 99 } ], "depth": 1, "facts": { "imp": [ [ "", "dir" ], [ "", "candidates" ], [ "", "readdirSync.filter" ], [ "", "readdirSync" ], [ "", "file.startsWith" ], [ "", "file.endsWith" ], [ "", "candidates.sort" ], [ "", "path.join" ], [ "", "parent" ], [ "", "path.dirname" ], [ "", "dir" ], [ "", "openApiOutputPath" ], [ "", "buildRequestsOutputPath" ], [ "", "formattedOptions" ], [ "", "formatOptions" ], [ "", "clientPlugin" ], [ "", "typescriptPlugin" ], [ "", "sdkPlugin" ], [ "", "plugins" ], [ "", "plugins.push" ], [ "", "plugins.push" ], [ "", "config" ], [ "", "findNearestTsConfigPath" ], [ "", "process.cwd" ], [ "", "createClient" ], [ "", "sdkGenContent" ], [ "", "readFile" ], [ "", "path.join" ], [ "", "importExtension" ], [ "", "sdkGenContent.match" ], [ "", "shimContent" ], [ "", "writeFile" ], [ "", "path.join" ], [ "", "source" ], [ "", "createSource" ], [ "", "formattedOptions.initialPageParam.toString" ], [ "", "print" ], [ "", "queriesOutputPath" ], [ "", "buildQueriesOutputPath" ], [ "", "formatOutput" ], [ "", "processOutput" ], [ "", "./common.mjs" ], [ "", "./createSource.mjs" ], [ "", "./format.mjs" ], [ "", "./print.mjs" ], [ "", "@hey-api/openapi-ts" ], [ "", "node:fs" ], [ "", "node:fs/promises" ], [ "", "node:path" ] ], "mbr": [ "candidates.length", "candidates.sort", "file.endsWith", "file.startsWith", "formattedOptions.client", "formattedOptions.enums", "formattedOptions.format", "formattedOptions.initialPageParam", "formattedOptions.initialPageParam.toString", "formattedOptions.input", "formattedOptions.lint", "formattedOptions.nextPageParam", "formattedOptions.noOperationId", "formattedOptions.noSchemas", "formattedOptions.omitInitialPageParam", "formattedOptions.pageParam", "formattedOptions.schemaType", "formattedOptions.useDateType", "options.output", "path.dirname", "path.join", "plugins.push", "process.cwd", "readdirSync().filter", "sdkGenContent.match" ], "tgt": [ "buildQueriesOutputPath", "buildRequestsOutputPath", "candidates.sort", "createClient", "createSource", "file.endsWith", "file.startsWith", "findNearestTsConfigPath", "formatOptions", "formatOutput", "formattedOptions.initialPageParam.toString", "path.dirname", "path.join", "plugins.push", "print", "process.cwd", "processOutput", "readFile", "readdirSync", "readdirSync().filter", "sdkGenContent.match", "writeFile" ], "funcs": [ [ "findNearestTsConfigPath", 793 ], [ "anonymous", 932 ], [ "anonymous", 1063 ], [ "generate", 1302 ] ], "metrics": { "ast": { "op.eq": 3, "op.gt": 1, "op.sub": 1, "op.land": 1, "op.lnot": 1, "max_depth": 16, "call_count": 25, "node_count": 921, "op.coalesce": 3, "member_count": 25, "max_array_len": 3, "op_density.eq": 0, "op_density.gt": 0, "op_density.sub": 0, "op_density.land": 0, "op_density.lnot": 0, "member_depth_max": 3, "infinite_loop_count": 1, "op_density.coalesce": 0 }, "file": { "size": 4550, "entropy": 4.65 }, "text": { "lines": 110, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0, "space_count": 1022, "char_entropy": 4.65, "unique_chars": 72, "top_char_null": 0, "string_density": 0.25, "top_char_ratio": 0.07, "avg_line_length": 40.36, "max_line_length": 181, "last_line_length": 1, "whitespace_ratio": 0.25, "identifier_density": 1.46, "line_length_stddev": 27.96, "normalized_string_count": 2.67, "repeated_char_sequences": 23, "suspicious_string_ratio": 0.04, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 10.17 }, "binds": { "count": 16 }, "binary": { "peak_region_bytes": 3526, "peak_region_entropy": 4.84 }, "source": { "function_count": 2 }, "imports": { "count": 8, "relative": 4, "stdlib_count": 2, "stdlib_ratio": 0.25, "relative_ratio": 0.5, "third_party_count": 6, "third_party_ratio": 0.75 }, "strings": { "sql": 1, "bytes": 507, "count": 28, "avg_length": 18.11, "max_length": 154, "path_count": 4, "avg_entropy": 3.24, "empty_count": 1, "entropy_stddev": 0.71 }, "comments": { "chars": 751, "count": 12, "lines": 12, "to_code_ratio": 0.12 }, "functions": { "count": 2, "nested": 1, "density": 3.64, "anonymous": 2, "avg_params": 1.25, "code_ratio": 0.9, "max_params": 2, "one_liners": 2, "length_stddev": 34.05, "avg_name_length": 15.5, "avg_length_lines": 24.75, "max_length_lines": 83, "min_length_lines": 1, "avg_nesting_depth": 0.5, "max_nesting_depth": 1, "high_entropy_names": 1, "single_char_params": 1, "avg_param_name_length": 5.4 }, "identifiers": { "count": 161, "unique": 69, "avg_length": 9.28, "max_length": 23, "min_length": 1, "avg_entropy": 2.72, "reuse_ratio": 0.43, "length_stddev": 4.9, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.01, "high_entropy_count": 5, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.49 } } }, "id": 33, "mol": "H(F₂)Md(Pa)", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/generate.mjs", "pid": 0, "refs": [ { "to": "./common.mjs", "off": 258, "file": 8, "kind": "local" }, { "to": "./createSource.mjs", "off": 303, "file": 10, "kind": "local" }, { "to": "./format.mjs", "off": 369, "file": 11, "kind": "local" }, { "to": "./print.mjs", "off": 407, "file": 5, "kind": "local" }, { "to": "./client.gen${importExtension}", "off": 3693, "kind": "local" }, { "to": "./sdk.gen${importExtension}", "off": 3742, "kind": "local" } ], "risk": 2, "sha": "8203395b11bb218f0243c5f1d397308a6be95373c1a76baa631f5d3f70a81da6", "size": 4550, "traits": [ { "id": "micro-behaviors/fs/file/read::file-read-api-call", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript readFile API" }, { "id": "micro-behaviors/fs/file/write/async::write-file-call-target", "conf": 0.9, "crit": 1, "desc": "Calls an unqualified writeFile function", "spans": [ [ 3786, 0 ] ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import", "conf": 0.95, "crit": 2, "desc": "Imports the Node fs/promises API", "spans": [ [ 75, 0 ] ] }, { "id": "micro-behaviors/fs/file/write/async::node-write-file-promise-destructured", "conf": 0.9, "crit": 3, "desc": "Node writes a file via destructured import", "spans": [ [ 75, 16 ], [ 3786, 9 ] ] } ], "type": "javascript" }, { "id": 34, "mol": "Md(Pa)", "sha": "c0f9ed6c1dab318167baae18cf6677f6f5001143c5b12689a0eff016e5e00681", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/cli.d.mts", "risk": 2, "size": 536, "type": "javascript", "depth": 1 }, { "id": 35, "mol": "Md(Pa)", "sha": "23b397ba8a05048b7ce505e3cc0cb9d84490815ed986504593f04ec377d06839", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/parseOperations.d.mts", "risk": 2, "size": 612, "type": "javascript", "depth": 1 }, { "id": 36, "mol": "Md(Pa)", "sha": "b529b8fa51f311013b09f8f095ae41236c3e82184fb81646d380c86584339464", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/service.mjs", "risk": 1, "size": 4326, "type": "javascript", "depth": 1 }, { "id": 37, "mol": "Md(Pa)", "sha": "cd4b9772f424020a1ff5e637537244efce8f162d9c4fee1209ab50d1e34b04fa", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/util.d.mts", "risk": 2, "size": 127, "type": "javascript", "depth": 1 }, { "ctx": [ { "b": "boXZ.B8\u0026{yx(kOnzGWduz!9z^x(d*cA=-BJaAz44wjyoHwGVyzw].*bar\u003eYwwmW/lB1.GMz/6ifwPG4S3tBu@z/P}xDMV\u003ckA=br5wH[%sz!T8iEircxz/3QvzF%5%i=FIHxD/IBx(d*cA=-BJazbt7wMqS4rbUPwBz8!BazbUjz6g3uz!9AuB-Ipxi%]XsAbP=sao", "ln": 0, "col": 1, "line": 1 }, { "b": "BzkVhaAIaoB-pe$z!B90z73?QDKp(rarUfjzGx[xuTEzVy?mG)zdK?Mazbt7wMqS4rbUPwBz97pze:AlBs}AwByu!AA+)f^3lQDlay/tcB95KiuU0\u003e\u003ezEEx[auZ\u0026Tx(X91zdLb5uUj1*wO${[wHPXFarR^Hv@DmaBrCgfy?j.LayPF5x(\u003eFrwNPasx(4ueyhW*7c%{s(x(X91zdLmva$+G3Aa9l(vp%d7yiarha$k5=b6w0teJs}6i%)8MarUfjzGx[xAa9l(vp%dzB8L}sjS)u}pFJJYvrcB2c$WgfwHPXFarR^Hv@DmaBrC:rA=U@kzxI7+Aa9l(vp%dzB8L}GC4CYnx(v(J3lQDlaAhvtxl4A$3lQDlarR^HatdLuzdLatz/xo9vq]{jA=AoL3lQDlarR^H", "ln": 332, "col": 11, "line": 9 }, { "b": "arR^Hatdeqz!SY)B0$lpkXK.OeN-QjfjO*jwO#Pww[u6]xD!#Ib0Y*MC}ADzx!J$jx\u003eqg7eN-)rz/WaddgdguarR^HarSpEwObv[y\u0026?6HkXK.OeN-QjfjO*jwO#Pww=", "ln": 1030, "col": 4, "line": 22 }, { "b": "BzkVhc)yk{w]zZbvrrROC42ifwJ?p?ar\u003cT5z!0v1B0byzBz#wAazbLdwmY^7CwhejazbLjzddKdwPy0Vdk2azz!SY)B0$lpvRG:$wG\u0026VFb5?NlBAzkdAW1^rdgdguarR^HarSpBwmOFPBzkVhc#JQuawV@#x(v(qa$Ux.x(n2njA+dHB.9-XefDck", "ln": 1164, "col": 26, "line": 24 }, { "b": "b3=SD3lQDlarR^HatdOKBzkVhc)yk{B-RaZvru6WD2NssefDcpB7DEZvru66w]zYjwmoN\u003efjXHkwI51rzdK\u0026bz!9A}aAhvtAaK6ix\u003equdvqYP#v@DmdwPz(nA+frhz/fScaA?gfB.bRpBz\u0026o\u0026vru66z^)D)v@#=odgdguarR^HarSpPAcb/jzyuXXeO5B4B.q)Har\u003cZazxJUhay]4)B.q?lz!9Aza$i\u003cwarR^", "ln": 1604, "col": 138, "line": 27 }, { "b": "arR^HarR^He]LYJx(v(qa$Ux=vp%dFvrb^[auT*Qy\u0026%qMa$K\u0026Xpgn0JaA7\u003cmBzbkdADL\u0026kC{46mA:-/@By/FnB-Rb8azbLjaAg+4x(mv3x(v(kefDcQvp%c}dgdguarR^HarSpPAcb/jzyuXXePbcABwMyUwL=/QvqNbHC42ifwJ?p?ar\u003cM?zdK*", "ln": 1971, "col": 1, "line": 32 }, { "b": "BzkVhB09Q*Ab](fA:-/qz/x/tc[dj+arR^HvrVc]BrCjczE)\u0026%By=\u003esAcb/jzGvuKC4CYnx(v(ri%{xyB7GDoA8pN[xl4A$c[dj+", "ln": 2403, "col": 13, "line": 37 } ], "depth": 1, "facts": { "imp": [ [ "", "program" ], [ "", "filename" ], [ "", "fileURLToPath" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "file" ], [ "", "readFile" ], [ "", "join" ], [ "", "packageJson" ], [ "", "JSON.parse" ], [ "", "version" ], [ "", "program.name.version.description.requiredOption.option.addOption.addOption.addOption.option" ], [ "", "program.name.version.description.requiredOption.option.addOption.addOption.addOption" ], [ "", "program.name.version.description.requiredOption.option.addOption.addOption" ], [ "", "program.name.version.description.requiredOption.option.addOption" ], [ "", "program.name.version.description.requiredOption.option" ], [ "", "program.name.version.description.requiredOption" ], [ "", "program.name.version.description" ], [ "", "program.name.version" ], [ "", "program.name" ], [ "", "options" ], [ "", "program.opts" ], [ "", "generate" ], [ "", "setupProgram" ], [ "", "./constants.mjs" ], [ "", "./generate.mjs" ], [ "", "commander" ], [ "", "node:fs/promises" ], [ "", "node:path" ], [ "", "node:url" ] ], "mbr": [ "JSON.parse", "Option().choices", "Option().choices().default", "packageJson.version", "program.name", "program.name().version", "program.name().version().description", "program.name().version().description().requiredOption", "program.name().version().description().requiredOption().option", "program.name().version().description().requiredOption().option().addOption", "program.name().version().description().requiredOption().option().addOption().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option().option().option().parse", "program.opts" ], "tgt": [ "Command", "JSON.parse", "Option", "Option().choices", "Option().choices().default", "dirname", "fileURLToPath", "generate", "join", "program.name", "program.name().version", "program.name().version().description", "program.name().version().description().requiredOption", "program.name().version().description().requiredOption().option", "program.name().version().description().requiredOption().option().addOption", "program.name().version().description().requiredOption().option().addOption().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option().option().option", "program.name().version().description().requiredOption().option().addOption().addOption().addOption().option().addOption().option().option().option().addOption().option().option().option().option().parse", "program.opts", "readFile", "setupProgram" ], "funcs": [ [ "setupProgram", 322 ] ], "metrics": { "ast": { "max_depth": 43, "call_count": 39, "node_count": 664, "member_count": 24, "max_array_len": 2, "member_depth_max": 20 }, "file": { "size": 2483, "entropy": 4.83 }, "text": { "lines": 40, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0, "space_count": 395, "char_entropy": 4.83, "unique_chars": 68, "top_char_null": 0, "string_density": 1.35, "top_char_ratio": 0.08, "avg_line_length": 61.08, "max_line_length": 141, "last_line_length": 15, "whitespace_ratio": 0.18, "identifier_density": 1.7, "line_length_stddev": 36.53, "normalized_string_count": 8.54, "normalized_unique_identifiers": 5.07 }, "binds": { "count": 7 }, "binary": { "peak_region_bytes": 2483, "peak_region_entropy": 4.85 }, "source": { "function_count": 1 }, "imports": { "count": 6, "relative": 2, "stdlib_count": 2, "stdlib_ratio": 0.33, "relative_ratio": 0.33, "third_party_count": 4, "third_party_ratio": 0.67 }, "strings": { "bytes": 1176, "count": 54, "avg_length": 21.78, "max_length": 88, "path_count": 3, "avg_entropy": 3.31, "entropy_stddev": 0.76 }, "functions": { "count": 1, "density": 2.5, "code_ratio": 0.78, "avg_name_length": 12, "no_params_count": 1, "avg_length_lines": 31, "max_length_lines": 31, "min_length_lines": 31 }, "identifiers": { "count": 68, "unique": 27, "avg_length": 7.81, "max_length": 17, "min_length": 3, "avg_entropy": 2.65, "reuse_ratio": 0.4, "length_stddev": 3.39, "high_entropy_count": 1, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.63, "all_uppercase_ratio": 0.04, "underscore_prefix_count": 2 } } }, "id": 38, "mol": "H₂(DbF)Md(Pa)", "path": "/Users/t/src/supplychain-attack-data/oss/attacks/openapi-react-query-codegen/samples/openapi-react-query-codegen/during/openapi-react-query-codegen-0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab.tgz!!package/dist/cli.mjs", "pid": 0, "refs": [ { "to": "./constants.mjs", "off": 230, "file": 4, "kind": "local" }, { "to": "./generate.mjs", "off": 274, "file": 34, "kind": "local" } ], "risk": 3, "sha": "4c5ffd62361a0272af29a107d52887d77ccc74cfe6465dc3adb5c4649e36019b", "size": 2483, "traits": [ { "id": "micro-behaviors/fs/file/read::file-read-api-call", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript readFile API" }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "spans": [ [ 0, 20 ] ] }, { "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import", "conf": 0.95, "crit": 2, "desc": "Imports the Node fs/promises API", "spans": [ [ 45, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Invokes zero-argument function at module scope", "spans": [ [ 2467, 15 ] ] } ], "type": "javascript" }, { "id": 42, "mol": "Md", "sha": "28e1e2b58ecd7b73b2f52b09a11ad0c9ee81cc27d25f3247036560359f94ceb5", "path": "@hey-api_openapi-ts@0.99.0.registry.json", "risk": 1, "size": 1033, "type": "registry", "depth": 2 }, { "id": 43, "sha": "b9c3ad3c93c820923fa9ae403c7ea671ec379ce283ca64cfb8ea29171317dd84", "path": "cross-spawn@7.0.6.registry.json", "size": 928, "type": "", "depth": 2 } ], "omitted_files": 34, "v": "8" } }