{
  "ml": {
    "v": "7",
    "id": 13,
    "lvl": -1,
    "conf": 0,
    "prob": 0.00001917282679642085,
    "type": "npm",
    "version": "v18.18",
    "analyzed_at": "2026-09-08T08:27:22Z"
  },
  "path": "corp-build-utils-poc@0.0.1-security?checksum=sha1:e017a95e9607d3604e4589df853c4241c8e1fcf8%2Csha512:6b18ee6fd500360c7d621d63c644081f2b9d1765006c01ea8c8dad83b412a0c9519b62ba7f947f72a971b64eada12459669b",
  "raw": {
    "rev": "479f3",
    "files": [
      {
        "id": 13,
        "ctx": [
          {
            "b": "abZy8000000@}UL=X*Hi490wlq\u0026781wsMywHR=}8Y2NcK}Vm*yNrQW0Jayl*L!IH^@mKD\u003c^-V*bcbkwx]\u0026Ye:Pq1ktDwwLCJ)js}c%^^/rnR\u0026/^/dF5WsR(3\u003e#DHiZ3qm!zm/4oc@+f*VlWXGqM\u003e4hR4=5jE$WnpkOZVD(oea3im=\u003cJcr]V]cAekT(G$X9bA5rJI=uEuWIyY/t(",
            "ln": 0
          }
        ],
        "mol": "O(S₂)Md(Pa₃)",
        "pid": 2,
        "rel": "fetched",
        "sha": "7ffcfe3cbcd57ae5e8befe9c076a88d4cc3ba613323bbd5498f55f306e5bd7e8",
        "via": "https://registry.npmjs.org/corp-build-utils-poc/-/corp-build-utils-poc-0.0.1-security.tgz",
        "path": "pkg:npm/corp-build-utils-poc@0.0.1-security?checksum=sha1:e017a95e9607d3604e4589df853c4241c8e1fcf8%2Csha512:6b18ee6fd500360c7d621d63c644081f2b9d1765006c01ea8c8dad83b412a0c9519b62ba7f947f72a971b64eada12459669b765c9bb9c10f40708a80a3572359",
        "refs": [
          {
            "to": "npm/security-holder",
            "off": 0,
            "kind": "repository"
          }
        ],
        "risk": 4,
        "size": 402,
        "type": "npm",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 402,
              "entropy": 7.44
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 402,
              "peak_region_entropy": 7.44
            },
            "consistency": {
              "name_repo_mismatch": 1
            }
          }
        },
        "ident": {
          "name": {
            "value": "corp-build-utils-poc",
            "source": "npm.name",
            "verified": false
          },
          "urls": [
            {
              "url": "npm/security-holder",
              "kind": "repository",
              "source": "npm.repository.url"
            }
          ],
          "trust": "unsigned",
          "version": {
            "value": "0.0.1-security",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "corp-build-utils-poc",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/package/manifest/freeform::npm-security-holder-package",
            "conf": 0.99,
            "crit": 3,
            "desc": "Official npm security holding package",
            "from": [
              {
                "file": 14
              }
            ],
            "uses": [
              4,
              6,
              9
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/manifest/attack-label::bug-bounty-marker-2",
            "conf": 0.75,
            "crit": 3,
            "desc": "Proof-of-concept or security-research marker",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/manifest/repository::repo-owner-project-coordinate",
            "conf": 0.9,
            "crit": 3,
            "desc": "Repository uses owner/project coordinate"
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "package.json declares repository metadata"
          },
          {
            "id": "metadata/package/versioning::npm-security-holder-version",
            "conf": 0.99,
            "crit": 1,
            "desc": "npm security holder version"
          },
          {
            "id": "metadata/package/manifest/freeform::npm-security-holder-readme-removal",
            "conf": 0.99,
            "crit": 1,
            "desc": "npm security holder removal notice",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/manifest/repository::npm-security-holder-repository",
            "conf": 0.99,
            "crit": 1,
            "desc": "npm security holder repository"
          },
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "metadata/package/quality/empty::npm-has-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package name"
          },
          {
            "id": "metadata/package/manifest/description::npm-security-holder-description",
            "conf": 0.99,
            "crit": 1,
            "desc": "npm security holder description"
          },
          {
            "id": "metadata/package/manifest/freeform::npm-security-holder-readme-title",
            "conf": 0.99,
            "crit": 1,
            "desc": "npm security holder README title",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest::npm-no-dependencies-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "npm manifest omits dependencies field"
          },
          {
            "id": "metadata/package/dependencies/manifest::npm-no-deps-devdependencies",
            "conf": 0.9,
            "crit": 2,
            "desc": "npm manifest omits devDependencies field"
          },
          {
            "id": "metadata/package/manifest/freeform::npm-security-holder-readme-advisory",
            "conf": 0.98,
            "crit": 1,
            "desc": "npm security holder advisory link",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/manifest/name::npm-name-poc",
            "atk": "T1195.002",
            "conf": 0.75,
            "crit": 3,
            "desc": "npm package name contains 'poc'"
          },
          {
            "id": "metadata/package/manifest/freeform::npm-security-holder-readme",
            "conf": 0.99,
            "crit": 3,
            "desc": "Official npm security holder README",
            "from": [
              {
                "off": 219,
                "file": 15,
                "line": 5
              }
            ],
            "uses": [
              5,
              10,
              13
            ]
          },
          {
            "id": "metadata/package/versioning::npm-has-version",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package version"
          },
          {
            "id": "metadata/package/manifest/repository::npm-name-repo-mismatch",
            "conf": 0.8,
            "crit": 3,
            "desc": "Package name disagrees with its repository",
            "spans": [
              [
                0,
                37
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/depconf::registry-security-withdrawn-package-coordinate",
            "atk": "T1195.002",
            "conf": 0.995,
            "crit": 3,
            "desc": "Package coordinate was withdrawn for security"
          }
        ]
      }
    ]
  }
}