{
  "ml": {
    "v": "7",
    "id": 6544,
    "lvl": -1,
    "conf": 0,
    "prob": 0.000012010335922241211,
    "type": "javascript",
    "version": "v18.18",
    "analyzed_at": "2026-09-20T07:45:12Z"
  },
  "path": "package/dist/protobuf.js.map##unicode-escape@0",
  "raw": {
    "rev": "e86a6",
    "files": [
      {
        "id": 8617,
        "mol": "O₃(AsLaS)H₄(Cm₅Db₁₂FOs₂)Md",
        "pid": 23,
        "rel": "fetched",
        "sha": "89442a4883dfa8f7d469ca87e30d08eb88ef529cc39d7962451ea151a21735da",
        "via": "https://registry.npmjs.org/protobufjs/-/protobufjs-6.10.1.tgz",
        "path": "pkg:npm/protobufjs@6.10.1!!package/dist/protobuf.js.map!!package/dist/protobuf.js.map##unicode-escape@0",
        "risk": 14,
        "size": 328395,
        "type": "javascript",
        "depth": 4,
        "facts": {
          "metrics": {
            "file": {
              "size": 328395,
              "entropy": 4.81
            },
            "binary": {
              "peak_region_bytes": 95947,
              "peak_region_entropy": 5.16
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::sourcemap",
            "conf": 1.0,
            "crit": 3,
            "desc": "JavaScript source map",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap-sources-content",
            "conf": 0.9,
            "crit": 3,
            "desc": "Source map sourcesContent array",
            "spans": [
              [
                45646,
                18
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                45728,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                45859,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "spans": [
              [
                45895,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "spans": [
              [
                119324,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                45767,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "spans": [
              [
                58644,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                45720,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/google::google-api-host-reference",
            "mbc": "C0002",
            "conf": 0.95,
            "crit": 3,
            "desc": "References a Google API host",
            "spans": [
              [
                312071,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/encoded::long-base64-like-path-segment",
            "conf": 0.9,
            "crit": 3,
            "desc": "Path has long Base64-like segment",
            "spans": [
              [
                63101,
                35
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "spans": [
              [
                303020,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.95,
            "crit": 3,
            "desc": "Encoded URL references MDN documentation",
            "spans": [
              [
                63046,
                22
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/buffer::uint8array-constructor",
            "conf": 0.9,
            "crit": 2,
            "desc": "Constructs a Uint8Array buffer",
            "spans": [
              [
                62877,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls a matcher in a conditional expression",
            "spans": [
              [
                84551,
                19
              ],
              [
                121470,
                39
              ],
              [
                127830,
                21
              ],
              [
                160413,
                40
              ],
              [
                181475,
                36
              ],
              [
                182555,
                18
              ],
              [
                182638,
                18
              ],
              [
                182721,
                17
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::object-type-dispatch-switch",
            "conf": 0.93,
            "crit": 3,
            "desc": "Switch dispatches on an object type field",
            "spans": [
              [
                94577,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-bounded-while-loop",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript bounded while loop",
            "spans": [
              [
                105666,
                14
              ],
              [
                106747,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-empty-module-exports",
            "conf": 0.8,
            "crit": 3,
            "desc": "CommonJS module exports an empty object",
            "spans": [
              [
                226998,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close",
            "conf": 0.86,
            "crit": 3,
            "desc": "Calls a parenthesized function expression",
            "spans": [
              [
                67747,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/decode/custom::fromcharcode-apply-array",
            "atk": "T1140",
            "conf": 0.92,
            "crit": 3,
            "desc": "Converts character-code array to string",
            "spans": [
              [
                50564,
                40
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/decode/custom::js-charcode-byte-mask",
            "atk": "T1140",
            "conf": 0.94,
            "crit": 3,
            "desc": "Masks character code to one byte",
            "spans": [
              [
                62763,
                19
              ],
              [
                288986,
                236
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/encode/charcode::charcode-at",
            "conf": 0.7,
            "crit": 3,
            "desc": "charCodeAt() method call",
            "spans": [
              [
                51607,
                12
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::result-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Result field or assignment key",
            "spans": [
              [
                194426,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/protobuf::google-protobuf-timestamp",
            "conf": 0.95,
            "crit": 3,
            "desc": "Google protobuf Timestamp type name",
            "spans": [
              [
                86215,
                25
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/transition::js-float-array-constructor",
            "conf": 0.9,
            "crit": 2,
            "desc": "Constructs a Float64Array buffer",
            "spans": [
              [
                66119,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/prototype::return-this-body",
            "conf": 0.7,
            "crit": 3,
            "desc": "Function body returns this",
            "spans": [
              [
                285812,
                25
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy",
            "conf": 0.8,
            "crit": 2,
            "desc": "Copies one indexed array element to another",
            "spans": [
              [
                54733,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Sorts a JavaScript array",
            "spans": [
              [
                101215,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read",
            "conf": 0.8,
            "crit": 2,
            "desc": "Reads an array element into a variable",
            "spans": [
              [
                97345,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/access::js-charat-lookup",
            "conf": 0.82,
            "crit": 2,
            "desc": "JavaScript string character lookup",
            "spans": [
              [
                49075,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "References the toString conversion method",
            "spans": [
              [
                54177,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/telemetry/logging/llm::console-log-json-stringify-call",
            "mbc": "C0069",
            "conf": 0.86,
            "crit": 3,
            "desc": "Console logs JSON stringified payload",
            "spans": [
              [
                300068,
                50
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/xor::eval-call-site",
            "atk": "T1027,T1059.007",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls eval on recovered source",
            "spans": [
              [
                75883,
                5
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/extensions/backdoor::dnr-websocket-marker",
            "conf": 0.86,
            "crit": 3,
            "desc": "DNR WebSocket marker",
            "spans": [
              [
                227698,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/client/response-body::response-text",
            "conf": 0.7,
            "crit": 3,
            "desc": "Reads an XMLHttpRequest response body",
            "spans": [
              [
                62684,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text",
            "conf": 0.92,
            "crit": 3,
            "desc": "Text has empty named-parameter catch",
            "spans": [
              [
                76062,
                12
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/decode/custom::js-octal-parseint",
            "atk": "T1140",
            "conf": 0.96,
            "crit": 3,
            "desc": "parseInt parses an octal string",
            "spans": [
              [
                182608,
                183
              ],
              [
                183521,
                134
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/arithmetic::js-bitwise-arithmetic-chain",
            "conf": 0.8,
            "crit": 3,
            "desc": "JavaScript bitwise arithmetic and shift chain",
            "spans": [
              [
                68699,
                27
              ],
              [
                73548,
                28
              ],
              [
                82747,
                37
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::readfilesync-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls readFileSync",
            "spans": [
              [
                219591,
                16
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/module/dynamic-load::node-computed-require-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Requires a computed Node module name",
            "spans": [
              [
                46335,
                16
              ]
            ]
          },
          {
            "id": "objectives/lateral-movement/brute-force/password::common-account-root-password-pair",
            "atk": "T1110.001",
            "conf": 0.86,
            "crit": 3,
            "desc": "Common account paired with root password",
            "spans": [
              [
                131330,
                9
              ]
            ]
          }
        ]
      }
    ]
  }
}