{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.018992117, "rte": "az", "prob": 0.018992117 } ], "prob": 0.018992117, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.018992116674780846, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00001091758440452395, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.018992116674780846, "type": "perl" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000016589960068813525, "type": "perl" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.018992116674780846, "type": "perl" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000011404355063859839, "type": "json" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000008682410225446802, "type": "perl" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000009417533874511719, "type": "perl" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000009258587851945776, "type": "perl" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000008443991646345239, "type": "perl" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000009228785529558081, "type": "perl" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000011662642464216333, "type": "ole" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.00001049041748046875, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-24T06:03:33Z" }, "path": "perl-xml-parser-2.53-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8010L00rqzkyJ[I\u003eWRiCfZHAKvm%nSzQ9N{x8S]S5AG/fH(z#n4jf$xo7dZ+8ykMK4", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H₂(CmPo)Md₂(BiHe)", "sha": "92f4f7b1d04506e2c937529cb97ef1667246bc996dd1817e3a13b62aed3bfaa2", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk", "risk": 5, "size": 211655, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 211655.0, "entropy": 7.99, "size_bytes": 211655.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 177863.0, "peak_region_entropy": 7.85 } } }, "traits": [ { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "from": [ { "file": 12 } ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 12 } ] }, { "id": "metadata/lang/scripted::use-module", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl module import statement", "from": [ { "file": 2 } ], "spans": [ [ 87, 11 ], [ 214, 9 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "Shared library binds dynamic loader", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "from": [ { "file": 5 } ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::version-text", "conf": 0.699999988079071, "crit": 2, "desc": "Version information string", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/scripted::subroutine-definition", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl subroutine definition", "from": [ { "file": 2 } ], "spans": [ [ 99, 11 ], [ 462, 26 ] ] }, { "id": "metadata/lang/scripted::sigil-variable-decl", "conf": 0.800000011920929, "crit": 2, "desc": "Perl sigil variable declaration", "from": [ { "file": 2 } ], "spans": [ [ 111, 13 ], [ 210, 13 ], [ 545, 10 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 12 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 12 } ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/lib/lwp::perl-lwp-useragent", "atk": "T1071.001", "conf": 0.8999999761581421, "crit": 3, "desc": "Perl LWP HTTP client import", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "from": [ { "off": 94, "file": 12, "line": 6 } ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "from": [ { "file": 5 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000[m?$70000000000kMA+z3JJA(b(/g\u003c", "n": [ { "c": 3, "d": "Shared library binds dynamic loader", "i": "metadata/binary/linking/runtime::library-loader-dep", "o": 0, "z": 32, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib08Mu@v%8*jwO#P%v@DmbwQ5p%uTE[\u003eB6\u0026M\u003eByeD!wo4VDwPzP]xM^-)z/6ufzEmf\u003cD0+x0zu9^koKyq3Bvu", "n": [ { "c": 2, "d": "Imports __tls_get_addr from the dynamic loader", "i": "metadata/binary/linking/runtime::imports-tls-get-addr", "o": 3514, "z": 12, "cf": 1.0 }, { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 3480, "z": 12, "cf": 0.8999999761581421 } ], "ln": 3464 }, { "b": "p?sV-uV6C0q=W\u003cXzua3JB97\u00262yHpN+yHpWZx(0=CwPzP]B9p]dwP@0fA=+-a08NlEy*RmbuVP!2x)6", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 4213, "z": 14, "cf": 0.8999999761581421 } ], "ln": 4197 }, { "b": "e]$}-g5%*rnKt^Kga\u003eu.m[=GvlTIP3f/e(2oI4MruOTk\u003c07PZOlpk9ne\u002624p055FoAS", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 5597, "z": 5, "cf": 0.800000011920929 } ], "ln": 5581 }, { "b": "l@VLOp*[x=wPv=ae\u0026tA+B#p)ega\u003elXmr\u0026=WBs}56swqEIi-6m9B7GwMiZ[pjvrsK\u003e", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 70470, "z": 4, "cf": 0.949999988079071 } ], "ln": 70454 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 77976, "z": 6, "cf": 0.5 } ], "ln": 77960 }, { "b": "0S-o40wk#TB9R?qwPhYzCSmP*hz^6%A==1FqVFE:z/65svS=y3wg}ClBPs{bruKOaatLMahukuZflqzWwmY.3fl/DmuP6.]v@=Wee(I:6xM4:0fjG6ry?bheB9dEne?.o\u003eB7w\u003c3B1.+$hEwv00aQ4\u003ex!Ar:v@=Wee(I-\u003c0000500\u0026M80000705axM", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 82446, "z": 6, "cf": 0.30000001192092896 } ], "ln": 82430 }, { "b": "BAhFivGn2[zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEmz:e]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 92589, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 92581, "z": 7, "cf": 0.8999999761581421 } ], "ln": 92565 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb04}![vS=r\u003cvrb^]", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 92783, "z": 8, "cf": 0.8999999761581421 } ], "ln": 92767 } ], "depth": 1, "facts": { "exp": [ [ "boot_XML__Parser__Expat" ] ], "imp": [ [ "", "XML_SetCommentHandler" ], [ "", "Perl_sv_setref_pv" ], [ "", "XML_GetBuffer" ], [ "", "Perl_sv_2iv_flags" ], [ "", "XML_SetNamespaceDeclHandler" ], [ "", "Perl_sv_2bool_flags" ], [ "", "XML_SetUnknownEncodingHandler" ], [ "", "XML_GetErrorCode" ], [ "", "Perl_sv_2uv_flags" ], [ "", "Perl_stack_grow" ], [ "", "strncmp" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "XML_GetCurrentByteIndex" ], [ "", "Perl_sv_catpvn_flags" ], [ "", "XML_SetEntityDeclHandler" ], [ "", "XML_ExternalEntityParserCreate" ], [ "", "XML_GetInputContext" ], [ "", "Perl_call_method" ], [ "", "XML_GetBase" ], [ "", "Perl_sv_derived_from" ], [ "", "Perl_av_len" ], [ "", "XML_GetCurrentLineNumber" ], [ "", "Perl_pop_scope" ], [ "", "XML_SetNotationDeclHandler" ], [ "", "XML_SetExternalEntityRefHandler" ], [ "", "XML_SetElementDeclHandler" ], [ "", "Perl_newSV" ], [ "", "XML_SetEndDoctypeDeclHandler" ], [ "", "XML_SetUnparsedEntityDeclHandler" ], [ "", "XML_ExpatVersionInfo" ], [ "", "XML_SetCdataSectionHandler" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "strchr" ], [ "", "XML_SetReparseDeferralEnabled" ], [ "", "Perl_sv_setiv_mg" ], [ "", "Perl_sv_catpvf_nocontext" ], [ "", "XML_GetCurrentColumnNumber" ], [ "", "XML_SetCharacterDataHandler" ], [ "", "Perl_sv_bless" ], [ "", "XML_ParserFree" ], [ "", "PL_current_context" ], [ "", "XML_SetXmlDeclHandler" ], [ "", "XML_SetDefaultHandler" ], [ "", "Perl_sv_2pv_flags" ], [ "", "Perl_xs_boot_epilog" ], [ "", "XML_SetUserData" ], [ "", "XML_UseForeignDTD" ], [ "", "Perl_safesysmalloc" ], [ "", "XML_Parse" ], [ "", "tls_get_addr" ], [ "", "XML_SetStartDoctypeDeclHandler" ], [ "", "Perl_sv_backoff" ], [ "", "gmon_start__" ], [ "", "Perl_croak_xs_usage" ], [ "", "Perl_savetmps" ], [ "", "XML_ParseBuffer" ], [ "", "memcpy" ], [ "", "Perl_gv_stashpv" ], [ "", "XML_ParserCreate_MM" ], [ "", "XML_SetEndCdataSectionHandler" ], [ "", "XML_SetAttlistDeclHandler" ], [ "", "Perl_av_push" ], [ "", "Perl_more_sv" ], [ "", "Perl_newSVpv" ], [ "", "Perl_safesyscalloc" ], [ "", "XML_SetBase" ], [ "", "Perl_av_pop" ], [ "", "Perl_croak_nocontext" ], [ "", "Perl_newXS_deffile" ], [ "", "Perl_more_bodies" ], [ "", "Perl_sv_setsv_flags" ], [ "", "Perl_sv_2mortal" ], [ "", "Perl_mg_get" ], [ "", "XML_SetParamEntityParsing" ], [ "", "Perl_newSVuv" ], [ "", "Perl_safesysfree" ], [ "", "Perl_safesysrealloc" ], [ "", "XML_ErrorString" ], [ "", "Perl_call_pv" ], [ "", "Perl_sv_catsv_flags" ], [ "", "XML_SetProcessingInstructionHandler" ], [ "", "Perl_xs_handshake" ], [ "", "XML_SetDefaultHandlerExpand" ], [ "", "XML_GetSpecifiedAttributeCount" ], [ "", "XML_SetElementHandler" ], [ "", "XML_SetStartCdataSectionHandler" ], [ "", "Perl_free_tmps" ], [ "", "XML_FreeContentModel" ], [ "", "Perl_markstack_grow" ], [ "", "Perl_hv_common_key_len" ], [ "", "Perl_sv_setpvn" ], [ "", "Perl_newRV" ], [ "", "Perl_sv_catpv" ], [ "", "Perl_call_sv" ], [ "", "Perl_sv_free2" ], [ "", "Perl_push_scope" ], [ "", "ITM_registerTMCloneTable" ], [ "", "Perl_newSViv" ], [ "", "XML_ExpatVersion" ], [ "", "Perl_gv_add_by_type" ], [ "", "Perl_sv_setiv" ], [ "", "Perl_newSVsv_flags" ], [ "", "XML_GetCurrentByteCount" ], [ "", "Perl_newSVpvn" ], [ "", "cxa_finalize" ], [ "", "Perl_sv_newmortal" ], [ "", "XML_DefaultCurrent" ], [ "", "Perl_av_clear" ], [ "", "Perl_get_hv" ] ], "sec": [ [ ".gnu.hash", 680, 36, 1.72, "alloc" ], [ ".dynsym", 720, 2688, 1.15, "alloc" ], [ ".dynstr", 3408, 2231, 4.83, "alloc" ], [ ".gnu.version", 5640, 224, 0.29, "alloc" ], [ ".gnu.version_r", 5864, 96, 2.82, "alloc" ], [ ".rela.dyn", 5960, 384, 1.84, "alloc" ], [ ".rela.plt", 6344, 2520, 1.74, "alloc,info_link" ], [ ".init", 12288, 27, 4.31, "alloc,executable" ], [ ".plt", 12320, 1696, 4.32, "alloc,executable" ], [ ".plt.got", 14016, 16, 3.58, "alloc,executable" ], [ ".plt.sec", 14032, 1680, 3.99, "alloc,executable" ], [ ".text", 15744, 50628, 6.13, "alloc,executable" ], [ ".fini", 66372, 13, 3.24, "alloc,executable" ], [ ".rodata", 69632, 3696, 4.75, "alloc" ], [ ".eh_frame_hdr", 73328, 668, 4.71, "alloc" ], [ ".eh_frame", 74000, 3804, 5.21, "alloc" ], [ ".note.gnu.property", 77808, 64, 1.91, "alloc" ], [ ".note.package", 77872, 116, 4.81, "alloc" ], [ ".init_array", 80432, 8, 1.06, "write,alloc" ], [ ".fini_array", 80440, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 80448, 32, 1.9, "write,alloc" ], [ ".dynamic", 80480, 528, 1.57, "write,alloc" ], [ ".got", 81008, 912, 1.75, "write,alloc" ], [ ".data", 81920, 40, 1.43, "write,alloc" ], [ ".comment", 81960, 31, 4.03, "merge,strings" ], [ ".debug_aranges", 82000, 128, 1.15, "" ], [ ".debug_info", 82128, 70, 2.01, "" ], [ ".debug_abbrev", 82198, 36, 3.35, "" ], [ ".debug_line", 82234, 201, 3.05, "" ], [ ".debug_str", 82435, 78, 4.6, "merge,strings" ], [ ".debug_line_str", 82513, 48, 4.41, "merge,strings" ], [ ".debug_rnglists", 82561, 66, 2.04, "" ], [ ".symtab", 82632, 5112, 2.03, "" ], [ ".strtab", 87744, 4800, 4.77, "" ], [ ".shstrtab", 92544, 364, 4.26, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_rpath": 1.0, "relacount": 10.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 112.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 213.0, "dynrela_count": 16.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "dwarf.cu_count": 2.0, "pltreloc_count": 105.0, "dt_versym_count": 112.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "debug_section_count": 7.0, "program_header_count": 11.0, "has_direct_loader_dep": 1.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 54097.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 54097.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 1.0 }, "file": { "size": 95280.0, "entropy": 5.48, "size_bytes": 95280.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.01, "data_entropy": 1.68, "overlay_size": 2372.0, "string_count": 384.0, "overlay_ratio": 0.02, "overall_entropy": 5.48, "overlay_entropy": 1.5, "entropy_variance": 2.29, "avg_string_length": 22.07, "max_string_length": 96.0, "peak_region_bytes": 38912.0, "code_to_data_ratio": 0.97, "peak_region_entropy": 6.21, "string_length_stddev": 13.33, "largest_section_ratio": 0.53, "sentence_string_count": 19.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "exports": { "count": 1.0 }, "imports": { "count": 110.0 }, "sections": { "count": 37.0, "code_size": 54060.0, "entropy_max": 6.13, "entropy_mean": 3.02, "name_entropy": 4.21, "writable_count": 7.0, "executable_count": 6.0, "nonstandard_count": 12.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "Md₂(BiHe)", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/auto/XML/Parser/Expat/Expat.so", "risk": 2, "sha": "4fa2ff02d6ad5e1b0dc93b54f5fe4c2739a8ce53a2aa330c5ae8005d31ca5193", "size": 95280, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3480, 12 ] ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "spans": [ [ 0, 20 ] ] }, { "id": "micro-behaviors/ui/help::version-text", "conf": 0.699999988079071, "crit": 2, "desc": "Version information string", "spans": [ [ 70470, 4 ] ] }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "Shared library binds dynamic loader", "spans": [ [ 0, 32 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3480, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3480, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boQ8.oGCjhvrcB2AS", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 14 }, { "b": "boPu(AcVFrxj#xfc$sXGf/.lNeIY1lfD:4$A=MBFs7b]YayPd#avx%NA+=^+z/oPaAS", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 53, "z": 3, "cf": 0.800000011920929 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 18, "z": 9, "cf": 0.6000000238418579 } ], "ln": 3, "addr": 16 }, { "b": "boPo*y-)+jxj#ydaAz4mwPz%9wg^", "ln": 4, "addr": 70 }, { "b": "bl", "ln": 5, "addr": 93 }, { "b": "", "ln": 8, "addr": 208 }, { "b": "Aa9l(vp%c]swqEIi-6m9B7GwN", "ln": 9, "addr": 209 }, { "b": "", "n": [ { "c": 2, "d": "Perl source syntax patterns", "i": "metadata/lang/scripted::source-syntax", "o": 230, "z": 12, "cf": 0.8999999761581421 } ], "ln": 10, "addr": 230 }, { "b": "B-RapB98Cpv@%^", "ln": 11, "addr": 231 }, { "b": "", "ln": 12, "addr": 243 }, { "b": "", "ln": 23, "addr": 466 }, { "b": "bURoouU\u003cT?wm5}Sx(4u\u003eauZ\u00263i@", "ln": 24, "addr": 467 }, { "b": "", "n": [ { "c": 2, "d": "Perl subroutine definition", "i": "metadata/lang/scripted::subroutine-definition", "o": 489, "z": 10, "cf": 0.8500000238418579 } ], "ln": 25, "addr": 489 }, { "b": "B9g}mzE[2mDJ", "ln": 26, "addr": 490 }, { "b": "arR^HzfWlLas7DkvrlGvasgDpxlbgAauZ\u0026juPO", "ln": 27, "addr": 500 }, { "b": "arR^HzfWlHB98XzwGTbUbW\u003e.aB9*\u0026cD2d5ui@", "n": [ { "c": 2, "d": "Perl sigil variable declaration", "i": "metadata/lang/scripted::sigil-variable-decl", "o": 531, "z": 13, "cf": 0.800000011920929 } ], "ln": 28, "addr": 531 }, { "b": "", "ln": 29, "addr": 561 }, { "b": "arR^HzfWlHzF%A7CYdLyauZ?)vrc14DROG%uQYiUvrt\u003cLAcb/jzGyjGE0!71DWN%", "ln": 30, "addr": 562 }, { "b": "", "ln": 141, "addr": 3869 }, { "b": "arR^HzfWlIxKL^?y?mTdauZ?[DMTOPwO+%gk6]?ezE^M{A=VTKEld", "ln": 142, "addr": 3870 }, { "b": "arR^HzfWlHx(mTbarR^HauZ\u0026TwO+}1wGSmivqYQ(wPz\u003csnP5l:Eld", "n": [ { "c": 1, "d": "Destructive-action word: delete", "i": "objectives/impact/destroy/keywords::delete-verb--delete", "o": 3932, "z": 6, "cf": 0.8999999761581421 } ], "ln": 143, "addr": 3913 }, { "b": "arR^HzfWlHw[=c\u003ey-\u003c\u0026yauZ\u0026TwO+}1wGSmivqYQ(wPz\u003csmRM:Gy\u003c!w", "ln": 144, "addr": 3956 }, { "b": "", "ln": 145, "addr": 4000 }, { "b": "j.Oznwhbi4k$%=", "ln": 325, "addr": 7953 }, { "b": "", "ln": 326, "addr": 7965 }, { "b": "swqEIi-6m9B7GwmeG^t4AaK6aaz(4cB.\u003eRiw]zYjAa9^dx(mMaswqEiwn+$2zdNQbA@", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 7982, "z": 4, "cf": 0.699999988079071 } ], "ln": 327, "addr": 7966 }, { "b": "", "ln": 328, "addr": 8020 }, { "b": "j.Oznwhbi9sX.:?q+o)", "ln": 329, "addr": 8021 }, { "b": "j.Oznwhko7A=kCgarR^HarR^HarR^HarR^Pmr\u0026=WBsXLlvrc0(BsXL5vrt{b", "ln": 578, "addr": 17672 }, { "b": "", "ln": 579, "addr": 17721 }, { "b": "ra]#!az2.czGE1nB0babzE)\u0026%By!#9Cw7M9ayMyiA=kD0B8#5kxcp]aB98CBv@#B6zxJUmaAz46z!A%4DsZRt", "n": [ { "c": 1, "d": "LLM prompt/instruction context component", "i": "objectives/evasion/security-bypass/llm/override::llm-instruction-context", "o": 17764, "z": 11, "cf": 0.7200000286102295 } ], "ln": 580, "addr": 17722 }, { "b": "", "ln": 581, "addr": 17791 }, { "b": "j.Oznwhkn{z/6u5zGE0zarR^HarR^HarR^HarS73CYm8kefEt?ByuP", "ln": 582, "addr": 17792 } ], "depth": 1, "facts": { "imp": [ [ "", "Carp" ], [ "", "IO::File" ], [ "", "XML::Parser::Expat" ], [ "", "strict" ], [ "", "warnings" ] ], "mbr": [ "IO::File.new", "XML::Parser::Expat.new", "XML::Parser::ExpatNB.new" ], "tgt": [ "IO::File", "XML::Parser::Expat", "XML::Parser::ExpatNB" ], "metrics": { "ast": { "op.lor": 4.0, "op.band": 1.0, "op.land": 2.0, "op.lnot": 1.0, "max_depth": 17.0, "op.concat": 4.0, "call_count": 35.0, "node_count": 2610.0, "member_count": 3.0, "op_density.lor": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 12.0, "member_depth_max": 2.0, "op_density.concat": 0.0, "string_literal_count": 18.0, "array_literal_max_length": 1.0 }, "file": { "size": 29543.0, "entropy": 4.79, "size_bytes": 29543.0 }, "text": { "digit_ratio": 0.01, "space_count": 5813.0, "total_lines": 881.0, "char_entropy": 4.79, "unique_chars": 93.0, "escape_density": 0.0, "string_density": 0.02, "ascii_art_lines": 1.0, "avg_line_length": 32.53, "max_line_length": 189.0, "empty_line_ratio": 0.28, "last_line_length": 4.0, "whitespace_ratio": 0.23, "most_common_ratio": 0.09, "identifier_density": 0.02, "line_length_stddev": 29.22, "unicode_escape_count": 1.0, "normalized_string_count": 0.61, "repeated_char_sequences": 79.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 16.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 1.23 }, "calls": { "count": 35.0 }, "binary": { "overall_entropy": 4.79, "peak_region_bytes": 10087.0, "peak_region_entropy": 5.1 }, "source": { "class_count": 1.0, "function_count": 9.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "members": { "count": 3.0 }, "strings": { "total": 18.0, "avg_length": 30.5, "max_length": 59.0, "avg_entropy": 3.57, "total_bytes": 549.0, "entropy_stddev": 1.02 }, "comments": { "chars": 762.0, "lines": 21.0, "total": 23.0, "to_code_ratio": 0.02, "empty_comments": 2.0 }, "functions": { "count": 10.0 }, "identifiers": { "count": 12.0, "total": 14.0, "avg_length": 13.25, "max_length": 23.0, "min_length": 3.0, "avg_entropy": 2.99, "reuse_ratio": 0.86, "unique_count": 12.0, "length_stddev": 6.38, "high_entropy_count": 2.0, "high_entropy_ratio": 0.17, "all_lowercase_ratio": 0.67 } } }, "id": 2, "mol": "H(Po)", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser.pm", "risk": 1, "sha": "9351907a92672e84652fe684c4506066e7f4f00ab55cabfd5d6949a9b24b757c", "size": 29543, "traits": [ { "id": "metadata/lang/scripted::use-module", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl module import statement", "spans": [ [ 230, 12 ] ] }, { "id": "metadata/lang/scripted::subroutine-definition", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl subroutine definition", "spans": [ [ 489, 10 ] ] }, { "id": "metadata/lang/scripted::sigil-variable-decl", "conf": 0.800000011920929, "crit": 2, "desc": "Perl sigil variable declaration", "spans": [ [ 531, 13 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 7982, 4 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 3932, 6 ] ] } ], "type": "perl" }, { "ctx": [ { "b": "boPVYp^]RJwPzVSzGEHIyZIx]boPu(AcVFrxj#xfc$sXGgb7yoavx%NA+=^+z/oPaATB3ll2puWA+Pf1BAnNBwPIB6C4Chp3l])5axi2*B0bBxz!B90z6iLlazbU9wGV5jw]@l9A+drPD2E*Fv{%l$A+e=}B98CpvS=^7azC{uvqYQez/Mgfaz(4cx\u003ezSkx(\u003eFuzE^s0aARpdaAH$dwGV8aA=2\u003euvriL/wPzPfx([Acy?tpb3ufA-yHH\u003c!axRuiiYZ8CA=U/ji%(sqB7DE]qB@}SB-Raprz(yHi+A8xwJHlwB7DE/s5p}srDz.(l1:+DBuo*pbo)KuboP:1By=OpxKM09Bzbxfaz2!twPzV%y-)qbBzk\u0026xazth3wnC*$aAz44woe(nxK@q$zGGPkwGUM4Bzk\u0026xazC.nzWEZlaz\u003eXbz/QaOaAIDzx(\u003eFwx(4Pdv}Y^@wGU]eazt[gwGU]ewPGEDnPV80z/](bayX[8A+eV}y\u003cvdvx\u003e7Y%x\u003evX%boPVYp=ZTqB7GwTxjU$5aA8jvx(v($y\u00261wtA+funA=bD0aA.-FvqWhVpDyKcvqYQ(wIarmbmj^0BZ=FfCw{]2CYWq7zGGl0vqYQ(wPw]u3lQEdC{1HXCYkhRbW$h6wH[@HB9R*QauZ\u0026juPPwMboQ60ay]zdcV*FNB7DFkBZ/f3v\u003c2F@3jm)#zfWlHB-IgT3jm)#x\u003ewFowmYv!zE)u3bW$h6wHO:G3lQDlar@0}vrl05zddYjxKM6}ayX[[zxK1iBrC4raAg+fB7F@$y?kduCw7Y2xDR2gayO]2z/Z2mv\u003c2h?z/{dearR^HboRhzwPRP%AV/7rB0a)lw[=6)aA8oyrz(yv3lQDlaz(xDbW$h6wNxO2x=]LYzE[2mrz(ypbW$h6wHPXFarR^HB-82bB8@DLwmYv!zE)u3bW$h6wNxO2x!qI\u0026v}YB\u003cwHO:G3lQDlarR^LvQTs?uV*y6auZ\u0026EqB@D7zE[30vpBpabW$h6wNxO2x!gxbqB@]gw[=6)eK0V*wgoOEarR^HEf{r7arR^LB-IgsjS):5nI9bzwP}G\u0026vSJ}yB9R*Tas7A8B7FZ3A+M%:3lQEt3lQE5y\u0026:egDKp(rarR}LA+MTVaz$+maxqrhc)S\u003eVB16fTarR^HB-82bB8@DLwmYv!zE)u3bZ1cweK1k=xK#3(diJ%AarR^HarR}LA+MTVaxqrheK15-Cva=/B0@qRA+N6Erz(yHi+A8xwI38QCvSc:3lQDlaBKOtaBKOtapoklzfWlHBZVyQas8hJeK1I*y\u003cf\u0026bxjU$5Eld=UaA.NrwPI]nc$D[3x(mG)as88rdiJ%AarR^HbZ0JrjS(1{A4Kn2uU\u003c}9vp%d?BBtn{az$+mawt\u003ckiYZnZwPy7HwO#Prdlv\u003eVarR^LBZV\u003c=wO#V#Ab](wC{\u003ea63lQEt3jm)#zfWlHA+fkkjS[SNCoxBQr8tRpqE%\u0026\u003cwPI@wcR3Q8cOcw=B-IgBi%(rqaz(xDbYWEqauZ?)BZV\u003c=A+flkwPI@wbYWEodlv\u003eVazCBgc)S?AB1GN\u0026B6\u0026H0A=k$EaBsCrarR^LCYkk#DQR%}z/OM-B8$=5wQLWNjS\u003e}NzxZhQas7#sB1GN%ByxolB6\u0026-$zE\u003c}yar?{NB-Igui%)8MarUYoBAIRwaA.NjwOa1harV7tarR1las8hJeK1I*lsB}Dq/(CTyKEsMD{5PRt@@xoaAhEAxEDb)bZsnWk6{T6vrl0UBywV{EsiT?bW$h6wHPXF3lQDpCYkk#vQTs?c)S}Qx^(aJarR1laAz4nB-IvxbYWEqeK0V.zGGDcBuo?TarR)Kmq=SUy\u003cf\u00269wQ5r7wO#P%xKL^?y?mR]3uHu0az=mvuUaF7uUaa%uT)[-vqZjbaBsCraz(xDc)T4RdiH+@kWMOW3lQDpCYkk#vQTs?c#:9zc{Sb8CYkk#DTx9FB7Fo(vpK83EjlQb3vK3tboPA)wftYjA9)g3ByeP%ByeJ]wNPF0A0=}bi%\u003e", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "new" ], [ "", "URI" ], [ "", "$base_uri.scheme" ], [ "", "URI.new_abs" ], [ "", "URI::file.cwd" ], [ "", "URI.new_abs" ], [ "", "new" ], [ "", "URI" ], [ "", "$uri.scheme" ], [ "", "URI.new_abs" ], [ "", "URI::file.cwd" ], [ "", "new" ], [ "", "LWP::UserAgent" ], [ "", "$ua.env_proxy" ], [ "", "new" ], [ "", "HTTP::Request" ], [ "", "$ua.request" ], [ "", "$res.is_error" ], [ "", "$res.status_line" ], [ "", "push" ], [ "", "$xp.base" ], [ "", "$res.content" ], [ "", "$xp.base" ], [ "", "LWP::UserAgent" ], [ "", "URI" ], [ "", "URI::file" ] ], "mbr": [ "$base_uri.scheme", "$res.content", "$res.is_error", "$res.status_line", "$ua.env_proxy", "$ua.request", "$uri.scheme", "$xp.base", "URI.new_abs", "URI::file.cwd" ], "tgt": [ "$base_uri.scheme", "$res.content", "$res.is_error", "$res.status_line", "$ua.env_proxy", "$ua.request", "$uri.scheme", "$xp.base", "HTTP::Request", "LWP::UserAgent", "URI", "URI.new_abs", "URI::file.cwd", "new", "push" ], "metrics": { "ast": { "max_depth": 13, "op.concat": 3, "call_count": 23, "node_count": 491, "member_count": 10, "max_array_length": 1, "max_member_depth": 2, "op_density.concat": 0.01 }, "file": { "size": 1582, "entropy": 5.01 }, "text": { "lines": 71, "top_char": 101, "digit_ratio": 0.01, "space_count": 275, "char_entropy": 5.01, "unique_chars": 69, "top_char_null": 0, "import_density": 4.23, "string_density": 0.04, "top_char_ratio": 0.08, "avg_line_length": 21.28, "max_line_length": 70, "empty_line_ratio": 0.23, "last_line_length": 2, "whitespace_ratio": 0.22, "identifier_density": 0.1, "line_length_stddev": 20.53, "max_whitespace_run": 2, "normalized_import_count": 0.36, "normalized_string_count": 0.36, "trailing_whitespace_lines": 3, "normalized_unique_identifiers": 0.65 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 1582, "peak_region_entropy": 5.02 }, "source": { "class_count": 1, "function_count": 2 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 9, "count": 3, "avg_length": 3, "max_length": 5, "avg_entropy": 1.3, "entropy_stddev": 0.97 }, "comments": { "chars": 529, "count": 17, "empty": 2, "lines": 15, "to_code_ratio": 0.27 }, "functions": { "count": 3 }, "identifiers": { "count": 7, "unique": 4, "avg_length": 12.5, "max_length": 19, "min_length": 3, "avg_entropy": 2.82, "reuse_ratio": 0.57, "length_stddev": 6.84, "all_lowercase_ratio": 0.5, "all_uppercase_ratio": 0.25 } } }, "id": 3, "mol": "H(Cm)Md(In)", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/LWPExternEnt.pl", "pid": 288, "risk": 3, "sha": "16ddc05c3ce2d598a6880eaf9ec52da861d335a4acab5c82bda46193ced5151d", "size": 1582, "traits": [ { "id": "metadata/import/perl/lwp/useragent::lwp/useragent", "conf": 0.95, "crit": 3, "desc": "imports LWP::UserAgent", "spans": [ [ 243, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/lwp::perl-lwp-useragent", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "Perl LWP HTTP client import", "spans": [ [ 239, 19 ] ] }, { "id": "metadata/import/perl/uri/file::uri/file", "conf": 0.95, "crit": 2, "desc": "imports URI::file", "spans": [ [ 228, 0 ] ] }, { "id": "metadata/import/perl/uri::uri", "conf": 0.95, "crit": 2, "desc": "imports URI", "spans": [ [ 219, 0 ] ] }, { "id": "metadata/lang/scripted::sigil-variable-decl", "conf": 0.8, "crit": 2, "desc": "Perl sigil variable declaration", "spans": [ [ 545, 0 ] ] }, { "id": "metadata/lang/scripted::subroutine-definition", "conf": 0.85, "crit": 2, "desc": "Perl subroutine definition", "spans": [ [ 462, 0 ] ] }, { "id": "metadata/lang/scripted::use-module", "conf": 0.85, "crit": 2, "desc": "Perl module import statement", "spans": [ [ 214, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::data-transfer-verb-token", "conf": 0.88, "crit": 1, "desc": "Data-transfer verb token", "spans": [ [ 1353, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 161, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 136, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 271, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 596, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 81, 0 ] ] } ], "type": "perl" }, { "ctx": [ { "b": "Aa9l(vp%c]swqEIi-6m9B7GwMiZ[pjvrsN", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "n": [ { "c": 2, "d": "Perl module import statement", "i": "metadata/lang/scripted::use-module", "o": 28, "z": 12, "cf": 0.8500000238418579 } ], "ln": 2, "addr": 28 }, { "b": "B-RapB98Cpv@%^", "ln": 3, "addr": 29 }, { "b": "", "ln": 4, "addr": 41 }, { "b": "boRhsA=bPexlbhkz/^akzEE0\u003cwN(]@y\u0026r=\u003ey\u00261wTaz$R8wPI*0v}u^1wPRQ7woe(oB7DFdzGEoQaA8cuB98CpzFa1", "ln": 5, "addr": 42 }, { "b": "boR8wvrrSevr\u0026#kz/^ahwGU(kzdN:4v\u003c2h$wft]7y\u003cvdwzxHrAzY\u003cmjA=bPexlbgtzGP/cA+P2ccM)kzv{%g\u0026C}G", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 116, "z": 4, "cf": 0.800000011920929 } ], "ln": 6, "addr": 114 }, { "b": "", "ln": 7, "addr": 185 }, { "b": "B-Rapsw}[ivpS}\u0026i@", "ln": 8, "addr": 186 }, { "b": "B-RaplT+1Oi@", "ln": 9, "addr": 200 }, { "b": "", "n": [ { "c": 2, "d": "Perl source syntax patterns", "i": "metadata/lang/scripted::source-syntax", "o": 210, "z": 13, "cf": 0.8999999761581421 } ], "ln": 10, "addr": 210 }, { "b": "z/{7ybVWuiq+o+WauZ?{ga\u003eBucP.", "ln": 11, "addr": 211 }, { "b": "", "ln": 12, "addr": 234 }, { "b": "arR^HswqESwN/K0arR^Hau.[htQAxXBxzmhl$G\u003eAnmuyDy?mR", "ln": 50, "addr": 1479 }, { "b": "dlv", "ln": 51, "addr": 1519 }, { "b": "", "n": [ { "c": 2, "d": "Perl subroutine definition", "i": "metadata/lang/scripted::subroutine-definition", "o": 1522, "z": 10, "cf": 0.8500000238418579 } ], "ln": 52, "addr": 1522 }, { "b": "B9g}mzE[2mDJ", "ln": 53, "addr": 1523 }, { "b": "arR^HzfWlLas7DkvrlGvasgDpxlbgAauZ\u0026juPO", "ln": 54, "addr": 1533 }, { "b": "arR^HB-82bB8@DLas7Mky?j.LEJSFJun0DAdiJ%", "ln": 104, "addr": 3148 }, { "b": "arR^HarR^Hw]zZ3vpJ%[c{Qjsv@C)(zF9rMvrufiaBs", "ln": 105, "addr": 3180 }, { "b": "arR^HarR^HarR^HzfWlHBzU$tjS)jdy?kT*q/DqTeK0VMBy]l6wHFVDuO0rBw[=6)asPw", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 3231, "z": 3, "cf": 0.4000000059604645 } ], "ln": 106, "addr": 3215 }, { "b": "arR^HarR^HarR^Hx\u003ewFoat4dEbY))xasOBW", "ln": 107, "addr": 3271 }, { "b": "arR^HarR^HarR^HarR^HbXy+bwGTbUbY))xi@", "ln": 108, "addr": 3300 }, { "b": "", "ln": 325, "addr": 8010 }, { "b": "arR^HarR^Hx\u003ewFoaz2!iB98ECbY^KsDNy4GwObv[y\u0026?4MayPd#az#atay]4}x(mG)c)f^RwPSnDbv\u003ev$vrDydcW^Ngtp?NnasOAZaBs", "ln": 326, "addr": 8011 }, { "b": "arR^HarR^HarR^HwmYN*By=NuB7GDucNiekw)]*#BshF#", "n": [ { "c": 1, "d": "Destructive-action word: delete", "i": "objectives/impact/destroy/keywords::delete-verb--delete", "o": 8106, "z": 6, "cf": 0.8999999761581421 } ], "ln": 327, "addr": 8094 }, { "b": "arR^HarR^HEe", "ln": 328, "addr": 8131 }, { "b": "", "ln": 329, "addr": 8141 }, { "b": "Ee", "ln": 531, "addr": 13556 }, { "b": "", "ln": 532, "addr": 13558 }, { "b": "B9g}ml}73NqCQBrDJ", "n": [ { "c": 1, "d": "Destructive-action word: destroy", "i": "objectives/impact/destroy/keywords::destroy-verb", "o": 13563, "z": 7, "cf": 0.8999999761581421 } ], "ln": 533, "addr": 13559 }, { "b": "arR^HzfWlHB7Gf1auZ\u0026*xLz72i@", "ln": 534, "addr": 13573 }, { "b": "arR^Hp*[x=wPymXwO0njbY^Kkw?uh[p*[x=wPAhwdlv", "ln": 535, "addr": 13595 }, { "b": "arR^HarR^HarR^Hx\u003ewFoaAz49c)SIBA+e\u0026iaz2KncQ}/^wK{lEwnC*8asOBW", "ln": 576, "addr": 14938 }, { "b": "", "ln": 577, "addr": 14987 }, { "b": "arR^HarR^HarR^HarR^Hbw7\u003emaAg[jy-\u003eO/f!+k8ayPd#aAhmuB7]91C{3WbA+]D3AX5tOwO00afj[{mwNxv{wO$\u003c@v{%gZAXqC", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 15009, "z": 4, "cf": 0.699999988079071 } ], "ln": 578, "addr": 14988 }, { "b": "arR^HarR^HarR^HarR^HA+flkx(W=cmRMWInmuyDy?kW", "ln": 579, "addr": 15068 }, { "b": "arR^HarR^HarR^HEe", "ln": 580, "addr": 15104 }, { "b": "j.Y1Hz6gqJp\u0026ZF:arR^HarR^HarR^HarS7evrcB2AX5tjvrc0(BsXL5vrt{b", "ln": 1007, "addr": 27196 }, { "b": "", "ln": 1008, "addr": 27245 }, { "b": "ra]#!az2.czGE1nB0babzE)\u0026%By!#9Cw7M9ayMyiA=kD0B8#5kxcp]aB98CBv@#B6zxJUmaAz46z!A%4DsZRt", "n": [ { "c": 1, "d": "LLM prompt/instruction context component", "i": "objectives/evasion/security-bypass/llm/override::llm-instruction-context", "o": 27288, "z": 11, "cf": 0.7200000286102295 } ], "ln": 1009, "addr": 27246 }, { "b": "", "ln": 1010, "addr": 27315 }, { "b": "j.Y1Hz6gqJlVl*UwO#PjarR^HarR^HarS7evrcB2AX5tiBAh8kxdi", "ln": 1011, "addr": 27316 } ], "depth": 1, "facts": { "imp": [ [ "", "Carp" ], [ "", "File::ShareDir" ], [ "", "File::Spec" ], [ "", "FileHandle" ], [ "", "IO::Handle" ], [ "", "XSLoader" ], [ "", "overload" ], [ "", "strict" ], [ "", "warnings" ] ], "mbr": [ "File::Spec.catdir", "File::Spec.catfile", "File::Spec.curdir" ], "tgt": [ "File::Spec" ], "metrics": { "ast": { "op.eq": 23.0, "op.gt": 3.0, "op.le": 1.0, "op.lt": 1.0, "op.lor": 5.0, "op.sub": 5.0, "op.band": 1.0, "op.land": 6.0, "op.lnot": 4.0, "max_depth": 23.0, "op.concat": 26.0, "call_count": 83.0, "node_count": 6422.0, "member_count": 3.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 66.0, "member_depth_max": 2.0, "op_density.concat": 0.0, "string_literal_count": 77.0, "array_literal_max_length": 1.0 }, "file": { "size": 44798.0, "entropy": 4.87, "size_bytes": 44798.0 }, "text": { "digit_ratio": 0.01, "space_count": 8545.0, "total_lines": 1496.0, "char_entropy": 4.87, "unique_chars": 97.0, "string_density": 0.05, "ascii_art_lines": 4.0, "avg_line_length": 28.95, "high_byte_ratio": 0.0, "max_line_length": 95.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.25, "last_line_length": 4.0, "whitespace_ratio": 0.22, "most_common_ratio": 0.09, "identifier_density": 0.06, "line_length_stddev": 27.27, "normalized_string_count": 1.99, "repeated_char_sequences": 88.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 15.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 6.26 }, "calls": { "count": 83.0 }, "binary": { "overall_entropy": 4.87, "peak_region_bytes": 19198.0, "peak_region_entropy": 5.14 }, "source": { "class_count": 4.0, "function_count": 63.0 }, "imports": { "count": 9.0, "unique_modules": 9.0, "third_party_count": 9.0, "third_party_ratio": 1.0 }, "members": { "count": 3.0 }, "strings": { "total": 77.0, "avg_length": 19.29, "max_length": 83.0, "avg_entropy": 2.52, "empty_count": 2.0, "total_bytes": 1485.0, "entropy_stddev": 1.58 }, "comments": { "chars": 1319.0, "lines": 34.0, "total": 35.0, "to_code_ratio": 0.02, "empty_comments": 1.0 }, "functions": { "count": 67.0 }, "identifiers": { "count": 66.0, "total": 83.0, "avg_length": 11.95, "max_length": 54.0, "min_length": 3.0, "avg_entropy": 2.84, "reuse_ratio": 0.8, "unique_count": 66.0, "length_stddev": 9.6, "high_entropy_count": 6.0, "high_entropy_ratio": 0.09, "all_lowercase_ratio": 0.79, "all_uppercase_ratio": 0.11 } } }, "id": 4, "mol": "H(Po)", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/Expat.pm", "risk": 1, "sha": "c73f28a6a12b6256c3f001ff17460742762433175ecac7aa8113250ab36cde50", "size": 44798, "traits": [ { "id": "metadata/lang/scripted::use-module", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl module import statement", "spans": [ [ 28, 12 ] ] }, { "id": "metadata/lang/scripted::subroutine-definition", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl subroutine definition", "spans": [ [ 1522, 10 ] ] }, { "id": "metadata/lang/scripted::sigil-variable-decl", "conf": 0.800000011920929, "crit": 2, "desc": "Perl sigil variable declaration", "spans": [ [ 210, 13 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 15009, 4 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 8106, 6 ] ] } ], "type": "perl" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "SPDX SBOM document", "i": "metadata/package/files/system-package::spdx-sbom-document", "o": 0, "z": 1, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003eHAaBh]wPz\u003caz/c:War\u003c-Xl%82@e\u0026aX5", "ln": 2, "addr": 2 }, { "b": "arR\u003esvrt{Kx\u003e7Z(B7DKRar\u003cfufFb1ifD@4", "ln": 3, "addr": 31 }, { "b": "arR^Hb5y$6wO#N2oLFM\u0026r+lq)x(v(kiV]R5e\u00262gaec", "ln": 8, "addr": 256 }, { "b": "arR^Hb4CU8vruBdB0rT/tl", "ln": 9, "addr": 290 }, { "b": "arR^HarR\u003ecz/oCMaz\u003eXavqYZ?asIy!e\u0026kBrg:%R1", "n": [ { "c": 2, "d": "Melange-generated SPDX SBOM", "i": "metadata/package/files/system-package::melange-spdx-sbom", "o": 314, "z": 14, "cf": 0.9800000190734863 } ], "ln": 10, "addr": 308 }, { "b": "arR^HarR\u003e7A+w/#x)Kifx(v(Iavx*Jx(mNavrb)faw3DXa]", "ln": 11, "addr": 341 }, { "b": "arR^Ht}t", "ln": 12, "addr": 379 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?lT+7Fxk.*ob03?\u003cp^EDwk$su}o*IJum[3r1ec", "ln": 41, "addr": 1294 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?rc-B]b03?\u003cAclhqa$J", "ln": 42, "addr": 1344 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fk$Gyy+o)Gy+oQmA=U/jkR:@HgC9S3kvFOxxGZP1hEwv0tY?.Ogb-VSB98Cvj:g*Xw[-B", "n": [ { "c": 2, "d": "Wolfi APK SPDX SBOM", "i": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "o": 1379, "z": 84, "cf": 0.9800000190734863 } ], "ln": 43, "addr": 1379 }, { "b": "arR^HarR^HEe", "ln": 44, "addr": 1479 }, { "b": "arR^HarT@v", "ln": 45, "addr": 1489 }, { "b": "arR^HarR\u003esz*c8nz^^fIz!0i$x(v(kiV]RwpEd]Tmn^8RpFJ8+", "ln": 91, "addr": 3249 }, { "b": "arR^HarR\u003eux(4v4l2HaED3T4jb03\u0026UvqH0@ec", "ln": 92, "addr": 3290 }, { "b": "arR^HarR\u003eHz/{8gwL3=KzZ4j+b4j#3B.L(cwft\u00261v@2H=wGUY8w]w/7A=k!qk#ph%l{-{Sfd{6]m[DDBpA?s", "n": [ { "c": 1, "d": "SPDX references APK DB package info", "i": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "o": 3341, "z": 44, "cf": 0.8999999761581421 } ], "ln": 93, "addr": 3320 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7EZSzEWH9wmYo}iV]RwpEd]Tmn^8RpFJ8+", "ln": 94, "addr": 3388 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7E:Jv@bN]wN(#Car\u003c9(Bzk/rx\u003e5.Ie?!F2", "ln": 95, "addr": 3429 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fk$Gyy+o)Gy+oQmA=U/jkR:@HgC9S3kvFOxxGZP1hEwv0tY?.Ogb:5\u003ex\u003eIc$j-B$My+o)Gy+oQmA=U/ja]", "n": [ { "c": 1, "d": "Wolfi APK package URL in SPDX", "i": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "o": 5641, "z": 94, "cf": 0.8999999761581421 } ], "ln": 152, "addr": 5641 }, { "b": "arR^HarR^HEe", "ln": 153, "addr": 5751 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 7269.0, "entropy": 4.98, "size_bytes": 7269.0 }, "json": { "parsed_bytes": 7269.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 4.98, "peak_region_bytes": 6245.0, "peak_region_entropy": 5.12 } } }, "id": 5, "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!var/lib/db/sbom/perl-xml-parser-2.53-r0.spdx.json", "risk": 1, "sha": "2027b37d5df0a3ba5c0a34b52b06bc7f20d09da1ffd68839ee1353b9bed60491", "size": 7269, "traits": [ { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "spans": [ [ 314, 14 ] ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "spans": [ [ 3341, 44 ] ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 33 ] ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "spans": [ [ 1379, 84 ], [ 1410, 14 ], [ 5641, 94 ] ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document" }, { "id": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK SPDX SBOM", "spans": [ [ 1379, 84 ], [ 1410, 14 ], [ 3341, 44 ], [ 5641, 94 ] ] }, { "id": "metadata/package/files/system-package::melange-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated SPDX SBOM", "spans": [ [ 314, 14 ] ] } ], "type": "json" }, { "id": 6, "sha": "7c1a9784336d29deb287a4407ad838cdc698647141ef34edc293165ee652f6d7", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/Style/Tree.pm", "risk": 1, "size": 2827, "type": "perl", "depth": 1 }, { "id": 7, "sha": "8fbb13653aa98849cb65fc1756679f59b325774a05da4a0721a2eaf6ca0922e1", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/Style/Subs.pm", "risk": 1, "size": 1241, "type": "perl", "depth": 1 }, { "id": 8, "sha": "0eda521382b439a757dc8ddd0661c0ce7ccc3ced8dc47a7734b035fd09d28839", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/Style/Stream.pm", "risk": 1, "size": 3863, "type": "perl", "depth": 1 }, { "id": 9, "sha": "2529d05f3714c6e1452fbda88b2fc1cdd552d47710bf4be7bf5c60f3a0e4a522", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/Style/Objects.pm", "risk": 1, "size": 1866, "type": "perl", "depth": 1 }, { "id": 10, "sha": "56ee4a4f155c5deda5ecd922d1071aa0462a8525c0ca26dde234b6401439fb30", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/Style/Debug.pm", "risk": 1, "size": 1029, "type": "perl", "depth": 1 }, { "id": 11, "sha": "a0b4899693f8a40631003349a280f83343c05dba209b8de842cedfe54ec8a596", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!usr/lib/perl5/vendor_perl/XML/Parser/Encodings/Japanese_Encodings.msg", "size": 4821, "type": "ole", "depth": 1 }, { "id": 12, "sha": "b6839013952ef45d2cfb09a033eb88e858b8f5da4fc55887676b9ce734d6d905", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/perl-xml-parser/perl-xml-parser-2.53-r0.apk!!.PKGINFO", "risk": 1, "size": 497, "type": "text", "depth": 1 } ], "omitted_files": 7, "rev": "33de0", "v": "8" } }