{ "llm": { "conf": 0.49997342, "grade": "suspicious", "model": "Qwen/Qwen3.6-27B", "review": true, "outcome": "suspicious", "interpretation": "Archive contains escaping symlink" }, "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": 250, "conf": 80, "mods": [ { "cls": 2, "raw": 0.99994683, "rte": "az", "prob": 0.99994683 } ], "prob": 0.49997342, "files": [ { "id": 0, "lvl": 250, "conf": 80, "prob": 0.4999734163284302, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0034699440002441406, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "json" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.3266848921775818, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-07-02T21:54:35Z" }, "path": "rabbitmq-cluster-operator-iamguarded-compat-2.20.0-r3.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8010L00rqzlDWBH9^R]e[j{x8zyDA08I)7J]*4uXf(Ed99Vc$\u003c.O]d)#6BvvjduTZ6", "n": [ { "c": 4, "d": "Archive contains symlink that may escape extraction directory", "i": "anti-analysis/archive/symlink-escape", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "O(Er)", "sha": "99b3b72e1e6466155a9102ebbf403bb0b39180bfd3aa26ab5f208a2c2ec3ae91", "path": "rabbitmq-cluster-operator-iamguarded-compat-2.20.0-r3.apk", "risk": 38, "size": 14225, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 14225.0, "entropy": 7.98, "size_bytes": 14225.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 14225.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "anti-analysis/archive/symlink-escape", "conf": 0.8999999761581421, "crit": 4, "desc": "Archive contains symlink that may escape extraction directory" }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "from": [ { "off": 123, "file": 4, "line": 6 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" } ] }, { "ctx": [ { "b": "boXZHx(kOBxBk$blVl{?A+Pf1BrA[\u003cz^^f^z/43FnP52\u003cavf*Waw#]^xMOqrqE%]XA=#28e^-*Cq=2\u003e:eLG\u003e*wO#N2eLfF:zGGP8x\u003eqrCave*\u0026lR6S$ga\u003el/B7GCoeP?ycx\u003ewF(as5fOeOe]AfD:T.aARpdzvdHearS\u0026{g9ydrxM21qph.m-A+xJiwO#QhaAhvtC4\u003eF#wfIv6arR!rCXImxf:.Jb3jp\u0026:A+PGmjTq-?wQ4{huT[1+wJ.j.DONSliw#pf3t9ZXy*Q)*uV6!7uVp3%B7GlhjT8d#gDEa9EiG19x\u003ewGfwPI@oeOlaHbY^Eox(Ferj0nSUwO}?$aAIisbY^Eox(Fe33lQE9w/$q2bTiz6zE\u003c}Aayd5KBzbl63lQDlaz2!iBrz?Sc$NTqByeJ@wmWhs3lQE6x:OA/x\u003ewF(ar\u00267yvqfK+x\u003eyZ\u0026z//u9A+fr6zGE6BjS\u003e}]a%peMaARpdzvdHej%\u00263cwN/y(ar\u003e(pA+PGmaz#atazbLmzE+^", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "set" ], [ "", "echo" ], [ "", "exit" ], [ "", "test" ], [ "", "sh" ], [ "", "exit" ], [ "", "echo" ], [ "", "exit" ] ], "tgt": [ "echo", "exit", "set", "sh", "test" ], "metrics": { "ast": { "op.eq": 1, "op.ne": 1, "max_depth": 7, "call_count": 8, "node_count": 144, "op_density.eq": 0.01, "op_density.ne": 0.01 }, "file": { "size": 431, "entropy": 5.03 }, "text": { "lines": 24, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.06, "space_count": 66, "char_entropy": 5.03, "unique_chars": 65, "top_char_null": 0, "string_density": 0.29, "top_char_ratio": 0.07, "avg_line_length": 16.96, "max_line_length": 47, "empty_line_ratio": 0.17, "last_line_length": 2, "whitespace_ratio": 0.21, "identifier_density": 1.29, "line_length_stddev": 14.79, "normalized_string_count": 1.43, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 3.27 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 431, "peak_region_entropy": 5.03 }, "strings": { "bytes": 89, "count": 7, "avg_length": 12.71, "max_length": 25, "avg_entropy": 2.83, "entropy_stddev": 1.23 }, "comments": { "chars": 104, "count": 4, "lines": 4, "to_code_ratio": 0.2 }, "identifiers": { "count": 31, "unique": 15, "avg_length": 4.07, "max_length": 19, "min_length": 1, "avg_entropy": 1.34, "reuse_ratio": 0.48, "length_stddev": 4.52, "has_digit_ratio": 0.27, "sequential_names": 1, "single_char_count": 4, "single_char_ratio": 0.27, "all_lowercase_ratio": 0.6 } } }, "id": 1, "mol": "H(Po)Md(Pa)", "path": "rabbitmq-cluster-operator-iamguarded-compat-2.20.0-r3.apk!!usr/bin/run-script", "pid": 0, "risk": 2, "sha": "67ec2a8bcc81b799eaa65f8268167921cc69847eb09274dac79e7867acb4a322", "size": 431, "traits": [ { "id": "metadata/file/string/identity::cli-posix-shell-common-token", "conf": 0.7, "crit": 1, "desc": "CLI argument names a common POSIX shell", "spans": [ [ 268, 0 ] ] }, { "id": "metadata/package/license::spdx-identifier", "conf": 0.9, "crit": 3, "desc": "SPDX license identifier", "spans": [ [ 60, 23 ] ] }, { "id": "metadata/package/license::spdx-license-identifier", "conf": 0.9, "crit": 3, "desc": "Source SPDX license identifier declaration", "spans": [ [ 60, 35 ] ] }, { "id": "micro-behaviors/process/create/shell/interpreter::shell-variable-file-exec", "conf": 0.9, "crit": 3, "desc": "Shell runs variable command file", "spans": [ [ 269, 10 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "SPDX SBOM document", "i": "metadata/package/files/system-package::spdx-sbom-document", "o": 0, "z": 1, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003eHAaBh]wPz\u003caz/c:War\u003c-Xl%82@e\u0026aX5", "ln": 2, "addr": 2 }, { "b": "arR\u003esvrt{Kx\u003e7Z(B7DKRar\u003cfufFb1ifD@4", "ln": 3, "addr": 31 }, { "b": "arR^Hb5y$6wO#N2oLFM\u0026r+lq)x(v(kiV]R5e\u00262gaec", "ln": 8, "addr": 286 }, { "b": "arR^Hb4CU8vruBdB0rT/tl", "ln": 9, "addr": 320 }, { "b": "arR^HarR\u003ecz/oCMaz\u003eXavqYZ?asIy!e\u0026kKuf!1p$", "n": [ { "c": 2, "d": "Melange-generated SPDX SBOM", "i": "metadata/package/files/system-package::melange-spdx-sbom", "o": 344, "z": 14, "cf": 0.9800000190734863 } ], "ln": 10, "addr": 338 }, { "b": "arR^HarR\u003e7A+w/#x)Kifx(v(Iavx*Jx(mNavrb)faw3DXa]", "ln": 11, "addr": 371 }, { "b": "arR^Ht}t", "ln": 12, "addr": 409 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?lT+7Fxk.*ob03?\u003cp^EDwk$su}o*IJum[3r1ec", "ln": 41, "addr": 1379 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?rc-B]b03?\u003cAclhqa$J", "ln": 42, "addr": 1429 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31flgGgvRG}3Av\u003eWpB-RUoAXhiGwPzj3z/NBzvqPU1vrb)\u0026wg.qfze-{9kR:@EfFk4hAX/{*A:@=CCSmP*hz!VYfFCmuwncabA=j9+z!%31a]", "n": [ { "c": 2, "d": "Wolfi APK SPDX SBOM", "i": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "o": 1464, "z": 114, "cf": 0.9800000190734863 } ], "ln": 43, "addr": 1464 }, { "b": "arR^HarR^HEe", "ln": 44, "addr": 1594 }, { "b": "arR^HarT@v", "ln": 45, "addr": 1604 }, { "b": "arR^HarR\u003esz*c8nz^^fIz!0i$x(v(kiV]RwpEd]Tmn^8RpFJ8+", "ln": 91, "addr": 3495 }, { "b": "arR^HarR\u003eux(4v4l2HaED3T4jb03\u0026UvqH0@ec", "ln": 92, "addr": 3536 }, { "b": "arR^HarR\u003eHz/{8gwL3=KzZ4j+b4j#3B.L(cwft\u00261v@2H=wGUY8w]w/7A=k!qk#ph%l{-{Sfd{6]m[DDBpA?s", "n": [ { "c": 1, "d": "SPDX references APK DB package info", "i": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "o": 3587, "z": 44, "cf": 0.8999999761581421 } ], "ln": 93, "addr": 3566 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7EZSzEWH9wmYo}iV]RwpEd]Tmn^8RpFJ8+", "ln": 94, "addr": 3634 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7E:Jv@bN]wN(#Car\u003cJRoF51LfD@4", "ln": 95, "addr": 3675 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31flgGgvRG}3Av\u003eWpB-RUoAXhiGwPzj3z/NBzvqPU1vrb)\u0026wg.qfze-{9kR:@EfFk4hAX/{*A:@=CCSmP*hz!VYfFCmuz/PM8x(l7OvpAXWBzV1Hv@cpeBy/FAz/xodvruBda]", "n": [ { "c": 1, "d": "Wolfi APK package URL in SPDX", "i": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "o": 8288, "z": 128, "cf": 0.8999999761581421 } ], "ln": 192, "addr": 8288 }, { "b": "arR^HarR^HEe", "ln": 193, "addr": 8438 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 10210.0, "entropy": 4.99, "size_bytes": 10210.0 }, "json": { "parsed_bytes": 10210.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 6114.0, "peak_region_entropy": 5.15 } } }, "id": 2, "path": "rabbitmq-cluster-operator-iamguarded-compat-2.20.0-r3.apk!!var/lib/db/sbom/rabbitmq-cluster-operator-iamguarded-compat-2.20.0-r3.spdx.json", "risk": 1, "sha": "d1dddc442188170d911a4769c49c11286e9c6b43282199f05b2d6be99a224eb4", "size": 10210, "traits": [ { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "spans": [ [ 3587, 44 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "spans": [ [ 344, 14 ] ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "spans": [ [ 1464, 114 ], [ 1495, 14 ], [ 8288, 128 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 63 ] ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document" }, { "id": "metadata/package/files/system-package::melange-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated SPDX SBOM", "spans": [ [ 344, 14 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK SPDX SBOM", "spans": [ [ 1464, 114 ], [ 1495, 14 ], [ 3587, 44 ], [ 8288, 128 ] ] } ], "type": "json" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 209, "entropy": 4.53 }, "binary": { "peak_region_bytes": 209, "peak_region_entropy": 4.53 } } }, "id": 3, "path": "rabbitmq-cluster-operator-iamguarded-compat-2.20.0-r3.apk!!opt/iamguarded/LICENSE-Chainguard", "pid": 0, "risk": 1, "sha": "808f8b32903913af6465f57c751499bc207fe8346d77bfb2cafcf174b49291be", "size": 209, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "spans": [ [ 59, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/encoded::long-base64-like-path-segment", "conf": 0.9, "crit": 1, "desc": "URL path has long base64-like segment", "spans": [ [ 181, 0 ] ] } ], "type": "text" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf8kwO+^)xjR", "n": [ { "c": 2, "d": "Melange-generated APK package info", "i": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "o": 0, "z": 22, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPM#jS[=NvQ:4[ze?dqy\u0026%/vwPxwvAaK5#Bz(gKx\u003c\u003e\u003c\u003eBZYr3wN)x5z/6D4Bn", "n": [ { "c": 2, "d": "Wolfi APK package info metadata", "i": "metadata/package/files/system-package::wolfi-apk-pkginfo", "o": 23, "z": 53, "cf": 0.9800000190734863 } ], "ln": 2, "addr": 23 }, { "b": "Abf9fwPw[RatLM8fFk4hAX^", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 77, "z": 18, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 77 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 4, "addr": 96 }, { "b": "B7]@iauZ\u00269f!+EA", "ln": 5, "addr": 110 }, { "b": "z/PM8x(k4RaAy[1vRG}3Av\u003eWpB-RUoAXhiGwPzj3z/L", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 123, "z": 34, "cf": 0.8999999761581421 } ], "ln": 6, "addr": 123 }, { "b": "Abf8%wPIu7jS[lMze-{9aAg+0yHH\u003c!azbLjazCn3xlvT6wmYo", "ln": 7, "addr": 158 }, { "b": "B-IpvjS\u003c", "ln": 8, "addr": 198 }, { "b": "v@Dj3x(\u003eEXatWQ*w?(q8fFLEvwO0ONwNWFPvQRnJwhM51vpJ[dv}vwMhz[]4fA", "ln": 9, "addr": 205 }, { "b": "zddc@Byw)3wPw[RaA}:uw[.", "n": [ { "c": 1, "d": "Wolfi package maintainer field", "i": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "o": 255, "z": 18, "cf": 0.8999999761581421 } ], "ln": 10, "addr": 255 }, { "b": "vS=y3wmPa\u003cwGTbUf/I3GgbH%BhzC", "ln": 11, "addr": 274 }, { "b": "y?Wx\u003czGxwijS)D}oF51LfA", "ln": 12, "addr": 297 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 453.0, "entropy": 5.06, "size_bytes": 453.0 }, "binary": { "overall_entropy": 5.06, "peak_region_bytes": 453.0, "peak_region_entropy": 5.06 } } }, "id": 4, "path": "rabbitmq-cluster-operator-iamguarded-compat-2.20.0-r3.apk!!.PKGINFO", "risk": 1, "sha": "2d365db422eb179fc7378a30b13d1945546a5a913d35775672b927ac1a9cdbb1", "size": 453, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 77, 18 ] ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "spans": [ [ 255, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 23, 53 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 23, 53 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 123, 34 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 23, 53 ], [ 77, 18 ], [ 123, 34 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK package info metadata", "spans": [ [ 23, 53 ], [ 77, 18 ], [ 123, 34 ], [ 255, 18 ] ] }, { "id": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated APK package info", "spans": [ [ 0, 22 ], [ 23, 53 ], [ 77, 18 ], [ 123, 34 ] ] } ], "type": "text" } ], "rev": "868bd", "v": "8" } }