{ "llm": { "conf": 0.99997556, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 0, "prob": 0.9999635, "class": "hostile" }, "outcome": "hostile", "interpretation": "Exfiltrates system info to webhook.site" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.999888, "rte": "az", "prob": 0.999888 }, { "cls": 2, "raw": 0.9999635, "rte": "az/npm", "prob": 0.9999635 } ], "prob": 0.9999635, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9999635219573975, "type": "npm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0013132691383361816, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0006360908155329525, "type": "package.json" } ], "version": "v18.18", "analyzed_at": "2026-09-05T21:29:58Z" }, "path": "nam-os-a-man-99.9.9.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000@}T*u2egG6Wr$l-A:Ji8!8niy#ZQuTB55azj#UDJ4(4xX(4GUT%tw5y5X0\u003e)wt0$x(5F?4J9)Z*\u0026B=m\u003ehp\u0026H6#dU?r4m*x{Qo-9Z.!13HWVkd80.T-09U35NdU^=f=JDq{1iAZ4\u003eVvU1c?wR^{?U%YD*$}J]LP\u003cP{o+[eZh2*lN-F0l%yo#Gizzssg/7{.S%G*d=Eg7KzzY7}e)K\u003cj]?Kf3z1Uuobk4uhMKxexFIi!Hs4*T:H3J5U9CN.OX-\u003eo9!*vdO%KaT?Y/7EZ9)7DD#Xm]K]Y7$?A-%iMIz25VL!(2]\u003e3+M@D\u0026!L73O!)CPIA4r#Qftqj:S?T^@G#4NCI2iW@PK(8=eU\u00261d:xqsE\u003e]C(", "ln": 0 } ], "mol": "O₃(Eu₃S₅Dy₂)H₄(Cm₅Db₂Os₄Po₂)Md₂(Pa₂In)", "sha": "6551f3b7dc74b09814f457d2c4e6a021acc81807bca5c614211b4bc62fa896c6", "path": "nam-os-a-man-99.9.9.tgz", "risk": 476, "size": 691, "type": "npm", "facts": { "metrics": { "file": { "size": 691, "entropy": 7.62 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 691, "peak_region_entropy": 7.62 } } }, "ident": { "name": { "value": "nam-os-a-man", "source": "npm.name", "verified": false }, "trust": "unsigned", "version": { "value": "99.9.9", "source": "npm.version", "verified": false }, "identifier": { "value": "nam-os-a-man", "source": "npm.name", "verified": false } }, "traits": [ { "id": "objectives/discovery/system/fingerprint/user::node-host-user-query", "atk": "T1033,T1082", "conf": 0.85, "crit": 3, "desc": "Node queries host and user identity", "from": [ { "file": 1 } ], "uses": [ 2, 35, 40 ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::npm-version-inflated-90plus", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version major 90+" }, { "id": "micro-behaviors/os/sysinfo/hostname::os-hostname-call", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "os.hostname() call", "from": [ { "file": 1 } ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-reference", "conf": 0.85, "crit": 3, "desc": "webhook.site service reference", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::postinstall-hook-declaration", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Package declares a postinstall hook" }, { "id": "metadata/package/quality/version-sentinel::npm-version-major-40-plus", "atk": "T1195.002", "conf": 0.82, "crit": 3, "desc": "npm package version major 40+" }, { "id": "objectives/exfiltration/oob/endpoint::oob-endpoint-any", "conf": 0.9, "crit": 3, "desc": "Any OOB callback endpoint", "from": [ { "file": 1 } ], "uses": [ 54 ] }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 2, "desc": "Package has install hooks", "from": [ { "file": 2 } ], "uses": [ 16 ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 1 } ] }, { "id": "supply-chain/install-hook/postinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'postinstall' hook that runs during install" }, { "id": "micro-behaviors/os/env/access::npm-init-cwd-read", "conf": 0.9, "crit": 3, "desc": "Reads npm invocation directory", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-error-handler", "conf": 0.9, "crit": 3, "desc": "JavaScript emitter discards errors", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/access::process-env", "conf": 0.8, "crit": 2, "desc": "Node process.env access", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version" }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "objectives/supply-chain/recon-exfil/callback::oob-endpoint-indicators", "conf": 0.9, "crit": 4, "desc": "OOB exfiltration endpoint indicators", "from": [ { "off": 421, "file": 1, "line": 17 } ], "uses": [ 6, 29 ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-postinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has postinstall script hook" }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-stream-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request writes body", "from": [ { "file": 1 } ], "uses": [ 19, 26, 45 ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "package.json defines a package name" }, { "id": "micro-behaviors/communications/http/request/client::request-write-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "JavaScript writes HTTP request body", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/module/load::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "from": [ { "file": 1 } ], "uses": [ 34, 57 ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::postinstall-runs-node-script", "conf": 0.92, "crit": 3, "desc": "Postinstall targets local Node.js file" }, { "id": "objectives/discovery/system/fingerprint/runtime::js-system-info-discovery", "atk": "T1082", "mbc": "B0012", "conf": 0.85, "crit": 3, "desc": "System information discovery (JS)", "from": [ { "file": 1 } ], "uses": [ 2, 35, 40 ] }, { "id": "micro-behaviors/os/network/interface::ipv4-family-literal", "atk": "T1016", "conf": 0.8, "crit": 1, "desc": "Checks an IPv4 interface family", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::host-identity-query", "conf": 0.86, "crit": 3, "desc": "Queries a host identity value", "from": [ { "file": 1 } ], "uses": [ 2, 38 ] }, { "id": "micro-behaviors/communications/http/request/client::node-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js built-in http/https module usage", "from": [ { "file": 1 } ], "uses": [ 48 ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "from": [ { "off": 534, "file": 1, "line": 22 } ], "uses": [ 8, 14 ] }, { "id": "micro-behaviors/communications/http/post::request-write-payload-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "HTTP request sends payload variable", "from": [ { "file": 1 } ] }, { "id": "objectives/exfiltration/oob/oast::javascript-oob-hostname-http-proximity", "atk": "T1048,T1082", "mbc": "E1041", "conf": 0.98, "crit": 5, "desc": "JavaScript accesses hostname near an OOB endpoint and HTTP request", "from": [ { "file": 1 } ], "uses": [ 6, 25, 48 ] }, { "id": "micro-behaviors/communications/http/webhook::webhook-post-method-field", "conf": 0.9, "crit": 3, "desc": "Webhook specifies HTTP POST", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/interface::node-local-ip-selection", "atk": "T1016", "conf": 0.96, "crit": 3, "desc": "Selects a local IPv4 interface address", "from": [ { "off": 230, "file": 1, "line": 8 } ], "uses": [ 24, 35, 47, 49 ] }, { "id": "objectives/supply-chain/impersonation/package/scoring::npm-dependency-confusion-candidate", "atk": "T1195.002", "mbc": "E1195", "conf": 0.92, "crit": 4, "desc": "Potential dependency confusion attack", "from": [ { "file": 2 } ], "uses": [ 7, 39, 43 ] }, { "id": "metadata/import/builtin::require-https", "conf": 0.78, "crit": 3, "desc": "Imports the Node.js HTTPS module", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/interface::node-network-interfaces-call", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Node.js network interface enumeration call", "from": [ { "file": 1 } ] }, { "id": "metadata/package/quality/empty::npm-empty-description", "conf": 0.85, "crit": 2, "desc": "package.json description field is empty" }, { "id": "objectives/discovery/system/fingerprint/user::small-node-host-user-query", "atk": "T1033,T1082", "conf": 0.9, "crit": 3, "desc": "Small Node script queries host and user", "from": [ { "file": 1 } ], "uses": [ 0, 31 ] }, { "id": "micro-behaviors/os/sysinfo/hostname::node-os-alias-hostname-call", "atk": "T1082", "conf": 0.8, "crit": 3, "desc": "Node os-alias hostname query", "from": [ { "file": 1 } ] }, { "id": "metadata/package/quality/version-sentinel::npm-version-inflated-major", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version has inflated major number" }, { "id": "micro-behaviors/process/user/query::os-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "os.userInfo() user query", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning::npm-unrealistic-major-version", "conf": 0.85, "crit": 3, "desc": "suspect major version (90+) for npm package" }, { "id": "objectives/supply-chain/recon-exfil/npm-install-targeting::webhook-site-uuid-path", "atk": "T1041", "conf": 0.98, "crit": 4, "desc": "webhook.site UUID callback path", "from": [ { "file": 1 } ] }, { "id": "metadata/package/quality/empty::npm-empty-description-any", "conf": 0.85, "crit": 2, "desc": "Package description metadata is empty or absent", "from": [ { "off": 53, "file": 2, "line": 4 } ], "uses": [ 13, 18, 36 ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-end-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request sends a body with end()", "from": [ { "file": 1 } ], "uses": [ 26, 45 ] }, { "id": "micro-behaviors/communications/http/request/client::request-end-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 1, "desc": "Ends a request-like object with .end()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-call", "conf": 0.5, "crit": 2, "desc": "Calls JSON.stringify()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/interface::returns-interface-address", "atk": "T1016", "conf": 0.86, "crit": 1, "desc": "Returns a network interface address", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::https-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js https.request", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/interface::internal-interface-filter", "atk": "T1016", "conf": 0.92, "crit": 1, "desc": "Filters internal network interfaces", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::inflated-major-tiny-postinstall-loader", "atk": "T1195.002", "conf": 0.97, "crit": 5, "desc": "Inflated-major package runs postinstall loader", "from": [ { "file": 2 } ], "uses": [ 22, 39 ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-source-call", "conf": 0.85, "crit": 3, "desc": "Source call passes a webhook.site URL", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-post-json-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Node HTTP request posts a JSON body", "from": [ { "file": 1 } ], "uses": [ 17, 27 ] }, { "id": "micro-behaviors/communications/http/post::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "from": [ { "file": 1 } ] }, { "id": "objectives/exfiltration/oob/endpoint::web-content-oob-service-reference", "conf": 0.9, "crit": 3, "desc": "OOB service URL in web content", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 1 } ] }, { "id": "objectives/exfiltration/http/upload::node-host-profile-env-exfil", "atk": "T1041,T1082,T1552.001", "conf": 0.99, "crit": 5, "desc": "Sends a serialized Node host profile through an HTTP POST", "from": [ { "off": 534, "file": 1, "line": 22 } ], "uses": [ 2, 6, 12, 14, 40, 46, 48 ] }, { "id": "metadata/import/builtin::require-os", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js os module", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::node-os-alias-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "Node os-alias user identity query", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer::javascript-write-then-end-stream", "conf": 0.9, "crit": 3, "desc": "JavaScript writes then ends a stream", "from": [ { "file": 1 } ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "objectives/exfiltration/oob/endpoint::npm-postinstall-oob-silent-json-beacon", "atk": "T1195.002,T1041", "mbc": "E1041", "conf": 0.98, "crit": 5, "desc": "npm postinstall silently POSTs JSON to an OOB sink", "from": [ { "off": 652, "file": 1, "line": 24 }, { "file": 2 } ], "uses": [ 6, 11, 22, 27 ], "spans": [ [ 0, 41 ] ] } ] }, { "ctx": [ { "b": "v@DmaBrCHyauZ\u0026/wPq\u003cbA+cTDz/WoPi%]FozGx[xxMOunB09Q*A+flkx(W=kcUNQzAc0xQi%(sbB-7Yhx(v(iy\u0026r/(y!mCKdiJ%AarUfjzGx[xzE){hauZ\u0026=B1RuwBA.UzyE@z=wPzx\u003ev}xZfdlv\u003eVazbLjasH-rzGx[xx\u003ey^-wGU]6awVDYwN/*mC42ifwPGnqwPR#xdiJ%AarR^Hw]zYjc$vgkB95KxwPP5kw/$/1vpJ\u003c$aBsCrarR^HazCBgc#JQre[OKex(55qjV$}JcRmcTg::y)clKEHwPPLszGGDgzEEugaAz4nB-IvxzE)]xvpS[?wPI]O3lQDlaBKOtaBKOtaAz4nB-IvxcV%rxzF%-pcP.V-3jpoYzGx[xAaa3dz^^f0jS)u}pFJJ-BAh8kxk7$6d0(pzaA.:pAYLsYB1RPRwPyvWw]x7De{hkDA=br5wH[fhay/RaiV@xZz!0v1B1R3wB$MuYnMo4:s41fUD)0xGz!0v1B1Q%Dwge(T3lQE8z/Z2rvqPNpaA8rNxM4%lzEEx[c[bHKdlv\u003ezv@DmaBrCQnAuEy!xMOunB1RGAADL\u0026lBsmFsasy\u0026ABz#pZfe4JXvRxW#yC6WxBy^9=vQ-?5fGq6AhzO=1eI]v@i4XPKvp?96gby[1v(O0Mgb?6red9HxDMWfpBzbP6iV]!DpG7juefFRqvpS}\u0026B2\u003eB\u003casxJ{zGGDcBs*EqAaHyTasyPpAbok#vruj4zzb:Cz/c{NasxJ{zGGDcBs*f$zFa68cPSwpB.kk%AXp*DBy!cSzFa68c#-Quy\u0026r-)diK3YEf}z+3uxY$e]LRQcUmssz/NiRasFVYjW70nEjmk+A+fkyCxdztwHIIaD2dzcwgoOEA+fkywO#3bdlv\u003e", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "os" ], [ "", "require" ], [ "", "https" ], [ "", "require" ], [ "", "nets" ], [ "", "os.networkInterfaces" ], [ "", "Object.values" ], [ "", "payload" ], [ "", "JSON.stringify" ], [ "", "os.userInfo" ], [ "", "process.cwd" ], [ "", "os.hostname" ], [ "", "req" ], [ "", "https.request" ], [ "", "Buffer.byteLength" ], [ "", "req.on" ], [ "", "req.write" ], [ "", "req.end" ], [ "", "https" ], [ "", "os" ] ], "mbr": [ "Buffer.byteLength", "JSON.stringify", "Object.values", "https.request", "net.address", "net.family", "net.internal", "os.hostname", "os.networkInterfaces", "os.userInfo", "os.userInfo().username", "process.cwd", "process.env", "process.env.INIT_CWD", "req.end", "req.on", "req.write" ], "tgt": [ "Buffer.byteLength", "JSON.stringify", "Object.values", "https.request", "os.hostname", "os.networkInterfaces", "os.userInfo", "process.cwd", "req.end", "req.on", "req.write", "require" ], "funcs": [ [ "localIP", 59 ], [ "anonymous", 665 ] ], "metrics": { "ast": { "op.eq": 1, "op.lor": 1, "op.land": 1, "op.lnot": 1, "max_depth": 12, "call_count": 13, "node_count": 291, "member_count": 17, "op_density.eq": 0, "op_density.lor": 0, "op_density.land": 0, "op_density.lnot": 0, "member_depth_max": 3 }, "file": { "size": 707, "entropy": 5.1 }, "text": { "lines": 26, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.04, "space_count": 85, "char_entropy": 5.1, "unique_chars": 64, "top_char_null": 0, "string_density": 0.38, "top_char_ratio": 0.07, "avg_line_length": 26.19, "max_line_length": 115, "empty_line_ratio": 0.12, "last_line_length": 10, "whitespace_ratio": 0.16, "identifier_density": 1.96, "line_length_stddev": 25.66, "normalized_string_count": 1.96, "normalized_unique_identifiers": 7.02 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 707, "peak_region_entropy": 5.1 }, "source": { "function_count": 1 }, "imports": { "count": 2, "stdlib_count": 2, "stdlib_ratio": 1 }, "strings": { "bytes": 126, "count": 10, "url_count": 1, "avg_length": 12.6, "max_length": 57, "avg_entropy": 2.44, "entropy_stddev": 1 }, "functions": { "count": 1, "density": 7.69, "anonymous": 1, "code_ratio": 0.38, "one_liners": 1, "length_stddev": 4, "avg_name_length": 7, "no_params_count": 2, "avg_length_lines": 5, "max_length_lines": 9, "min_length_lines": 1 }, "identifiers": { "count": 51, "unique": 33, "avg_length": 6.09, "max_length": 17, "min_length": 2, "avg_entropy": 2.3, "reuse_ratio": 0.65, "length_stddev": 2.83, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.06 } } }, "id": 1, "mol": "O₃(Eu₃S₂Dy₂)H₄(Cm₅Db₂Os₄Po)Md(In)", "path": "nam-os-a-man-99.9.9.tgz!!package/index.js", "pid": 0, "risk": 285, "sha": "440b15defeb1c0607fc79a236ff2a5bfb47f90ba978c883d87f14bf054324d43", "size": 707, "traits": [ { "id": "metadata/import/builtin::require-https", "conf": 0.78, "crit": 3, "desc": "Imports the Node.js HTTPS module", "spans": [ [ 40, 7 ] ] }, { "id": "metadata/import/builtin::require-os", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js os module", "spans": [ [ 11, 0 ] ] }, { "id": "micro-behaviors/communications/http/post::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "spans": [ [ 597, 17 ] ] }, { "id": "micro-behaviors/communications/http/post::request-write-payload-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "HTTP request sends payload variable", "spans": [ [ 676, 9 ] ] }, { "id": "micro-behaviors/communications/http/request/client::https-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js https.request", "spans": [ [ 452, 13 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-end-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 1, "desc": "Ends a request-like object with .end()", "spans": [ [ 696, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-write-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "JavaScript writes HTTP request body", "spans": [ [ 676, 9 ] ] }, { "id": "micro-behaviors/communications/http/webhook::webhook-post-method-field", "conf": 0.9, "crit": 3, "desc": "Webhook specifies HTTP POST", "spans": [ [ 478, 69 ] ] }, { "id": "micro-behaviors/data/buffer::javascript-write-then-end-stream", "conf": 0.9, "crit": 3, "desc": "JavaScript writes then ends a stream", "spans": [ [ 679, 26 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-error-handler", "conf": 0.9, "crit": 3, "desc": "JavaScript emitter discards errors", "spans": [ [ 652, 22 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-call", "conf": 0.5, "crit": 2, "desc": "Calls JSON.stringify()", "spans": [ [ 314, 0 ] ] }, { "id": "micro-behaviors/os/env/access::npm-init-cwd-read", "conf": 0.9, "crit": 3, "desc": "Reads npm invocation directory", "spans": [ [ 370, 20 ] ] }, { "id": "micro-behaviors/os/env/access::process-env", "conf": 0.8, "crit": 2, "desc": "Node process.env access", "spans": [ [ 370, 0 ] ] }, { "id": "micro-behaviors/os/network/interface::internal-interface-filter", "atk": "T1016", "conf": 0.92, "crit": 1, "desc": "Filters internal network interfaces", "spans": [ [ 230, 0 ] ] }, { "id": "micro-behaviors/os/network/interface::ipv4-family-literal", "atk": "T1016", "conf": 0.8, "crit": 1, "desc": "Checks an IPv4 interface family", "spans": [ [ 221, 0 ] ] }, { "id": "micro-behaviors/os/network/interface::node-network-interfaces-call", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Node.js network interface enumeration call", "spans": [ [ 98, 18 ] ] }, { "id": "micro-behaviors/os/network/interface::returns-interface-address", "atk": "T1016", "conf": 0.86, "crit": 1, "desc": "Returns a network interface address", "spans": [ [ 245, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::node-os-alias-hostname-call", "atk": "T1082", "conf": 0.8, "crit": 3, "desc": "Node os-alias hostname query", "spans": [ [ 421, 11 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::os-hostname-call", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "os.hostname() call", "spans": [ [ 421, 11 ] ] }, { "id": "micro-behaviors/process/user/query::node-os-alias-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "Node os-alias user identity query", "spans": [ [ 339, 11 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::web-content-oob-service-reference", "conf": 0.9, "crit": 3, "desc": "OOB service URL in web content", "spans": [ [ 478, 12 ] ] }, { "id": "objectives/supply-chain/recon-exfil/npm-install-targeting::webhook-site-uuid-path", "atk": "T1041", "conf": 0.98, "crit": 4, "desc": "webhook.site UUID callback path", "spans": [ [ 478, 49 ] ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "spans": [ [ 578, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 562, 32 ] ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request", "spans": [ [ 534, 6 ], [ 542, 6 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "spans": [ [ 470, 20 ] ] }, { "id": "micro-behaviors/process/user/query::os-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "os.userInfo() user query", "spans": [ [ 339, 11 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-reference", "conf": 0.85, "crit": 3, "desc": "webhook.site service reference", "spans": [ [ 478, 12 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-source-call", "conf": 0.85, "crit": 3, "desc": "Source call passes a webhook.site URL", "spans": [ [ 452, 13 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "uses": [ 23, 25 ], "spans": [ [ 534, 6 ], [ 542, 6 ], [ 578, 16 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js built-in http/https module usage", "uses": [ 4 ], "spans": [ [ 452, 13 ] ] }, { "id": "micro-behaviors/os/module/load::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "uses": [ 0, 1 ], "spans": [ [ 11, 7 ] ] }, { "id": "micro-behaviors/os/network/interface::node-local-ip-selection", "atk": "T1016", "conf": 0.96, "crit": 3, "desc": "Selects a local IPv4 interface address", "uses": [ 13, 14, 15, 16 ], "spans": [ [ 98, 18 ], [ 221, 4 ], [ 230, 13 ], [ 245, 19 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::host-identity-query", "conf": 0.86, "crit": 3, "desc": "Queries a host identity value", "uses": [ 17, 18 ], "spans": [ [ 421, 11 ] ] }, { "id": "objectives/discovery/system/fingerprint/runtime::js-system-info-discovery", "atk": "T1082", "mbc": "B0012", "conf": 0.85, "crit": 3, "desc": "System information discovery (JS)", "uses": [ 15, 18, 27 ], "spans": [ [ 98, 18 ], [ 339, 11 ], [ 421, 11 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::oob-endpoint-any", "conf": 0.9, "crit": 3, "desc": "Any OOB callback endpoint", "uses": [ 20 ], "spans": [ [ 478, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-end-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request sends a body with end()", "uses": [ 5, 31 ], "spans": [ [ 452, 13 ], [ 696, 7 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-request-stream-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Node HTTP request writes body", "uses": [ 5, 6, 31 ], "spans": [ [ 452, 13 ], [ 676, 9 ], [ 696, 7 ] ] }, { "id": "objectives/exfiltration/http/upload::node-host-profile-env-exfil", "atk": "T1041,T1082,T1552.001", "conf": 0.99, "crit": 5, "desc": "Sends a serialized Node host profile through an HTTP POST", "uses": [ 4, 10, 12, 18, 25, 27, 36 ], "spans": [ [ 314, 14 ], [ 339, 11 ], [ 370, 11 ], [ 421, 11 ], [ 452, 13 ], [ 478, 12 ], [ 534, 6 ], [ 542, 6 ] ] }, { "id": "objectives/exfiltration/oob/oast::javascript-oob-hostname-http-proximity", "atk": "T1048,T1082", "mbc": "E1041", "conf": 0.98, "crit": 5, "desc": "JavaScript accesses hostname near an OOB endpoint and HTTP request", "uses": [ 4, 34, 36 ], "spans": [ [ 421, 11 ], [ 452, 13 ], [ 478, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/client::node-http-post-json-body", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Node HTTP request posts a JSON body", "uses": [ 30, 38 ], "spans": [ [ 452, 13 ], [ 534, 6 ], [ 542, 6 ], [ 578, 16 ], [ 676, 9 ], [ 696, 7 ] ] }, { "id": "objectives/discovery/system/fingerprint/user::node-host-user-query", "atk": "T1033,T1082", "conf": 0.85, "crit": 3, "desc": "Node queries host and user identity", "uses": [ 15, 18, 27 ], "spans": [ [ 98, 18 ], [ 339, 11 ], [ 421, 11 ] ] }, { "id": "objectives/supply-chain/recon-exfil/callback::oob-endpoint-indicators", "conf": 0.9, "crit": 4, "desc": "OOB exfiltration endpoint indicators", "uses": [ 36, 40 ], "spans": [ [ 421, 11 ], [ 452, 13 ], [ 478, 12 ] ] }, { "id": "objectives/discovery/system/fingerprint/user::small-node-host-user-query", "atk": "T1033,T1082", "conf": 0.9, "crit": 3, "desc": "Small Node script queries host and user", "uses": [ 22, 42 ], "spans": [ [ 0, 16 ], [ 98, 18 ], [ 339, 11 ], [ 421, 11 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb5Q?aePkXZvj=t8zxZRsarR\u003eKwPz\u003caz/c:War\u0026*ae\u0026+KAa$K6zar\u003eucB7ol8Acb/jzx.a:a%FMBarR\u003eBvqfQ6iV]RXzE^s6e]2CKed9Hxb6dmmx(Ffnb03\u0026[3lQDlar\u003e=yB98blB97\u0026by:7[.b5RsfwGUY8wmZ0ryi7NaarV7-3lQDnyH}^nz/Pxfb03\u0026Jt}us9ar\u003elpBzbPkb03?\u003ca$K6zar\u003eSov}xL0wG\u003ceTb1UZ2a$K6zar\u003e]MAaHjOar\u003erlzeBieyi7NaEf]", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 226, "entropy": 4.39 }, "binary": { "peak_region_bytes": 226, "peak_region_entropy": 4.39 } } }, "id": 2, "mol": "O(S₃)H(Po)Md(Pa₂)", "path": "nam-os-a-man-99.9.9.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "index.js", "off": 83, "file": 1, "kind": "local" } ], "risk": 191, "sha": "09726d8aa7c5cc05da2bd4d656336bf46f6a13d8cfe1d39a126554f5ef974cb3", "size": 226, "traits": [ { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field", "spans": [ [ 0, 21 ] ] }, { "id": "supply-chain/install-hook/postinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'postinstall' hook that runs during install", "spans": [ [ 113, 13 ] ] }, { "id": "metadata/package/quality/empty::npm-empty-description", "conf": 0.85, "crit": 2, "desc": "package.json description field is empty", "spans": [ [ 53, 0 ] ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "package.json defines a package name", "spans": [ [ 4, 0 ] ] }, { "id": "metadata/package/quality/version-sentinel::npm-version-inflated-major", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version has inflated major number", "spans": [ [ 30, 6 ] ] }, { "id": "metadata/package/quality/version-sentinel::npm-version-major-40-plus", "atk": "T1195.002", "conf": 0.82, "crit": 3, "desc": "npm package version major 40+", "spans": [ [ 30, 6 ] ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version", "spans": [ [ 30, 0 ] ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::npm-version-inflated-90plus", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "npm package version major 90+", "spans": [ [ 30, 6 ] ] }, { "id": "metadata/package/versioning::npm-unrealistic-major-version", "conf": 0.85, "crit": 3, "desc": "suspect major version (90+) for npm package", "spans": [ [ 30, 6 ] ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter", "spans": [ [ 96, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::postinstall-runs-node-script", "conf": 0.92, "crit": 3, "desc": "Postinstall targets local Node.js file", "spans": [ [ 113, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-postinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has postinstall script hook", "spans": [ [ 113, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::postinstall-hook-declaration", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Package declares a postinstall hook", "spans": [ [ 113, 13 ] ] }, { "id": "metadata/package/quality/empty::npm-empty-description-any", "conf": 0.85, "crit": 2, "desc": "Package description metadata is empty or absent", "uses": [ 2, 3, 6 ], "spans": [ [ 4, 0 ] ] }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 2, "desc": "Package has install hooks", "uses": [ 11 ], "spans": [ [ 113, 0 ] ] }, { "id": "objectives/supply-chain/impersonation/package/scoring::npm-dependency-confusion-candidate", "atk": "T1195.002", "mbc": "E1195", "conf": 0.92, "crit": 4, "desc": "Potential dependency confusion attack", "uses": [ 4, 13, 14 ], "spans": [ [ 4, 12 ], [ 30, 6 ], [ 53, 0 ], [ 113, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::inflated-major-tiny-postinstall-loader", "atk": "T1195.002", "conf": 0.97, "crit": 5, "desc": "Inflated-major package runs postinstall loader", "uses": [ 4, 10 ], "spans": [ [ 30, 6 ], [ 113, 13 ] ] } ], "type": "package.json" } ], "rev": "479f3", "v": "8" } }