{ "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00007651249, "rte": "az", "prob": 0.00007651249 } ], "prob": 0.00007651249, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007651249325135723, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000059992074966430664, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00005120038986206055, "type": "static-lib" } ], "version": "v18.18", "analyzed_at": "2026-08-02T20:16:27Z" }, "path": "libfetch-2.40nb5.tgz", "raw": { "files": [ { "id": 0, "mol": "H₂(Cm₃F)", "sha": "9849034ed8cd0634fdfd77c1072314b61c618f87d7824dfe944519d25194c39e", "path": "libfetch-2.40nb5.tgz", "risk": 3, "size": 35632, "type": "xz", "facts": { "metrics": { "file": { "size": 35632.0, "entropy": 8.0, "size_bytes": 35632.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 35632.0, "peak_region_entropy": 7.85 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "References certificate terminology", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP URL uses alternate port 8080", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-cmd-auth", "atk": "T1071.002", "mbc": "C0004", "conf": 0.699999988079071, "crit": 1, "desc": "FTP authentication command token", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-protocol-support", "atk": "T1071.002", "mbc": "C0004", "conf": 0.8500000238418579, "crit": 3, "desc": "FTP control-channel command support", "from": [ { "off": 43754, "file": 2 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::netrc", "atk": "T1552.001", "conf": 0.949999988079071, "crit": 3, "desc": ".netrc credentials file", "from": [ { "file": 1 } ], "spans": [ [ 67956, 7 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-prefix", "conf": 0.699999988079071, "crit": 2, "desc": "X509_ function prefix", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/proxy::proxy-connect-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.800000011920929, "crit": 3, "desc": "HTTP CONNECT proxy tunnel method", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-cmd-listing", "atk": "T1071.002", "mbc": "C0004", "conf": 0.699999988079071, "crit": 1, "desc": "FTP listing/navigation command token", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::package-or-netrc-credential-file", "atk": "T1552.001", "conf": 0.8999999761581421, "crit": 3, "desc": "Package client credential file reference", "from": [ { "off": 17363, "file": 1, "line": 627 }, { "off": 67956, "file": 2 } ], "spans": [ [ 67956, 7 ] ] } ] }, { "analysis_gaps": [ "flow-graph-limited" ], "ctx": [ { "b": "e)GOL3nbNcavy6^D2^RixMLvBv\u003c@JPixo5Jgb7ysavGTJeK:X@x(mMalVo(Cwmou#q/fBZA+xA3B{Y\u003cba%ol\u003eAcVFrxj#xfc$sXGgb7BpawcM-A+uH[z/fD7zENf$xjV9ajzF!CA+vTjwPQmql[Sy#xfDUPtP$pRy?$kmx\u003eIa3B0bHmB7GxnwN)z2e)GOce)GOyqE%xMB98CpvS=^bz/cXazE:(jB7DFdzxK1sB-H#6ayPd#ayY55vrcSow]zZbB1wCTx([2hz/M$Ax([3bB-W%ytP$qcz!9M]x\u003e7N[x(v(uayPq4aAg[jze19lwN({5A=lbnwmYo]Bzb98aARpdazbLdy\u0026sJizF784z/f91BzkVhA%:K8a%prmwGU\u00263Buf:YtP$pBe*a56wncabA+P09BzkVhB0bykaAIEzA:@V6v@C)?az(mxBrCQnByw)3aARpdayO.$C4z!az/x#xx\u003eIa33nbNcarR^HzF%Shv}vhlBzbxfaz++kBrCHlay/tcwncd1z/fRsvqYP#Bzbkdw]zH4z*b]kxcp-0B7o2{x(dB4e^:joa%nS[aw#=Yx(!xpx\u003c#jbx(v)gazCZovRGZ*A^n^tz/PXqzfo]waAz4j", "ln": 0, "col": 1, "line": 1 }, { "b": "p!TCHl)bL%qC]!Qr7PISawUDHo*}@Eni{0Ik%!dpnMn?nk#6/\u003cmOcMOmn)bcmO=]8k{e#\u0026qDcjPrzkXRaw=6op!$1U3nbNcave)]avF!1lRG^qo*}D5arTlJawLYPmoh\u0026Lr3kagk$\u003c@{r7GC2k#*(PpF@rhqxOt5pe\u003ea.lrc#XqD1Y8miCn}k%!l", "ln": 829, "col": 7, "line": 17 }, { "b": "r7GCNqDUbrmJ+w@k%!dpnMn?zaxI95r7GCQaw2rJlR*DRqB9VHefE\u003e\u003cqB%kP3nbNcawtu)lp\u003c\u003cxr9p:{pF@rmpF$dmc}Nf3oJsFLpdDB4mmQ3ym[3fumiCx7awU%cmn^hU", "ln": 1237, "col": 31, "line": 22 }, { "b": "ax8ocnfyq^o*Iore^:joa{]@ca%nd2A+e/Gq:-U?w[u6]xF87(B%5H(hz=KifFCBsf!$ypi3o}giXSuJgbZm=wPF$.CYj=J3nbNcas6Y[Bv5[]iV@3CByO#pgC0X(f!LgvatLSahzl:vfekg7f!+TBf/?fEaA}KCavQJ]as4pDtP%Icl$vAdwN/p*vR6N5gbpy6gb7Et3na.*avX!0lR5sQ3nba}3nbm\u003cawLi%mg7Uxz6iC4ByO#UvqxBOqCnh:3nb7\u003cazbhbv}XXEA=U!(qCnh:3nb7\u003cazbhbv}XkFAcUCYoDU\u003e[e(3maw[u6]xHW2NwMqS4as)\u003cLphIa=wPRA}svV}A", "ln": 1442, "col": 4, "line": 25 }, { "b": "3na[/azbhbv}WGd3na!\u0026aAITBBZ]IoB-IpvdHE^$zxJL5ByO#UvqxBOqCnhSv@DmaBrC7bvr9FuB7n({zdK[lb4CLeB95KmxKL{7dRJ:wBrR?Kx(n2nAbP=sa%n7tz/fSray/7[AV=\u0026xz^%$lb4CLeB95KmxKL{7dS]/zAV#RIv@DmaBrC7bvr9FuAcC*", "ln": 2433, "col": 12, "line": 75 }, { "b": "BrC7bvr9Furz(Hm3na!\u0026aAITBBZ]IoB-IpvdHE^$zxJL5ByO#Kz/x#4qCnhSv@DmaBrCTDA=\u003e(laA.Zvas.HT3na!\u0026aA?Wqwc%}UzxJL5ByO#NA+e/ZqCnhSB98CBv@@\u0026oA+(\u003cFBS}eBmSY++wPRA}nLZDU3na!=azbhbv}X$mwPQ{IoDUJ?z/fSray/6", "ln": 2626, "col": 24, "line": 80 }, { "b": "axqrkuR\u003c/(oHRY0gbQ@%bv\u003ev$x(mG8rz(H$nkAe-oHRY0gbQ]@3uHrfBZ]IoB-IpvDKp(rarUfcvr8U%B7n({zdM{KqCpB@lR6TumnccBas!M?t@@xoarR!pxKL]/aA.:pA:8KwoKy^#mn=/Fp9q5ff\u003cM\u003cFarR^Hv}Yp\u003e2{shhwlS5ioKyQ$l}*3Aas!M?t@@xoarR!pxKL]/aztXmBx.:yoKys^q=DBVp9q5ff\u003cM\u003cFarR^Hx(n202{sh9A=:wIarR^Hv}Yp\u003e2}xF7v(\u003e2uarR!Bw[Cy(2{sd#w]?K9i%)8MarU-tDsZD92{s4}zFa68i%)8MarU=uzdN6@2{s4)B97=az!9M]x\u003ep*p3vK#ye\u003e6pTe(lG]ra]?=AbPDdBy/FnA+funA=bD0ayYQ6e\u003ef.3w[u6]xIz]JwMqS4as)\u003cLmS6tXwPRA}lVl{?", "ln": 6464, "col": 8, "line": 194 }, { "b": "aAhmtBrCQjzF9J6x(n0lwNP9(z!pblxK@r1x\u003eI94AbP=saAy[dxjShlB7F[\u0026e)9cpx(CgKasOA=3nbd]3q1?LBzbj)e(uBcwc%.}x(W={BswtAy**%0x(+zrAaJJ[w[+*!eda10zxJL5ByO#^m}D^ir8sX*3na!=azbhbv}XwzBvGkaas)\u003edzE:7", "ln": 11812, "col": 9, "line": 415 }, { "b": "a{}:@wft\u00261B8#LzA+3ppvqZ13D2mFxB3J$WttfcAxM4%lzEEx[tQ\u0026@FBx{7y3nbm\u003cav]Ehp-@X7njulw3rgXI3na!=azbhbv}X$mwPQExr8sX*3na!=azbhbv}XwzBvYwgp-}p@vqYP.e\u003ef.3w[u6]xI-?[nk@L+3taA#v@#B6zGu}mze:r5zdNQbaARpdav]Ehp+KKQf^7BQz//]cz!}3ks7#+\u0026ayMyex([DkwGU/iv@0RrBzblawGUYd3t1x(zxJvgv}Yp*v}u^8xKM09Bzblhay/tbAbo!xCwhejaw$V@atL\u0026fhxVBCwfs=tlM!cxf/HY(e(lG]nOf8!xK}J6qevv=3mGC0A+e:5diJksve", "ln": 12161, "col": 67, "line": 429 }, { "b": "z!9A4Bz\u0026pAB7DFkvrlH7C4z!kz!9Ai3na[(avQC@mPrh\u003ep^F2Us5hZZ3pFDqvrDydavYsbaAg+gB9zLywftO#aARpdaAz4gz//LkB7GxnwPw]lwPq\u003c7B98ECz/fbevqYP#zF%A7", "ln": 15207, "col": 17, "line": 555 }, { "b": "aA.:pAV!!dwg}\u003ewayMyivrlHlz/PwhCv+/aaAIHkv}/K?wN(]$zxK4mwGU@jz*lKmrz(Hy3na[(avQC@nk@L+uS6rZmn=ML3r7[Pv}/K?wPF#oxK@rbwObH]A+fnlrz(HkBz\u0026pAB7DFaz/M%\u003er8=WpA+flkwPI%me^+fZaAIaoaARJee\u003c%X4vrDWgas)\u003ewxK@q%z!0{bwO#Pjrz(HkCwg(fayX[8B-Rb8ayPslA+e\u0026]A=L-iaxqrke^:j5BrB1}av]Ehp*Wj3mn^FUm[3fL3r7[Pv}/K?wPF#oxK@q^B7Gwzl1:+DBrCTDA+PA7aARJAB-Rapw]zYjnk@L+aAz4kB.bSoB1N/0xLzJgv{%l$vR3W8B7F%ay-)}nwO@Smz/PSczF78ox([2hnk@L+aA8pmxk8laz/M$tA=lhFaAIamC4CYnaARp9", "ln": 16926, "col": 16, "line": 614 }, { "b": "B7Gwmvp%d?BAo5we\u003eHdcmrP!Gmo0eL3r7[Pv}/K?wPF#5azbt7wGV8kaA.:pazC.mBy!(\u003eaA7\u003c0e(k$0ELir\u003ewPR%53uQhey\u0026slcaA.SCy\u0026r%2zxJ?9zdN=hvqYP#Aa9*eCw?IjB0b7kAV^?Jp-%*[By/IC3r7IE3nbC3azb.matBjnz/M$eay]58v@=p5BzkVhaA7\u003cmBzbkdw[=6)azbLjzddJs3rgXMB0b7avruTjwGUYdaz2!pwPzH4", "ln": 17299, "col": 24, "line": 624 }, { "b": "z/fA6zGE1Avrc6\u003cvR/P#x(k54az\u003eL8zE)\u0026hB7]G9y*?ubBz\u0026pzxLzJG3nbd]3na..av]Ehp*W3%pGQ:.xMOuniXJd9A=lhFe[Gooze:r5e[n*piYF/MfBxBeA0/fGaARpdaAhvtCZgAMwPz%9AV/ylADL#owPF#5B-.qdzGGP5vruj4zy=]LxK#i}ayPq43uQGgaA8jvx(v)gayPC4x(4i!y?j-3z/M$tvrlH7zF78lxK@q{B-.qdzGGP5vruj4zxJE#Byu^era]?=w[=pbBrCBiBzbP6azC)tvTf8sB7]J8aARpdaAhvtCZgAiqCoaUe(lG]e\u003c%H#nk@L+uR\u003cS@sxN!2BAzE.fe3MWttfcAB-RbmtQ\u0026@FBx{}jdQbO*u2U0#tQ\u0026@FBx}dJA=lhFe[Gooze:r5e[n*piYF/MfBxBeA0/MTwGV59v@Dl}az\u003eXixM4A7x(+zaC{4lJx(mMaBzbj)e\u003e6}ank@L+uR\u003cS@sxO#%rA8G@wO#W9A=k\u0026jwO#PjC42A9vpB4:iTNGawfrEux(){bvqE5rz!rQ5wPP5ezE^r@Bp7Mrr8u{#qCQy$j.O}VA5]T9Ab](wC}JVMvqP$1wIdFhz8%Tgi4$Xgr8=X3p/p7\u003esZKD{r7GeYvrlc)iX0f}dQbO*u3gj1A:g7#m%52$tQ\u0026@KBx@\u003cfwlZP*m%52ze\u003e6pTe(lG]rbS)\u0026x(^Y(y?j-hxK@reB7DFjw/$I8Ab](wC{3ZqAV!!dav]Ehp-%*\u003cA=#2maAzQxzFs03aA8cuBzbkdy\u0026r/(yZK\u0026]B95@QwmYv!zE\u003cecmrP!GpHu{@pGQ:bvriM6z!%ldCxk!Le\u003c:7\u003eeO]cywPzi}at4Izw]?K9azC.7wO#O%petj[qCQy$j-24DvqGQ}B95@/gb**te?![j3na+T3nbm\u003cax7Y$aveX1pynZVa%nHuAV!$9ByO#bf^51Oe)GOye)9cpw]@0azY*?Ueda1iAV!$oA3c\u003eTeda1iAV/7nat:ATqGAf$b%-UCe*9#eB97#f3n9R\u003cawameod?t+wQefiy?9", "ln": 17948, "col": 6, "line": 651 } ], "depth": 1, "facts": { "imp": [ [ "", "Copyright" ], [ "", "Smørgrav.Copyright" ], [ "", "CONTRIBUTORS" ], [ "", "to.If.Ql" ], [ "", "If.Ql" ], [ "", "low" ], [ "", "range" ] ], "mbr": [ "Ed.Pp", "If.Ql", "NetBSD.org", "RFC.Pp", "SCHEME.Fn", "Smørgrav.Copyright", "The.Fa", "The.Fn", "URL.If", "URL.The", "VALUES.Fn", "a.Dv", "a.Li", "a.Vt", "actual.Fn", "after.Pp", "after.Pp.Fn", "and.Aq", "and.Fn", "are.Fn", "argument.Pp", "automatically.This", "be.Fn", "below.Pp", "below.Pp.Fn", "by.Fn", "calling.Fn", "change.Sh", "compared.Sh", "component.Pp", "component.Pp.Fn", "components.Fn", "conditions.are", "connection.The", "connections.Pp", "connections.Pp.Fn", "connections.Pp.Fn.Fn", "connections.Pp.Fn.Fn.Fn", "connections.The", "connections.The.Entries", "copyright.notice", "distribution.THIS", "epoch.If", "error.If", "existing.Vt", "failure.Pp", "fetch.h", "fetch.h.Bd", "fetch.h.Bl", "fetchConnectionCacheClose.Nm", "fetchConnectionCacheClose.Nm.Nd", "fetchConnectionCacheClose.Nm.Nd.Sh", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb.Sh", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb.Sh.In", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb.Sh.In.h", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb.Sh.In.h.In", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb.Sh.In.h.In.h", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb.Sh.In.h.In.h.Ft", "fetchConnectionCacheClose.Nm.Nd.Sh.Lb.Sh.In.h.In.h.Ft.Fn", "fetchConnectionCacheInit.Nm", "fetchCopyURL.Nm", "fetchFreeURL.Nm", "fetchFreeURL.The", "fetchFreeURL.The.Vt", "fetchFreeURLList.Nm", "fetchFreeURLList.The", "fetchFreeURLList.The.Fn", "fetchGetFTP.Nm", "fetchGetFile.Nm", "fetchGetHTTP.Nm", "fetchGetURL.Fn", "fetchGetURL.Nm", "fetchInitURLList.Nm", "fetchListFTP.Nm", "fetchListFile.Nm", "fetchListHTTP.Nm", "fetchListURL.Nm", "fetchListURL.Nm.Nm", "fetchListURL.Nm.Nm.Nm", "fetchListURL.Nm.Nm.Nm.Nm", "fetchListURL.Nm.Nm.Nm.Nm.Nm", "fetchListURL.Nm.Nm.Nm.Nm.Nm.Nm", "fetchMakeURL.Fn", "fetchMakeURL.Nm", "fetchParseURL.Nm", "fetchPutFTP.Nm", "fetchPutFile.Nm", "fetchPutHTTP.Nm", "fetchPutURL.Nm", "fetchStatFTP.Nm", "fetchStatFile.Nm", "fetchStatHTTP.Nm", "fetchStatURL.Nm", "fetchStringifyURL.Fn", "fetchStringifyURL.Nm", "fetchUnquoteFilename.Nm", "fetchUnquotePath.Fn", "fetchUnquotePath.Nm", "fetchXGetFTP.Fn", "fetchXGetFTP.Nm", "fetchXGetFile.Fn", "fetchXGetFile.Nm", "fetchXGetHTTP.Fn", "fetchXGetHTTP.Nm", "fetchXGetURL.Fn", "fetchXGetURL.Nm", "fetchXGetXXX.Fn", "flag.If", "flags.Pp", "flags.Pp.Fn", "functions.Sh", "hint.Callers", "indepent.Fn", "int.Fn", "last_modified.For", "last_modified.For.Li", "library.They", "locally.For", "modification.Pp", "modification.Pp.Fn", "names.If", "newer.Va", "not.Fn", "options.The", "or.Dv", "or.Fn", "path.Only", "protocol.With", "prototype.Pp", "prototype.Pp.Ft", "quoting.Query", "reserved.Redistribution", "respectively.Note", "result.Pp", "result.Pp.Fn", "returned.Fn", "scheme.Pp", "schemes.For", "second.The", "second.The.Vt", "see.Xr", "sent.For", "should.Fn", "simply.Va", "simply.Va.The", "simply.Va.The.Pp", "specified.Fn", "string.Fn", "string.Pp", "structure.In", "structure.In.h", "structure.In.h.Bd", "structure.Pp", "structure.Pp.Fn", "structure.The", "structure.The.Vt", "system.Only", "system.Only.Aq", "the.Aq", "the.Fa", "the.Fn", "the.Nm", "the.Pp", "the.Pp.Fn", "the.Ql", "the.Vt", "the.documentation", "them.Sh", "to.If", "to.If.Ql", "to.Nm", "unimplemented.Sh", "url.Fn", "width.It", "width.It.It", "width.It.It.It", "width.It.It.It.It", "width.It.It.It.It.It", "width.It.It.It.It.It.It", "width.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It", "width.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.El", "width.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.It.El.Pp", "without.modification" ], "tgt": [ "CONTRIBUTORS", "Copyright", "If.Ql", "Smørgrav.Copyright", "a", "d", "l", "low", "range", "to.If.Ql" ], "metrics": { "ast": { "op.gt": 1, "op.lt": 1, "op.add": 4, "op.div": 2, "op.mul": 3, "op.sub": 23, "max_depth": 26, "call_count": 12, "node_count": 5627, "member_count": 195, "max_array_len": 1, "op_density.gt": 0, "op_density.lt": 0, "op_density.add": 0, "op_density.div": 0, "op_density.mul": 0, "op_density.sub": 0, "sequence_count": 39, "max_concat_chain": 2, "member_depth_max": 21 }, "file": { "size": 20939, "entropy": 5.11 }, "text": { "lines": 785, "top_char": 116, "tab_count": 16, "max_ws_run": 4, "digit_ratio": 0.01, "space_count": 2695, "char_entropy": 5.11, "unique_chars": 96, "top_char_null": 0, "string_density": 0.12, "top_char_ratio": 0.07, "avg_line_length": 25.67, "max_line_length": 122, "non_ascii_ratio": 0, "empty_line_ratio": 0, "last_line_length": 47, "long_token_count": 1, "whitespace_ratio": 0.17, "identifier_density": 3.51, "line_length_stddev": 22.41, "normalized_string_count": 3.32, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 80.69 }, "binary": { "peak_region_bytes": 12288, "peak_region_entropy": 5.25 }, "strings": { "bytes": 1492, "count": 93, "avg_length": 16.04, "max_length": 30, "avg_entropy": 3.26, "empty_count": 1, "entropy_stddev": 0.35 }, "identifiers": { "count": 2758, "unique": 776, "avg_length": 6.59, "max_length": 25, "min_length": 1, "avg_entropy": 2.27, "reuse_ratio": 0.28, "length_stddev": 3.41, "sequential_names": 21, "single_char_count": 21, "single_char_ratio": 0.03, "high_entropy_count": 7, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.64, "all_uppercase_ratio": 0.11 } } }, "id": 1, "mol": "K(Te)H₃(Cm₄Db₂F₃)", "path": "libfetch-2.40nb5.tgz!!man/man3/fetch.3", "pid": 0, "risk": 5, "sha": "5c3b607d43e4ca0d3b25b5f183b2abca70bb73aa3efa33c134a9ea5269572827", "size": 20939, "traits": [ { "id": "metadata/file/line::file-has-30-plus-lines", "conf": 0.9, "crit": 2, "desc": "File has 30 or more lines" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 269, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 171, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 264, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 877, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 207, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 392, 0 ] ] }, { "id": "micro-behaviors/communications/http/message::http-versions", "conf": 0.75, "crit": 3, "desc": "HTTP protocol version strings", "spans": [ [ 12314, 8 ] ] }, { "id": "micro-behaviors/communications/proxy/env::no-proxy-exclusion-write", "atk": "T1090", "conf": 0.9, "crit": 3, "desc": "Writes the NO_PROXY exclusion list", "spans": [ [ 18636, 10 ] ] }, { "id": "micro-behaviors/data/property/access::js-addition-indexed-access", "conf": 0.95, "crit": 3, "desc": "Computed property access with addition", "spans": [ [ 6528, 25 ], [ 6565, 21 ], [ 6598, 19 ], [ 6629, 21 ] ] }, { "id": "well-known/tool/development/vcs/github-web::github-repo-fetched-path", "conf": 0.98, "crit": 3, "desc": "Fetched github.com repository artifact" }, { "id": "micro-behaviors/communications/http/request/cgi::http-referer-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_REFERER variable", "spans": [ [ 16990, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/cgi::http-user-agent-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_USER_AGENT variable", "spans": [ [ 17131, 15 ] ] }, { "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "conf": 0.7, "crit": 3, "desc": "HTTP URL uses alternate port 8080", "spans": [ [ 18012, 29 ], [ 18223, 62 ] ] }, { "id": "micro-behaviors/data/property/assign::auth-token-variable-assignment", "conf": 0.8, "crit": 3, "desc": "Assigns an AUTH or TOKEN named variable", "spans": [ [ 18435, 16 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::netrc", "atk": "T1552.001", "conf": 0.95, "crit": 3, "desc": ".netrc credentials file", "spans": [ [ 17363, 8 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::package-or-netrc-credential-file", "atk": "T1552.001", "conf": 0.9, "crit": 3, "desc": "Package or netrc credential file reference", "uses": [ 15 ], "spans": [ [ 17363, 8 ] ] }, { "id": "micro-behaviors/fs/path/credential::developer-auth-file-reference", "conf": 0.92, "crit": 3, "desc": "References a developer credential file", "uses": [ 16 ], "spans": [ [ 17363, 8 ] ] }, { "id": "micro-behaviors/fs/path/token::developer-credential-stores", "atk": "T1552.001", "conf": 0.92, "crit": 3, "desc": "References developer credential store paths", "uses": [ 16 ], "spans": [ [ 17363, 8 ] ] }, { "id": "micro-behaviors/fs/path/credential::token-and-secret-config-paths", "atk": "T1552.001", "conf": 0.9, "crit": 3, "desc": "Token and secret config paths", "uses": [ 15, 16, 18 ], "spans": [ [ 17363, 8 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "aV%gNv}X4kfczwWarR^HarR^HarR^Hf/I3Hh.^0Af/yc%fD.FXarSuXarR^HfD.FXarR^Hf!$QAarR^HarU500000!000fN000fN000fN000fN000fN000)#000", "n": [ { "c": 1, "d": "Binary has low overall entropy", "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "C(RJ1Bz}jaB2\u003eQ*03#XEavoHTx\u003e5niA$5DRvQTs(v(:Q4Bz}jImn%m+mo0d+njt*j08(\u0026.q#*PNBz#p3lR*DLmmg2%c389[wfsAxr8tk5e?)!x07.3HBugJ\u003cB2\u003eQT4gi8iA=lhFeKsJ3xM4{9Dsp]fz/bLCr8=X3p/p7\u003esZKD{r7D##3ijoRB6O=bc1E0@wPq\u003c7B98blxcnHwiXJcjB0U(cc37gPB2\u003e%cc37wNav]Ehp+KKQf+1D\u0026nOfLGz!9M]x\u003ep*bq!ZbVwJy}WA$5DRnn\u0026M\u003eiV].\u00264gi83B-.qnA+P\u0026dBzkVh07Z6*p*VH*r7E0Wr8=X3qBK5zqBKE-vrDWg08^xuwPzv5iV].\u0026iXJcjB0U(p3ii$nw[u0]AYLr?A$5DRnk@L+uSy2[qEqZWmnu!ZrDz.(eKs2XzGE]Zc36I50bMvUw[u6]xFha[fAt0VzF9JwayYRrwPH0Xy\u00260Sl4gi8RwPz%9AV/ylADL#owPF#5B-.qnA+P\u0026dBzkVh0bDdSA4LHmx)a4/vTi6bB07DevjSJEwfre", "n": [ { "c": 3, "d": "HTTP CONNECT proxy tunnel method", "i": "micro-behaviors/communications/http/request/proxy::proxy-connect-method", "o": 16696, "z": 22, "cf": 0.800000011920929 }, { "c": 2, "d": "Authorization header", "i": "micro-behaviors/communications/http/request/client::auth-header-dup", "o": 16863, "z": 13, "cf": 0.5 }, { "c": 2, "d": "User-Agent header", "i": "micro-behaviors/communications/http/request/client::user-agent-header", "o": 16956, "z": 11, "cf": 0.5 }, { "c": 1, "d": "HTTP Referer header", "i": "micro-behaviors/communications/http/headers::referer-header", "o": 16905, "z": 8, "cf": 0.6000000238418579 } ], "ln": 16632 }, { "b": "c0qupnie4\u003eiWEYEm[(}.c1FcswN]H}wN/*8Bz\u0026oFA@YY-B-7#awb)]%ash7Knk@L+fek7l4gi85z/fVdzGEE7wO#d5xAgzrzGGDcBs*y0zF9IXoKS0:eLQd]x\u003ez6\u003cwb]qwv{%E[z/bLOA:-\u003cbw[u0mmq=QNwnb{]09rl6eKsJ3xK#76x\u003e7N[wDk8ozGGN", "n": [ { "c": 2, "d": "HTTP/1.x version string", "i": "micro-behaviors/communications/http/request/client::http-version", "o": 17113, "z": 7, "cf": 0.5 } ], "ln": 17065 }, { "b": "000000000000000000000000000000000000000000000000000000000000k%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ2lyv}od.xj#0]yIW\u003c9z/xYpB98LFCx!yVfFLssg=mfIi5@Gx00000000000000000000q/#$Lz/eJ%wMJCNra{zzA+ODXBn#pv000000000000000000000000000000n)#QbwNXwxAZsU+o\u003c@rtB-6/]y^AhRq!o]zv@$E:", "n": [ { "c": 2, "d": "Hardcoded standard base64 alphabet", "i": "micro-behaviors/data/encode/base64::alphabet-standard", "o": 18092, "z": 64, "cf": 0.5 } ], "ln": 18044 }, { "b": "(b%29%4OjEBG4@\u003c\u003eJz)C006Le%nSb+Uik\u0026=006Le%nSb+Qes]Zr1ffmvqZ13D2mFxA@XWep*V)(m[DCQrz#s:ash7]c36I507G{:uR\u003c3!q==:)l\u0026XJOkMBRDq=s!+A$5DRrz#s:ash7r3ij78mn+lOB3I3)kQx}I3iiefD2NsT07G{:uR\u003cS@sxLSoBz$PaA=lhF07Z6*p*W3%pGQ:1xMOunuVp47CZfp3Bz}j[BAzE4o\u00261eCasgIb3ij4dp^(GMv*@+Baohyhr8u{#k#QYNrZ*v\u0026pEERKzF]I@wPS3dzF78hvrlH7C4z!kz!9zVp^F1", "n": [ { "c": 3, "d": "FTP control-channel command support", "i": "micro-behaviors/communications/ftp/control::ftp-protocol-support", "o": 43321, "z": 10, "cf": 0.8500000238418579 } ], "ln": 43257 }, { "b": "asg\u0026uBQXVTc1wlhc1wlic1u{Nr6:E-njt*j08=l+qufiQq#/V?pF.Gc08M-+4gi7YB1X?X07fdOpZ):ilSVU#b}ZV*4gi8lnM[L9b}ZV*4gi8fl@V(6b}ZV*4gi7?f!$Kwh8WxMirguVg?m)^ggRW+ggRW+ggRW+ggRW+ggQw-r8lx(k#pxD08ui^q#/*cB97\u0026hBrCBeA+/lbaAz4jy\u003cu1Fz/6u1zE:(dyHIF*l${WMv@#TfC{4fIvruTk", "n": [ { "c": 1, "d": "FTP listing/navigation command token", "i": "micro-behaviors/communications/ftp/control::ftp-cmd-listing", "o": 43754, "z": 8, "cf": 0.699999988079071 } ], "ln": 43690 }, { "b": "q=uv%petj$mn=YDsZK#]mn:a:q+Orzz/fVdCYU6rA+eW3x(v(iw)]y\u0026wN(bFlUgpWx\u003ez6?vru66B9g@bwN/*yash7o07gsrBzku3v{%E\u003cazC[rB.bOOash7o08t%ZqBpC807Y)Wmf1SPfd}cNBAg\u003c\u003ewmYvYB.(d1zdc{/x(mFZase-@gbA$]0bMN^x(i]\u0026vrlHlz/Pv*vpJ!=B-8p3petj[qCQy$0b=ZZAb](wC(QxNB95Kxz/^alz/]@d090#EzGxJ6zGE1wwPI^aC4CXpw)]y\u0026B-I3[ph.m-wmPZ(B8@EAwN/U0wb]Q", "n": [ { "c": 3, "d": ".netrc credentials file", "i": "micro-behaviors/fs/path/sensitive/credentials::netrc", "o": 67956, "z": 7, "cf": 0.949999988079071 }, { "c": 3, "d": "Discovers user information via environment variables", "i": "objectives/discovery/account/env::user-info-multiple", "o": 67949, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "X.509 certificate handling (legitimate)", "i": "micro-behaviors/crypto/certificate/usage::certificate-handling", "o": 67892, "z": 11, "cf": 0.800000011920929 } ], "ln": 67844 }, { "b": "ASx3poKydUp!j2MuUr}(uV6p?wDkUcoKzBzBtmcwwO2)?v}xX5x\u003ez6?vru5Xst.=)uUr}(uVQv0ygQ)%uV6p?wDk*\u0026fGAGnk$%^Pz/fc5x(mFZst.=)uUr}(uUKO5B.bP2zEEx[08(/\u0026uQE^{uVP!2uU0.WvrDyduV{13x\u003ezS$Aa9\u003c4A@YcqoKyd^sylbXByfi5A+Pch0a{B}x()[^mn^2\u003cAb]VgByeQ1A=k#tuUjlSw=", "n": [ { "c": 2, "d": "X509_ function prefix", "i": "micro-behaviors/crypto/certificate/usage::x509-prefix", "o": 74355, "z": 5, "cf": 0.699999988079071 } ], "ln": 74307 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 100912.0, "entropy": 4.45, "size_bytes": 100912.0 }, "binary": { "overall_entropy": 4.45, "peak_region_bytes": 8192.0, "peak_region_entropy": 5.99 } } }, "id": 2, "mol": "H₂(Cm₂F)", "path": "libfetch-2.40nb5.tgz!!lib/libfetch.a", "pid": 0, "risk": 3, "sha": "06d13ab53d9085372aab952d2c3e2304c120255b6283c8ed13a4868f68efcf07", "size": 100912, "traits": [ { "id": "micro-behaviors/communications/http/request/proxy::proxy-connect-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.800000011920929, "crit": 3, "desc": "HTTP CONNECT proxy tunnel method", "spans": [ [ 16696, 22 ] ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-cmd-auth", "atk": "T1071.002", "mbc": "C0004", "conf": 0.699999988079071, "crit": 1, "desc": "FTP authentication command token", "spans": [ [ 43321, 10 ], [ 43351, 7 ], [ 43361, 7 ], [ 43371, 13 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-prefix", "conf": 0.699999988079071, "crit": 2, "desc": "X509_ function prefix", "spans": [ [ 74355, 5 ], [ 74377, 5 ], [ 74395, 5 ] ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-cmd-listing", "atk": "T1071.002", "mbc": "C0004", "conf": 0.699999988079071, "crit": 1, "desc": "FTP listing/navigation command token", "spans": [ [ 43754, 8 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::netrc", "atk": "T1552.001", "conf": 0.949999988079071, "crit": 3, "desc": ".netrc credentials file", "spans": [ [ 67956, 7 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "References certificate terminology", "spans": [ [ 67892, 11 ] ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-protocol-support", "atk": "T1071.002", "mbc": "C0004", "conf": 0.8500000238418579, "crit": 3, "desc": "FTP control-channel command support", "spans": [ [ 43321, 10 ], [ 43351, 7 ], [ 43361, 7 ], [ 43371, 13 ], [ 43754, 8 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::package-or-netrc-credential-file", "atk": "T1552.001", "conf": 0.8999999761581421, "crit": 3, "desc": "Package client credential file reference", "spans": [ [ 67956, 7 ] ] } ], "type": "static-lib" } ], "rev": "c795d", "v": "8" } }