{
  "ml": {
    "v": "7",
    "id": 117,
    "lvl": -1,
    "conf": 0,
    "prob": 0.00002337495425308589,
    "type": "gz",
    "version": "v18.18",
    "analyzed_at": "2026-09-23T16:09:13Z"
  },
  "path": "speedtest.net@master",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 117,
        "mol": "O₃(CIXe₂)H₅(Cm₄Db₇FOs₂Po₆)Md₃(In₄Pa₆)",
        "pid": 3,
        "rel": "fetched",
        "sha": "915333fdc270ae04ad7dd87ab5ffcb6c77c8beb323a9b66c16095971c1e169fa",
        "via": "https://codeload.github.com/machinemetrics/speedtest.net/tar.gz/master",
        "path": "pkg:github/machinemetrics/speedtest.net@master",
        "risk": 23,
        "size": 98279,
        "type": "gz",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 98279,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 98279,
              "peak_region_entropy": 7.85
            },
            "consistency": {
              "self_dependency": 0,
              "unused_runtime_deps": 0
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program",
            "conf": 0.82,
            "crit": 3,
            "desc": "Node spawns a variable program path",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::node-chmod-call",
            "conf": 0.85,
            "crit": 3,
            "desc": "Node calls chmod to change permissions",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/child_process::child_process",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports child_process",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/decompress-targz::decompress-targz",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports decompress-targz",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Joins array with a short delimiter",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-end-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream end handler",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/repository::has-repository-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "package.json declares repository metadata"
          },
          {
            "id": "metadata/import/npm/decompress-unzip::decompress-unzip",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports decompress-unzip",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/construct::script-dirname-ref",
            "conf": 0.6,
            "crit": 3,
            "desc": "References script directory path",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the Node.js process.platform value",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-async-iife-import-hook",
            "conf": 0.9,
            "crit": 3,
            "desc": "Async IIFE executes at module end",
            "from": [
              {
                "file": 120
              }
            ],
            "uses": [
              30,
              55
            ]
          },
          {
            "id": "metadata/import/builtin::require-child-process",
            "conf": 0.8,
            "crit": 3,
            "desc": "require() of the child_process module",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/tree-kill::tree-kill",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports tree-kill",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls a matcher in a conditional expression",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/entrypoint::bin-field-declared",
            "conf": 0.95,
            "crit": 3,
            "desc": "Manifest declares a bin entry"
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-bounded-while-loop",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript bounded while loop",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Invokes zero-argument function at module scope",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::result-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Result field or assignment key",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package declares a runtime dependency",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-stdin-read",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads a JSON event payload from stdin",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/import/builtin::require-fs",
            "conf": 0.7,
            "crit": 2,
            "desc": "Imports the Node.js fs module",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/tasking::http-task-liveness-field",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Structured object contains a liveness field",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::module-scope-zero-arg-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Module scope assigns zero-argument call",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/repository::has-repository-url",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json declares a repository URL"
          },
          {
            "id": "metadata/package/files/included::package-json-basename",
            "conf": 0.95,
            "crit": 3,
            "desc": "Filename is package.json",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/import/npm/sha256-file::sha256-file",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports sha256-file",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/concat::js-loop-string-concat-any",
            "conf": 0.6,
            "crit": 3,
            "desc": "String concatenation inside JavaScript loop",
            "from": [
              {
                "file": 119
              }
            ],
            "uses": [
              68
            ]
          },
          {
            "id": "metadata/import/npm/felipecrs/decompress-tarxz::felipecrs/decompress-tarxz",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports @felipecrs/decompress-tarxz",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::child-process-require",
            "atk": "T1059",
            "mbc": "C0017",
            "conf": 0.8,
            "crit": 3,
            "desc": "Imports the Node.js child_process module",
            "from": [
              {
                "file": 119
              }
            ],
            "uses": [
              11
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-trailing-iife-closure",
            "conf": 0.85,
            "crit": 3,
            "desc": "JavaScript file ends with an IIFE",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/spawn::child-process-member-spawn",
            "conf": 0.85,
            "crit": 3,
            "desc": "Node.js child_process spawns an external process",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/util::util",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports util",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/replace::chained-replace-calls",
            "conf": 0.9,
            "crit": 3,
            "desc": "Chains multiple JavaScript string replacements",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/files/package-json::files-array-present",
            "conf": 0.92,
            "crit": 3,
            "desc": "Package.json declares a files allowlist"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/execution/exploit/network-service/exploit-automation::nuclei-remote-http-target-field",
            "conf": 0.93,
            "crit": 3,
            "desc": "Nuclei example hardcodes an HTTP target",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/count::npm-dependency-fanout",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package has at least eight runtime deps"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member",
            "conf": 0.8,
            "crit": 3,
            "desc": "Reads the Node.js process.platform value",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/versioning/scheme::mature-version",
            "conf": 0.7,
            "crit": 2,
            "desc": "Major version is 1 or higher"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/npm/path::path",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports path",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/spawn::child-process-alias-spawn",
            "mbc": "C0017",
            "conf": 0.85,
            "crit": 3,
            "desc": "Node.js child_process alias spawn",
            "from": [
              {
                "off": 7254,
                "file": 119,
                "line": 244
              }
            ],
            "uses": [
              11,
              31
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close",
            "conf": 0.86,
            "crit": 3,
            "desc": "Calls a parenthesized function expression",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/import/npm/download::download",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports download",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/replace::url-target-replace-assignment",
            "conf": 0.9,
            "crit": 3,
            "desc": "Assigns replaced text to a URL variable",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::local-exec-function",
            "atk": "T1059",
            "conf": 0.9,
            "crit": 2,
            "desc": "Local function named exec",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/file/string/telemetry::platform-profile-field",
            "conf": 0.95,
            "crit": 3,
            "desc": "Platform profile field name",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/spawn::windowshide-option",
            "conf": 0.85,
            "crit": 3,
            "desc": "Node.js windowsHide spawn option",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/benchmark/speedtest::speedtest",
            "conf": 0.9,
            "crit": 3,
            "desc": "speedtest utility",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/draftlog::draftlog",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports draftlog",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/tasking/json-http::upload-task-dispatch-branch",
            "atk": "T1071.001,T1059,T1105,T1620",
            "mbc": "B0030",
            "conf": 0.94,
            "crit": 3,
            "desc": "Dispatches an upload task token",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::async-iife-invoke",
            "conf": 0.7,
            "crit": 3,
            "desc": "Immediately invokes an async function"
          },
          {
            "id": "micro-behaviors/process/info/commandline::check-argv",
            "conf": 0.8,
            "crit": 3,
            "desc": "Reads Node.js arguments through process.argv",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/tasking/json-http::download-task-dispatch-branch",
            "atk": "T1071.001,T1059,T1105,T1620",
            "mbc": "B0030",
            "conf": 0.94,
            "crit": 3,
            "desc": "Dispatches a download task token",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-data-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream data handler",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/spawn::child-process-creation-api",
            "atk": "T1106",
            "conf": 0.92,
            "crit": 3,
            "desc": "Starts a child process through a platform API",
            "from": [
              {
                "off": 7254,
                "file": 119,
                "line": 244
              }
            ],
            "uses": [
              31,
              44
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::unzip-tool-reference",
            "conf": 0.7,
            "crit": 3,
            "desc": "References unzip extraction tool",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal",
            "atk": "T1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "child_process module name literal",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::node-child-process-capability",
            "conf": 0.8,
            "crit": 3,
            "desc": "Imports or invokes Node.js child-process APIs",
            "from": [
              {
                "off": 1333,
                "file": 119,
                "line": 36
              }
            ],
            "uses": [
              2,
              11
            ]
          },
          {
            "id": "metadata/import/npm/decompress-tarbz2::decompress-tarbz2",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports decompress-tarbz2",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/mkdirp::mkdirp",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports mkdirp",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/decompress-tar::decompress-tar",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports decompress-tar",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/chalk::chalk",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports chalk",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/concat::js-loop-string-concat",
            "conf": 0.6,
            "crit": 2,
            "desc": "String concatenation in loop body using array",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/execution/automation/skill::skill-automatic-trigger-marker",
            "atk": "T1059",
            "conf": 0.92,
            "crit": 3,
            "desc": "Agent skill runs automatically",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/package::dep-eslint",
            "conf": 0.9,
            "crit": 3,
            "desc": "Depends on ESLint",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url",
            "conf": 0.75,
            "crit": 3,
            "desc": "Contains a hardcoded remote HTTP(S) URL",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/import/npm/fs::fs",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports fs",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::object-type-dispatch-switch",
            "conf": 0.93,
            "crit": 3,
            "desc": "Switch dispatches on an object type field",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/repository::repo-url-git-host",
            "conf": 0.9,
            "crit": 3,
            "desc": "Repository identifies major Git host"
          },
          {
            "id": "micro-behaviors/os/module/require::node-system-module-import-set",
            "conf": 0.88,
            "crit": 3,
            "desc": "Imports at least two Node system modules",
            "from": [
              {
                "file": 119
              }
            ],
            "uses": [
              11,
              20
            ]
          },
          {
            "id": "metadata/import/npm/decompress::decompress",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports decompress",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/file/comment::source-comment-bytes-over-300",
            "conf": 0.92,
            "crit": 2,
            "desc": "Source has over 300 comment bytes",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/impact/ransom/encrypt/runtime-generated::destructive-action-b",
            "atk": "T1486",
            "conf": 0.94,
            "crit": 3,
            "desc": "Destructive or exfiltration verb with target",
            "from": [
              {
                "file": 2
              }
            ]
          }
        ]
      }
    ]
  }
}