{
  "ml": {
    "v": "7",
    "id": 2829,
    "lvl": -1,
    "conf": 0,
    "prob": 0.000015457471818081103,
    "type": "shell",
    "version": "v18.18",
    "analyzed_at": "2026-09-21T06:33:37Z"
  },
  "path": "resources/bin/lobe-cli.js##url@7131678",
  "raw": {
    "rev": "5bb5a",
    "files": [
      {
        "id": 2829,
        "mol": "O(As)H(Db)",
        "pid": 1,
        "rel": "fetched",
        "sha": "7daaaa4c95d61fa55ff46b505e6b5f7b53f7336d10e4a884a981db558176c3a7",
        "via": "https://github.com/lobehub/lobehub/releases/download/v2.2.18/lobehub-desktop-2.2.18.x86_64.rpm",
        "path": "https://github.com/lobehub/lobehub/releases/download/v2.2.18/lobehub-desktop-2.2.18.x86_64.rpm!!opt/LobeHub/resources/app.asar!!resources/bin/lobe-cli.js!!resources/bin/lobe-cli.js##url@7131678",
        "risk": 4,
        "size": 7623,
        "type": "shell",
        "depth": 5,
        "facts": {
          "imp": [
            [
              "",
              "connecting"
            ],
            [
              "",
              "interrupted"
            ],
            [
              "",
              "expired"
            ],
            [
              "",
              "expired"
            ],
            [
              "",
              "expired"
            ],
            [
              "",
              "disconnected"
            ],
            [
              "",
              "disconnected"
            ],
            [
              "",
              "reconnecting"
            ],
            [
              "",
              "reconnecting"
            ],
            [
              "",
              "reconnecting"
            ],
            [
              "",
              "reconnecting"
            ],
            [
              "",
              "auth_expired"
            ],
            [
              "",
              "minting"
            ],
            [
              "",
              "auth_failed"
            ],
            [
              "",
              "the.Shutting"
            ],
            [
              "",
              "auth_failed"
            ],
            [
              "",
              "auth_failed"
            ],
            [
              "",
              "auth_failed"
            ],
            [
              "",
              "refresh"
            ],
            [
              "",
              "successfully.Reconnecting"
            ],
            [
              "",
              "auth_expired"
            ],
            [
              "",
              "auth_expired"
            ],
            [
              "",
              "token"
            ],
            [
              "",
              "successfully.Reconnecting"
            ],
            [
              "",
              "down"
            ],
            [
              "",
              "down"
            ],
            [
              "",
              "down"
            ],
            [
              "",
              "down"
            ],
            [
              "",
              "system_info_request"
            ],
            [
              "",
              "tool_call_request"
            ],
            [
              "",
              "rpc_request"
            ],
            [
              "",
              "agent_run_request"
            ]
          ],
          "mbr": [
            "auth_expired.Attempting",
            "auth_expired.Re",
            "auth_failed.Attempting",
            "d.apiName",
            "e.message",
            "e.workspaceId",
            "m.success",
            "minting.Closing",
            "s.deviceId",
            "successfully.Reconnecting",
            "successfully.Reconnecting.Run",
            "t.agentType",
            "t.message",
            "t.operationId",
            "t.requestId",
            "the.Shutting"
          ],
          "tgt": [
            "agent_run_request",
            "auth_expired",
            "auth_failed",
            "connecting",
            "disconnected",
            "down",
            "expired",
            "interrupted",
            "minting",
            "r",
            "reconnecting",
            "refresh",
            "rpc_request",
            "successfully.Reconnecting",
            "system_info_request",
            "the.Shutting",
            "token",
            "tool_call_request"
          ],
          "metrics": {
            "ast": {
              "op.gt": 2,
              "op.sub": 3,
              "max_depth": 15,
              "call_count": 60,
              "node_count": 1175,
              "member_count": 16,
              "op_density.gt": 0,
              "op_density.sub": 0,
              "sequence_count": 3,
              "member_depth_max": 3
            },
            "file": {
              "size": 7623,
              "entropy": 5.24
            },
            "text": {
              "lines": 1,
              "top_char": 101,
              "max_ws_run": 4,
              "digit_ratio": 0.01,
              "space_count": 270,
              "char_entropy": 5.24,
              "unique_chars": 81,
              "top_char_null": 0,
              "lines_over_200": 1,
              "lines_over_500": 1,
              "string_density": 78,
              "top_char_ratio": 0.11,
              "avg_line_length": 7623,
              "lines_over_1000": 1,
              "max_line_length": 7623,
              "last_line_length": 7623,
              "long_token_count": 14,
              "whitespace_ratio": 0.04,
              "identifier_density": 275,
              "normalized_string_count": 78,
              "suspicious_string_ratio": 0.21,
              "suspicious_identifier_ratio": 0.09
            },
            "binds": {
              "count": 5
            },
            "binary": {
              "peak_region_bytes": 7623,
              "peak_region_entropy": 5.33
            },
            "strings": {
              "bytes": 5548,
              "count": 78,
              "shell": 1,
              "avg_length": 71.13,
              "max_length": 528,
              "avg_entropy": 3.74,
              "empty_count": 2,
              "entropy_stddev": 1.05,
              "high_entropy_count": 2,
              "embedded_code_candidates": 15
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.script_as_unknown": 1
            },
            "identifiers": {
              "count": 275,
              "unique": 113,
              "avg_length": 6.55,
              "max_length": 19,
              "min_length": 1,
              "avg_entropy": 2.12,
              "reuse_ratio": 0.41,
              "length_stddev": 3.91,
              "has_digit_ratio": 0.01,
              "sequential_names": 10,
              "single_char_count": 11,
              "single_char_ratio": 0.1,
              "high_entropy_count": 1,
              "high_entropy_ratio": 0.01,
              "all_lowercase_ratio": 0.63,
              "all_uppercase_ratio": 0.1
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/extension/token-shape::bare-alphanumeric-script-basename",
            "conf": 0.9,
            "crit": 2,
            "desc": "Script filename is a bare alphanumeric token"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                2152,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                3624,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                2645,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                2036,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/device-code::success-status-field",
            "conf": 0.93,
            "crit": 1,
            "desc": "Success status field",
            "spans": [
              [
                4905,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::result-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Result field or assignment key",
            "spans": [
              [
                4905,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "References the toString conversion method",
            "spans": [
              [
                7213,
                8
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::js-module-basename",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 1.0,
            "crit": 3,
            "desc": "JavaScript module file extension"
          },
          {
            "id": "metadata/file/naming::sequential-identifiers",
            "conf": 0.8,
            "crit": 2,
            "desc": "Sequential source identifier names"
          },
          {
            "id": "metadata/file/padding::low-whitespace",
            "conf": 0.7,
            "crit": 2,
            "desc": "Very low whitespace ratio (minified/compressed)"
          },
          {
            "id": "metadata/package/error-handling::catch-keyword",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains a catch error handler",
            "spans": [
              [
                1670,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/ssh/client::auth-failed",
            "atk": "T1021.004",
            "conf": 0.5,
            "crit": 3,
            "desc": "SSH authentication failed message",
            "spans": [
              [
                3334,
                21
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::backtick-command-substitution",
            "conf": 1.0,
            "crit": 2,
            "desc": "shell backtick command substitution",
            "spans": [
              [
                2103,
                0
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Last line is over 1000 chars"
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Exactly one line exceeds 1000 chars"
          },
          {
            "id": "micro-behaviors/fs/path/secret-config::ssh-tooling-or-transcript-context",
            "atk": "T1552.001",
            "conf": 0.9,
            "crit": 1,
            "desc": "SSH tooling or documentation transcript",
            "uses": [
              12
            ],
            "spans": [
              [
                3334,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/credential::any-credential-path",
            "conf": 0.9,
            "crit": 1,
            "desc": "References a credential-bearing path",
            "uses": [
              16
            ],
            "spans": [
              [
                3334,
                0
              ]
            ]
          }
        ]
      }
    ]
  }
}