{
  "ml": {
    "v": "7",
    "id": 1347,
    "lvl": -1,
    "conf": 0,
    "prob": 0.00001582503318786621,
    "type": "github_actions",
    "version": "v18.18",
    "analyzed_at": "2026-09-23T22:28:28Z"
  },
  "path": "sonarqube-scan-action@v8.0.0",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 1848,
        "mol": "K₂(Li₃Te)O₈(As₅C₃CaDyErIS₃Xe)H₉(Cm₄₉Cr₄Db₃₆F₁₆MgOs₁₂Po₂₁TiU₃)Md₅(Bk₉In₁₃Pa₁₁Pt)",
        "pid": 38,
        "rel": "fetched",
        "sha": "57061884dbd4720debb2d5d6d78d98bb5b8c486ad45172fd38bacac99e9af667",
        "via": "https://codeload.github.com/sonarsource/sonarqube-scan-action/tar.gz/v8.0.0",
        "path": "pkg:github/sonarsource/sonarqube-scan-action@v8.0.0",
        "risk": 75,
        "size": 2019685,
        "type": "gz",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 2019685,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 2017280,
              "peak_region_entropy": 7.85
            },
            "consistency": {
              "self_dependency": 0,
              "unused_runtime_deps": 1
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/communications/http/request/get::node-http-client-get",
            "conf": 0.75,
            "crit": 3,
            "desc": "Node HTTP client invokes get()",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/path::test-path-basename",
            "conf": 1.0,
            "crit": 2,
            "desc": "Test path basename",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-runner-os",
            "conf": 0.8,
            "crit": 3,
            "desc": "Reads RUNNER_OS CI variable",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/import/shell/dirname-0-utils/sh::dirname-0-utils/sh",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports $(dirname -- \"$0\")/utils.sh",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/credentials::fetch-credentials-include",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.86,
            "crit": 3,
            "desc": "Fetch sends browser credentials",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "well-known/tool/sysadmin/github-runner::worker",
            "conf": 0.95,
            "crit": 3,
            "desc": "GitHub Actions Runner.Worker identifier",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair",
            "conf": 0.8,
            "crit": 3,
            "desc": "password/passwd key with inline value",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::action-secret-input",
            "conf": 0.95,
            "crit": 3,
            "desc": "Action input references workflow secret"
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::shell-sha256-checksum-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell SHA-256 checksum command",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::semver-class-text",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver SemVer class text",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::is-test",
            "conf": 0.9,
            "crit": 2,
            "desc": "Test, spec, or fixture file",
            "from": [
              {
                "file": 111
              }
            ],
            "uses": [
              121,
              160,
              221,
              397
            ]
          },
          {
            "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment",
            "conf": 0.94,
            "crit": 3,
            "desc": "Assigns character code to array element",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "metadata/file/comment::source-comment-bytes-over-300",
            "conf": 0.92,
            "crit": 2,
            "desc": "Source has over 300 comment bytes",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/attributes::define-property-variable-arguments",
            "conf": 0.92,
            "crit": 3,
            "desc": "Defines an object property using variables",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/configuration::node-http-options-host-port",
            "conf": 0.86,
            "crit": 3,
            "desc": "HTTP options contain hostname and port",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/path::path",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:path",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster",
            "conf": 0.86,
            "crit": 3,
            "desc": "Dense computed-property call cluster (3+)",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-fill-call",
            "conf": 0.8,
            "crit": 3,
            "desc": "JavaScript array fill call",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encoded::base64-token",
            "conf": 0.7,
            "crit": 2,
            "desc": "Calls a Base64 conversion helper",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls a matcher in a conditional expression",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::has-build-script-build",
            "conf": 0.7,
            "crit": 3,
            "desc": "Package declares build script"
          },
          {
            "id": "micro-behaviors/os/env/cicd::github-env-file",
            "conf": 0.85,
            "crit": 3,
            "desc": "GITHUB_ENV environment file",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "DirectoryEntry property write API call",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/custom::fromcharcode-apply-array",
            "atk": "T1140",
            "conf": 0.92,
            "crit": 3,
            "desc": "Converts character-code array to string"
          },
          {
            "id": "metadata/lang/javascript-features::es6-class",
            "conf": 0.9,
            "crit": 2,
            "desc": "ES6 class declaration"
          },
          {
            "id": "micro-behaviors/fs/file/stat::shell-test-directory",
            "conf": 0.9,
            "crit": 2,
            "desc": "Shell tests a path is a directory",
            "from": [
              {
                "file": 20
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/git::github-actions-git-push",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub Actions pushes a git ref"
          },
          {
            "id": "micro-behaviors/data/decode/hex::js-hex-number-parse",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript hex-to-integer conversion",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::javascript-write-then-end-stream",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript writes then ends a stream",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::node-dirent-isdirectory",
            "conf": 0.72,
            "crit": 2,
            "desc": "Checks whether Node.js entries are directories",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member",
            "conf": 0.8,
            "crit": 3,
            "desc": "Reads the Node.js process.platform value",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/build/ci/trigger::scheduled-workflow-trigger",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub scheduled workflow trigger"
          },
          {
            "id": "metadata/import/npm/actions/exec::actions/exec",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/exec",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/file/encoded::embedded-code-candidates-6",
            "conf": 0.8,
            "crit": 3,
            "desc": "Source has 6+ code-like string candidates",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::node-create-restricted-mode",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node creates a path with restricted mode",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/build/bundler/asset::has-sourcemap",
            "conf": 0.9,
            "crit": 2,
            "desc": "Code has source map reference",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/custom::javascript-decode-function",
            "atk": "T1140",
            "conf": 0.9,
            "crit": 3,
            "desc": "Defines a JavaScript decode function",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-bracket-runner",
            "conf": 0.85,
            "crit": 3,
            "desc": "process.env bracket access for runner vars",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/files/runtime::typescript-source-tree-artifact",
            "conf": 0.95,
            "crit": 3,
            "desc": "Source file under src",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/base64::embedded-atob-call-text",
            "conf": 0.9,
            "crit": 3,
            "desc": "Data contains JavaScript atob call",
            "from": [
              {
                "file": 36
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/cookies::same-origin-request-marker",
            "conf": 0.95,
            "crit": 3,
            "desc": "HTTP request enables same-origin credentials"
          },
          {
            "id": "micro-behaviors/time/schedule/interval::repeated-settimeout",
            "conf": 0.9,
            "crit": 3,
            "desc": "Contains at least six setTimeout calls",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/hook/webextension::access-control-allow-origin-header",
            "conf": 0.8,
            "crit": 3,
            "desc": "Access-Control-Allow-Origin header name",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/build/ci/agent::github-actions-runner-image",
            "conf": 0.96,
            "crit": 3,
            "desc": "GitHub Actions runner image configuration",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-data-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream data handler",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/os/wmi/query::cim-instance-cmdlet",
            "conf": 0.8,
            "crit": 3,
            "desc": "Uses Get-CimInstance cmdlet",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/util/types::util/types",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:util/types",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.95,
            "crit": 3,
            "desc": "Encoded URL references MDN documentation",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-401-unauthorized",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP 401 unauthorized response text",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap-sources-content",
            "conf": 0.9,
            "crit": 3,
            "desc": "Source map sourcesContent array",
            "from": [
              {
                "file": 26
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::spec-test-filename",
            "conf": 0.85,
            "crit": 2,
            "desc": "Spec or test filename markers",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::step-token-input-secret-reference",
            "conf": 0.95,
            "crit": 3,
            "desc": "Step token input references an Actions secret"
          },
          {
            "id": "metadata/build/bundler/wrapper::js-tsc-reexport-barrel",
            "conf": 0.96,
            "crit": 2,
            "desc": "Transpiled CommonJS re-export barrel",
            "from": [
              {
                "file": 32
              },
              {
                "off": 1063484,
                "file": 35,
                "line": 30533
              },
              {
                "file": 38
              },
              {
                "off": 3801,
                "file": 40,
                "line": 114
              }
            ],
            "uses": [
              304,
              393
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script",
            "conf": 0.85,
            "crit": 3,
            "desc": "Script sets curl or wget output file",
            "from": [
              {
                "file": 19
              }
            ],
            "uses": [
              230,
              318
            ]
          },
          {
            "id": "micro-behaviors/communications/email/mime::mime-octet-stream",
            "conf": 0.85,
            "crit": 3,
            "desc": "Uses the application/octet-stream MIME type",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/name/convention::npm-has-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "npm manifest declares a package name"
          },
          {
            "id": "micro-behaviors/communications/http/url/build::network-destination-function-binding",
            "mbc": "C0002",
            "conf": 0.94,
            "crit": 3,
            "desc": "Network destination assigned from call",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/testing/scripted::coverage-marker-c8",
            "conf": 1.0,
            "crit": 2,
            "desc": "References the c8 JavaScript coverage tool",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/reverse::split-reverse-join-string",
            "mbc": "C0019",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reverses string with split reverse join"
          },
          {
            "id": "micro-behaviors/data/source/property/read::result-dot-member-read",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads result through dot or arrow access",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-bracket-github",
            "conf": 0.8,
            "crit": 3,
            "desc": "process.env bracket access for github vars",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/ssl::reject-unauthorized-false",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node TLS check disabled by option",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::certificate-ref",
            "conf": 0.5,
            "crit": 2,
            "desc": "References certificate terminology",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "objectives/evasion/masquerade/process/path::path-public-temp-writable",
            "atk": "T1036.005",
            "mbc": "F0004",
            "conf": 0.6,
            "crit": 3,
            "desc": "Public or Temp writable-path marker",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/custom::js-octal-parseint",
            "atk": "T1140",
            "conf": 0.96,
            "crit": 3,
            "desc": "parseInt parses an octal string",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::unzip-tool-reference",
            "conf": 0.7,
            "crit": 3,
            "desc": "References unzip extraction tool",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/data-file::data-file-js-decoder-runtime",
            "atk": "T1027",
            "mbc": "F0001",
            "conf": 0.88,
            "crit": 3,
            "desc": "JavaScript decoder runtime in data",
            "from": [
              {
                "file": 31
              }
            ]
          },
          {
            "id": "metadata/import/npm/zlib::zlib",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports node:zlib",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy",
            "conf": 0.8,
            "crit": 2,
            "desc": "Copies one indexed array element to another",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/entrypoint::main-runtime-tree-entrypoint",
            "conf": 0.85,
            "crit": 2,
            "desc": "Package main targets runtime tree"
          },
          {
            "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter",
            "atk": "T1059",
            "mbc": "B0030",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package script invokes a language interpreter"
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::js-exec-call",
            "conf": 1.0,
            "crit": 1,
            "desc": "Calls a function named exec",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/tasking::http-task-liveness-field",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Structured object contains a liveness field",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/module/require::cjs-require-in-try",
            "conf": 0.9,
            "crit": 3,
            "desc": "CommonJS require inside a try block",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/body::request-body-property-access",
            "conf": 0.84,
            "crit": 3,
            "desc": "Accesses a request body property"
          },
          {
            "id": "metadata/import/npm/async_hooks::async_hooks",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:async_hooks",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/ipc/message::postmessage-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Sends data with window or worker postMessage",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/route::javascript-get-route-condition-cluster",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.94,
            "crit": 3,
            "desc": "Server defines several HTTP GET routes",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-versions",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP protocol version strings",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-staging-path",
            "atk": "T1105",
            "conf": 0.82,
            "crit": 3,
            "desc": "References curl writing to an output path",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::tests-path-filename",
            "conf": 0.85,
            "crit": 2,
            "desc": "File path or name indicates test code",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/stream::adodb-fragment-adod",
            "conf": 0.85,
            "crit": 3,
            "desc": "Obfuscated ADODB fragment \"ADOD\"",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::ssl-certs-path",
            "conf": 0.8,
            "crit": 2,
            "desc": "References the system TLS certificate directory",
            "from": [
              {
                "file": 22
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::github-token-secret",
            "conf": 0.88,
            "crit": 3,
            "desc": "References Actions-provided GITHUB_TOKEN",
            "from": [
              {
                "file": 60
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/user-agent::ua-curl",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.5,
            "crit": 3,
            "desc": "curl User-Agent",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/read::process-env",
            "conf": 0.8,
            "crit": 2,
            "desc": "Node process.env access",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::curl-wget-argv",
            "atk": "T1105",
            "conf": 0.88,
            "crit": 3,
            "desc": "Curl or wget argv invocation",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/body::request-end-call",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.72,
            "crit": 3,
            "desc": "Ends a request-like object with .end()",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/hook/webextension::dnr-referer-header",
            "conf": 0.8,
            "crit": 3,
            "desc": "DNR rule names Referer header",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/content-type::application-json",
            "conf": 0.65,
            "crit": 3,
            "desc": "References the application/json media type",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call",
            "conf": 0.84,
            "crit": 3,
            "desc": "Calls Node.js synchronous directory enumeration",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/query::js-urlsearchparams-construction",
            "conf": 0.95,
            "crit": 3,
            "desc": "Builds URL query parameters",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::js-fs-write-sync",
            "conf": 1.0,
            "crit": 3,
            "desc": "Writes file via Node.js fs",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::node-write-file-sync",
            "conf": 1.0,
            "crit": 3,
            "desc": "Node synchronously writes a file",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/run-sonar-scanner::relative/1/run-sonar-scanner",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./run-sonar-scanner",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::shell-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "POSIX shell script extension",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/base64::tostring-base64",
            "conf": 0.8,
            "crit": 3,
            "desc": "Base64 encoding via toString (JS)",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/request::request-network-target-field",
            "conf": 0.9,
            "crit": 3,
            "desc": "HTTP request selects a network target",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/telemetry/logging/warning::node-process-emit-warning",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node.js process emit-warning call"
          },
          {
            "id": "metadata/package/documentation/agent-safety::security-markdown-basename",
            "conf": 0.94,
            "crit": 3,
            "desc": "Security documentation markdown file",
            "from": [
              {
                "file": 58
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::command-run-instruction",
            "conf": 0.84,
            "crit": 3,
            "desc": "Command execution help instruction",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::source-curl-output-option",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl output file source",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-rest-json-accept-header",
            "conf": 0.95,
            "crit": 3,
            "desc": "GitHub REST JSON API Accept header",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/package/files/runtime::javascript-dist-tree-artifact",
            "conf": 0.95,
            "crit": 3,
            "desc": "JavaScript/TypeScript file under dist",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/schema-object::result-field-key",
            "conf": 0.9,
            "crit": 1,
            "desc": "JSON-like object result field",
            "from": [
              {
                "file": 116
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/fragment::location-hash-read",
            "conf": 0.85,
            "crit": 3,
            "desc": "Reads the URL fragment from location.hash",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::github-path-file",
            "conf": 0.85,
            "crit": 3,
            "desc": "GITHUB_PATH environment file",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/fs::fs",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports node:fs",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/npm/worker_threads::worker_threads",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:worker_threads",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::has-build-script-1",
            "conf": 1.0,
            "crit": 3,
            "desc": "Package has compiled build script",
            "from": [
              {
                "file": 23
              }
            ]
          },
          {
            "id": "metadata/import/npm/buffer::buffer",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports node:buffer",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.72,
            "crit": 3,
            "desc": "HTTP Bearer authorization header prefix",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::x509-string",
            "conf": 0.6,
            "crit": 2,
            "desc": "References X.509 certificate terminology",
            "from": [
              {
                "file": 110
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.85,
            "crit": 3,
            "desc": "Shell lists architecture selector names",
            "from": [
              {
                "file": 21
              }
            ],
            "uses": [
              255
            ]
          },
          {
            "id": "objectives/evasion/masquerade/traffic::browser-html-accept-header",
            "atk": "T1071.001",
            "mbc": "B0030",
            "conf": 0.8,
            "crit": 3,
            "desc": "Browser HTML Accept header literal",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/content::batch-command-extension-literal",
            "conf": 0.95,
            "crit": 3,
            "desc": "Batch or command file extension literal",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::command-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Command field or assignment key",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/stat::shell-test-writable",
            "conf": 0.9,
            "crit": 2,
            "desc": "Shell tests a path is writable",
            "from": [
              {
                "file": 20
              }
            ]
          },
          {
            "id": "metadata/import/npm/child_process::child_process",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports child_process",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/identity::result-code-script-property",
            "conf": 0.82,
            "crit": 3,
            "desc": "Reads a result or response code field",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/file/policy/config/identity::android-build-context",
            "conf": 0.85,
            "crit": 3,
            "desc": "Android build or manifest context",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::test-basename-pattern",
            "conf": 1.0,
            "crit": 2,
            "desc": "Node.js test filename pattern",
            "from": [
              {
                "file": 9
              },
              {
                "file": 10
              },
              {
                "file": 12
              },
              {
                "file": 13
              },
              {
                "file": 16
              }
            ],
            "uses": [
              296
            ]
          },
          {
            "id": "micro-behaviors/communications/http/cookie-store::cookie-helper-set-function",
            "atk": "T1539",
            "mbc": "C0002",
            "conf": 1.0,
            "crit": 3,
            "desc": "Defines setCookie helper",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/util::util",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:util",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/websocket::websocket-lower",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.5,
            "crit": 3,
            "desc": "References the lowercase websocket keyword",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/body::request-write-raw-data-variable",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.84,
            "crit": 3,
            "desc": "HTTP request writes a raw data variable",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/json::json-stringify-identifier",
            "conf": 0.85,
            "crit": 3,
            "desc": "Serializes an identifier as JSON",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::checkout-persisted-credentials",
            "conf": 0.96,
            "crit": 3,
            "desc": "Checkout persists Git credentials on disk"
          },
          {
            "id": "micro-behaviors/fs/delete/file/command::delete-rm-hardcoded",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.66,
            "crit": 3,
            "desc": "Deletes files in /tmp, /var/tmp, or /dev",
            "from": [
              {
                "file": 22
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/install-sonar-scanner::relative/1/install-sonar-scanner",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./install-sonar-scanner",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/build/ci/permission::job-contents-write-permission",
            "conf": 0.92,
            "crit": 3,
            "desc": "Job grants contents write permission"
          },
          {
            "id": "micro-behaviors/data/compress/zlib::node-zlib-import",
            "conf": 0.9,
            "crit": 3,
            "desc": "Imports the Node.js zlib module",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::result-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Result field or assignment key",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/hex::js-parseint-radix-16",
            "conf": 0.85,
            "crit": 3,
            "desc": "JavaScript parseInt with radix 16",
            "from": [
              {
                "file": 36
              }
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-code-fr",
            "conf": 0.97,
            "crit": 2,
            "desc": "French UI language code",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/file/string/credential::uppercase-password-identifier",
            "conf": 0.45,
            "crit": 3,
            "desc": "Uppercase identifier contains PASSWORD or PASS",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-variable-in-filename",
            "conf": 0.9,
            "crit": 3,
            "desc": "Arch variable spliced into a filename",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::commonjs-require-barrel-exports",
            "conf": 0.9,
            "crit": 3,
            "desc": "CommonJS exports object of relative require()s"
          },
          {
            "id": "micro-behaviors/data/encode/char-code::long-numeric-array-literal",
            "conf": 0.9,
            "crit": 1,
            "desc": "Long numeric array literal",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/file/library::js-repeated-unlink-call",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.6,
            "crit": 3,
            "desc": "Repeated Node unlink calls",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-version-access",
            "conf": 0.72,
            "crit": 3,
            "desc": "Reads Node.js version through process.version",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/archive::windows-archive-path",
            "conf": 0.86,
            "crit": 3,
            "desc": "Windows archive file path",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/mem/alloc/heap::megabyte-buffer-allocation",
            "conf": 0.86,
            "crit": 3,
            "desc": "Source allocates a megabyte-sized buffer",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/arithmetic::source-xor-operation",
            "conf": 1.0,
            "crit": 3,
            "desc": "Source references XOR syntax",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multi-arch-target",
            "conf": 0.85,
            "crit": 3,
            "desc": "Script references multiple CPU architectures",
            "from": [
              {
                "file": 21
              }
            ],
            "uses": [
              204,
              414
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/command-network-surface::js-many-shell-command-strings",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.86,
            "crit": 3,
            "desc": "Many shell command strings in JavaScript",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/command-and-control/channel/covert::port-443-constant-assignment",
            "atk": "T1573,T1043",
            "mbc": "C0022.002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Assigns 443 to a port variable",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/computed::js-nested-concat-this-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "Nested this-concat calls a computed member",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/replace::chained-replace-calls",
            "conf": 0.9,
            "crit": 3,
            "desc": "Chains multiple JavaScript string replacements",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/file/naming::sequential-identifiers",
            "conf": 0.8,
            "crit": 2,
            "desc": "Sequential source identifier names",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/build::package-manager-install-argv",
            "atk": "T1059",
            "conf": 0.94,
            "crit": 1,
            "desc": "Package-manager install argument vector",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/construct::invocation-root-path-join",
            "conf": 0.9,
            "crit": 3,
            "desc": "Builds a path under the invocation directory",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/lockfile::resolved-repository-path",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Lockfile resolves under a repository path"
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::subshell-curl",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl invoked inside command substitution",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-3f",
            "mbc": "B0032",
            "conf": 0.5,
            "crit": 3,
            "desc": "0x3f hex byte token",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/json::json-stringify-call",
            "conf": 0.5,
            "crit": 2,
            "desc": "Calls JSON.stringify()",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/import/npm/assert/strict::assert/strict",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:assert/strict",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/flags::code-powershell-noninteractive-options",
            "conf": 0.96,
            "crit": 3,
            "desc": "Code invokes noninteractive PowerShell",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format",
            "conf": 0.9,
            "crit": 3,
            "desc": "Code formats a zero-padded integer",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::wpt-security-features-resource",
            "conf": 0.9,
            "crit": 2,
            "desc": "WPT security-features resource helper",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::test-basename-path",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 1.0,
            "crit": 3,
            "desc": "Test file path or basename",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::module-scope-zero-arg-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Module scope assigns zero-argument call",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/import/npm/http::http",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports http",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::authorization-header-index-assignment",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.88,
            "crit": 3,
            "desc": "Authorization header property assignment",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::stream-write-buffer-arg",
            "conf": 0.9,
            "crit": 3,
            "desc": "Writes a buffer argument to a stream",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/dns::dns",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports node:dns",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/websocket::websocket-class",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.5,
            "crit": 3,
            "desc": "WebSocket class reference",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::getExecOutput",
            "atk": "T1059",
            "conf": 0.8,
            "crit": 3,
            "desc": "Node.js exec output capture (GitHub Actions)",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Auth-like constant assignment",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/mock-fs::mock-fs",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports mock-fs",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent",
            "atk": "T1105",
            "conf": 0.92,
            "crit": 3,
            "desc": "curl command uses silent or fail flags",
            "from": [
              {
                "off": 911,
                "file": 18,
                "line": 23
              },
              {
                "off": 1557,
                "file": 19,
                "line": 57
              }
            ],
            "uses": [
              216,
              231
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/integer-codec::uint16-be-buffer-write",
            "conf": 0.85,
            "crit": 3,
            "desc": "Writes 16-bit big-endian buffer value",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/wasm::webassembly-instantiate",
            "conf": 0.85,
            "crit": 3,
            "desc": "Instantiates a WebAssembly module",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::child-process-exec",
            "atk": "T1059",
            "mbc": "C0017",
            "conf": 0.85,
            "crit": 3,
            "desc": "Node.js child_process execution",
            "from": [
              {
                "off": 1050052,
                "file": 35,
                "line": 30126
              },
              {
                "off": 1049931,
                "file": 45,
                "line": 30124
              }
            ],
            "uses": [
              169
            ]
          },
          {
            "id": "micro-behaviors/data/decode/base64::base64-decode-call-text",
            "conf": 0.86,
            "crit": 3,
            "desc": "JavaScript invokes a Base64 decoder",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff",
            "mbc": "B0032",
            "conf": 0.5,
            "crit": 3,
            "desc": "0xff hex byte token",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/location::node-homedir-hidden-entry",
            "conf": 0.92,
            "crit": 3,
            "desc": "Node builds a hidden home-directory path",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/guard::node-temp-exec-benign-context",
            "conf": 0.9,
            "crit": 1,
            "desc": "Benign Node temp execution context",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              1,
              10,
              50,
              80,
              121,
              190,
              206,
              221,
              235,
              238,
              282,
              285,
              296,
              321,
              374,
              397,
              411,
              412,
              429,
              433,
              480
            ]
          },
          {
            "id": "micro-behaviors/data/decode/symbol-base64::atob-decode",
            "conf": 0.9,
            "crit": 3,
            "desc": "Decodes Base64 data with JavaScript atob()",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/time/query::js-triple-date-now",
            "conf": 0.4,
            "crit": 3,
            "desc": "3+ Date.now() calls",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/temp::unix-temp",
            "conf": 0.7,
            "crit": 2,
            "desc": "Unix /tmp/ path reference",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "metadata/import/npm/string_decoder::string_decoder",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports string_decoder",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/build/minifier::js-large-minified-bundle",
            "conf": 0.92,
            "crit": 2,
            "desc": "Large minified JavaScript bundle",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program",
            "conf": 0.82,
            "crit": 3,
            "desc": "Node spawns a variable program path",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/reference::javascript-comment-url-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript comment contains a URL",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap",
            "conf": 1.0,
            "crit": 3,
            "desc": "JavaScript source map",
            "from": [
              {
                "file": 26
              }
            ]
          },
          {
            "id": "metadata/lang/encoded/unicode-escape::shell-interpreter-powershell",
            "conf": 0.95,
            "crit": 3,
            "desc": "powershell marker encoded",
            "from": [
              {
                "file": 28
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::range-testset-helper",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver range testSet helper",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/scripted::after-each-call",
            "conf": 0.6,
            "crit": 3,
            "desc": "afterEach hook",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "metadata/build/minifier::js-min-or-map-basename",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript minified or map basename"
          },
          {
            "id": "micro-behaviors/process/create/exec::cmd-exe-reference",
            "conf": 0.8,
            "crit": 3,
            "desc": "References Windows cmd.exe interpreter",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/require::decode-named-function-decl",
            "atk": "T1059.007",
            "mbc": "B0024",
            "conf": 0.5,
            "crit": 3,
            "desc": "Function whose name contains Decode",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::sh-runner-os",
            "conf": 0.8,
            "crit": 3,
            "desc": "$RUNNER_OS shell environment access",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls a computed this method",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/build/ecosystem::artifact-integrity-verification-routine",
            "conf": 0.95,
            "crit": 3,
            "desc": "Checks artifact integrity before use",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell evaluates variable command",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl or wget references shell variable",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/file/comment::source-comment-bytes-over-20000",
            "conf": 0.9,
            "crit": 3,
            "desc": "Source has over 20000 comment bytes",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/name/vocabulary::npm-hyphenated-multiword-name",
            "conf": 0.7,
            "crit": 2,
            "desc": "npm hyphenated multiword name"
          },
          {
            "id": "micro-behaviors/communications/http/request/verb::http-post-method-condition",
            "conf": 0.95,
            "crit": 3,
            "desc": "Checks for an HTTP POST method",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/url::archive-url-reference-text",
            "conf": 0.88,
            "crit": 3,
            "desc": "References an HTTP(S) archive URL in text",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/build/bundler/javascript-bundle-markers::js-multi-line-blob-recognized-text",
            "conf": 0.95,
            "crit": 1,
            "desc": "Text tokens identify a normal JavaScript bundle blob",
            "from": [
              {
                "file": 35
              },
              {
                "file": 38
              },
              {
                "file": 40
              },
              {
                "file": 45
              }
            ],
            "uses": [
              18
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-x86",
            "conf": 1.0,
            "crit": 1,
            "desc": "x86 architecture string",
            "from": [
              {
                "file": 21
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/content-type::content-type-header",
            "conf": 0.5,
            "crit": 3,
            "desc": "References an HTTP Content-Type header",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::mocha-describe-call",
            "conf": 0.6,
            "crit": 2,
            "desc": "Mocha describe() call",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call",
            "conf": 0.95,
            "crit": 3,
            "desc": "Invokes preserved console method with arguments",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/time/query::js-triple-new-date",
            "conf": 0.4,
            "crit": 3,
            "desc": "3+ new Date() calls",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/lang/source::js-ts-source-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "JavaScript or TypeScript source filename",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/import/npm/string-argv::string-argv",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports string-argv",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/import/npm/stream/web::stream/web",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports stream/web",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "metadata/import/npm/events::events",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports events",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/base64::node-buffer-base64-encode",
            "mbc": "C0026",
            "conf": 0.95,
            "crit": 3,
            "desc": "Encodes Node.js Buffer output as Base64",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::object-exec-method-call",
            "atk": "T1059",
            "conf": 1.0,
            "crit": 1,
            "desc": "Calls an object exec method",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/file/string/count::few-string-literals",
            "conf": 0.4,
            "crit": 3,
            "desc": "File has very few string literals"
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::curl-command-call",
            "atk": "T1105",
            "conf": 0.96,
            "crit": 3,
            "desc": "Shell invokes the curl command",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation",
            "atk": "T1059.001,T1059.003",
            "conf": 0.94,
            "crit": 3,
            "desc": "Windows shell command-mode invocation syntax",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/assert::assert",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports assert",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/content-length::raw-content-length-header",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Sets an HTTP Content-Length header",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/lang/encoded/unicode-escape::shell-interpreter-encoded",
            "conf": 0.9,
            "crit": 3,
            "desc": "Encoded shell interpreter (unicode escapes)",
            "from": [
              {
                "file": 28
              },
              {
                "file": 36
              }
            ],
            "uses": [
              188,
              316
            ]
          },
          {
            "id": "metadata/package/testing/scripted::js-bdd-suite",
            "conf": 0.85,
            "crit": 2,
            "desc": "JavaScript BDD test suite",
            "from": [
              {
                "off": 2328,
                "file": 9,
                "line": 65
              },
              {
                "off": 2255,
                "file": 10,
                "line": 83
              },
              {
                "off": 3868,
                "file": 12,
                "line": 127
              },
              {
                "off": 1827,
                "file": 13,
                "line": 56
              },
              {
                "file": 16
              }
            ],
            "uses": [
              235,
              429
            ]
          },
          {
            "id": "micro-behaviors/process/user/query::os-homedir-call",
            "atk": "T1033",
            "conf": 0.7,
            "crit": 3,
            "desc": "os.homedir() user home directory",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::mkdir-command",
            "conf": 0.8,
            "crit": 3,
            "desc": "Shell invokes mkdir command",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/process/user/query::node-os-alias-homedir-call",
            "atk": "T1033",
            "conf": 0.8,
            "crit": 3,
            "desc": "Node os-alias home directory query",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-release-api",
            "conf": 0.6,
            "crit": 3,
            "desc": "GitHub REST releases endpoint",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/keywords::download-status-msg",
            "conf": 0.8,
            "crit": 3,
            "desc": "Download status message",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/post::url-encoded-content-type",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Uses URL-encoded HTTP form content",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/timers::timers",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports timers",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-command-position-script",
            "conf": 0.9,
            "crit": 1,
            "desc": "curl/wget in shell command position",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-text",
            "atk": "T1105",
            "conf": 0.86,
            "crit": 3,
            "desc": "curl text contains silent or fail flags",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::openssl-self-signed-cert",
            "atk": "T1587.003",
            "conf": 0.85,
            "crit": 3,
            "desc": "Generates self-signed TLS certificate",
            "from": [
              {
                "file": 110
              }
            ]
          },
          {
            "id": "metadata/package/scripts/develop::has-test-script",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json declares a test script"
          },
          {
            "id": "micro-behaviors/communications/http/request/json::module-execution-http-call",
            "conf": 0.95,
            "crit": 3,
            "desc": "Module initialization calls an HTTP client"
          },
          {
            "id": "metadata/package/testing/scripted::js-bdd-describe-text",
            "conf": 0.75,
            "crit": 2,
            "desc": "JavaScript describe() test call",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Invokes zero-argument function at module scope",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/package/license::mit-license-grant-text",
            "conf": 0.9,
            "crit": 2,
            "desc": "MIT license permission grant sentence",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::pkg-build-or-test-helper-script",
            "conf": 0.95,
            "crit": 2,
            "desc": "Packaging build or test helper script",
            "from": [
              {
                "file": 1
              },
              {
                "file": 2
              },
              {
                "file": 111
              },
              {
                "file": 114
              },
              {
                "file": 115
              }
            ],
            "uses": [
              411
            ]
          },
          {
            "id": "metadata/file/string/telemetry::platform-profile-field",
            "conf": 0.95,
            "crit": 3,
            "desc": "Platform profile field name",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url",
            "conf": 0.75,
            "crit": 3,
            "desc": "Contains a hardcoded remote HTTP(S) URL",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/redirect::shell-file-write-command",
            "conf": 0.86,
            "crit": 3,
            "desc": "Shell command redirects output to file",
            "from": [
              {
                "off": 981,
                "file": 22,
                "line": 24
              },
              {
                "file": 46
              },
              {
                "file": 48
              },
              {
                "file": 55
              },
              {
                "file": 60
              },
              {
                "file": 63
              },
              {
                "file": 68
              },
              {
                "file": 74
              }
            ],
            "uses": [
              426
            ]
          },
          {
            "id": "micro-behaviors/communications/http/upload::form-data-append",
            "conf": 0.7,
            "crit": 3,
            "desc": "Appends data to FormData",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read",
            "conf": 0.8,
            "crit": 2,
            "desc": "Reads an array element into a variable",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source",
            "conf": 1.0,
            "crit": 3,
            "desc": "Source contains low-bit mask syntax",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Sorts a JavaScript array",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/workers::worker-threads-import",
            "atk": "T1059.007",
            "mbc": "C0017",
            "conf": 0.85,
            "crit": 3,
            "desc": "Imports worker_threads module",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Joins array with a short delimiter",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/data/format/string::source-bytes-equals-literal",
            "conf": 0.94,
            "crit": 3,
            "desc": "Source contains a bytes= string literal",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/actions/tool-cache::actions/tool-cache",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/tool-cache",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/alloc::node-buffer-tostring-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Converts Node.js Buffer output to text",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/object::js-deserialise",
            "conf": 0.85,
            "crit": 3,
            "desc": "References a deserialization-related symbol",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/builtin::import-dns",
            "conf": 0.8,
            "crit": 3,
            "desc": "ESM import of the Node.js dns module",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/documentation/security-advisory::ghsa-identifier",
            "conf": 0.92,
            "crit": 3,
            "desc": "References a GitHub Security Advisory identifier",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/build/ci/github-actions::action-runtime-env-docs",
            "conf": 0.94,
            "crit": 3,
            "desc": "GitHub Actions runtime env docs",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--x86-or-mips",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.85,
            "crit": 1,
            "desc": "Shell x86 or MIPS architecture selector",
            "from": [
              {
                "file": 21
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/host::url-host-property-assignment",
            "conf": 0.82,
            "crit": 3,
            "desc": "Assigns a request or URL host property",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/utils::relative/1/utils",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./utils",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/import/npm/http2::http2",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports node:http2",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/documentation/source::readme-markdown-basename",
            "conf": 0.99,
            "crit": 2,
            "desc": "README Markdown basename",
            "from": [
              {
                "file": 59
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-invoke",
            "conf": 0.86,
            "crit": 3,
            "desc": "Immediately invokes a synchronous function",
            "from": [
              {
                "file": 35
              }
            ],
            "uses": [
              440,
              498
            ]
          },
          {
            "id": "metadata/file/encoded::large-base64-like-literal",
            "conf": 0.8,
            "crit": 3,
            "desc": "Large Base64-like string literal",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/variable-spawn::spawn-destination-variable",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node spawns destination path variable",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/replace::keyed-replacement-call",
            "conf": 0.96,
            "crit": 3,
            "desc": "Replaces text using a keyed replacement table",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::node-chmod-call",
            "conf": 0.85,
            "crit": 3,
            "desc": "Node calls chmod to change permissions",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/build/ci/permission::id-token-write-permission",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub Actions OIDC write permission",
            "from": [
              {
                "file": 67
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/symbol-base64::buffer-from-base64",
            "conf": 0.8,
            "crit": 3,
            "desc": "Base64 decoding via Buffer.from (JS)",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/perf_hooks::perf_hooks",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:perf_hooks",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::write-file-sync",
            "conf": 0.95,
            "crit": 3,
            "desc": "Node fs writes to a file synchronously",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::node-child-process-capability",
            "conf": 0.8,
            "crit": 3,
            "desc": "Imports or invokes Node.js child-process APIs",
            "from": [
              {
                "off": 788,
                "file": 27,
                "line": 32
              },
              {
                "off": 383,
                "file": 30,
                "line": 5
              },
              {
                "off": 1409,
                "file": 35,
                "line": 37
              },
              {
                "off": 997,
                "file": 40,
                "line": 28
              },
              {
                "off": 1348,
                "file": 45,
                "line": 36
              }
            ],
            "uses": [
              118
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/sanity-checks::relative/1/sanity-checks",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./sanity-checks",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/read::repeated-constructor-property-read",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads constructor properties repeatedly",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript silently discards caught errors"
          },
          {
            "id": "micro-behaviors/communications/http/webdav::propfind-method",
            "conf": 0.95,
            "crit": 3,
            "desc": "References the WebDAV PROPFIND method",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/random/crypto::webcrypto-random-uuid",
            "conf": 0.72,
            "crit": 3,
            "desc": "Generates UUID with Web Crypto",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/external/github::github-release-api-latest",
            "atk": "T1105",
            "conf": 0.84,
            "crit": 3,
            "desc": "GitHub latest release API template",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::server-response-send-end",
            "mbc": "C0002",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls server response send/end method",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/files/runtime::javascript-utils-basename",
            "conf": 0.85,
            "crit": 3,
            "desc": "JavaScript utils.js basename",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/websocket::websocket-subprotocol-header",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "WebSocket subprotocol header",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/navigation::js-url-host-read",
            "conf": 0.8,
            "crit": 3,
            "desc": "Reads hostname from URL variable",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/unix-utils::jq-processing",
            "conf": 1.0,
            "crit": 2,
            "desc": "Uses jq for JSON processing",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::process-stdout-data-listener",
            "conf": 0.9,
            "crit": 3,
            "desc": "Registers a process stdout data listener",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::any-test-presence-marker",
            "conf": 0.5,
            "crit": 2,
            "desc": "Package carries a test file, directory or harness import",
            "from": [
              {
                "file": 111
              }
            ],
            "uses": [
              397
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-darwin-check",
            "conf": 0.6,
            "crit": 2,
            "desc": "process.platform macOS check",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "metadata/build/bundler/asset::js-any-bundle-output",
            "conf": 0.95,
            "crit": 2,
            "desc": "Contains bundled or minified JavaScript",
            "from": [
              {
                "file": 32
              },
              {
                "file": 35
              },
              {
                "file": 37
              },
              {
                "file": 40
              },
              {
                "file": 42
              },
              {
                "file": 45
              }
            ],
            "uses": [
              184,
              373
            ]
          },
          {
            "id": "metadata/package/testing/http-fixtures::http-request-known-source-file",
            "conf": 0.99,
            "crit": 2,
            "desc": "File belongs to a known HTTP library or test suite",
            "from": [
              {
                "file": 1
              },
              {
                "file": 2
              },
              {
                "file": 111
              },
              {
                "file": 114
              },
              {
                "file": 115
              }
            ],
            "uses": [
              411
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "Calls JavaScript toString conversion method",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/process/hook/webextension::access-control-allow-headers-header",
            "conf": 0.8,
            "crit": 3,
            "desc": "Access-Control-Allow-Headers header name",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/file/line::file-has-30-plus-lines",
            "conf": 0.9,
            "crit": 2,
            "desc": "File has 30 or more lines",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-code-en",
            "conf": 0.97,
            "crit": 2,
            "desc": "English UI language code",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/system::windows-common-data-tree-path",
            "conf": 0.78,
            "crit": 3,
            "desc": "Windows ProgramData/Users/inetpub path",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::unzip-archive-to-directory--rx-1",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.86,
            "crit": 3,
            "desc": "Regex component marker",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/package/empty::npm-no-keywords",
            "conf": 0.5,
            "crit": 2,
            "desc": "package.json has no keywords"
          },
          {
            "id": "metadata/build/ci/gate::same-repository-pr-head-gate",
            "conf": 0.95,
            "crit": 3,
            "desc": "PR target job requires same repository head"
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-darwin-branch",
            "conf": 0.7,
            "crit": 2,
            "desc": "Branches on macOS platform value",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::child-process-require",
            "atk": "T1059",
            "mbc": "C0017",
            "conf": 0.8,
            "crit": 3,
            "desc": "Imports the Node.js child_process module",
            "from": [
              {
                "file": 30
              },
              {
                "file": 35
              },
              {
                "file": 40
              },
              {
                "file": 45
              }
            ],
            "uses": [
              399
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::test-basename-suffix",
            "conf": 1.0,
            "crit": 2,
            "desc": "Node.js test filename suffix",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/ipc/message::js-message-event-listener",
            "conf": 0.85,
            "crit": 3,
            "desc": "Registers an event listener for message events",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-method-call",
            "conf": 0.75,
            "crit": 3,
            "desc": "Calls a Node OS platform method",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::step-environment-secret-reference",
            "conf": 0.95,
            "crit": 3,
            "desc": "Step environment references an Actions secret"
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript iterates enumerable object keys",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find",
            "conf": 0.85,
            "crit": 2,
            "desc": "Traverses directories using common APIs",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/archive::unix-temp-archive-path",
            "conf": 0.86,
            "crit": 3,
            "desc": "Unix temporary archive path",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/alloc::buffer-from-utf8",
            "conf": 0.9,
            "crit": 3,
            "desc": "Creates Node.js Buffer from UTF-8 text",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/build/bundler/wrapper::js-tsc-reexport-getter",
            "conf": 0.97,
            "crit": 2,
            "desc": "Transpiled re-export getter (tsc/babel barrel)",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/array::js-string-split",
            "conf": 0.6,
            "crit": 3,
            "desc": "Split to empty-delimiter char array",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/error-handling::try-block-open",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains the opening of a try block",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stdout-reference",
            "conf": 0.8,
            "crit": 3,
            "desc": "References Node.js stdout stream",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/connect::net-connect",
            "conf": 0.86,
            "crit": 3,
            "desc": "Node net.connect or createConnection usage",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::silent-getexecoutput-text",
            "atk": "T1059",
            "conf": 0.85,
            "crit": 3,
            "desc": "Silenced output-capturing exec call",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/os::os",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports node:os",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/alloc::buffer-from-call",
            "conf": 0.4,
            "crit": 3,
            "desc": "Calls Buffer.from at least three times",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path",
            "from": [
              {
                "file": 60
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::powershell-expand-archive-text",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.85,
            "crit": 3,
            "desc": "References PowerShell Expand-Archive cmdlet",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/binary::buffer-slice-call-name",
            "conf": 0.9,
            "crit": 1,
            "desc": "slice method call name",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-cmd",
            "atk": "T1105",
            "conf": 0.7,
            "crit": 2,
            "desc": "curl command includes URL or option",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/lang/encoded/unicode-escape::shell-interpreter-cmd",
            "conf": 0.95,
            "crit": 3,
            "desc": "cmd interpreter marker encoded",
            "from": [
              {
                "file": 28
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::recursive-mkdir-sync",
            "conf": 0.9,
            "crit": 3,
            "desc": "Creates a directory tree synchronously",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-option-script",
            "conf": 0.85,
            "crit": 3,
            "desc": "curl/wget text includes output option",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/import/npm/crypto::crypto",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports crypto",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::mocha-test-file",
            "conf": 0.9,
            "crit": 2,
            "desc": "Mocha test file",
            "from": [
              {
                "file": 9
              },
              {
                "file": 10
              },
              {
                "file": 11
              },
              {
                "file": 12
              },
              {
                "file": 13
              },
              {
                "file": 16
              }
            ],
            "uses": [
              206,
              433
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-arm",
            "conf": 0.94,
            "crit": 1,
            "desc": "x86 or ARM architecture reference",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix",
            "conf": 0.55,
            "crit": 3,
            "desc": "Gmail consumer email domain suffix",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/directory::fs-rm-recursive",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.8,
            "crit": 3,
            "desc": "Node.js fs.rm with recursive option",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-api-host",
            "conf": 0.86,
            "crit": 3,
            "desc": "GitHub API host reference",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/runtime::homedir-literal",
            "atk": "T1195.002",
            "conf": 0.8,
            "crit": 3,
            "desc": "homedir string literal",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop",
            "conf": 0.8,
            "crit": 3,
            "desc": "Loop XORs through modulo-indexed accumulator",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/base64::base64-typed-array-reconstruction",
            "conf": 0.96,
            "crit": 3,
            "desc": "Rebuilds Base64 data as typed bytes",
            "from": [
              {
                "file": 40
              }
            ],
            "uses": [
              11,
              176,
              331
            ]
          },
          {
            "id": "objectives/command-and-control/beacon/network/json::base64-chunk-word",
            "atk": "T1071.001",
            "mbc": "B0030",
            "conf": 0.9,
            "crit": 3,
            "desc": "Base64 chunk sizing word",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "well-known/lib/network/public-suffix-list::psl-github-io",
            "conf": 0.9,
            "crit": 3,
            "desc": "Public suffix github.io",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/alloc::uint8array-constructor",
            "conf": 0.9,
            "crit": 2,
            "desc": "Constructs a Uint8Array buffer"
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-empty-module-exports",
            "conf": 0.8,
            "crit": 3,
            "desc": "CommonJS module exports an empty object",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/asymmetric/signature::signable-artifact-name",
            "conf": 0.95,
            "crit": 3,
            "desc": "Checksum manifest or detached signature filename",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/link/symlink::readlink",
            "conf": 0.8,
            "crit": 3,
            "desc": "Read symbolic link target path",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/versioning/scheme::npm-has-version",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package version"
          },
          {
            "id": "metadata/build/ci/step::actions-setup-node",
            "conf": 0.92,
            "crit": 3,
            "desc": "actions/setup-node workflow step"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-while-switch-loop",
            "conf": 0.95,
            "crit": 3,
            "desc": "JavaScript while loop contains switch dispatch"
          },
          {
            "id": "micro-behaviors/os/module/require::esm-side-effect-package-import",
            "conf": 0.9,
            "crit": 3,
            "desc": "ESM side-effect-only package import",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/process/fd/stdio::stdin-string",
            "conf": 0.3,
            "crit": 2,
            "desc": "References standard input name (stdin)",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "objectives/execution/automation/agent::vulnerability-state-marker-vulnerable",
            "atk": "T1059,T1190,T1595",
            "conf": 0.82,
            "crit": 3,
            "desc": "Vulnerable or CVE state marker",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::github-actions-oidc-token-request-env",
            "conf": 0.96,
            "crit": 3,
            "desc": "Actions OIDC token request env vars",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::semver-class",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver SemVer class module",
            "from": [
              {
                "file": 29
              },
              {
                "off": 13115,
                "file": 30,
                "line": 414
              }
            ],
            "uses": [
              9,
              463
            ]
          },
          {
            "id": "metadata/build/ci/step::composite-action-type",
            "conf": 1.0,
            "crit": 3,
            "desc": "GitHub Actions composite action definition"
          },
          {
            "id": "micro-behaviors/os/package-manager/install::gha-apt-install-noninteractive-y",
            "conf": 0.85,
            "crit": 3,
            "desc": "GitHub Actions apt noninteractive install",
            "from": [
              {
                "file": 60
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::range-class",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver Range class module",
            "from": [
              {
                "file": 29
              },
              {
                "off": 34941,
                "file": 30,
                "line": 1306
              }
            ],
            "uses": [
              189,
              479
            ]
          },
          {
            "id": "micro-behaviors/data/encode/charcode::charcode-at",
            "conf": 0.7,
            "crit": 3,
            "desc": "charCodeAt() method call"
          },
          {
            "id": "metadata/lang/scripted::require-symbol",
            "conf": 1.0,
            "crit": 2,
            "desc": "CommonJS require symbol",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::node-write-file-sync-call",
            "conf": 1.0,
            "crit": 3,
            "desc": "Node calls imported writeFileSync",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/client::js-fetch-implementation-call",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.84,
            "crit": 3,
            "desc": "Calls an injected JavaScript fetch",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/module/require::node-lazy-net-builtin-import",
            "atk": "T1027",
            "conf": 0.9,
            "crit": 3,
            "desc": "Defers loading a Node network builtin",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::browser-url-origin-read",
            "conf": 0.94,
            "crit": 3,
            "desc": "Derives an origin from a URL",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-ci",
            "conf": 0.75,
            "crit": 3,
            "desc": "Reads CI environment flag",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/identity::host-user-object-fields",
            "conf": 0.9,
            "crit": 3,
            "desc": "Host or user object field keys",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/fd/stdio::stdout-string",
            "conf": 0.3,
            "crit": 2,
            "desc": "References the stdout stream name"
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-win32-branch",
            "conf": 0.7,
            "crit": 2,
            "desc": "Branches on Windows platform value",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/hex::js-hex-charcode-decoder",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript hex escape decoder",
            "from": [
              {
                "file": 36
              }
            ]
          },
          {
            "id": "objectives/impact/ui/manipulation/traffic::hostname-includes-call",
            "atk": "T1176,T1185,T1041",
            "mbc": "B0030",
            "conf": 0.9,
            "crit": 3,
            "desc": "Branches on URL hostname.includes",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/body::req-write",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Write data to HTTP request stream",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file",
            "atk": "T1105",
            "conf": 0.7,
            "crit": 3,
            "desc": "References curl file-output option",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/verb::javascript-mutating-method-branch-cluster",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.96,
            "crit": 3,
            "desc": "Branches on mutating HTTP request methods",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/shell::shell-profile-append-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Appends with the appendFile API",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/cookie-store::cookie-helper-function-definitions",
            "atk": "T1539",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Defines set get and clear cookie helpers",
            "from": [
              {
                "off": 849192,
                "file": 35,
                "line": 24215
              },
              {
                "off": 805382,
                "file": 40,
                "line": 22095
              },
              {
                "off": 849075,
                "file": 45,
                "line": 24213
              }
            ],
            "uses": [
              122
            ]
          },
          {
            "id": "metadata/import/npm/actions/core::actions/core",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @actions/core",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::action-main-entrypoint",
            "conf": 1.0,
            "crit": 3,
            "desc": "Action declares a main entrypoint"
          },
          {
            "id": "metadata/package/testing/corpus::xss-category-label",
            "conf": 0.9,
            "crit": 3,
            "desc": "XSS attack category label",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/custom::file-upload-headers",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.78,
            "crit": 3,
            "desc": "HTTP file upload header stack",
            "from": [
              {
                "off": 381420,
                "file": 35,
                "line": 8356
              },
              {
                "file": 38
              },
              {
                "off": 205741,
                "file": 40,
                "line": 6841
              },
              {
                "off": 381303,
                "file": 45,
                "line": 8354
              }
            ],
            "uses": [
              54,
              227,
              460
            ]
          },
          {
            "id": "micro-behaviors/fs/path/self::cwd-reference",
            "conf": 0.84,
            "crit": 3,
            "desc": "References the Node.js current working directory",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal",
            "atk": "T1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "child_process module name literal",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/lockfile::package-lock-resolved-url",
            "atk": "T1195.002",
            "conf": 0.86,
            "crit": 3,
            "desc": "Lockfile dependency resolved URL"
          },
          {
            "id": "micro-behaviors/process/hook/webextension::access-control-expose-headers-header",
            "conf": 0.8,
            "crit": 3,
            "desc": "Access-Control-Expose-Headers header name",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/minifier::js-medium-minified-line",
            "conf": 0.9,
            "crit": 2,
            "desc": "JavaScript contains a long minified line",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/path::test-spec-path-benign-context",
            "conf": 1.0,
            "crit": 1,
            "desc": "Test or spec path context",
            "from": [
              {
                "file": 1
              },
              {
                "file": 2
              },
              {
                "file": 114
              },
              {
                "file": 115
              }
            ],
            "uses": [
              1
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/assignment::indexed-call-assignment",
            "conf": 0.85,
            "crit": 3,
            "desc": "Indexed call assignment target",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/stream::stream",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:stream",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/char-code::fromcharcode-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Builds characters with String.fromCharCode"
          },
          {
            "id": "micro-behaviors/communications/http/request/body::request-write-call",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.72,
            "crit": 3,
            "desc": "JavaScript writes HTTP request body",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/framing::node-be32-frame-length-read",
            "mbc": "C0001",
            "conf": 0.95,
            "crit": 3,
            "desc": "Reads BE32 frame length at offset zero",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::js-stream-write-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls a write method on a stream",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path",
            "from": [
              {
                "file": 60
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/credential::any-credential-path",
            "conf": 0.9,
            "crit": 1,
            "desc": "References a credential-bearing path",
            "from": [
              {
                "file": 5
              },
              {
                "file": 30
              }
            ],
            "uses": [
              408
            ]
          },
          {
            "id": "metadata/import/npm/console::console",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:console",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/sanity-checks/js::relative/2/sanity-checks/js",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../sanity-checks.js",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/unsafe::zlib-implementation-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a zlib implementation",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/os/module/require::dynamic-import-string-literal",
            "conf": 0.8,
            "crit": 3,
            "desc": "Dynamically imports a literal module path"
          },
          {
            "id": "micro-behaviors/data/encode/char-code::multiple-fromcharcode-calls",
            "conf": 0.92,
            "crit": 3,
            "desc": "Calls String.fromCharCode multiple times"
          },
          {
            "id": "metadata/import/npm/relative/1/exec-zlpfwmph/js::relative/1/exec-zlpfwmph/js",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./exec-zlpfwmpH.js",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "micro-behaviors/fs/path/temp::tmp-zip-path",
            "conf": 0.6,
            "crit": 3,
            "desc": "Temporary directory ZIP path reference",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/window/automation::dom-dispatch-error-event",
            "conf": 0.92,
            "crit": 3,
            "desc": "Dispatches synthetic DOM error event"
          },
          {
            "id": "metadata/build/ci/step::mutable-version-action-ref",
            "conf": 0.9,
            "crit": 3,
            "desc": "Workflow action uses mutable version tag"
          },
          {
            "id": "metadata/build/bundler/wrapper::js-tslib-reexport-helper",
            "conf": 0.97,
            "crit": 2,
            "desc": "Calls a tslib/TypeScript re-export helper",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/post::post",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "HTTP POST method string literal",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/rollup/plugin-node-resolve::rollup/plugin-node-resolve",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @rollup/plugin-node-resolve",
            "from": [
              {
                "file": 116
              }
            ]
          },
          {
            "id": "metadata/import/npm/test::test",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:test",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory",
            "conf": 1.0,
            "crit": 2,
            "desc": "File identified as a test by path or name",
            "from": [
              {
                "file": 111
              }
            ],
            "uses": [
              80,
              411
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::unzip-command",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.82,
            "crit": 3,
            "desc": "unzip extraction command",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/import/builtin::child-process-import-runtime",
            "conf": 0.85,
            "crit": 3,
            "desc": "Imports Node child_process through ESM",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler",
            "conf": 0.85,
            "crit": 3,
            "desc": "Registers asynchronous named event handler",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl",
            "atk": "T1105",
            "conf": 0.66,
            "crit": 3,
            "desc": "Download via curl",
            "from": [
              {
                "file": 18
              },
              {
                "file": 19
              }
            ],
            "uses": [
              315
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/retry-after::retry-after-header-name-reference",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "References the Retry-After header name",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-os-platform-alias-branch",
            "conf": 0.82,
            "crit": 3,
            "desc": "Node OS alias platform branch",
            "from": [
              {
                "file": 30
              }
            ],
            "uses": [
              294,
              298,
              356,
              418
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "conf": 0.7,
            "crit": 3,
            "desc": "Invokes PowerShell with command-line options",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/schema-object::command-field-key",
            "conf": 0.9,
            "crit": 1,
            "desc": "JSON-like object command field",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/utils/js::relative/2/utils/js",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../utils.js",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::joyent-copyright",
            "conf": 1.0,
            "crit": 2,
            "desc": "Joyent copyright header Node.js",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/private-key::keystore-suffix",
            "atk": "T1552.001",
            "conf": 0.8,
            "crit": 1,
            "desc": "Keystore file path suffix",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/ssl::node-tls-connect",
            "mbc": "C0001",
            "conf": 0.88,
            "crit": 3,
            "desc": "Node TLS module connects a socket",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::digest-method-call",
            "conf": 0.8,
            "crit": 3,
            "desc": "Calls a digest() method",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory-path",
            "conf": 1.0,
            "crit": 2,
            "desc": "File is in common test directory",
            "from": [
              {
                "file": 111
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-or-declaration-file",
            "conf": 0.85,
            "crit": 1,
            "desc": "File is a test or type-declaration source file",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              10,
              50,
              80
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a loopback HTTP URL",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-aarch64",
            "conf": 1.0,
            "crit": 3,
            "desc": "AArch64 (ARM64) architecture string",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/file/string/file::tmp",
            "conf": 0.2,
            "crit": 1,
            "desc": "tmp keyword",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "metadata/build/ci/permission::job-pull-requests-write-permission",
            "conf": 0.92,
            "crit": 3,
            "desc": "Job grants pull-request write permission"
          },
          {
            "id": "micro-behaviors/os/env/secret-name::javascript-credential-env-read",
            "conf": 0.85,
            "crit": 3,
            "desc": "JavaScript reads a credential env var",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-linux-branch",
            "conf": 0.7,
            "crit": 2,
            "desc": "Branches on Linux platform value",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/credential-access/theft/keywords::keystore-word",
            "conf": 0.94,
            "crit": 3,
            "desc": "\"keystore\" word inside a string literal",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-code-de",
            "conf": 0.97,
            "crit": 2,
            "desc": "German UI language code",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/runtime::bun-data-child-process-reference",
            "atk": "T1195.002",
            "mbc": "B0024",
            "conf": 0.9,
            "crit": 3,
            "desc": "Bun data payload references child_process",
            "from": [
              {
                "file": 28
              }
            ]
          },
          {
            "id": "metadata/import/npm/diagnostics_channel::diagnostics_channel",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:diagnostics_channel",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/webdav::mkcol-method",
            "conf": 0.95,
            "crit": 3,
            "desc": "References the WebDAV MKCOL method",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/path::shell-executable-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a shell executable",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/temp::tmp-path-content",
            "conf": 1.0,
            "crit": 2,
            "desc": "Contains a /tmp/ or /var/tmp/ path",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/redirect::shell-echo-file-write",
            "conf": 0.86,
            "crit": 3,
            "desc": "Shell echo redirects output to file"
          },
          {
            "id": "micro-behaviors/data/string/concat::join-empty-separator-call",
            "conf": 0.82,
            "crit": 3,
            "desc": "Joins values without a separator",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only",
            "conf": 0.88,
            "crit": 3,
            "desc": "Catch block only returns a constant",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/scripted::it-call",
            "conf": 0.6,
            "crit": 3,
            "desc": "it() function call",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/object::js-serialise",
            "conf": 0.85,
            "crit": 3,
            "desc": "References a serialization-related symbol",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/read::javascript",
            "conf": 0.8,
            "crit": 2,
            "desc": "Access environment variables",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::silent-error-handler",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript emitter discards errors",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/fixture::test-filename-pattern",
            "conf": 0.6,
            "crit": 2,
            "desc": "Common test filename pattern",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/client::node-http",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Node.js built-in http/https module usage",
            "from": [
              {
                "file": 30
              }
            ],
            "uses": [
              452
            ]
          },
          {
            "id": "metadata/import/npm/tls::tls",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports node:tls",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission",
            "conf": 0.82,
            "crit": 3,
            "desc": "Emits object through named JavaScript event",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/user-agent::mobile-user-agent-header-map-read",
            "conf": 0.94,
            "crit": 3,
            "desc": "Reads User-Agent from a header map",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/build::arch-variable-in-url",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Architecture variable appears in URL",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the Node.js process.platform value",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close",
            "conf": 0.86,
            "crit": 3,
            "desc": "Calls a parenthesized function expression"
          },
          {
            "id": "metadata/import/npm/url::url",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:url",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/encoded::js-commented-percent-encoded-url-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript commented encoded URL context",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/versioning/scheme::mature-version",
            "conf": 0.7,
            "crit": 2,
            "desc": "Major version is 1 or higher"
          },
          {
            "id": "metadata/package/files/included::package-json-basename",
            "conf": 0.95,
            "crit": 3,
            "desc": "Filename is package.json",
            "from": [
              {
                "file": 23
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/query::query-serializer-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls a URL query serializer",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/wmi/query::query-os-info",
            "conf": 0.8,
            "crit": 3,
            "desc": "Queries OS information via WMI",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "well-known/lib/web/whatwg-encoding::encoding-get-spec-comment",
            "conf": 0.99,
            "crit": 3,
            "desc": "WHATWG encoding-get concept comment",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/send::node-socket-write",
            "atk": "T1071",
            "mbc": "C0001",
            "conf": 0.86,
            "crit": 3,
            "desc": "Node socket writes a data payload",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/gpg-verification::relative/1/gpg-verification",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./gpg-verification",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/lockfile::resolved-registry-hostname",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Lockfile resolves through a registry host"
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "References the toString conversion method",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/client::http-get-dup",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Node.js http.get",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest",
            "atk": "T1195.002",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Action action.yml manifest",
            "from": [
              {
                "file": 25
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-403-forbidden",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP 403 forbidden response text",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/websocket::websocket-headers",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.85,
            "crit": 3,
            "desc": "WebSocket protocol headers",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::pkg-build-script-field",
            "conf": 0.6,
            "crit": 3,
            "desc": "Package declares a build script"
          },
          {
            "id": "metadata/import/npm/https::https",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports https",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/custom::boundary-param",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains an HTTP multipart boundary parameter",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::architecture-parameter-assignment",
            "conf": 0.94,
            "crit": 2,
            "desc": "Architecture parameter assignment",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/header/custom::multipart-upload",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.6,
            "crit": 3,
            "desc": "Multipart form data upload",
            "from": [
              {
                "file": 35
              },
              {
                "file": 40
              },
              {
                "file": 45
              }
            ],
            "uses": [
              458
            ]
          },
          {
            "id": "micro-behaviors/data/manipulation::log-redaction-option",
            "conf": 0.85,
            "crit": 3,
            "desc": "Log redaction option or call",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/url::encode-uri-component-call",
            "conf": 0.7,
            "crit": 3,
            "desc": "URL-encodes data via encodeURIComponent",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::semver-invalid-version-typeerror",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver invalid-version TypeError",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/build::http-url-template-literal",
            "conf": 0.94,
            "crit": 3,
            "desc": "Builds an HTTP URL with interpolation",
            "from": [
              {
                "file": 16
              }
            ]
          },
          {
            "id": "micro-behaviors/os/module/require::cjs-side-effect-package-require",
            "conf": 0.93,
            "crit": 3,
            "desc": "CommonJS side-effect-only package require",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "metadata/import/npm/rollup/plugin-commonjs::rollup/plugin-commonjs",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @rollup/plugin-commonjs",
            "from": [
              {
                "file": 116
              }
            ]
          },
          {
            "id": "micro-behaviors/process/hook/webextension::access-control-allow-methods-header",
            "conf": 0.8,
            "crit": 3,
            "desc": "Access-Control-Allow-Methods header name",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/credential-access/theft/keywords::password-upper",
            "conf": 0.45,
            "crit": 3,
            "desc": "PASSWORD credential label",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/websocket::ping-pong-pair",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "PING/PONG protocol marker",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add",
            "conf": 0.85,
            "crit": 3,
            "desc": "Length-bounded loop uses compound addition",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/lang/embedded::javascript",
            "conf": 1.0,
            "crit": 2,
            "desc": "javascript code embedded in string"
          },
          {
            "id": "micro-behaviors/communications/socket/connect::node-net-options-connect-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node net.connect call with options object",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/2/gpg-verification/js::relative/2/gpg-verification/js",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ../gpg-verification.js",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-in-js-exec",
            "conf": 0.92,
            "crit": 3,
            "desc": "JavaScript exec() invokes curl command",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/enumerate/directory::fs-readdir",
            "conf": 0.6,
            "crit": 3,
            "desc": "Calls Node.js readdir at least twice",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "objectives/command-and-control/channel/tunnel/relay::node-cli-worker-env-flag",
            "atk": "T1090, T1572",
            "mbc": "B0030",
            "conf": 0.84,
            "crit": 3,
            "desc": "Node CLI worker environment guard",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/file/string/identity::multi-architecture-name-set--other",
            "conf": 0.9,
            "crit": 1,
            "desc": "x86, ARC, or MPSL architecture reference",
            "from": [
              {
                "file": 21
              }
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::range-class-text",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver Range class text",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::node-test-runner-import",
            "conf": 0.95,
            "crit": 3,
            "desc": "Imports the node:test runner",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call",
            "conf": 0.75,
            "crit": 3,
            "desc": "Indirect string replacement call",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::bat-dup",
            "conf": 0.5,
            "crit": 1,
            "desc": ".bat extension reference",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/import/npm/relative/1/mocks/js::relative/1/mocks/js",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./mocks.js",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/npm/net::net",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports net",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file-command",
            "atk": "T1105",
            "conf": 0.94,
            "crit": 3,
            "desc": "Executes curl with output-path option",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text",
            "mbc": "F0011",
            "conf": 0.86,
            "crit": 3,
            "desc": "Detaches a handle with unref()",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::correct-example-comment",
            "conf": 0.85,
            "crit": 3,
            "desc": "Standalone \"// correct\" example annotation",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/base64::btoa-symbol",
            "conf": 0.78,
            "crit": 3,
            "desc": "Calls the browser btoa() Base64 encoder",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package declares a runtime dependency",
            "from": [
              {
                "file": 23
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-end-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream end handler",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/extensions/backdoor::dnr-response-headers-marker",
            "conf": 0.86,
            "crit": 3,
            "desc": "DNR response headers marker",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-win32-check",
            "conf": 0.6,
            "crit": 2,
            "desc": "Checks whether Node.js runs on Windows",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::multi-platform-branch",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.8,
            "crit": 3,
            "desc": "Multi-platform OS branching logic",
            "from": [
              {
                "file": 30
              }
            ],
            "uses": [
              283,
              492
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::js-proxy-get-trap",
            "conf": 0.9,
            "crit": 3,
            "desc": "Proxy intercepts property reads",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/error-handling::catch-keyword",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains a catch error handler",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/package/testing/scripted::coverage-markers-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "Coverage marker family A",
            "from": [
              {
                "off": 77120,
                "file": 40,
                "line": 2552
              }
            ],
            "uses": [
              57
            ]
          },
          {
            "id": "metadata/package/dependencies/lockfile::package-lock-has-install-script",
            "atk": "T1195.002",
            "conf": 0.85,
            "crit": 3,
            "desc": "Lockfile dependency has install script"
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-start",
            "conf": 0.86,
            "crit": 3,
            "desc": "Starts a synchronous function expression",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/websocket::websocket-connection-upgrade-header",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "WebSocket connection upgrade header",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.92,
            "crit": 3,
            "desc": "Command-line usage text marker",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::js-fromcharcode-alias",
            "conf": 0.9,
            "crit": 3,
            "desc": "Aliases String.fromCharCode conversion function",
            "from": [
              {
                "file": 40
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::powershell-system-drawing-addtype",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.88,
            "crit": 3,
            "desc": "PowerShell System.Drawing load",
            "from": [
              {
                "file": 28
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/url::archive-url-reference-a",
            "conf": 0.88,
            "crit": 3,
            "desc": "URL ends in .zip or .7z",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/message::host-header-line-token",
            "conf": 0.85,
            "crit": 3,
            "desc": "HTTP Host header name token",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/package/config::excludes-identifier",
            "conf": 0.7,
            "crit": 3,
            "desc": "Uses an excludes identifier",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/import/npm/querystring::querystring",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports node:querystring",
            "from": [
              {
                "file": 27
              }
            ]
          },
          {
            "id": "metadata/lang/javascript-features::template-literal",
            "conf": 0.9,
            "crit": 2,
            "desc": "ES6 template literal syntax",
            "from": [
              {
                "file": 35
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/dynamic::node-http-module-get-url-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "Node HTTP GET receives URL variable",
            "from": [
              {
                "file": 30
              }
            ]
          },
          {
            "id": "metadata/file/comment::source-at-most-two-comments",
            "conf": 0.88,
            "crit": 2,
            "desc": "Source has at most two comments"
          },
          {
            "id": "metadata/file/string/identity::multi-architecture-name-set--arm-mips",
            "conf": 0.9,
            "crit": 1,
            "desc": "ARM or MIPS architecture reference",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/file/catalog/service::service-name-github",
            "conf": 0.6,
            "crit": 3,
            "desc": "GitHub service name",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::composite-action-step-script",
            "conf": 1.0,
            "crit": 3,
            "desc": "Composite action step script body",
            "from": [
              {
                "file": 47
              }
            ]
          },
          {
            "id": "metadata/package/manager::homebrew-install-command",
            "conf": 0.5,
            "crit": 3,
            "desc": "Homebrew install command",
            "from": [
              {
                "file": 47
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/script/file::shell-script-execution-alt",
            "atk": "T1059.004",
            "conf": 0.7,
            "crit": 3,
            "desc": "Executes shell script via alt interpreters",
            "from": [
              {
                "file": 55
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal",
            "conf": 0.88,
            "crit": 3,
            "desc": "Executes a local relative file",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/script/file::shell-script-relative-execution",
            "atk": "T1059.004",
            "conf": 0.7,
            "crit": 3,
            "desc": "Executes a relative shell script path (.sh)",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir",
            "conf": 0.7,
            "crit": 3,
            "desc": "Execution from current directory (./file)",
            "from": [
              {
                "file": 62
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell command execution capability",
            "from": [
              {
                "file": 62
              }
            ],
            "uses": [
              518
            ]
          },
          {
            "id": "micro-behaviors/data/string/assembly::sh-template-opening-delimiter",
            "conf": 0.85,
            "crit": 3,
            "desc": "Shell contains a template delimiter",
            "from": [
              {
                "file": 63
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::gh-issue-mgmt",
            "conf": 1.0,
            "crit": 3,
            "desc": "GitHub CLI repository workflow operations",
            "from": [
              {
                "file": 65
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/vcs/git::shell-git-commit",
            "atk": "T1059.004",
            "conf": 0.92,
            "crit": 3,
            "desc": "Commits changes to a Git repository",
            "from": [
              {
                "file": 65
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/vcs/git::shell-git-push",
            "atk": "T1059.004",
            "conf": 0.92,
            "crit": 3,
            "desc": "Pushes commits to a Git remote",
            "from": [
              {
                "file": 65
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::chmod-command",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.6,
            "crit": 3,
            "desc": "chmod shell command",
            "from": [
              {
                "file": 75
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Cleartext http:// URL",
            "from": [
              {
                "file": 77
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/local-exec::execute-quoted-var",
            "atk": "T1059.004",
            "conf": 0.88,
            "crit": 3,
            "desc": "Executes a quoted shell-variable path",
            "from": [
              {
                "file": 101
              }
            ]
          }
        ]
      }
    ]
  }
}