{ "llm": { "conf": 0.4170972, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate browser package build script" }, "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.16728173, "rte": "az", "prob": 0.16728173 } ], "prob": 0.16728173, "skip": [ { "rte": "az/tar", "why": "unavailable" }, { "rte": "az/tar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.16728173196315765, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000027388334274291992, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00004271666330168955, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000020792087525478564, "type": "shell" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000011573235497053247, "type": "srcinfo" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000011732180610124487, "type": "desktop-entry" } ], "version": "v18.18", "analyzed_at": "2026-06-25T01:48:13Z" }, "path": "brave-bin-1-1.91.178-1.src.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zN\u003e?e:mIMD#R{UJM*v/^q?k:[\u0026jxR2U1Yh^!3RaYR^JT2nuJo/er^=wdKM", "n": [ { "c": 2, "d": "Archive parser reported errors", "i": "metadata/file/metrics::archive-parse-error", "o": 0, "z": 24, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "O(Er)H₃(CmFPo)", "sha": "816919d9f1c043f527b5b62e3d7e389831d106832bbde651ee386792f8a4c50b", "path": "brave-bin-1-1.91.178-1.src.tar.gz", "risk": 4, "size": 6273, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 6273.0, "entropy": 7.96, "size_bytes": 6273.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 6144.0, "peak_region_entropy": 7.8 } } }, "traits": [ { "id": "micro-behaviors/fs/chmod/executable/mode::shell-7xx", "atk": "T1222", "mbc": "E1222", "conf": 0.699999988079071, "crit": 3, "desc": "Shell chmod 7xx (executable)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 1 } ] }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x", "atk": "T1222", "mbc": "E1222", "conf": 0.75, "crit": 3, "desc": "chmod +x (make executable)", "from": [ { "file": 2 } ] }, { "id": "metadata/file/format::desktop-type-application", "conf": 1.0, "crit": 1, "desc": "Desktop entry Type=Application" }, { "id": "micro-behaviors/communications/url/external/github::github-release-download", "atk": "T1105", "conf": 0.8500000238418579, "crit": 3, "desc": "GitHub releases download URL", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "off": 376, "file": 1, "line": 25 } ] }, { "id": "metadata/file/format::desktop-exec-present", "conf": 1.0, "crit": 1, "desc": "Desktop entry has Exec directive" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "crit": 3, "desc": "Shell exec builtin (process replacement)", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::desktop-terminal-hidden", "conf": 1.0, "crit": 1, "desc": "Desktop entry Terminal=false" } ] }, { "ctx": [ { "b": "boXZ.B8\u0026{yx(kOnzGWdivrl8?3rPX^uQEQ:mOc9Snkz@GjT8d#svtU^lR*DDnK)bUpFBnseG#D!nkz@GEj)i.z/ff3xcI:F3joc@pdwOWnLzMoa%.Iql}pPKpFKwJm{!!.o*%E-vSC[2wI4Igvp%Tlv@Dl%a{[V\u003ew^O\u0026^wPI@oeOlaHbZR)OpdwOWnLzN3a{@B9wO}?Yzddx}x(4u6eP-a5pFKw^oI5eZauQ+\u003cbZR)OpdwOWnLzN3a{}{@3jpx-AV^.BpdwO:nLRX%x(k4qbZR)OpdwO:nMeO)kWw^Z3s[5Z329#]aS%#[3jd1.bZR)OpdwO:nLRZ5a%o3$aynnRi=/mGv}vYbt}dlED)ycF30**z33o\u0026(zvcWRmOD9ruRB3\u0026r4y9Wa%.I5pFKw^oI4#FEiH9E31^(Uwn=u%3jpu?AbP=savwW$pFBn+rZ/[+nL-8*moAI!k%lPpBywS{wHv/(wQ4=@atmULBt49zvrMilvRGZkvSC[2wGSfxDQZW{m{!}Yq=D%^u40[ta%.I2EiG0", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "test" ], [ "", "mapfile" ], [ "", "exec" ] ], "tgt": [ "exec", "mapfile", "test" ], "metrics": { "ast": { "max_depth": 9, "call_count": 3, "node_count": 140, "max_array_length": 1 }, "file": { "size": 427, "entropy": 5.54 }, "text": { "lines": 25, "top_char": 34, "tab_count": 10, "space_count": 18, "char_entropy": 5.54, "unique_chars": 64, "top_char_null": 0, "string_density": 0.4, "top_char_ratio": 0.05, "avg_line_length": 16.08, "max_line_length": 55, "empty_line_ratio": 0.24, "last_line_length": 50, "whitespace_ratio": 0.12, "identifier_density": 1.04, "line_length_stddev": 18.43, "max_whitespace_run": 1, "normalized_string_count": 2, "normalized_unique_identifiers": 3.01 }, "binds": { "count": 4 }, "binary": { "peak_region_bytes": 427, "peak_region_entropy": 5.54 }, "strings": { "bytes": 160, "count": 10, "avg_length": 16, "max_length": 37, "avg_entropy": 3.54, "entropy_stddev": 0.8 }, "comments": { "chars": 18, "count": 1, "lines": 1, "to_code_ratio": 0.04 }, "identifiers": { "count": 26, "unique": 14, "avg_length": 8.21, "max_length": 20, "min_length": 1, "avg_entropy": 2.32, "reuse_ratio": 0.54, "length_stddev": 6.04, "single_char_count": 1, "single_char_ratio": 0.07, "high_entropy_count": 2, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 0.21, "all_uppercase_ratio": 0.5 } } }, "id": 1, "mol": "H(F)", "path": "brave-bin-1-1.91.178-1.src.tar.gz!!brave-bin/brave-bin.sh", "pid": 0, "risk": 2, "sha": "75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00", "size": 427, "traits": [ { "id": "micro-behaviors/fs/path/location::shell-home-dotpath", "conf": 0.85, "crit": 3, "desc": "Shell path to a dot-entry under $HOME", "spans": [ [ 58, 10 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Uses shell exec to replace process", "spans": [ [ 376, 4 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 202, 0 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV})LvrMi8jyJwMePLAswNPT\u003ekW[+xC4Apoz/4V", "n": [ { "c": 2, "d": "Arch PKGBUILD package recipe basename", "i": "metadata/file/string/identity::pkgbuild-basename", "o": 0, "z": 8, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "boPu(zGG]kvS=^hAYLsgvqGH:awDoOy?mH4vqWhIv{%g+vNavrwPz^kwIdFhz9v", "ln": 2, "addr": 44 }, { "b": "boPu(zGG]kvS=^hAYLsnz/-*}awDM.B.bwiq^\u003cYPB8L(6auTyQB768$B-G-Wzddc{e[n*pj]", "ln": 3, "addr": 95 }, { "b": "vrb\u003c\u003ejT+LmhEwv0ayOY0v}W+Sdf", "ln": 17, "addr": 687 }, { "b": "B-IpYxMOunB2\u003e%cvSC[2wIdFhz2", "ln": 18, "addr": 709 }, { "b": "y?Wx\u003czGxwLc@0Jig9w[Zl)b#ZB98tqi+8\u0026zz/6ihz7b", "n": [ { "c": 2, "d": "BSD license reference", "i": "metadata/package/license::bsd-word", "o": 745, "z": 3, "cf": 0.699999988079071 } ], "ln": 19, "addr": 731 }, { "b": "wmYZ\u003ezE^/Kc$c}kvj=qfvG", "ln": 20, "addr": 766 }, { "b": "31[u}gx", "ln": 21, "addr": 784 }, { "b": "z/x/jz/fRVc)rUNA+PFw", "ln": 30, "addr": 1026 }, { "b": "B8Mhwv}v!KbYEKizEEx[e]$XGvSC[2wI4wiz*cnlAXp)lB8b(oA47", "ln": 31, "addr": 1043 }, { "b": "B8Mhwv}x1(i5Ub4g^9ljDVi+kzEEx[EjVZ\u003eAbf9fwPAhJCSmP*hz^4jx(D9]xMOunB2\u003e%cxk8E3BZ=$kz/4dpA::c5fjF%gC4AmmA=leywPxCAwO+{^B7GzCwn=Wfy\u0026r-)flOQ/Abf9fwPAhLvSC[2wI4wiz*cnlAXeL-Abf9fwPAhJy?W^fCR9uvwhVm%DtdsE", "n": [ { "c": 3, "d": "GitHub releases download URL", "i": "micro-behaviors/communications/url/external/github::github-release-download", "o": 1142, "z": 49, "cf": 0.8500000238418579 } ], "ln": 32, "addr": 1086 }, { "b": "B8Mhwv}x1Qvrb\u003c\u003ehz^MBbZTGCxkRc{wQMcQDVi+kC4CYxeN-7dv}W+Se{.kJiYZ}@Bz#pZfe3%LBzb/ae[n*pfjF%gC4AsoA::c5eN\u0026:sCxmtoflgSuwNPT\u003eB1.6xCw.knvpR3mbZTGCxlE\u003cbEj]5IvrMilvSDyhB7GwzbZTGCxlE\u003cbEjYnHzGQgQvrciyg+K8*A47", "ln": 33, "addr": 1243 }, { "b": "", "ln": 34, "addr": 1402 }, { "b": "32KD*x(UsFA3eRgvrMh", "ln": 42, "addr": 1827 }, { "b": "31v%^ByxhjeQg\u003eIa%.byxkRc{wI2fDyId*4AXeL7k#H6ve{.kJa%nE8ayYw1C4y", "ln": 43, "addr": 1843 }, { "b": "31ET=z!6$vCPZEovrMinvSC[2wD", "n": [ { "c": 3, "d": "chmod +x (make executable)", "i": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x", "o": 1895, "z": 10, "cf": 0.75 } ], "ln": 44, "addr": 1894 }, { "b": "Ee", "ln": 45, "addr": 1916 }, { "b": "", "ln": 46, "addr": 1918 }, { "b": "", "ln": 50, "addr": 1998 }, { "b": "2{QN3y\u002613lazbtdwOLT/y-)\u003ewwPz\u0026mBz\u0026pmwPP5pxK@rcB.LweB75@%vScGlCw?Iqx(mL", "ln": 51, "addr": 1999 }, { "b": "31ET=z!6$Eh-iDna%.byxjLZ%fk\u003e/KfjF%gC4Ammx(kOlxMw3dwI4$izE^i{CP)", "n": [ { "c": 3, "d": "Shell chmod 7xx (executable)", "i": "micro-behaviors/fs/chmod/executable/mode::shell-7xx", "o": 2056, "z": 11, "cf": 0.699999988079071 } ], "ln": 52, "addr": 2055 }, { "b": "", "ln": 53, "addr": 2106 }, { "b": "32ao#Byx04at2##fGg\u003cDar\u00267IyIdJ[zdLtvxD!MybYEKiwnc6qB-RNRvRGZkvSC[2wG?", "ln": 54, "addr": 2107 } ], "depth": 1, "facts": { "imp": [ [ "", "mkdir" ], [ "", "mkdir" ], [ "", "bsdtar" ], [ "", "bsdtar" ], [ "", "chmod" ], [ "", "chmod" ], [ "", "install" ], [ "", "install" ], [ "", "cp" ], [ "", "cp" ], [ "", "chmod" ], [ "", "chmod" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "pushd" ], [ "", "pushd" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "bsdtar", "chmod", "cp", "install", "mkdir", "pushd" ], "metrics": { "ast": { "op.div": 1.0, "op.mod": 2.0, "max_depth": 8.0, "bind_count": 20.0, "call_count": 11.0, "node_count": 420.0, "op_density.div": 0.0, "op_density.mod": 0.0, "identifier_count": 74.0, "string_literal_count": 23.0, "array_literal_max_length": 5.0 }, "file": { "size": 2532.0, "entropy": 5.55, "size_bytes": 2532.0 }, "text": { "tab_count": 24.0, "digit_ratio": 0.15, "space_count": 138.0, "total_lines": 62.0, "char_entropy": 5.55, "mixed_indent": 1.0, "unique_chars": 91.0, "string_density": 0.37, "avg_line_length": 39.84, "high_byte_ratio": 0.01, "max_line_length": 158.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.1, "last_line_length": 1.0, "long_token_count": 2.0, "whitespace_ratio": 0.09, "most_common_ratio": 0.06, "identifier_density": 2.1, "line_length_stddev": 34.15, "encoded_string_ratio": 0.17, "normalized_string_count": 2.92, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.18, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 114.0, "normalized_unique_identifiers": 12.43 }, "binds": { "count": 20.0 }, "calls": { "count": 11.0 }, "binary": { "overall_entropy": 5.55, "peak_region_bytes": 2532.0, "peak_region_entropy": 5.43 }, "source": { "function_count": 2.0 }, "strings": { "total": 23.0, "avg_length": 34.91, "max_length": 68.0, "path_count": 1.0, "avg_entropy": 3.82, "hex_strings": 4.0, "total_bytes": 803.0, "entropy_stddev": 0.34 }, "comments": { "chars": 589.0, "lines": 11.0, "total": 11.0, "to_code_ratio": 0.22, "high_entropy_comments": 2.0 }, "functions": { "count": 2.0, "avg_params": 6.0, "max_params": 9.0, "length_stddev": 5.5, "avg_name_length": 7.0, "avg_length_lines": 10.5, "max_length_lines": 16.0, "min_length_lines": 5.0, "many_params_count": 1.0, "avg_param_name_length": 25.25, "density_per_100_lines": 3.23, "code_in_functions_ratio": 0.34 }, "identifiers": { "count": 74.0, "total": 130.0, "avg_length": 9.14, "max_length": 72.0, "min_length": 1.0, "avg_entropy": 2.4, "reuse_ratio": 0.57, "unique_count": 74.0, "length_stddev": 11.24, "has_digit_ratio": 0.35, "single_char_count": 1.0, "single_char_ratio": 0.01, "high_entropy_count": 7.0, "high_entropy_ratio": 0.09, "all_lowercase_ratio": 0.38, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 18.0 } } }, "id": 2, "mol": "H₂(CmF)", "path": "brave-bin-1-1.91.178-1.src.tar.gz!!brave-bin/PKGBUILD", "risk": 2, "sha": "12ba16dff73b9fe4a459afa0a83fea497fea879eada82d3ab33f496e2c2222f1", "size": 2532, "traits": [ { "id": "micro-behaviors/communications/url/external/github::github-release-download", "atk": "T1105", "conf": 0.8500000238418579, "crit": 3, "desc": "GitHub releases download URL", "spans": [ [ 1142, 49 ] ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::shell-7xx", "atk": "T1222", "mbc": "E1222", "conf": 0.699999988079071, "crit": 3, "desc": "Shell chmod 7xx (executable)", "spans": [ [ 2056, 11 ] ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x", "atk": "T1222", "mbc": "E1222", "conf": 0.75, "crit": 3, "desc": "chmod +x (make executable)", "spans": [ [ 1895, 10 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOkvrl8?3l{W9x)p+izGY-mz/fA6zGE1tw/$-2BzbPhyJx\u00269zGxxhav/15uQNE-3l{Wcw/%]ym)ZiEoHH1pvriM2wO2:4vqH3%A+e=jaA.Tlvru66e(LUnnLR-J3tai%aAg+hxDR2bas5vFx(\u003eFdx\u003ey%1eIg\u003cGzdLqqzFTOveIgEvv}YB:at2fQx\u003ey%ew[=76wPx}1o^@dDwn.!$arR!vw/$qZar\u00267TAa9\u003c4EiG^%EJQl)p!KqBry]\u003eLbP{w#j0nSUwO}?$arR^HarR!rv}Y^6eOc4GtXda[f/}fDz6gqTdJ?k)zE)\u0026%BzkS9ayPd#ayO!\u003ex(mMae(LUnnLR-JazbLjas8qMvrughasX\u0026\u003ctXda[fL@0varR^HarR^Hc#AydwPhA$at2f:A+PAkB8\u003e=8zF0/fj%h3{DR^^iEiHr%q=k$Opdw2daBFLVwQ4{hatBiCarR^HarR!tx(\u003eFuAaAy0wI4RlwmY#)arR^HarR^Hxk8DgvpS)\u003ea%.Iis44DXfd{g3lRg3xpyni!arUog3s[6)wEn", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "git" ], [ "", "echo" ], [ "", "makepkg" ], [ "", "exit" ], [ "", "git" ], [ "", "git" ] ], "tgt": [ "echo", "exit", "git", "makepkg" ], "metrics": { "ast": { "max_depth": 11, "call_count": 6, "node_count": 98 }, "file": { "size": 434, "entropy": 5.17 }, "text": { "lines": 13, "top_char": 101, "digit_ratio": 0.03, "space_count": 85, "char_entropy": 5.17, "unique_chars": 68, "top_char_null": 0, "string_density": 0.31, "top_char_ratio": 0.05, "avg_line_length": 32.38, "max_line_length": 84, "empty_line_ratio": 0.08, "last_line_length": 4, "whitespace_ratio": 0.23, "identifier_density": 2.15, "line_length_stddev": 25.42, "max_whitespace_run": 1, "normalized_string_count": 1.11, "suspicious_comment_ratio": 0.33, "normalized_unique_identifiers": 4.32 }, "binary": { "peak_region_bytes": 434, "peak_region_entropy": 5.17 }, "strings": { "bytes": 85, "count": 4, "avg_length": 21.25, "max_length": 66, "avg_entropy": 3.18, "entropy_stddev": 0.9 }, "comments": { "chars": 84, "count": 3, "lines": 3, "high_entropy": 1, "to_code_ratio": 0.3 }, "identifiers": { "count": 28, "unique": 16, "avg_length": 6.94, "max_length": 16, "min_length": 2, "avg_entropy": 2.24, "reuse_ratio": 0.57, "length_stddev": 4.22, "all_lowercase_ratio": 0.44, "all_uppercase_ratio": 0.13 } } }, "id": 3, "mol": "H₂(FPo₂)", "path": "brave-bin-1-1.91.178-1.src.tar.gz!!brave-bin/.pre-commit", "pid": 0, "risk": 2, "sha": "c25db50166a6ed40e93ab6a044b74f7a3417fe665233f1e2ccf33c40c2ee4905", "size": 434, "traits": [ { "id": "micro-behaviors/fs/path/vcs::git-precommit-hook-path", "conf": 0.9, "crit": 3, "desc": "Git pre-commit hook path" }, { "id": "micro-behaviors/process/create/shell/security::ansi-terminal-control-command", "conf": 0.94, "crit": 3, "desc": "Command emits terminal control sequences", "spans": [ [ 223, 72 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::command-substitution", "conf": 1.0, "crit": 3, "desc": "Shell command-substitution syntax", "spans": [ [ 117, 49 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 257, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 105, 0 ] ] } ], "type": "shell" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1389.0, "entropy": 5.23, "size_bytes": 1389.0 }, "binary": { "overall_entropy": 5.23, "peak_region_bytes": 1389.0, "peak_region_entropy": 5.17 } } }, "id": 4, "path": "brave-bin-1-1.91.178-1.src.tar.gz!!brave-bin/.SRCINFO", "refs": [ { "to": "pkg:alpm/arch/alsa-lib", "off": 267, "kind": "dependency" }, { "to": "pkg:alpm/arch/gtk3", "off": 287, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxss", "off": 303, "kind": "dependency" }, { "to": "pkg:alpm/arch/nss", "off": 321, "kind": "dependency" }, { "to": "pkg:alpm/arch/ttf-font", "off": 336, "kind": "dependency" } ], "sha": "1306a6cf96b2dd64123d67604e943ecc1706e3a12d6697abbf14fd9a361a6668", "size": 1389, "type": "srcinfo" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 8677, "entropy": 6.08 }, "binary": { "peak_region_bytes": 8677, "peak_region_entropy": 5.93 } } }, "id": 5, "mol": "Md", "path": "brave-bin-1-1.91.178-1.src.tar.gz!!brave-bin/brave-browser.desktop", "pid": 0, "risk": 1, "sha": "c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a", "size": 8677, "traits": [ { "id": "metadata/file/format/structured::desktop-terminal-false", "conf": 1.0, "crit": 3, "desc": "Desktop entry Terminal=false" } ], "type": "desktop_entry" } ], "rev": "33de0", "v": "8" } }