{
  "llm": {
    "conf": 0.9665,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Supply chain impersonation squatting"
  },
  "ml": {
    "v": "7",
    "eng": "2.6.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9695494,
        "rte": "az",
        "prob": 0.9695494
      }
    ],
    "prob": 0.95,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.949999988079071,
        "type": "npm"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001004338264465332,
        "type": "javascript"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000012248754501342773,
        "type": "package.json"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000011255343451921362,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-10T13:20:54Z"
  },
  "path": "statist-browser-typed-client-hra.eventcalendar.events-0.0.1.tgz",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "abZy8Za:+C0@}Vpf\u0026d9?5c}ZG}4Lg!3(8Hc5(G4O:ItN]8.^Vu9Yo:kBAQqc!BeAYZ\u003eefIb\u0026yz\u0026{X#*u)^dpw\u003ct{j5NfPsa\u003ccR#Q/cYxGm}CKawaT=\u003cmwk}yCZ::t9{JG{oMV\u003e)IY%sn@d8f=m=Epd%i\u003cRkQ/$9lBWvM:mx!%H[5mCpMta#]tU?AuAVp(Gf=s]?q!l\u003e+yA}(esbhiX4u4Y#)w]CAxzAyD/\u0026IT{[rQQ]*1qf@TvOt:7BcLi(Dm:/J+@N*-[$-]J(#\u0026A]AQwbZ=}ztXlp@8rP+M3pn\u0026r+c=*Hp/\u003cy6htsw=4-9jfes8)tJSp[fwxd4?e)=FzyM##H(\u003e)JKGhsU{[a1(QA\u0026--hQFbPnV{5jmQ*5",
            "n": [
              {
                "c": 5,
                "d": "npm init stub squats internal client library name",
                "i": "objectives/supply-chain/impersonation/manifest/placeholder::service-client-library-name-squat",
                "o": 0,
                "z": 41,
                "cf": 0.94
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O(S₂)Md(Pa₃)",
        "sha": "969b0f96d154f54d4df0c73e5a4b850918fe101ddc8b0aeb90a85e0727b32f9d",
        "path": "/tmp/cyclotron-17ecbc2c/samples/969b0f96d154/statist-browser-typed-client-hra.eventcalendar.events-0.0.1.tgz",
        "risk": 117,
        "size": 383,
        "type": "npm",
        "facts": {
          "metrics": {
            "file": {
              "size": 383.0,
              "entropy": 7.28,
              "size_bytes": 383.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 7.28,
              "peak_region_bytes": 383.0,
              "peak_region_entropy": 7.28
            }
          }
        },
        "ident": {
          "name": {
            "value": "statist-browser-typed-client-hra.eventcalendar.events",
            "source": "npm.name",
            "verified": false
          },
          "trust": "unsigned",
          "version": {
            "value": "0.0.1",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "statist-browser-typed-client-hra.eventcalendar.events",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/package/manifest/description::desc-service-client-library",
            "conf": 0.9,
            "crit": 3,
            "desc": "Description claims service client library"
          },
          {
            "id": "metadata/package/quality/empty::tiny-commonjs-exports-object",
            "conf": 0.85,
            "crit": 3,
            "desc": "Tiny CommonJS module exports an object literal",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/quality/empty::npm-empty-author",
            "conf": 0.75,
            "crit": 2,
            "desc": "package.json author field is empty"
          },
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "metadata/package/testing/presence/manifest::npm-init-default-test",
            "conf": 0.95,
            "crit": 1,
            "desc": "Default npm-init placeholder test script"
          },
          {
            "id": "metadata/package/manifest/name::npm-dotted-typed-client-name",
            "conf": 0.88,
            "crit": 3,
            "desc": "npm name resembles internal typed client"
          },
          {
            "id": "objectives/supply-chain/impersonation/manifest/placeholder::service-client-library-name-squat",
            "atk": "T1195.002",
            "mbc": "B0024",
            "conf": 0.94,
            "crit": 5,
            "desc": "npm init stub squats internal client library name",
            "from": [
              {
                "off": 105,
                "file": 1,
                "line": 6
              },
              {
                "off": 93,
                "file": 2,
                "line": 4
              }
            ],
            "spans": [
              [
                0,
                41
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/manifest/skeleton::brand-new-empty-client-library-squat",
            "atk": "T1195.002",
            "mbc": "B0024",
            "conf": 0.95,
            "crit": 5,
            "desc": "Brand-new empty stub squats client library name",
            "from": [
              {
                "off": 105,
                "file": 1,
                "line": 6
              },
              {
                "off": 93,
                "file": 2,
                "line": 4
              },
              {
                "off": 0,
                "file": 3,
                "line": 1
              }
            ],
            "spans": [
              [
                0,
                32
              ]
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "fdFBUasXHPByxo9B960yA=leywPxwAD2Nt9eN@QhwO#PwxMvJlwP?T5ByO-}wO#3!AXp{DwO#Qh3lQ/vq!o#)x\u003e7Y%v@b\u003c\u003czGE1qx\u003c#9\u003eA^n0mdLzbMB-RapB98Cpv@@[R3jpS*wozZ1e[GoDz/P@vauZ\u0026]Eld=",
            "n": [
              {
                "c": 3,
                "d": "Tiny CommonJS module exports an object literal",
                "i": "metadata/package/quality/empty::tiny-commonjs-exports-object",
                "o": 105,
                "z": 19,
                "cf": 0.85
              },
              {
                "c": 2,
                "d": "Minifier helper patterns",
                "i": "metadata/build/minifier::terser-minifier-helpers",
                "o": 92,
                "z": 10,
                "cf": 1.0
              },
              {
                "c": 2,
                "d": "Script file",
                "i": "metadata/file/extension/identity::script-file",
                "o": 0,
                "z": 8,
                "cf": 1.0
              }
            ],
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "module.exports"
            ]
          ],
          "mbr": [
            "module.exports"
          ],
          "metrics": {
            "ast": {
              "max_depth": 4.0,
              "bind_count": 1.0,
              "call_count": 0.0,
              "node_count": 19.0,
              "member_count": 1.0,
              "identifier_count": 2.0,
              "member_depth_max": 2.0,
              "string_literal_count": 1.0
            },
            "file": {
              "size": 127.0,
              "entropy": 4.57,
              "size_bytes": 127.0
            },
            "text": {
              "space_count": 10.0,
              "total_lines": 7.0,
              "char_entropy": 4.57,
              "unique_chars": 32.0,
              "string_density": 0.14,
              "avg_line_length": 17.14,
              "max_line_length": 56.0,
              "empty_line_ratio": 0.14,
              "last_line_length": 20.0,
              "whitespace_ratio": 0.13,
              "most_common_ratio": 0.11,
              "identifier_density": 0.29,
              "line_length_stddev": 18.09,
              "normalized_string_count": 0.38,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 0.71
            },
            "binds": {
              "count": 1.0
            },
            "binary": {
              "overall_entropy": 4.57,
              "peak_region_bytes": 127.0,
              "peak_region_entropy": 4.57
            },
            "members": {
              "count": 1.0
            },
            "strings": {
              "total": 1.0,
              "avg_length": 10.0,
              "max_length": 10.0,
              "avg_entropy": 2.92,
              "total_bytes": 10.0
            },
            "comments": {
              "chars": 86.0,
              "lines": 4.0,
              "total": 1.0,
              "to_code_ratio": 1.33
            },
            "identifiers": {
              "count": 2.0,
              "total": 2.0,
              "avg_length": 6.5,
              "max_length": 7.0,
              "min_length": 6.0,
              "avg_entropy": 2.7,
              "reuse_ratio": 1.0,
              "unique_count": 2.0,
              "length_stddev": 0.5,
              "all_lowercase_ratio": 1.0
            }
          }
        },
        "id": 1,
        "mol": "Md(Pa)",
        "path": "/tmp/cyclotron-17ecbc2c/samples/969b0f96d154/statist-browser-typed-client-hra.eventcalendar.events-0.0.1.tgz!!package/index.js",
        "pid": 0,
        "risk": 1,
        "sha": "2489f9c94acd6920edd252081ba341683a231ba2fc0795599df7a23cc601fb57",
        "size": 127,
        "traits": [
          {
            "id": "metadata/package/quality/empty::tiny-commonjs-exports-object",
            "conf": 0.85,
            "crit": 3,
            "desc": "Tiny CommonJS module exports an object literal",
            "spans": [
              [
                105,
                19
              ]
            ]
          }
        ],
        "type": "javascript"
      },
      {
        "ctx": [
          {
            "b": "DKp(rb5Q?awG\u003ceTb6d\u003cmBzk/reN\u0026:sCxmtoeP=nSwN)x5y?WD#Bs?fDvj(bmwO#Q1vqGH)wmoHhwP?T5BAnSS3lQDnC4CYnx(v(kiV]R2e?![ja$K6zar\u003eucB7ol8Acb/jzx.a:b2-5[C4\u003eC$ay/k4wO#Pjy?Wv0vrcSqed9Hxb5H+5zx.a:b57}9wQ2?xB0rdxarR\u003eHv@=p5BAnS!aBsCrarR^JBy/Jnb03?\u003cwN/y(ay39VA=M8siV@rUaARgoBrCTzwN/B^x\u003ep*Wa%niVaz2!iBrApZ3lQEted9Hxb5p+nCw?IjB0rT/tu@=!arR\u003epB-.qnAW0K!a%FMBarR\u003eAx\u003e7Z(B7DKRar\u003cJKr3zV$",
            "n": [
              {
                "c": 3,
                "d": "Description claims service client library",
                "i": "metadata/package/manifest/description::desc-service-client-library",
                "o": 93,
                "z": 22,
                "cf": 0.9
              },
              {
                "c": 3,
                "d": "npm name resembles internal typed client",
                "i": "metadata/package/manifest/name::npm-dotted-typed-client-name",
                "o": 4,
                "z": 53,
                "cf": 0.88
              },
              {
                "c": 3,
                "d": "Test script is a trivial shell command",
                "i": "objectives/supply-chain/impersonation/manifest/skeleton::test-script-trivial-shell",
                "o": 175,
                "z": 41,
                "cf": 0.85
              },
              {
                "c": 2,
                "d": "Package declares keywords",
                "i": "metadata/package/keywords/identity::has-keywords",
                "o": 236,
                "z": 2,
                "cf": 0.75
              },
              {
                "c": 2,
                "d": "Root JavaScript main entrypoint",
                "i": "metadata/package/manifest/entrypoint::main-root-javascript-entry",
                "o": 136,
                "z": 8,
                "cf": 0.9
              },
              {
                "c": 2,
                "d": "Package version uses numeric SemVer format",
                "i": "metadata/package/versioning::conventional-version-base",
                "o": 71,
                "z": 5,
                "cf": 1.0
              },
              {
                "c": 2,
                "d": "npm zero version with benign package context",
                "i": "metadata/package/versioning::npm-zero-version-benign-context",
                "o": 254,
                "cf": 0.8
              }
            ],
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 288.0,
              "entropy": 4.58,
              "size_bytes": 288.0
            },
            "binary": {
              "overall_entropy": 4.58,
              "peak_region_bytes": 288.0,
              "peak_region_entropy": 4.58
            }
          }
        },
        "id": 2,
        "mol": "Md(Pa₂)",
        "path": "/tmp/cyclotron-17ecbc2c/samples/969b0f96d154/statist-browser-typed-client-hra.eventcalendar.events-0.0.1.tgz!!package/package.json",
        "pid": 0,
        "refs": [
          {
            "to": "index.js",
            "off": 145,
            "file": 1,
            "kind": "local"
          }
        ],
        "risk": 2,
        "sha": "173cef4111b5a3c88afecadaa34d6cd3c93e5197f11cb4886fd3d86dc3c71003",
        "size": 288,
        "traits": [
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field",
            "spans": [
              [
                0,
                21
              ]
            ]
          },
          {
            "id": "metadata/package/testing/presence/manifest::npm-init-default-test",
            "conf": 0.95,
            "crit": 1,
            "desc": "Default npm-init placeholder test script",
            "spans": [
              [
                175,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/manifest/name::npm-dotted-typed-client-name",
            "conf": 0.88,
            "crit": 3,
            "desc": "npm name resembles internal typed client",
            "spans": [
              [
                4,
                53
              ]
            ]
          },
          {
            "id": "metadata/package/manifest/description::desc-service-client-library",
            "conf": 0.9,
            "crit": 3,
            "desc": "Description claims service client library",
            "spans": [
              [
                93,
                22
              ]
            ]
          },
          {
            "id": "metadata/package/quality/empty::npm-empty-author",
            "conf": 0.75,
            "crit": 2,
            "desc": "package.json author field is empty",
            "spans": [
              [
                254,
                0
              ]
            ]
          }
        ],
        "type": "package.json"
      },
      {
        "id": 3,
        "mol": "Md",
        "sha": "5c831a96ee5575effe370e6b7a5230b985d1af3a956162f8d1f9af34f221a6b8",
        "path": "statist-browser-typed-client-hra.eventcalendar.events@0.0.1.registry.json",
        "risk": 1,
        "size": 825,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 1,
    "v": "8"
  }
}