{ "llm": { "conf": 0.9965205, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.9948067, "class": "benign" }, "outcome": "hostile", "interpretation": "Exfiltrates secrets to webhook.site" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.9948067, "rte": "az", "prob": 0.9948067 }, { "cls": 0, "raw": 0.99710864, "rte": "az/npm", "prob": 0.99710864 } ], "prob": 0.9965205, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9965205192565918, "type": "npm" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000014146168723527808, "type": "javascript" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000012874603271484375, "type": "javascript" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000030308961868286133, "type": "javascript" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000013440847396850586, "type": "package.json" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.0003822942671831697, "type": "javascript" } ], "version": "v18.18", "analyzed_at": "2026-09-07T01:16:31Z" }, "path": "focus-20.0.4.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZyggWSj@00vgGv@2H=wIe7kASCEt*J85\u0026Vm9kP@s}3uvfbf}l@FkzV9!e1V#]Mr6R:x@}LVndl(48QnQ}-WeVSPS-$HfZMXNP)g+/URP60@:7O1o*+=Ap!A3D*NA\u003cauyJbBMPoib7]r+txkrO2mQEShEy+f/f%]siSOM-6QTdWwoKB/^5jkdeLMRUhWz(L(a7BZ}hLRU%e:tb=v9}2", "ln": 0 } ], "mol": "K(Li₄)O₅(Eu₂S₂AsCa₂I)H₆(Cm₃₀Cr₄Db₁₉F₈Os₉Po₁₂)Md₂(Pa₄)Th", "sha": "6863cf841bdb292995c668405a1d1c5fa5701bccf90ef047cff6c6babb3e7d65", "path": "focus-20.0.4.tgz", "refs": [ { "to": "pkg:github/nstudio/xplat", "off": 0, "kind": "repository" } ], "risk": 227, "size": 824058, "type": "npm", "facts": { "metrics": { "file": { "size": 824058, "entropy": 8 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 824058, "peak_region_entropy": 7.86 }, "consistency": { "self_dependency": 0, "name_repo_mismatch": 1, "unused_runtime_deps": 1 } } }, "ident": { "name": { "value": "@nstudio/focus", "source": "npm.name", "verified": false }, "urls": [ { "url": "git+https://github.com/nstudio/xplat.git", "kind": "repository", "source": "npm.repository.url" }, { "url": "https://nstudio.io/xplat", "kind": "homepage", "source": "npm.homepage" } ], "trust": "unsigned", "authors": [ { "name": "Nathan Walker", "role": "author", "source": "npm.author" } ], "version": { "value": "20.0.3", "source": "npm.version", "verified": false }, "identifier": { "value": "@nstudio/focus", "source": "npm.name", "verified": false } }, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call", "conf": 0.84, "crit": 3, "desc": "Calls Node.js synchronous directory enumeration", "from": [ { "file": 4 } ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-dev-secret-regex-list", "atk": "T1041", "conf": 0.94, "crit": 4, "desc": "Node developer secret regex list", "from": [ { "off": 990101, "file": 14, "line": 2 } ], "uses": [ 40, 173, 228 ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member", "conf": 0.8, "crit": 3, "desc": "Reads the Node.js process.platform value", "from": [ { "file": 4 } ] }, { "id": "objectives/impact/ui/manipulation/core::hostname-includes-call", "atk": "T1176,T1185,T1041", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Branches on URL hostname.includes", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/vars/cicd::multi-ci-provider-env-refs--buildkite", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (BUILDKITE)", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-redirect-state-pair", "conf": 0.9, "crit": 3, "desc": "OAuth redirect and state parameters", "from": [ { "file": 14 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-megabyte-single-line", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JS/TS line exceeds 1 MB", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::gcp-metadata-flavor-header", "conf": 0.9, "crit": 3, "desc": "Sends the GCP Metadata-Flavor request header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-release-api", "conf": 0.6, "crit": 3, "desc": "GitHub REST releases endpoint", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::js-bearer-header-from-auth-token", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Uses an auth token in Bearer header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-proxy-get-trap", "conf": 0.9, "crit": 3, "desc": "Proxy intercepts property reads", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/request/json::fetch-external-url", "conf": 0.92, "crit": 3, "desc": "Fetches hardcoded external HTTP(S) URL", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/spawn-minified::detached-bang-true", "atk": "T1059", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detached spawn minified true", "from": [ { "file": 14 } ] }, { "id": "well-known/lib/cloud/aws-sdk-js::aws-sdk-js-v3-imds-provider", "conf": 0.99, "crit": 3, "desc": "Recognized AWS SDK JS v3 IMDS credential provider context", "from": [ { "off": 1425229, "file": 14, "line": 2 } ], "uses": [ 61, 182 ] }, { "id": "micro-behaviors/communications/http/url/query::browser-url-query-enumeration", "conf": 0.86, "crit": 3, "desc": "Enumerates URL query parameters", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-issue-label-api", "conf": 0.84, "crit": 3, "desc": "GitHub issue label endpoint path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-start-route", "conf": 0.93, "crit": 3, "desc": "Device authorization start route", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::google-accounts", "conf": 0.6, "crit": 3, "desc": "Google Accounts domain marker", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/dns/lookup/txt::resolve-txt-reference", "atk": "T1071.004", "mbc": "C0011", "conf": 0.9, "crit": 3, "desc": "References the Node.js DNS resolveTxt API", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/string/concat::js-dotted-variable-concat", "conf": 0.9, "crit": 1, "desc": "Dotted variable concatenation", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-token-request", "conf": 0.95, "crit": 3, "desc": "Completes device authorization and sends its OAuth token", "from": [ { "off": 3277181, "file": 14, "line": 2 } ], "uses": [ 11, 73, 148, 216 ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call", "conf": 0.9, "crit": 3, "desc": "Calls a computed this method", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/vars/cicd::github-actions-flag", "conf": 0.85, "crit": 3, "desc": "GITHUB_ACTIONS runtime flag", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-loop-condition", "conf": 0.93, "crit": 1, "desc": "Device authorization condition loop", "from": [ { "file": 14 } ], "uses": [ 54 ] }, { "id": "metadata/library/structure::js-webpack-bundle", "conf": 0.95, "crit": 2, "desc": "Webpack bundled JavaScript module", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/query::encoded-template-query-parameter", "conf": 0.9, "crit": 3, "desc": "Encodes value in a URL query template", "from": [ { "file": 14 } ] }, { "id": "metadata/file/profile/locale::language-label-table-name", "conf": 0.95, "crit": 2, "desc": "Contains a UI language-label table", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/manipulation::replacement-redaction-marker", "conf": 0.8, "crit": 3, "desc": "Replaces data with a redaction marker", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-loop-timer", "conf": 0.93, "crit": 1, "desc": "Repeating timer marker", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/io/stream::process-stdout-data-listener", "conf": 0.9, "crit": 3, "desc": "Registers a process stdout data listener", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/vars/cicd::multi-ci-provider-env-refs--travis", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (TRAVIS)", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-create-repo-octokit-call", "conf": 0.9, "crit": 3, "desc": "Octokit creates authenticated repository", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-pkce-code-challenge", "conf": 0.8, "crit": 3, "desc": "OAuth PKCE code-challenge field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-read-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents read endpoint path", "from": [ { "file": 14 } ] }, { "id": "metadata/library/structure::js-tsc-reexport-barrel", "conf": 0.96, "crit": 2, "desc": "Transpiled CommonJS re-export barrel", "from": [ { "file": 2 }, { "file": 14 } ], "uses": [ 65 ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-reference", "conf": 0.85, "crit": 3, "desc": "webhook.site service reference", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/asymmetric/key::private-key-identifier", "conf": 0.75, "crit": 1, "desc": "Private-key identifier", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/header/retry-after::retry-after-header-name-reference", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "References the Retry-After header name", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/message::raw-http-control-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP control request line", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-runner-registration-api", "conf": 0.9, "crit": 3, "desc": "GitHub Actions runner registration endpoint path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/download/release::forge-release-download-url", "conf": 0.95, "crit": 3, "desc": "References a release download URL path", "from": [ { "file": 14 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/interface::node-network-interfaces-call", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Node.js network interface enumeration call", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/prototype::return-this", "conf": 0.75, "crit": 3, "desc": "Prototype function returns this", "from": [ { "off": 174369, "file": 14, "line": 2 } ], "uses": [ 111, 225 ] }, { "id": "micro-behaviors/data/serialize/json::command-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object command field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/shell/build::npm-install-command", "atk": "T1059", "conf": 0.82, "crit": 3, "desc": "npm package install command", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/encode/base64::json-stringify-base64", "mbc": "C0026", "conf": 0.85, "crit": 3, "desc": "JSON stringified to base64", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::dmi-bios-vendor", "conf": 0.5, "crit": 2, "desc": "DMI bios_vendor field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/server/middleware::wildcard-cors-map-entry", "conf": 0.95, "crit": 3, "desc": "JavaScript defines wildcard CORS map entry", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-for-condition", "conf": 0.93, "crit": 1, "desc": "Device authorization for condition", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/property/transition::js-function-metadata-typed-array-proximity", "conf": 0.97, "crit": 3, "desc": "Defines function metadata near typed-array allocation", "from": [ { "off": 174255, "file": 14, "line": 2 } ], "uses": [ 103, 181, 199 ] }, { "id": "micro-behaviors/os/env/vars/platform::node-appdata-access", "conf": 0.9, "crit": 3, "desc": "Node reads Windows APPDATA directory", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/request/dynamic::http-client-get-options", "conf": 0.86, "crit": 3, "desc": "HTTP GET receives request options", "from": [ { "file": 14 } ] }, { "id": "objectives/credential-access/env/secrets/cloud-access::aws-secret-env-access", "atk": "T1552.001", "conf": 0.88, "crit": 3, "desc": "Reads AWS secret key from environment", "from": [ { "file": 14 } ] }, { "id": "well-known/lib/cloud/aws-sdk-js::v3-imds-credential-path", "conf": 0.98, "crit": 2, "desc": "AWS SDK JS v3 IMDS credential path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-refresh-grant-type", "conf": 0.9, "crit": 3, "desc": "OAuth refresh_token grant type", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-session-word", "conf": 0.45, "crit": 1, "desc": "session route vocabulary word", "from": [ { "file": 14 } ] }, { "id": "metadata/library/structure::js-tslib-reexport-helper", "conf": 0.97, "crit": 1, "desc": "Calls a tslib/TypeScript re-export helper", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/archive/extract/tar::js-tar-gzip-extract-command", "conf": 0.9, "crit": 3, "desc": "JavaScript extracts a gzip archive with tar", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/query::function-encoded-template-query-parameter", "conf": 0.92, "crit": 3, "desc": "Encodes query value with function", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::completed-status-field", "conf": 0.93, "crit": 1, "desc": "Completed status field", "from": [ { "file": 14 } ] }, { "id": "metadata/file/profile/locale::language-label-table-codes-a", "conf": 0.9, "crit": 2, "desc": "Common UI language-code pair", "from": [ { "file": 14 } ], "uses": [ 98 ] }, { "id": "micro-behaviors/data/db/web-storage::indexeddb-open", "conf": 0.9, "crit": 3, "desc": "Opens an IndexedDB database", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::javascript-response-body", "conf": 0.9, "crit": 3, "desc": "References JavaScript responseBody property", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-terminal-status", "conf": 0.93, "crit": 3, "desc": "OAuth device authorization completion status", "from": [ { "file": 14 } ], "uses": [ 68, 129 ] }, { "id": "micro-behaviors/communications/http/auth::device-code-polling-loop", "conf": 0.93, "crit": 3, "desc": "Polls device authorization state", "from": [ { "off": 3357782, "file": 14, "line": 2 } ], "uses": [ 26, 31, 187, 203 ] }, { "id": "micro-behaviors/fs/directory/delete::fs-rm-recursive", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Node.js fs.rm with recursive option", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::object-field-dispatch-switch", "conf": 0.93, "crit": 3, "desc": "Switch dispatches on a command-like object field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-token-word", "conf": 0.45, "crit": 1, "desc": "token route vocabulary word", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/url/external/github::github-release-api-latest", "atk": "T1105", "conf": 0.84, "crit": 3, "desc": "GitHub latest release API template", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/buffer::indexed-byte-xor-mutation", "conf": 0.92, "crit": 3, "desc": "XOR-mutates an indexed byte", "from": [ { "file": 14 } ] }, { "id": "metadata/file/profile/identity::escaped-unicode-codepoint", "conf": 0.99, "crit": 3, "desc": "Escaped Unicode codepoint in source", "from": [ { "file": 14 } ] }, { "id": "objectives/impact/ui/manipulation/core::search-engine-google-host", "atk": "T1176,T1185,T1041", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Google hostname comparison fragment", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/decode/base64::buffer-from-base64-to-utf8", "conf": 0.85, "crit": 3, "desc": "Buffer base64 decode to UTF-8", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/hash/digest::javascript-sha256-operation", "mbc": "C0029", "conf": 0.88, "crit": 3, "desc": "Performs JavaScript SHA-256 operation", "from": [ { "file": 14 } ] }, { "id": "metadata/package/quality/benign-context::node-proxy-agent-connect-tls", "conf": 0.96, "crit": 3, "desc": "Node proxy-agent CONNECT TLS upgrade client", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/query::query-parameter-mutation", "conf": 0.82, "crit": 3, "desc": "Mutates a URL query parameter collection", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/vars/user-paths::userprofile-var", "conf": 0.5, "crit": 3, "desc": "USERPROFILE path environment variable", "from": [ { "file": 14 } ] }, { "id": "objectives/supply-chain/install-hook/bun-bootstrap::trufflehog-release-marker", "atk": "T1195.002", "mbc": "B0024", "conf": 0.95, "crit": 4, "desc": "Downloads latest trufflehog release", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/token-auth::jwt-rsa-algorithm-field", "conf": 0.9, "crit": 3, "desc": "RSA algorithm field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/access::js-filtered-env-copy", "conf": 0.9, "crit": 3, "desc": "Filters and copies process.env values", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/upload::node-manual-multipart-body", "conf": 0.96, "crit": 3, "desc": "Builds Node multipart form-data body", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-authorization-endpoint-url", "conf": 0.94, "crit": 3, "desc": "OAuth authorization endpoint URL", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-before-await-or-require", "conf": 0.88, "crit": 3, "desc": "Catch block precedes await or require call", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/shell/path::shell-executable-reference", "conf": 0.9, "crit": 3, "desc": "References a shell executable", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/write/file/direct::js-file-write", "conf": 0.9, "crit": 3, "desc": "JavaScript file write operation", "from": [ { "file": 14 } ], "uses": [ 130 ] }, { "id": "well-known/lib/cloud/google-cloud-js::cloud-platform-oauth-scope", "conf": 0.99, "crit": 3, "desc": "Google Cloud platform OAuth scope URL", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::response-text", "conf": 0.7, "crit": 3, "desc": "Reads an XMLHttpRequest response body", "from": [ { "file": 14 } ] }, { "id": "metadata/file/string/cloud::aws-imds-v2-token-path", "conf": 0.88, "crit": 3, "desc": "AWS IMDSv2 token request path", "from": [ { "file": 14 } ] }, { "id": "metadata/file/profile/locale::language-label-code-en", "conf": 0.97, "crit": 1, "desc": "English UI language code", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/application/config::vscode-settings-json-filename", "conf": 0.95, "crit": 1, "desc": "VS Code settings.json filename", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/security/auth/cloud::node-aws-container-credential-uri", "conf": 0.95, "crit": 3, "desc": "Node references AWS container credential URI", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/header/accept::accept-json-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Requests a JSON HTTP response", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-response-field", "conf": 0.93, "crit": 3, "desc": "OAuth device code response field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/property/transition::js-function-metadata-descriptor", "conf": 0.9, "crit": 2, "desc": "Defines a function metadata property", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/syntax/schema::username-object-key", "conf": 0.9, "crit": 1, "desc": "Object literal declares a username key", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content", "conf": 0.7, "crit": 2, "desc": "References the Node.js process.platform value", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-create-repo", "conf": 0.9, "crit": 3, "desc": "GitHub repository creation workflow API", "from": [ { "file": 14 } ], "uses": [ 34 ] }, { "id": "well-known/tool/detection/security-scanner::secret-redactor-context", "conf": 0.95, "crit": 1, "desc": "Secret-leak redactor / sanitizer tool context", "from": [ { "file": 14 } ], "uses": [ 177 ] }, { "id": "micro-behaviors/os/env/vars/cicd::multi-ci-provider-env-refs--gitlab", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (GITLAB_CI)", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/shell/selection::platform-shell-path-selection", "conf": 0.93, "crit": 3, "desc": "Selects shell executable by platform", "from": [ { "file": 4 }, { "off": 1076481, "file": 14, "line": 2 } ], "uses": [ 93, 105 ] }, { "id": "objectives/impact/ui/manipulation/core::search-engine-hostname-gate", "atk": "T1176,T1185,T1041", "mbc": "B0030", "conf": 0.94, "crit": 3, "desc": "Branches on major search-engine hostname", "from": [ { "off": 2637156, "file": 14, "line": 2 } ], "uses": [ 5, 80 ] }, { "id": "micro-behaviors/data/source/prototype::return-this-body", "conf": 0.7, "crit": 1, "desc": "Function body returns this", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/url/external/github::github-release-download", "atk": "T1105", "conf": 0.85, "crit": 3, "desc": "GitHub release asset URL template", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/gcp::cloud-kms-endpoint", "conf": 0.84, "crit": 3, "desc": "GCP Cloud KMS endpoint", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 14 } ] }, { "id": "metadata/file/profile/locale::language-label-table-codes-b", "conf": 0.9, "crit": 2, "desc": "European UI language-code pair", "from": [ { "file": 14 } ], "uses": [ 120 ] }, { "id": "micro-behaviors/data/archive/extract/tar::js-tar-extract-command", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "JavaScript command extracts an archive with tar", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/telemetry/logging/event::extension-installation-id-field", "conf": 0.93, "crit": 3, "desc": "Extension installation identifier field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/vcs/git::git-clone-command", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Git clone command", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-pkce-code-verifier", "conf": 0.8, "crit": 3, "desc": "OAuth PKCE code-verifier field", "from": [ { "file": 14 } ] }, { "id": "metadata/file/profile/locale::language-label-code-de", "conf": 0.97, "crit": 1, "desc": "German UI language code", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-typed-array-reconstruction", "conf": 0.96, "crit": 3, "desc": "Rebuilds Base64 data as typed bytes", "from": [ { "off": 193512, "file": 14, "line": 2 } ], "uses": [ 124, 199, 237 ] }, { "id": "metadata/lang/source::generated-do-not-edit-text", "conf": 0.85, "crit": 1, "desc": "Generated source warning text", "from": [ { "file": 14 } ], "uses": [ 231 ] }, { "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment", "conf": 0.94, "crit": 3, "desc": "Assigns character code to array element", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/serialize/json::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/application/config::vscode-global-settings-path", "conf": 0.94, "crit": 3, "desc": "VS Code global settings path", "from": [ { "off": 13156, "file": 4, "line": 263 }, { "off": 50059, "file": 14, "line": 2 } ], "uses": [ 99, 215 ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL" }, { "id": "micro-behaviors/data/decode/custom::js-charcode-byte-mask", "atk": "T1140", "conf": 0.94, "crit": 3, "desc": "Masks character code to one byte", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-flow-marker", "conf": 0.93, "crit": 1, "desc": "Device authorization flow marker", "from": [ { "off": 3295641, "file": 14, "line": 2 } ], "uses": [ 18 ] }, { "id": "micro-behaviors/fs/write/file/direct::write-file-async", "conf": 0.8, "crit": 2, "desc": "Node fs writes to a file asynchronously", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/random/crypto::webcrypto-get-random-values", "conf": 0.96, "crit": 3, "desc": "Generates Web Crypto random bytes", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/asymmetric/key::armored-named-private-key-header", "conf": 0.95, "crit": 3, "desc": "References named armored private-key header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-get-authenticated-user", "conf": 0.8, "crit": 3, "desc": "GitHub authenticated user lookup API", "from": [ { "file": 14 } ] }, { "id": "objectives/credential-access/cloud/token/files::gcp-secretmanager-api", "atk": "T1552.001", "conf": 0.88, "crit": 3, "desc": "GCP Secret Manager API", "from": [ { "file": 14 } ] }, { "id": "metadata/file/string/identity::hostname-field-token", "conf": 0.4, "crit": 1, "desc": "Contains a hostname field token", "from": [ { "file": 14 } ] }, { "id": "well-known/lib/crypto/google-auth::js-package-name-embedded", "conf": 0.98, "crit": 3, "desc": "Embedded google-auth-library package name", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/file/read::readfilesync-call", "conf": 0.9, "crit": 3, "desc": "Calls readFileSync", "from": [ { "file": 4 } ] }, { "id": "metadata/library/structure::js-webpack-minified-module-call", "conf": 0.95, "crit": 2, "desc": "Minified webpack module-factory invocation", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/db/redis::ioredis", "conf": 1.0, "crit": 3, "desc": "ioredis driver reference", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/path::js-url-host-read", "conf": 0.8, "crit": 3, "desc": "Reads hostname from URL variable", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/temp/directory::node-mkdtemp-os-tmpdir", "conf": 0.88, "crit": 3, "desc": "Creates a randomized temp staging directory", "from": [ { "file": 14 } ] }, { "id": "metadata/library/structure::js-large-minified-bundle", "conf": 0.92, "crit": 2, "desc": "Large minified JavaScript bundle", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::dmi-sysfs", "conf": 0.6, "crit": 2, "desc": "DMI sysfs path access", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy", "conf": 0.8, "crit": 2, "desc": "Copies one indexed array element to another", "from": [ { "file": 14 } ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "well-known/lib/crypto/google-auth::js-sdk-bundle", "conf": 0.98, "crit": 3, "desc": "Google Auth Library JavaScript SDK", "from": [ { "file": 14 } ] }, { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 1, "desc": "File uses a source declaration extension", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-user-handoff", "conf": 0.95, "crit": 3, "desc": "Presents a device code with a provider verification URI", "from": [ { "off": 3295856, "file": 14, "line": 2 } ], "uses": [ 18, 161, 175 ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-protocol-reference", "conf": 0.5, "crit": 3, "desc": "References the OAuth 2 protocol", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-end", "conf": 0.7, "crit": 2, "desc": "References PEM certificate footer", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/query::btoa-json-stringify-call", "conf": 0.9, "crit": 3, "desc": "Base64-encodes JSON.stringify output via btoa", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/file/write/direct::js-file-write", "conf": 1.0, "crit": 2, "desc": "Writes file via Node.js fs", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/token-auth::bearer-header-from-variable", "conf": 0.94, "crit": 3, "desc": "Builds Bearer authorization header from variable", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-api-reference", "mbc": "C0029", "conf": 0.9, "crit": 3, "desc": "References an HMAC API", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-create-or-update-file-contents", "conf": 0.92, "crit": 3, "desc": "GitHub file contents write API", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-method-call", "conf": 0.75, "crit": 3, "desc": "Calls a Node OS platform method", "from": [ { "file": 14 } ] }, { "id": "objectives/command-and-control/beacon/network/json::base64-chunk-word", "atk": "T1071.001", "mbc": "B0030", "conf": 0.9, "crit": 1, "desc": "Base64 chunk sizing word", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::node-createhmac-text-call", "mbc": "C0029", "conf": 0.92, "crit": 3, "desc": "Node.js HMAC call in source text", "from": [ { "file": 14 } ] }, { "id": "metadata/library/structure::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "off": 18, "file": 2, "line": 2 }, { "off": 361466, "file": 14, "line": 2 } ], "uses": [ 38, 142, 202 ] }, { "id": "objectives/supply-chain/install-hook/dropper/bun::github-maintainer-enumeration", "atk": "T1195.002", "mbc": "B0024", "conf": 0.95, "crit": 4, "desc": "Enumerates packages by GitHub maintainer", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-device-grant-type", "conf": 0.9, "crit": 3, "desc": "OAuth device_code grant type", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/post::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/encode/char-code::long-numeric-array-literal", "conf": 0.9, "crit": 1, "desc": "Long numeric array literal", "from": [ { "file": 14 } ] }, { "id": "objectives/exfiltration/stealer/credential/dev-file::npm-token-name-ref", "atk": "T1552.001,T1041", "mbc": "E1552", "conf": 0.88, "crit": 1, "desc": "Reads npm auth token from environment", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-method-preservation", "conf": 0.95, "crit": 3, "desc": "Preserves original JavaScript console methods", "from": [ { "file": 14 } ] }, { "id": "well-known/lib/network/registry-auth-token::auth-token-key", "conf": 0.99, "crit": 3, "desc": "npm _authToken config key", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/header/custom::custom-token-header", "conf": 0.9, "crit": 3, "desc": "Sets custom X-prefixed token header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::googleapis-oauth", "conf": 0.6, "crit": 3, "desc": "Google OAuth path marker", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/ecommerce::amazon-retail-host-primary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 1, "desc": "Amazon retail host reference (primary TLD)", "from": [ { "file": 14 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 10 }, { "file": 11 }, { "file": 12 } ], "uses": [ 147 ] }, { "id": "objectives/anti-static/obfuscation/payload/config::api-named-byte-array-const--rx-4", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 1, "desc": "SCHEMA identifier (config name)", "from": [ { "file": 14 } ] }, { "id": "objectives/discovery/system/fingerprint/hardware::dmi-fields", "atk": "T1082", "conf": 0.5, "crit": 3, "desc": "DMI/SMBIOS fields", "from": [ { "file": 14 } ], "uses": [ 143, 209 ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-auth-token-token", "atk": "T1041", "conf": 0.9, "crit": 1, "desc": "Node auth token field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-response-fields", "conf": 0.93, "crit": 1, "desc": "OAuth device code response field forms", "from": [ { "file": 14 } ], "uses": [ 102 ] }, { "id": "objectives/exfiltration/oob/endpoint::web-content-oob-service-reference", "conf": 0.9, "crit": 3, "desc": "OOB service URL in web content", "from": [ { "file": 14 } ] }, { "id": "well-known/tool/detection/security-scanner::secret-redactor-symbols", "conf": 0.9, "crit": 1, "desc": "Secret redactor / leak-scanner function names", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/decode/custom::fromcharcode-apply-array", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "Converts character-code array to string", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/decode/base64::multiple-node-base64-decodes", "conf": 0.8, "crit": 3, "desc": "Multiple Node.js Base64 decodes", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/property/transition::js-float-array-constructor", "conf": 0.9, "crit": 2, "desc": "Constructs a Float64Array buffer", "from": [ { "file": 14 } ] }, { "id": "well-known/lib/cloud/aws-sdk-js::v3-imds-endpoint-marker", "conf": 0.98, "crit": 2, "desc": "AWS SDK JS v3 IMDS endpoint", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/graphql::api-route", "conf": 0.92, "crit": 3, "desc": "GraphQL API route request", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-create-repo-and-contents-write", "conf": 0.95, "crit": 3, "desc": "Creates a GitHub repo and writes contents", "from": [ { "off": 3336645, "file": 14, "line": 2 } ], "uses": [ 106, 155 ] }, { "id": "micro-behaviors/fs/file/extension::locked-extension-reference", "conf": 0.9, "crit": 3, "desc": "References the .locked file extension", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/spawn-variable::spawn-variable-program", "conf": 0.82, "crit": 3, "desc": "Node spawns a variable program path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-poll-status", "conf": 0.93, "crit": 3, "desc": "Device authorization pending or completion status", "from": [ { "file": 14 } ], "uses": [ 72, 129 ] }, { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata" }, { "id": "micro-behaviors/data/control-flow/analysis::js-zero-based-index-loop", "conf": 0.8, "crit": 2, "desc": "JavaScript zero-based index loop", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/services/ecommerce::amazon-hostname-field-reference", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Amazon hostname stored in a hostname field", "from": [ { "file": 14 } ], "uses": [ 135, 169 ] }, { "id": "objectives/anti-static/obfuscation/payload/config::api-named-byte-array-const--rx-2", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 1, "desc": "ENDPOINT identifier (config name)", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/dns/lookup/txt::node-indexed-txt-query-label", "atk": "T1071.004", "mbc": "C0011", "conf": 0.95, "crit": 3, "desc": "Indexed DNS TXT query loop", "from": [ { "off": 2577, "file": 3, "line": 61 }, { "off": 91422, "file": 14, "line": 2 } ], "uses": [ 21, 22, 189 ] }, { "id": "micro-behaviors/crypto/hash/hmac::node-timing-safe-equal-text-call", "mbc": "C0029", "conf": 0.92, "crit": 3, "desc": "Node.js constant-time comparison call", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-auth-word", "conf": 0.45, "crit": 1, "desc": "auth route vocabulary word", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/string/search::compiled-js-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of JavaScript regex patterns", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/spawn::stdio-ignore", "mbc": "F0005", "conf": 0.85, "crit": 3, "desc": "Spawns a child with standard I/O ignored", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/vars/cicd::multi-ci-provider-env-refs", "conf": 0.92, "crit": 3, "desc": "Multiple CI provider environment references", "from": [ { "off": 1076653, "file": 14, "line": 2 } ], "uses": [ 6, 25, 33, 108, 230 ] }, { "id": "micro-behaviors/process/create/shell/build::eslint-fix-command", "atk": "T1059", "conf": 0.8, "crit": 3, "desc": "ESLint fix command", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/buffer::uint8array-constructor", "conf": 0.9, "crit": 2, "desc": "Constructs a Uint8Array buffer", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/vars/access::node-home-access", "conf": 0.9, "crit": 3, "desc": "Node reads HOME directory environment variable", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/manipulation::sensitive-token-redaction", "conf": 0.8, "crit": 3, "desc": "Redacts a token or secret value", "from": [ { "file": 14 } ] }, { "id": "metadata/library/structure::js-medium-minified-line", "conf": 0.9, "crit": 1, "desc": "JavaScript contains a long minified line", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/auth::device-code-poll-identifier", "conf": 0.93, "crit": 3, "desc": "Device authorization polling identifier", "from": [ { "file": 14 } ], "uses": [ 129, 175 ] }, { "id": "micro-behaviors/communications/http/services/aws::sigv4-algorithm-constant", "conf": 0.9, "crit": 3, "desc": "AWS Signature V4 signing algorithm constant", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/serialize/json-write::json-stringified-text-field", "conf": 0.9, "crit": 3, "desc": "Serializes a text or caption field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-write-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents write endpoint path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/syntax/schema::hostname-object-key", "conf": 0.9, "crit": 1, "desc": "Object literal declares a hostname key", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/headers::javascript-basic-auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JavaScript Basic Authorization header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::dmi-vendor-product", "conf": 0.5, "crit": 2, "desc": "DMI vendor and product identification fields", "from": [ { "file": 14 } ], "uses": [ 52 ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-login-word", "conf": 0.45, "crit": 1, "desc": "login route vocabulary word", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/file/write/direct::node-write-file-sync", "conf": 1.0, "crit": 3, "desc": "Node synchronously writes a file", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-result-word", "conf": 0.4, "crit": 1, "desc": "Command/result assignment pair", "from": [ { "off": 5229, "file": 14, "line": 2 } ], "uses": [ 1, 47 ] }, { "id": "micro-behaviors/data/serialize/json::refresh-token-field-stringify", "conf": 0.96, "crit": 3, "desc": "JSON serialization includes refresh-token field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detaches a handle with unref()", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/application/config::vscode-user-dir-components", "conf": 0.92, "crit": 1, "desc": "VS Code user config directory components", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::js-bearer-header-from-secret-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Uses a credential variable in Bearer header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-begin", "conf": 0.7, "crit": 2, "desc": "References PEM certificate header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/config/schema::uppercase-host-assignment-label", "conf": 0.6, "crit": 1, "desc": "Uppercase HOST assignment label", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/exec::node-execfile-reference", "atk": "T1059", "conf": 0.86, "crit": 3, "desc": "References Node execFile API", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 14 } ] }, { "id": "metadata/file/string/cloud::cloud-instance-metadata-link-local-host", "conf": 0.88, "crit": 3, "desc": "Cloud instance metadata link-local address", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-app-installation-token-api", "conf": 0.88, "crit": 3, "desc": "GitHub App installation token endpoint path", "from": [ { "file": 14 } ] }, { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-delete-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents delete endpoint path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/prototype::return-this-prototype", "conf": 0.7, "crit": 3, "desc": "Prototype methods returning this", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/hash/file::hash-mismatch-abort", "conf": 0.9, "crit": 3, "desc": "Reports a downloaded digest mismatch", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/source/syntax/schema::host-identity-field-pair", "conf": 0.88, "crit": 3, "desc": "Object literal pairs hostname and username keys", "from": [ { "off": 3335258, "file": 14, "line": 2 } ], "uses": [ 104, 207 ] }, { "id": "micro-behaviors/os/env/vars/credentials::aws-secret-access-key-var", "conf": 0.86, "crit": 1, "desc": "AWS secret-key environment name reference", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/security/auth/cloud::node-aws-container-metadata-ip", "conf": 0.95, "crit": 3, "desc": "Node references AWS container metadata address", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/vars/cicd::multi-ci-provider-env-refs--circleci", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (CIRCLECI)", "from": [ { "file": 14 } ] }, { "id": "metadata/lang/source::generated-code-do-not-edit-text", "conf": 0.85, "crit": 1, "desc": "Generated code do-not-edit warning", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/oauth::refresh-token-snake-assign", "conf": 0.9, "crit": 3, "desc": "Snake-case OAuth refresh_token field assign", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/env/access::node-process-env-object-field", "conf": 0.9, "crit": 3, "desc": "Places full Node environment in object field", "from": [ { "file": 14 } ] }, { "id": "metadata/package/manifest/entrypoint::pkg-types-field", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript types entry" }, { "id": "third_party/SigBase/JS/NPM/Supplychain/Compromise/Sep25", "conf": 0.9, "crit": 5, "desc": "Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)" }, { "id": "micro-behaviors/process/interpreter/wasm::webassembly-module-instance-check", "conf": 0.85, "crit": 3, "desc": "Constructs WebAssembly Module or Instance", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/vcs/git::public-forge-git-clone", "atk": "T1105", "conf": 0.92, "crit": 3, "desc": "Git clones a public code forge", "from": [ { "off": 1054618, "file": 14, "line": 2 } ], "uses": [ 20, 118 ] }, { "id": "metadata/package/manifest/repository::npm-name-repo-mismatch", "conf": 0.8, "crit": 3, "desc": "Package name disagrees with its repository", "spans": [ [ 0, 37 ] ] }, { "id": "metadata/package/dependencies/manifest::npm-phantom-runtime-dependency", "conf": 0.82, "crit": 3, "desc": "Declared runtime dependency lacks module import", "spans": [ [ 0, 38 ] ] }, { "id": "micro-behaviors/communications/http/download/write::script-fetches-and-writes-remote-content", "atk": "T1105", "conf": 0.94, "crit": 3, "desc": "Script saves fetched remote content to disk", "from": [ { "off": 20412, "file": 4, "line": 394 }, { "off": 565508, "file": 14, "line": 2 } ], "uses": [ 71, 96, 152, 211 ], "spans": [ [ 0, 41 ] ] } ] }, { "ctx": [ { "b": "b6v%raAITBx\u003e8lei%{dtAV!Z@v@=c?By^^MzE^E0xcotWd0fcpB08!RaARphB1Q*bv@=c?By^^MzE^E0xdj%JD(%?kvRPE:Bs}6zwNPW(au{$%w{503BzkVhc#QTVz7D/BefFZ-diJ%AarR^Hx\u003ewFoyCE1}jV%{gzE^r\u003cx(mG)diJyYauZ\u0026.i%)8MarU\u0026oAV![7B7lsQawVDYwN/*mxjVfXCwZk$z/xodBA{n=B7ol8Acc2sc#yHTyBIsLarR^Hx\u003ewFoa.ke9v\u003c3eDasFBDwPPasx(k57wPIu7koIa^e)?%%A@", "ln": 0, "col": 1, "line": 1 }, { "b": "wO#TcwPzi*y?kTIBAhInefFOpBugKRB-7Yhx(v(qdiJ%WA+funA=91ptwEIaaBLwXi%)8MarV7tarR^HpHX6Iv@%tlwObT]wL^z=AaK6iC{)OZazS.-ay]58v\u003c%FDEjlp1asH\u0026AzEW^5z/c$wefF^XazSIJyCEsYDKp(rarUxgasI1Xau.\u003eJaA.NjwObT]wN)kjyCE1}azT4CarR^Hz^d0jt{8oMzcH^Yi%{x+dlv(Wvr9F$uUaF3z/P}#ByxhjjS(d{xLzJgcmf\u003cSxLzJuuTEw?AbP=sq/(C*diK1=azb+lv@#B6zyxuMaz2!pz/P@vdiJ%AarR^Hw]zYjd0x3taAeDqzxJ^BazCBgc#ZpLjV%]iwmYvYB.(dzasnATaX#MZwN/*mAb](sz/*nzwIdU8B5d0$p\u0026ZF[wPz)re[nsay:-\u003etAbP=sB1wCMdjDxDuT[a/vru6Ex(mD}zF7weCYmOwBAn#Qz7D/Gdlv(+i%[+)ygQ)%e[wK9x(mGUA=k]dA==NPwQ5fjA==vNar\u003ef1wPHN:wozZ1a$K\u003c-aA?gfB.9PRBAhInaBLX23svdKCYmOwBw)o\u0026AWU%tADL#owHF-PflqezflIwJy\u0026Z^HefFIGAbP=sB16fT", "ln": 304, "col": 16, "line": 6 } ], "depth": 1, "facts": { "imp": [ [ "", "Object.getOwnPropertyDescriptor" ], [ "", "Object.defineProperty" ], [ "", "Object.prototype.hasOwnProperty.call" ], [ "", "__createBinding" ], [ "", "Object.defineProperty" ], [ "", "__exportStar" ], [ "", "require" ], [ "", "./src/utils" ] ], "mbr": [ "Object.create", "Object.defineProperty", "Object.getOwnPropertyDescriptor", "Object.prototype", "Object.prototype.hasOwnProperty", "Object.prototype.hasOwnProperty.call", "desc.configurable", "desc.writable", "m.__esModule" ], "tgt": [ "Object.defineProperty", "Object.getOwnPropertyDescriptor", "Object.prototype.hasOwnProperty.call", "__createBinding", "__exportStar", "require" ], "funcs": [ [ "anonymous", 88 ], [ "anonymous", 327 ], [ "anonymous", 410 ], [ "anonymous", 541 ] ], "metrics": { "ast": { "op.eq": 2, "op.ne": 1, "op.lor": 4, "op.land": 3, "op.lnot": 3, "max_depth": 19, "call_count": 7, "node_count": 345, "member_count": 9, "op_density.eq": 0.01, "op_density.ne": 0, "op_density.lor": 0.01, "op_density.land": 0.01, "op_density.lnot": 0.01, "member_depth_max": 4 }, "file": { "size": 804, "entropy": 4.96 }, "text": { "lines": 17, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 130, "char_entropy": 4.96, "unique_chars": 52, "top_char_null": 0, "string_density": 0.29, "top_char_ratio": 0.08, "avg_line_length": 46.29, "max_line_length": 126, "last_line_length": 46, "whitespace_ratio": 0.18, "identifier_density": 4.06, "line_length_stddev": 34.48, "normalized_string_count": 1.21, "suspicious_identifier_ratio": 0.22, "normalized_unique_identifiers": 5.63 }, "binds": { "count": 6 }, "binary": { "peak_region_bytes": 804, "peak_region_entropy": 4.96 }, "imports": { "count": 1, "relative": 1, "relative_ratio": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 41, "count": 5, "avg_length": 8.2, "max_length": 11, "path_count": 1, "avg_entropy": 2.67, "entropy_stddev": 0.55 }, "functions": { "nested": 1, "density": 23.53, "anonymous": 4, "avg_params": 2.5, "code_ratio": 0.94, "max_params": 4, "one_liners": 1, "length_stddev": 2.55, "no_params_count": 1, "avg_length_lines": 4, "max_length_lines": 8, "min_length_lines": 1, "avg_nesting_depth": 0.25, "max_nesting_depth": 1, "single_char_params": 7, "avg_param_name_length": 1.8 }, "identifiers": { "count": 69, "unique": 23, "avg_length": 7.65, "max_length": 24, "min_length": 1, "avg_entropy": 2.19, "reuse_ratio": 0.33, "length_stddev": 5.61, "has_digit_ratio": 0.04, "sequential_names": 5, "single_char_count": 4, "single_char_ratio": 0.17, "high_entropy_count": 3, "high_entropy_ratio": 0.13, "all_lowercase_ratio": 0.65, "numeric_suffix_count": 1, "underscore_prefix_count": 3 } } }, "id": 2, "mol": "H₂(Db₂Po)Md(Pa)", "path": "focus-20.0.4.tgz!!package/index.js", "pid": 0, "refs": [ { "to": "./src/utils", "off": 779, "file": 17, "kind": "local" } ], "risk": 5, "sha": "fb375439bb35b5e89bed56cbd2ad5ee6c454418d581b013ceb390bd2ca241664", "size": 804, "traits": [ { "id": "metadata/import/npm/relative/1/src/utils::relative/1/src/utils", "conf": 0.95, "crit": 2, "desc": "imports ./src/utils", "spans": [ [ 778, 0 ] ] }, { "id": "metadata/build/bundler/wrapper::js-tslib-reexport-helper", "conf": 0.97, "crit": 2, "desc": "Calls a tslib/TypeScript re-export helper", "spans": [ [ 495, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 568, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 37, 0 ] ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist" }, { "id": "metadata/package/files/runtime::javascript-utils-basename", "conf": 0.85, "crit": 3, "desc": "JavaScript utils.js basename" }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "spans": [ [ 568, 16 ] ] }, { "id": "micro-behaviors/data/source/property/attributes::define-property-variable-arguments", "conf": 0.92, "crit": 3, "desc": "Defines an object property using variables", "spans": [ [ 368, 34 ] ] }, { "id": "micro-behaviors/process/create/load/local::cjs-local-require-call", "atk": "T1059.007", "conf": 0.9, "crit": 3, "desc": "CommonJS local-module require call", "spans": [ [ 770, 7 ] ] }, { "id": "metadata/build/bundler/wrapper::js-tsc-reexport-barrel", "conf": 0.96, "crit": 2, "desc": "Transpiled CommonJS re-export barrel", "uses": [ 1 ], "spans": [ [ 495, 0 ] ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "uses": [ 9 ], "spans": [ [ 495, 0 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "b6v%raAITBx\u003e8lei%[+)ygQ)%e[wK9x(mGUA=k]dA==NPwQ5fjA==vNar\u003ef1wPHN:wozZ1a$K\u003c-aA?gfB.9PRBAhInaBLX23t1E3z/P@ve[wK9vrDydauZ\u0026TwObv[y\u0026\u003c2si%]FozGx[xB7n({zddK2v@(0iauZ\u0026/wPq\u003cbA+cTykW!LyB.\u003eGbeO5BoyIv(zB7n({zddK2v@\u0026?yi%)R]azCXiz/P}xDMWDIwmoN\u003erc7ABzF0P}efF5ly*?ARwO=r%A=SvKazbUjz6gh\u003ezGx]xwnb%nCYmFcBsfcSv@DmaBrC*Ey*?A)B-.tlB6*TAjS[=RADL#owHF-/zGx]xwnb%nCYmFcBs?SSx(4\u0026mdlv(Dz/fSraA.^uy\u0026-@rauZ\u0026/wPq\u003cbA+cTye?O!fe?.u?x(4\u0026mdlv(MwPP5jvqPNq3taA#v@#B6zxJF3w)]*#Byc:Jz/x/jz/fRBaBsCrarR!vw/@GBz/x/jz/fRGzEEw", "ln": 0, "col": 1, "line": 1 }, { "b": "f!NfYsA57+Bxry3yJBD6v}v8qdgdguarR^HarR^HarS(\u003eu)4*VA=L-eBzMjBB9hCvz/P@hwi7\u0026BB.\u003e(nBywV{ef]N!Abn%8uV*E8y\u0026-@re]#eOAbP=swN[RNvrua1A=2(0x([2-CZRg!mr\u0026lTAbo8Daz#ADxcq5fwmV)3vrujbwPIv4x(Ff43lQDlarR^HarR^HauyR)cP.UTarR^HarR!pz/fSmy?kkyvrcllu{[NrvrDydx(mMaBz\u0026oHw{4{aB97\u00262yBplkzE:(hxM59ezF786C4CYtBzbxaxcqnfzEWl2zF{Ufz!0{haA}mnaAIHkv}/K?wN)zsDU4CzA:.ZYBy/(ddlv\u003eVarR!P3lQDlaz2wgwGVsbarR^HarR^HzEEx[auY", "ln": 462, "col": 43, "line": 12 }, { "b": "wO0qL3lQDlarR^HarR^Hay/tcB95Kky?#yRAc0c+ax@bk3lQDlarR^HarR^HazbLjasH-rzGx[xvq{fZvruf9z!pb2AbXSZBzb.AaBsCrarR^HarR^HarR^HarR!ny?#yRAc0TJB-RjAu[9SKDTQ(jp*[DVEpaG=3lQDlarR^HarR^HaBKOtarR^HarQ", "ln": 1202, "col": 63, "line": 30 }, { "b": "AbY\u003evjS)%mi%)8MarR^HarR^HarUxgasIbozdK?kjV%]nw{4{aB97\u00262yBpkKclNkCBzkVhB1RALz!-\u0026[BAn(NDKp(rarR^HarR^HarR^HarUomv%8\u0026*zB5kXB09Q*z/x/jz/fRGAb](iwN/?6e]$#Fx(\u003e:Jegh(0zddxic#ZQTjW70ce{8bFz73?Zi%)8MarR^HarR^HarR^HarUxgasFS(efGgRy*?A)B-.tlB6!", "ln": 2180, "col": 25, "line": 55 }, { "b": "A=+#6zE:(eA=kY7v@%wjAbV}qvqPN%aA8ahBAzkmxcqefvrua1A+#}hA=k!qBzbkdvq{fdzEEx[3lQDlarR^HarR^HarR^HarR^Hatkw\u003cyisPtayO!\u003eaAhd9By]Diz6i}saARpdaz$R8wGV8kayX[8B8UY2x\u003ez6?3lQDlarR^HarR^HarR^HarR^HazbLjasI5qBrCoujS(Buazz@XazbL4B-Qt@l2Z^:e]k9pxlm/GazAtRdiJ%AarR^HarR^HarR^HarR^HarR^HarR^Hv@DmaBrCKyz!-\u0026[BwumYwGTbUw]zg4B5cWtAbY(5x\u003cA!carR^HarR^HarR^HarR^HarR^HarR^Hw]zg4B5cWtAbY(5x\u003cz\u0026AayDVGfjw*sB1X!=Ab](iwN/*SvqPO7u][YrarR^HarR^HarR^HarR^HarR!P3lQDlarQ", "ln": 2428, "col": 38, "line": 59 }, { "b": "wGU]eaxhnZA+frgy\u0026%\u0026lz/b[nfczwWarR^HarR^Hx\u003ewFoa-}=)z/ff3xd^+uv@co#wIdXmv@co#wPGnwzGwY!w]/yIaBsCGfczwWarR^HarR^HarU=ElVl\u003cOx\u003eG5fCW\u003eMjwmWxjB-RjAcVS^gwPzv1v}xZlwg?$BcN?a:fe1B\u003carR^HarR^HaBKOIfczwWarR^HarV7", "ln": 3802, "col": 65, "line": 95 } ], "depth": 1, "facts": { "imp": [ [ "", "Object.defineProperty" ], [ "", "exports.default" ], [ "", "schematics_1" ], [ "", "require" ], [ "", "xplat_utils_1" ], [ "", "require" ], [ "", "utils_1" ], [ "", "require" ], [ "", "name" ], [ "", "name" ], [ "", "extraNote" ], [ "", "console.warn" ], [ "", "name" ], [ "", "appPaths" ], [ "", "allApps" ], [ "", "allApps.push" ], [ "", "libsDir" ], [ "", "tree.getDir" ], [ "", "allLibs" ], [ "", "libsFolders" ], [ "", "allLibs.push" ], [ "", "packagesDir" ], [ "", "tree.getDir" ], [ "", "allPackages" ], [ "", "packagesFolders" ], [ "", "allPackages.push" ], [ "", "focusOnApps" ], [ "", "focusOnApps" ], [ "", "options.projects.split.map" ], [ "", "options.projects.split" ], [ "", "p.trim" ], [ "", "projectName" ], [ "", "focusOnApps.i" ], [ "", "utils_1.FocusHelpers.updateIDESettings" ], [ "", "utils_1.FocusHelpers.updateIDESettings" ], [ "", "../../utils" ], [ "", "@angular-devkit/schematics" ], [ "", "@nstudio/xplat-utils" ] ], "mbr": [ "Object.defineProperty", "allApps.push", "allLibs.push", "allPackages.push", "console.warn", "exports.default", "focusOnApps.length", "libsDir.path", "libsDir.subdirs", "options.name", "options.projects", "options.projects.split", "options.projects.split().map", "p.trim", "packagesDir.path", "packagesDir.subdirs", "schematics_1.chain", "tree.getDir", "utils_1.FocusHelpers", "utils_1.FocusHelpers.updateIDESettings", "xplat_utils_1.getAppPaths", "xplat_utils_1.isXplatWorkspace", "xplat_utils_1.prerun", "xplat_utils_1.supportedPlatformsWithNx" ], "tgt": [ "Object.defineProperty", "allApps.push", "allLibs.push", "allPackages.push", "console.warn", "options.projects.split", "options.projects.split().map", "p.trim", "require", "tree.getDir", "utils_1.FocusHelpers.updateIDESettings", "utils_1.FocusHelpers.updateIDESettings()" ], "funcs": [ [ "default_1", 337 ], [ "anonymous", 1099 ], [ "anonymous", 2312 ] ], "metrics": { "ast": { "op.lt": 1, "op.ne": 1, "op.land": 3, "op.lnot": 1, "max_depth": 19, "call_count": 20, "node_count": 705, "member_count": 24, "max_array_len": 8, "op_density.lt": 0, "op_density.ne": 0, "sequence_count": 5, "op_density.land": 0, "op_density.lnot": 0, "member_depth_max": 4 }, "file": { "size": 3997, "entropy": 4.39 }, "text": { "lines": 103, "top_char": 101, "max_ws_run": 13, "digit_ratio": 0.01, "space_count": 1324, "char_entropy": 4.39, "unique_chars": 73, "top_char_null": 0, "string_density": 0.17, "top_char_ratio": 0.05, "avg_line_length": 37.81, "max_line_length": 122, "last_line_length": 4, "whitespace_ratio": 0.36, "identifier_density": 1.15, "line_length_stddev": 23.8, "normalized_string_count": 1.68, "repeated_char_sequences": 60, "suspicious_comment_ratio": 0.05, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 7.33 }, "binds": { "count": 19 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 4.8 }, "source": { "function_count": 1 }, "imports": { "count": 3, "relative": 1, "relative_ratio": 0.33, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 390, "count": 17, "avg_length": 22.94, "max_length": 106, "path_count": 1, "avg_entropy": 3.19, "empty_count": 1, "entropy_stddev": 1.1 }, "comments": { "code": 2, "chars": 1229, "count": 40, "lines": 40, "base64": 1, "high_entropy": 1, "to_code_ratio": 0.63 }, "functions": { "count": 1, "nested": 2, "density": 2.91, "anonymous": 2, "avg_params": 1.33, "code_ratio": 1.17, "max_params": 2, "one_liners": 1, "length_stddev": 28.88, "avg_name_length": 9, "avg_length_lines": 40, "max_length_lines": 70, "min_length_lines": 1, "avg_nesting_depth": 1, "max_nesting_depth": 2, "single_char_params": 1, "avg_param_name_length": 4.75 }, "identifiers": { "count": 118, "unique": 49, "avg_length": 8.04, "max_length": 24, "min_length": 1, "avg_entropy": 2.56, "reuse_ratio": 0.42, "length_stddev": 4.29, "has_digit_ratio": 0.08, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.04, "high_entropy_count": 4, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.49, "numeric_suffix_count": 4 } } }, "id": 3, "path": "focus-20.0.4.tgz!!package/src/schematics/mode/index.js", "pid": 0, "refs": [ { "to": "../../utils", "off": 312, "file": 4, "kind": "local" } ], "risk": 2, "sha": "3c1a00842a51daf05ee58a2a5638c82c92967e65508e3c07991c2f5d3817ea1c", "size": 3997, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "spans": [ [ 673, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "spans": [ [ 1251, 0 ] ] }, { "id": "metadata/file/profile/locale::language-label-table-name", "conf": 0.95, "crit": 2, "desc": "Contains a UI language-label table", "spans": [ [ 510, 0 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript source filename", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/library/runtime::js-module-exports", "conf": 1.0, "crit": 2, "desc": "Exports a JavaScript module", "spans": [ [ 77, 0 ] ] }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "spans": [ [ 2648, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-zero-based-index-loop", "conf": 0.8, "crit": 2, "desc": "JavaScript zero-based index loop", "spans": [ [ 2577, 0 ] ] }, { "id": "micro-behaviors/data/string/search::js-includes-indexof-call", "conf": 0.82, "crit": 2, "desc": "Searches strings with includes or indexOf", "spans": [ [ 3856, 0 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "b6v%raAITBx\u003e8lei%[+)ygQ)%e[wK9x(mGUA=k]dA==NPwQ5fjA==vNar\u003ef1wPHN:wozZ1a$K\u003c-aA?gfB.9PRBAhInaBLX23t1E3z/P@ve\u003ef+?B-Q8+y\u0026A%aB09Q*C5I89att\u003e:v@DmaBrC*Ey*?A)B-.tlB6*TAjS[=RADL#owHF-/zGx]xwnb%nCYmFcBs?SSx(4\u0026mdlv(Dz/fSraAg+hxKrFpjS[=RADL#owHF:wvrufbdlv(Dz/fSrazbX4f^5R4A+flkx(W=kb4+)udlv(Dz/fSraB4:tghp\u003eMjS[=RADL#owHF:Ezep$xB0r4{3s!0(B95KnwP?\u003c6Byc:BjS[=RADL#owHF-/zG)*BwP?\u003c6BrSd}3u/\u0026#avZoVB-Q8+y\u0026A%aB2%ZSw{503BzkVhasGY$v%8\u0026-wO=r%A=SVLDKp(rarUoszEW^5z/cXuAaAy0wL2oUq!p5)x(mN8c#T6Dx(v)gdiJ%AarR^HarR^HA+funA=90FBAg@7ec", "ln": 0, "col": 1, "line": 1 }, { "b": "fcB+yzGx-jwId!qxdbcKz/PSmAa9l/ay]hbiWVE3Ab](bwPI]Bv%qDidjEs=arR^HarR^HarR^HarR^Hfe1CTz/fSray]hbpgn0JauZ\u0026^A=kD0B8@%zCvS9Je]$#Fx(\u003e:Jfdeh3A@", "ln": 616, "col": 18, "line": 18 }, { "b": "z/PSwu)4GMcNQ$.arR^HarR^HarR^HarR^Hy?mYhx(=:^y\u00261fmvpK6}jS[uBy\u0026:eH3lQDlarR^HarR^HarR^Haz+RhazC)=CW\u003eMjwnb{]auZ\u0026VvqH0@i%)8MarR^HarR^HarR^HarUGiBrC1h", "ln": 945, "col": 61, "line": 22 }, { "b": "z/fRGwmY{Uz!9A4E0^5PAcb/jzGvBvwP*^^wmV(DjV%]nw{4{aB97\u00262yBpLNDKp(rarR^HarR^HarR^HarR^HarSr\u003caAIjmCoysgyZIpcarR^HarR^HarR^HarR^HarUxtmS\u0026J-B94", "ln": 1143, "col": 26, "line": 27 }, { "b": "f!NfYsA57+Bxry3yJBD6v}v8qdjDx^3lQDlarR^HarR^HarR^HarR^HarR^HazbLjasH-rzGx[xA3f7haB4\u003cwvrt\u003e0BzkMjuOKfOB-qqrA=+(6p\u00266MZw]zZbB606$xIJ!3aBsCrarR^HarR^HarR^HarR^HarR^HarR^HarR!pz/fSrayPkdmRMWXwPv", "ln": 1305, "col": 41, "line": 30 }, { "b": "arR^HarR^HarR^HarR!pz/fSraz2!cy\u0026%o1wfs2TAbn%8w]zZbB1RfAv@co#wPGnsdiH?$w)]H%wGT2RBAhIni%)8MarR^HarR^HarR^HarR^HarR^HarR^HarUfjzGx[xvq{fPx(4)5AV^H", "ln": 2700, "col": 14, "line": 57 }, { "b": "B-Qt@l2Z^:asnATz/x/jz/fRGw]zg4B5cWtAbY\u003eJy?mG%Bz99CDKp(rarR^HarR^HarR^HarR^HarR^HarR^HarR^HarSr\u003cazbL4B-RnmxcqbgayPkdA%:3jarR^HarQ", "ln": 2893, "col": 44, "line": 59 }, { "b": "arR^HarR^WfcB$vaz2!cy\u0026%o5zF782zH0vzy*?A$z/PXqvrrS2y?$TBB7GCoBzbkdw]7)*3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^Hatkw\u003cBzbxfazC)tB-Rb8azbLjaxJb-q/(}#z6i[xAbY-oBrC47y\u0026sI8arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hx(=Z/v@co#x(mMajS[\u0026!B.9SwarR^HarR^H", "ln": 3777, "col": 26, "line": 73 }, { "b": "aBsCrarR^HarR^HarR^HarR^HarR^HarR^HarR!pz/fSrayPkdpgn0JauZ\u0026^e]\u003eJxy***+c){F]fjw*sB1X)(aswJ=i%)8MarR^HarR^HarR^HarR^HarR^HarR^HarSr\u003cazbtdB95KBwPIB8ayP85azCZov{%B\u0026az#9uw]zg4B7]J83lQDlarR^HarR^Hao", "ln": 4168, "col": 57, "line": 81 }, { "b": "atkw\u003ccN{P0vq{gbfk+iux)a6ev@=p5Bs!%}B8\u003e+zAa9l(vp%d7yiarhcPSwZvqH0@ed9HxarR^HarR^HarR^HarR^HarR^HarS3YdLCjHAc0WIvrujbwPIv4x(FeCdLCENz!\u003czw", "ln": 7116, "col": 24, "line": 139 }, { "b": "iV@J+B.99harR^HarR^HarR^HarR^HarR^HarR^HcN{P0vq{gbfk+iux)a6ev@=p5Bs!%}B8\u003e+zdK)83e]2CPiV@+RarR^HarR^HarR^HarR^HarR^HarR^HarR^HCw7M9iV]^}c$lRawO${[wHPlNB0\u0026HCarR^HarR^HarR^HarR^HarR^HarR^HEjLZFarR^H", "ln": 7353, "col": 56, "line": 142 }, { "b": "vqG:5z//V7AV!!fAc0dgA+cw8CW\u003eMjwmYo]c$NTkwPh-lw]zYjBzbkdz/fbeBzb98cVZztwOD3{azbL4B-Rb8aA8cD3lQDlarR^HarR^HarR^Hatkw\u003cvqH16aAIWAAbP=sazbL4B-RnmxcqbgayPkdB1.(YBZ!%3y?d9$Ej)5SarR^HarR^HarR^H", "ln": 10932, "col": 27, "line": 219 }, { "b": "atkw\u003cr-pbdz!9A4B9hCvz/P}barR^HarR^Hy?mYhx(^r@lVlHDi%)8MarR^HarUfjzGx[xx(^0Sv\u003c0]SAb](bwPI]BAbn%8w]zZbau.\u003egcUcUaCwg}xi%)8MarR^HarUxgasIeEBzkVhB1RPRwPy^\u0026wmoN\u003eB15kU3lQDlarR^HarR^Hatkh]3lQDlarR^HarR^HarScRrDz.(aAIaoBzkS9A%:3jarR^HarR^HarR^Rfa5*AarR^HarR^HarSr\u003cay/tc", "ln": 12498, "col": 8, "line": 248 }, { "b": "arR^HarR^HarR!ywPP5qB7Gw\u003cwPS3dzFa2\u003eq:UFlwL=/SxDPCXx(^0Sv*Tt3arR^HarR^HarR^HarS(\u003eAb](bwPI]BwO#Vznkz@Gas^^warR^HarR^HarR^HarR^HarR!mfhc7?A::0lff%L@y?Wx/BzkVhax9A4AbP=sfgfU*wIm58wPxCBwPS3dzFa2yyiarhu\u003cX20arR^HarR^HarR^HarSY/cOGTKAXzlEv{%gblVlHDfi978AXzGBBAzkmxlbXuB8L}zi%)8MarR^HarR^HarUfjzGx[xCwg@9z*cm[z/65djS[Y:z!0v1B1R3wB$M6Sp^^PGk%2z@arR^HarR^HarR!vw/@HCx(mE1Cxlq[zdLdsDKp(rarR^HarR^HarR^HarU/FwPyZXBAzkmxld9LlVlHDp*[DVauZ?}fF1t=vruf\u0026f!NiVx(kvFCwg@9z*cm[z/65pasxJ{wmWbtasyfgwPxdHaszkwBAzkmxlbXuB8L}zdlv\u003eVarR^HarR^HarR!P3lQDlarR^HarR^Hatkw\u003cv@Dmaz!@#qy\u0026r@mcV%GwA-lK\u003eBzkS9B5(jbz!9AQvrufzcOfyYwPyZXBAzkmxld9LlVlHDp*[DVdlv\u003eVarR^HarR^HarR!vB5)t", "ln": 12787, "col": 2, "line": 257 }, { "b": "wmXbGwNPW(q!p5)x(mN8ph+k=auZ\u0026PnPVt3aAhmuB7]91wGVnpBS+jkzyoJGxKM6}ayMynB7GwmB7GDnx(mN8e]2DCzxKjoBs[Xcw/#ekefF\u003eIwO@R\u003eqY[CCwmV(-B7GwmB7GDnx(mN8ayPd#aAH$mwGUA0C{3)pzE:(dw/#eaBAzkmxcqqmazthbwGUYeay/C6vru6\u003ee){:FarR^HarR^HarR^Hfe1CTz/fSmy?kknz!yECx(^r@lVlHDiWVE)B5)uHz!9Ad", "ln": 13371, "col": 21, "line": 267 }, { "b": "zFa2.B8L}EaA8jvx(v)ge{hkDA-E6?vru74efF\u003eIBzkVhB16fTarR^HarR^HarR^HarR^HarR^Hc[)g{w]?rle{ztIBy^{Qy?lK\u003czEUazB-Rbmq!p5)x(mN8r-qw7wmXOCBz9iFc[)g{wmY}1x()Ype]$PAx\u003c\u003e*(DsYY\u0026z/d0LzE[2\u003cwPS3dzFa2tdlv\u003eVarR^HarR^HarR^HarR^HarR^WfcBj\u0026l@b\u0026^Ab]VgBrCHABrCWswGVbmwmoN\u003eB0bsdwmV8\u003carQ", "ln": 13962, "col": 80, "line": 275 }, { "b": "arR^HarR^HarR!P3lQDlarR^HarR^Haz2wgwGVsbarR^HarR^HarR^HarR^Hv@Dmaz!@#qy\u0026r@mu}$SZwGV8kaxzz-lVlHDaA.:pA=Tn:zF{UdwP?T3z/xM8zGE1rz!9A4B7GCCaB4\u003cwvrrS4z/](baz#atazbt9wftq#C{3c^avy6TwGV59BAzkmxlbhfzxK3", "ln": 15211, "col": 2, "line": 299 }, { "b": "arUfjzGx[xCw?IqB8UL$wM9eZBzkS9B5lp!xDPCXc[)g{Aa9\u003c4uOKfFz!T8rc#:iBv}x.5e[o9oc[cX\u0026cOxN-v@C)?cOcw/B7GDnx(mN8e]2DCzyl\u003e{3lQDlarR^HarR^Hatkw\u003cv@Dmaz!@#qy\u0026r@mcWfGHyJBD6v}wOIBAzkmxlc)TBz9Y.eo=2MyJBD6v}wOIBAzkmxlc)TBz99+3lQDlarR^HarR^Haz+RhaA}:AyJBD6v}wOIBAzkmx8", "ln": 15560, "col": 11, "line": 308 }, { "b": "vrcSDp\u0026ZbVwPzv1v}xZ?3lQDlarR^Hatkw\u003carSY/uTEtTA=br5wJHkwarR^HarR^WfcB$vasICFzE^WfB4yj^wHO:G3lQDlarR^Hatkw\u003carUSzwObH]wO#0?B4g7:wmY^7jS[@.zE^WfB4yj^wJHkwarR^HarR^WfcCVIarR^HarR^Hfe1CTz/fSraAhvjw]/7TazbWEA+eV\u0026wnc6.D2vauAb]J4wPzv1v}xZJz!@@}AW-RMx(4)5AWUJxjW702B1RJQvrtB[zEU8fz!T8qAb]J4wPzv1v}xZJz!@@}AX5tBdjD(-B3%..wN/?2A^o5Zdlv\u003eVarR^HarR^WfcB\u003evzE:(4x(XopaA8de3lQDlarR^Hatkw\u003cr8k[T", "ln": 16858, "col": 22, "line": 334 }, { "b": "A.Z4WwH[@Kv@Dl%x\u003eF!xi%)8MarR^HarSr\u003carR!P3lQDlarR^Hatkw\u003carUGiBrCKyz!-\u0026[Bxi9!Cox3\u003ew]/OBwNPasx(4uVD2vauAb](iwN/*.x\u003eqG\u0026wNXOWz/PX\u003evruflar\u003c/+mLcOzdlv\u003eVarR^HarR^WfczwWx\u003ewFoAb](iwN/*.x\u003eqGqaBsCrarR^HarR^WfczwWarSr\u003cay/tcB8L(ae]kDsc)@$Oz!-\u0026[Bxi9!Crd95aAhvtygQ)%r+Vb?dlv\u003eV", "ln": 18024, "col": 77, "line": 354 }, { "b": "ayYFcy?d9$auZ\u0026+wP]nwzep$xB1P!4x(4r\u003eAWVnSxK$Q.y?mWeiV@J+B.8Xzdlv\u003eVarR^HarR^WfczwWarR^HarUfjzGx[xB7/05wN[.JBAzkmxlcTZwmZ0djS(dnl2}0O", "ln": 18525, "col": 25, "line": 362 }, { "b": "wk^5YBzkS9B4HmWwQ4Gkz/x/jz/e^2xM58-CW\u003eMjwmYpvx(4v4nP56ICWh{Ee{pVtB.8WUayDEwa.=0^CW\u003eMjwnb{]EpbbzarR^HarR^Hfe1B\u003carR^HarR^HarR!Paz2wgwGVsbarR^HarR^Hfe1B\u003carR^HarR^HarR^HaAIaoBzkS9B1Q)uAbok#vrq", "ln": 19201, "col": 62, "line": 369 }, { "b": "y?kknz!yECB7GDnx(mN8iWVE3B7GDnx(mN8dlv\u003eVarR^HarR^WfczwWarR^Hw]/OGA+PSbmRMWIq*Am\u003cc\u003c?7tarR^HarSr\u003carR^HarR^HaAhvtygQ)%r+Vb?s7L\u0026tBz(hpp*[DVed9HxarR^HarSr\u003carR^HarR^HaAIaoBzkS9A%:3jarR^HarSr\u003carR^HarR^Qi%)8Mao", "ln": 20364, "col": 26, "line": 393 } ], "depth": 1, "facts": { "imp": [ [ "", "Object.defineProperty" ], [ "", "exports.FocusHelpers" ], [ "", "xplat_utils_1" ], [ "", "require" ], [ "", "path_1" ], [ "", "require" ], [ "", "fs_1" ], [ "", "require" ], [ "", "xml2js" ], [ "", "require" ], [ "", "devkit_1" ], [ "", "require" ], [ "", "FocusHelpers" ], [ "", "groupByName" ], [ "", "framework" ], [ "", "frameworkSuffix" ], [ "", "isFullstack" ], [ "", "isExcluding" ], [ "", "appWildcards" ], [ "", "userUpdates" ], [ "", "isFullstack" ], [ "", "appFilter" ], [ "", "userUpdates.p" ], [ "", "userUpdates.p" ], [ "", "userUpdates.p" ], [ "", "platforms" ], [ "", "excluded" ], [ "", "platforms.includes" ], [ "", "appFilter" ], [ "", "appWildcards.push" ], [ "", "isExcluding" ], [ "", "appName" ], [ "", "p.replace" ], [ "", "userUpdates.p" ], [ "", "userUpdates.p" ], [ "", "options.focusOnApps.includes" ], [ "", "handledPlatforms" ], [ "", "libName" ], [ "", "p.replace" ], [ "", "userUpdates.p" ], [ "", "packageName" ], [ "", "p.replace" ], [ "", "userUpdates.p" ], [ "", "handledPlatforms.target" ], [ "", "isVsCode" ], [ "", "updateVSCode" ], [ "", "isWebStorm" ], [ "", "updateWebStorm" ], [ "", "workspaceUpdates" ], [ "", "updateVSCode" ], [ "", "FocusHelpers.updateIDESettings" ], [ "", "newSettings" ], [ "", "exclude" ], [ "", "searchExclude" ], [ "", "newSettings.files.exclude" ], [ "", "Object.assign" ], [ "", "Object.assign" ], [ "", "newSettings.search.exclude" ], [ "", "Object.assign" ], [ "", "Object.assign" ], [ "", "newSettings.files.exclude.focusApp" ], [ "", "newSettings.search.exclude.focusApp" ], [ "", "isFocusingOnAppSubFolder" ], [ "", "options.focusOnApps.filter" ], [ "", "options.allApps.includes" ], [ "", "options.focusOnApps.includes" ], [ "", "skipExcluding" ], [ "", "app.indexOf" ], [ "", "skipExcluding" ], [ "", "newSettings.files.exclude.app" ], [ "", "newSettings.search.exclude.app" ], [ "", "Object.assign" ], [ "", "Object.assign" ], [ "", "isVsCode" ], [ "", "isMac" ], [ "", "userSettingsVSCodePath" ], [ "", "windowsHome" ], [ "", "userSettingsVSCodePath" ], [ "", "isVsCode" ], [ "", "vscodeCreateSettingsNote" ], [ "", "userSettings" ], [ "", "userSettingsJson" ], [ "", "newSettings" ], [ "", "generateVSCodeUpdatedSettings" ], [ "", "console.warn" ], [ "", "console.log" ], [ "", "workspaceSettingsPath" ], [ "", "process.cwd" ], [ "", "workspaceSettingsJson" ], [ "", "workspaceSettings" ], [ "", "workspaceSettingsJson" ], [ "", "newSettings" ], [ "", "generateVSCodeUpdatedSettings" ], [ "", "FocusHelpers.updateVSCode" ], [ "", "isWebStorm" ], [ "", "FocusHelpers.updateWebStorm" ], [ "", "projectViewObject" ], [ "", "webStormExcludedViewNode" ], [ "", "builder" ], [ "", "builder.buildObject" ], [ "", "FocusHelpers.createWebStormProjectView" ], [ "", "FocusHelpers.webStormExcludedViewNode" ], [ "", "exports.FocusHelpers" ], [ "", "FocusHelpers" ], [ "", "@nstudio/xplat-utils" ], [ "", "@nx/devkit" ], [ "", "fs" ], [ "", "path" ], [ "", "xml2js" ] ], "mbr": [ "FocusHelpers.createWebStormProjectView", "FocusHelpers.updateIDESettings", "FocusHelpers.updateVSCode", "FocusHelpers.updateWebStorm", "FocusHelpers.webStormExcludedViewNode", "Object.assign", "Object.defineProperty", "app.indexOf", "appWildcards.push", "builder.buildObject", "console.log", "console.warn", "devkit_1.serializeJson", "exports.FocusHelpers", "fs_1.existsSync", "fs_1.mkdirSync", "fs_1.readFileSync", "fs_1.writeFileSync", "options.allApps", "options.allApps.includes", "options.allApps.length", "options.allLibs", "options.allPackages", "options.appWildcards", "options.devMode", "options.focusOnApps", "options.focusOnApps.filter", "options.focusOnApps.filter().length", "options.focusOnApps.includes", "options.focusOnApps.length", "options.isFullstack", "options.platforms", "options.userUpdates", "options.workspaceUpdates", "p.replace", "path_1.join", "platforms.includes", "process.cwd", "process.env", "process.env.APPDATA", "process.env.HOME", "process.platform", "xml2js.Builder", "xplat_utils_1.getFrontendFramework", "xplat_utils_1.getGroupByName", "xplat_utils_1.isTesting", "xplat_utils_1.isXplatWorkspace", "xplat_utils_1.jsonParse", "xplat_utils_1.sanitizeCommaDelimitedArg", "xplat_utils_1.supportedPlatformsWithNx" ], "tgt": [ "Object.assign", "Object.defineProperty", "app.indexOf", "appWildcards.push", "builder.buildObject", "console.log", "console.warn", "generateVSCodeUpdatedSettings", "options.allApps.includes", "options.focusOnApps.filter", "options.focusOnApps.includes", "p.replace", "platforms.includes", "process.cwd", "require", "updateVSCode", "updateWebStorm", "webStormExcludedViewNode", "xml2js.Builder" ], "funcs": [ [ "anonymous", 316 ], [ "updateIDESettings", 346 ], [ "anonymous", 399 ], [ "generateVSCodeUpdatedSettings", 9384 ], [ "anonymous", 11277 ], [ "updateVSCode", 12458 ], [ "updateWebStorm", 16632 ], [ "createWebStormProjectView", 20868 ], [ "webStormExcludedViewNode", 21493 ] ], "metrics": { "ast": { "op.eq": 6, "op.add": 1, "op.lor": 4, "op.land": 7, "op.lnot": 8, "max_depth": 31, "call_count": 55, "node_count": 2887, "member_count": 50, "max_array_len": 1, "op_density.eq": 0, "op_density.add": 0, "op_density.lor": 0, "sequence_count": 21, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 2, "member_depth_max": 4 }, "file": { "size": 21827, "entropy": 4.04 }, "text": { "lines": 436, "top_char": 101, "max_ws_run": 15, "digit_ratio": 0.01, "space_count": 8965, "char_entropy": 4.04, "unique_chars": 80, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.18, "top_char_ratio": 0.05, "avg_line_length": 49.06, "max_line_length": 201, "last_line_length": 63, "long_token_count": 1, "whitespace_ratio": 0.43, "identifier_density": 1.04, "line_length_stddev": 28.91, "normalized_string_count": 3.74, "repeated_char_sequences": 326, "suspicious_string_ratio": 0.08, "suspicious_comment_ratio": 0.23, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 12.32 }, "binds": { "count": 56 }, "binary": { "peak_region_bytes": 8515, "peak_region_entropy": 4.63 }, "source": { "function_count": 6 }, "imports": { "count": 5, "stdlib_count": 2, "stdlib_ratio": 0.4, "third_party_count": 3, "third_party_ratio": 0.6 }, "strings": { "bytes": 1637, "count": 78, "shell": 6, "avg_length": 20.99, "max_length": 169, "path_count": 2, "avg_entropy": 3.25, "empty_count": 4, "entropy_stddev": 0.63 }, "comments": { "chars": 5586, "count": 140, "lines": 144, "base64": 22, "todo_count": 2, "high_entropy": 10, "to_code_ratio": 0.49 }, "functions": { "count": 6, "nested": 3, "density": 2.06, "anonymous": 3, "avg_params": 1.33, "code_ratio": 2.35, "max_params": 3, "one_liners": 1, "length_stddev": 126.93, "over_100_lines": 3, "avg_name_length": 20.17, "avg_length_lines": 113.78, "max_length_lines": 427, "min_length_lines": 1, "avg_nesting_depth": 1.11, "max_nesting_depth": 2, "high_entropy_names": 5, "single_char_params": 1, "avg_param_name_length": 8 }, "identifiers": { "count": 452, "unique": 108, "avg_length": 10.14, "max_length": 29, "min_length": 1, "avg_entropy": 2.77, "reuse_ratio": 0.24, "length_stddev": 5.88, "has_digit_ratio": 0.05, "sequential_names": 2, "single_char_count": 3, "single_char_ratio": 0.03, "high_entropy_count": 17, "high_entropy_ratio": 0.16, "all_lowercase_ratio": 0.38, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 4 } } }, "id": 4, "mol": "O(I)H₂(F₅Os₃)", "path": "focus-20.0.4.tgz!!package/src/utils/index.js", "pid": 0, "risk": 7, "sha": "0310fd1c4c9b77e777bfc0443e014971fccfd6c4784e36d83d0522474409facb", "size": 21827, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"" }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"" }, { "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call", "conf": 0.84, "crit": 3, "desc": "Calls Node.js synchronous directory enumeration", "spans": [ [ 17015, 15 ] ] }, { "id": "micro-behaviors/fs/file/read::cwd-reference", "conf": 0.84, "crit": 1, "desc": "References the Node.js current working directory" }, { "id": "micro-behaviors/fs/file/write/direct::node-write-file-sync", "conf": 1.0, "crit": 3, "desc": "Node synchronously writes a file", "spans": [ [ 14026, 18 ] ] }, { "id": "micro-behaviors/fs/path/application/config::vscode-settings-json-filename", "conf": 0.95, "crit": 1, "desc": "VS Code settings.json filename" }, { "id": "micro-behaviors/fs/path/application/config::vscode-user-dir-components", "conf": 0.92, "crit": 1, "desc": "VS Code user config directory components" }, { "id": "micro-behaviors/fs/path/application/config::vscode-workspace-dir", "conf": 0.8, "crit": 1, "desc": "VS Code workspace directory" }, { "id": "micro-behaviors/os/env/vars/platform::node-appdata-access", "conf": 0.9, "crit": 3, "desc": "Node reads Windows APPDATA directory" }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content", "conf": 0.7, "crit": 2, "desc": "References the Node.js process.platform value", "spans": [ [ 12562, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member", "conf": 0.8, "crit": 3, "desc": "Reads the Node.js process.platform value" }, { "id": "micro-behaviors/process/create/agent::ai-agent-unattended-execution-value", "atk": "T1059", "mbc": "B0022", "conf": 0.9, "crit": 1, "desc": "Unattended agent execution mode value", "spans": [ [ 18557, 0 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "spans": [ [ 17015, 0 ] ] }, { "id": "micro-behaviors/fs/file/read::readfilesync-call", "conf": 0.9, "crit": 3, "desc": "Calls readFileSync", "spans": [ [ 18088, 16 ] ] }, { "id": "micro-behaviors/os/env/vars/access::node-home-access", "conf": 0.9, "crit": 3, "desc": "Node reads HOME directory environment variable" }, { "id": "micro-behaviors/fs/path/application/config::vscode-global-settings-path", "conf": 0.94, "crit": 3, "desc": "VS Code global settings path", "uses": [ 5, 6 ] }, { "id": "objectives/execution/condition/platform::has-os-check", "conf": 0.6, "crit": 1, "desc": "Checks for OS platform", "uses": [ 9 ], "spans": [ [ 12562, 0 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "uses": [ 12 ], "spans": [ [ 17015, 14 ] ] }, { "id": "objectives/impact/wipe/disk/mass-delete::target-vscode", "conf": 0.85, "crit": 3, "desc": "References VS Code or JetBrains IDE configuration directories", "uses": [ 7 ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb0Z3!BAIbdz.CZvv%8\u0026ped9Hxb6EKrB7]Mgb03?\u003cgb7sme\u0026aX53lQDnwmY*(A+PGmx(v(kiV]Roz!0{haztt5AaK6hazbLjaz(4mz/PAdz/W4nzxKahA+PDmB0a4xmroU73lQDnxM4:0Aa9x\u003cb03?\u003cxMOunB2\u003e%czGx]xwnb%mx(tUHAbn%8a$K6zar\u003e\u0026qAbP/iBz(hBb03\u0026[3lQDlar\u003e]MAaHjOar\u003eDjBrSmyarR^Hb6v{xb03?\u003cxk8DrxMOunB2\u003e%cxk8E3BZ=$kz/4dBB98Lnx(tUHAbn%8e[X)ua{]CnEjLZFar\u003ePjD3sgEwoe}Qax]f}arR^JCYmFcBrSmyarR^Hb4CUiB8@{Ly*?A$z/PXsed9HxarR\u003eBB.(elePtJmBy]Diz6yIrarR^Hb5RSHed9HxarR\u003epzFa9dvr9Ly3lQDlar\u003e(pxK#3?Bzklaa$K6zarR^JzGx]xwnb%aed9HxarR\u003euz!0{ha{]Cnt}us9ar\u003eVhx(kaQar\u003eJqwmZ0ryi7NI3lQDnBA}?pB0rT/b57}9wQ2?re{8dUed9Hxb4kRoxM4]niV]Rwvruf\u003ezxJ1?y?)Q5a$K6zar\u003eSov}xL0wG\u003ceTb27Tda$K6zar\u003eoqxlbmTaBsCrarR^JB-IpxiV]RWBAzFyiXJd0x([3hvLheez7/^FBAIbdz.DuOy*?Asx(!urwPG45arV7-3lQDnB7n({zddK2v@\u0026?Par\u0026A\u003ev@Dg1wN/*@z/dgxB8L}ued9Hxb5R3BB-p(1By=TSaBsCrarR^JA+flkx(W^4wO#Qhb03\u0026[EjL", "ln": 0, "col": 1, "line": 1 }, { "b": "zGv0.ar\u0026A\u003eze0T6vruj4zGvBBB8L}u3lQEted9Hxb4Ln7wO#3\u0026zEWx(B0rT/DKp(rarR\u003c[vqY.2y*?uowmY}1x((1rz/PzkiV]RMf/Q^te?!F23lQDlar\u003c6VzFa9dvr9@gwP?\u003c6Bt4YBxK#3?Bzklab03?\u003cunjz(fFk46ed9HxarR\u003c[zGx]xwnb%nCYmFcBs?SSx(4\u0026miV]R4fFk4igA[vSarR^Hb6W%vghp\u003eOiV]R}fFkmog9N5FaBKPB3i", "ln": 660, "col": 14, "line": 30 } ], "depth": 1, "facts": { "imp": [ [ "20.0.3", "@nstudio/xplat-utils" ], [ "~0.6.2", "xml2js" ], [ "^18.0.0", "@angular-devkit/core" ], [ "^18.0.0", "@angular-devkit/schematics" ] ], "metrics": { "file": { "size": 861, "entropy": 4.71 }, "binary": { "peak_region_bytes": 861, "peak_region_entropy": 4.71 }, "references": { "declared_count": 3, "unresolved_count": 0, "security_hold_count": 0, "unresolved_extension_count": 0 }, "consistency": { "name_repo_mismatch": 1 } } }, "id": 7, "mol": "Md(Pa₃)", "path": "focus-20.0.4.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "pkg:github/nstudio/xplat", "off": 208, "kind": "repository" }, { "to": "pkg:npm/%40angular-devkit/core", "off": 715, "kind": "dependency" }, { "to": "pkg:npm/%40angular-devkit/schematics", "off": 754, "kind": "dependency" }, { "to": "pkg:npm/%40nstudio/xplat-utils@20.0.3", "off": 799, "kind": "dependency" }, { "to": "pkg:npm/xml2js", "off": 837, "file": 17, "kind": "dependency" }, { "to": "index.js", "off": 414, "file": 2, "kind": "local" } ], "risk": 2, "sha": "bced2e81fcf8b54c963ae1a50a35bf3b10568bc95d402842465cf0b0bea53570", "size": 861, "traits": [ { "id": "metadata/package/files/included::npm-publish-root-manifest", "conf": 0.95, "crit": 2, "desc": "Manifest sits at npm publish root", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/manifest/entrypoint::main-root-javascript-entry", "conf": 0.9, "crit": 2, "desc": "Root JavaScript main entrypoint", "spans": [ [ 405, 0 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata", "spans": [ [ 161, 0 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL", "spans": [ [ 200, 0 ] ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host", "spans": [ [ 200, 40 ] ] }, { "id": "metadata/package/manifest/entrypoint::pkg-types-field", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript types entry" }, { "id": "metadata/package/manifest/repository::npm-name-repo-mismatch", "conf": 0.8, "crit": 3, "desc": "Package name disagrees with its repository", "spans": [ [ 0, 37 ] ] }, { "id": "metadata/package/manifest/name::npm-no-name-field", "conf": 0.9, "crit": 3, "desc": "package.json omits name field" } ], "type": "package.json" }, { "ctx": [ { "b": "v{%E4juM\u003c@mnDxTcTpLczAq3uarUSCB7^QtzFB90B2)MzarUSzz!0v1B2)MzarR^HA=(nvePkI/aA.dozGH1My*?A%B97V8arR^HB97#jB2)MzarR^HeG!}tzdL:Jl$7gCaw^8%v}x.5x(mM*zxH5AarR!EB-6k.v%8*dat4aDa%YJKpe\u003cUSr8T$-xMOunB2\u003e%cCv+k%z/ozzB7]-cfjFxIv{}lbhz3:uh-ifzhdOD]vLxR]eOnGMwNYadf/H^}h-\u0026c[v}Y^6a%YJKpe\u003cUSr8T$-D(#)bB7El^at4^WfD+-=vQTs?hz=KdCowOAzxH5AarR!rzGX6CzxH5AarR^Havw}1r7fLYq-V3DDWu(Sz+r@7pagf{v@=d5B15kWEoZUUpEXPbdo{:}zx*n\u003ez!%ujB0b7kAV/pyBz#wAtY9Cdl{j^5tWe%sgG#K{gCJ-KcTpKVqBK2HjZovttRE@\u0026tqeb{ghQnztY9XkoIwk-jZovttRE@\u0026tqnh}gI{wAtY9q7jZovttRE@\u0026tqf]0cM\u003cSRph.mxz!%ujtY9!:boPD#zEW^5z/cXtzY\u0026[9yH[RUx(()*vJW%knG.IKy\u00261e$zF9W9xMW=\u003evq]{ediJ$xzxH5Aaz+$a", "ln": 36841, "col": 36778, "line": 2 }, { "b": "w[+H/tY7VbarUl9xM21qb3Y1@z/fb\u003ezD}6\u003cv}Y^6eOc4GbZS3Vmmx$1[sL.$ax8=\u003cx(FepwQ4=@B-.tozxJCcze:r5By!#abZSoNEiI{lcW^K2fGg:Fd0d1Xen=[1k6}f1AWU@Sen^7Jc#{\u003e=bTVG!zddr)iW=Buk5$i!lVl*UvqYQbl349\u0026zdMQ-y?lWZBza-!vO79wzGGPmC%=H!zddr)iW=Buk0:mhB.$X/z!@#^x([2\u0026wNXkwwO#Q7Bn", "ln": 42070, "col": 42007, "line": 2 }, { "b": "fGrrxBUUT8iB2*igb7y\u003ctWhzbfFWlBtY?!Qhd*8#BU+Z9fD@5:wJ.kwc/PVAt{p?xwJ.kwa$E+Dd\u003cwmyem-rPb3Mlwv}vemt{p?swJ.kwa$EXBd@F]Gb3=xzxjTjItWg!\u0026a$NtqjTa8Od@O#Hb3=xzxK%sJtoUOiwH!%ga$NOxjTa9pa$E+Dd}rcvxjSPiwH?Fad%2nLb3=xzD1xb.tWhzZi5t5GtWhzZw[CH7tWhzZw[CTXa$MV7jTa9pa]", "ln": 1158176, "col": 1158113, "line": 2 }, { "b": "Zb^D:a$QWriWdc/a$QWsiWeoMa$QY@iWdvha$QY%iWeGNa$QY\u0026iWb}?a$QZFiWeS^b7g[4w{503BzkVhazth8rC(IXz!9AcBszMSwPS6nzxIU+e{7VCBsqkWEp^Rtv@#B6zxK1xA+PA7rbU6yA::kwBszMSwPS6nzxJR3B5^9(v@C)?d0c[5w{503BzkVhaA.Nov@C)?rbU6yA::kwBszMSwPS6nzxK3NzddJ@xEDR!dsuIEu41bydlq6-zu", "ln": 1160665, "col": 1160602, "line": 2 }, { "b": "a$NtDvpKy[z/e6=z/{1$x)KtKfF3*RvpKy[z/e6=z/{1$wPh6#vruBdiWhCla$N!Tw[C+4iWb+@enF/Wa$$-bgC*%Eh-J*avQ\u0026}Ww[L^\u003eyhmT5zF%GlA=VtBC6wgRDlK[iwJ.g\u003cj7-RMv@#B6zxInWxhiO^vR6NdBs.CYDV\u0026?raARfCzE\u003ewkwH}n3eoLIPwmWrhwH}F9em@DRBzbxfj85pPaT*@lazC.mByx5%wP8f6ltp7cB.$P0AW-CTwD", "ln": 2800467, "col": 2800404, "line": 2 }, { "b": "xdOjmy=S=ST%eoBx(m@LDVAXgwQ3l?cmAOCA^P8\u003egDdlwj1\u003ej$C42hFbi1i+b7h1WB.$F@wN^=FA+e({CSEG8bpD+IeJE9-f!tnidlxg}eoUDriW/83AW:dnq/)4]zF7OlA=k!Zz!9AQz!T9hc@a]4vR6NjAa9^dwL3=Yc#{\u003c[fEXD0en/PEuUB1}i^U)UxjVrGfd4]*c%FwSiBKHKk}LMiDOE6fEjmlhxdOjmy=S$^eoig5k2VMzx(mMow=", "ln": 3277133, "col": 3277070, "line": 2 }, { "b": "xlm/KBzbxfe{ztIBy=\u003exdlnT%j91[OB-IvxBzbxfe]j%qBwuyUwiU8+bjApWb06:)ek{Uhx(mMKwN/T?wPxzxA=l5rBA}?pe{7VHBuKkUzEW^5z/cXuBy)HiwQ5qBBs.CYDV\u0026?raz%tOB-7Yhx(v(iB-.jPlUH4vyE@zNz/6DfwPRGiBs.C-zyG{Qvr9FWj-Se\u003ewO#d5xE$@2x\u003ew+.jz(P*wPS6nzxHR{C42zlBy^QTBy)H1xK$W?lv0V:c\u0026", "ln": 3368287, "col": 3368224, "line": 2 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3735207, "entropy": 5.35 }, "text": { "lines": 2, "top_char": 101, "max_ws_run": 20, "digit_ratio": 0.03, "space_count": 66469, "char_entropy": 5.35, "unique_chars": 168, "top_char_null": 0, "escape_density": 0.01, "lines_over_200": 1, "lines_over_500": 1, "top_char_ratio": 0.1, "avg_line_length": 1867603, "lines_over_1000": 1, "max_line_length": 3735143, "non_ascii_ratio": 0, "hex_escape_count": 52, "last_line_length": 3735143, "long_token_count": 8889, "whitespace_ratio": 0.02, "line_length_stddev": 1867540, "octal_escape_count": 17, "unusual_whitespace": 1, "non_printable_ratio": 0, "unicode_escape_count": 134, "repeated_char_sequences": 48 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 536576, "peak_region_entropy": 5.75 }, "source": { "ast_unavailable": 1, "ast_unavailable.tree_sitter_guard": 1 } } }, "id": 14, "mol": "Th", "path": "focus-20.0.4.tgz!!package/bundle.js", "pid": 0, "risk": 108, "sha": "dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c", "size": 3735207, "traits": [ { "id": "third_party/SigBase/JS/NPM/Supplychain/Compromise/Sep25", "conf": 0.9, "crit": 5, "desc": "Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)", "spans": [ [ 36969, 41 ], [ 37064, 17 ] ] } ], "type": "javascript" } ], "rev": "479f3", "v": "8" } }