{
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00008370479,
        "rte": "az",
        "prob": 0.00008370479
      },
      {
        "cls": 0,
        "raw": 0.00019320846,
        "rte": "az/tar",
        "prob": 0.00019320846
      }
    ],
    "prob": 0.00008370479,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00008370479190489277,
        "type": "apk_alpine"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000019252300262451172,
        "type": "shell"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000010401010513305664,
        "type": "text"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-26T09:48:33Z"
  },
  "path": "freeradius-openrc-3.0.27-r3.apk",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X",
            "n": [
              {
                "c": 2,
                "d": "Archive parser reported errors",
                "i": "metadata/file/metrics::archive-parse-error",
                "o": 0,
                "z": 24,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O(P)H(Po)",
        "sha": "9a42dbc077be60e5eacce4dd83b871b1d04536b91e2f5b02719ade6eb724fa71",
        "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/freeradius-openrc/freeradius-openrc-3.0.27-r3.apk",
        "risk": 2,
        "size": 2329,
        "type": "apk_alpine",
        "facts": {
          "metrics": {
            "file": {
              "size": 2329.0,
              "entropy": 7.9,
              "size_bytes": 2329.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 7.9,
              "peak_region_bytes": 2048.0,
              "peak_region_entropy": 7.79
            }
          }
        },
        "traits": [
          {
            "id": "objectives/persistence/system/init/boot::openrc-init-script-header",
            "atk": "T1037.004",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "OpenRC init script header",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Shell command name from variable",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell command execution capability",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package info file"
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-version-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package version field",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-package-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package name field",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "from": [
              {
                "off": 0,
                "file": 1,
                "line": 1
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package origin field",
            "from": [
              {
                "file": 2
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boXZYvRGZkz/xo9A:{XwB-4J[zEEx[jT9vowO1+9l}HxSa{}\u003c(B7ol8Acb/jzEl)!wN/H=z/ff3xfvCaxK$W?ay/tcw[+[2A::67z/c:awmY*(A+PGmx(v(@A+f69vpRIBqE%V.vpQG\u003cz/ff3xlwl6BzkVha{[V*CYW$muT[1\u003ezddr)B3gZSxK$W?v@Dl%x\u003eFQ%wQ5rqvpa7$vrcE3wm5?+zeAZ0wof)TA+f69vpQL?3oxpPDT*V2w[=6)iZ1VuwPRAnA:-G?vLq+gwncgcwg?wgzE$8v3s^WXzEEx[jT8d#v}Gv=x(4u9bpUu{a{[V!z/6u1zE+)OflItRflpPpzzc3swncgcwfIv9aw$G[nMwXSuR:G$qY]^}azbLjayX+?yJ\u003cicwftx2ze-{9x\u003c$^)x([Ryz/fxp3s!0\u003ezddr)uTW$/B3gZ0w/@Woas8qzw[LZ\u0026y?j[CdT-A\u003ezxHiKv}Gv\u003evqPN4e[n*qw{\u003e^EDT*#hzddr)uTW$/B2\u003e(#qB9Yxrz#p)pF+1?EiG2dz/6u1zE^9-vpK7=A=l8rwizbZwPG45Aa@\u0026{x(4uza$)$Vzz9nklTJ+)lRY{wmj@K[wfIu/A+flkx(W=}uUj1*wPH0UbX7C0w[=6)a{[V/wPhi#wge(HDKp6%wO2x{zE)[%31mB/wPw]9x(W^evqG-!33yr2ay]wh3vJl*B97\u0026hByf0cwHF#IDKp67axR-FiV}1naARphB0bKCx(4PdzE)x\u0026wN[1j31ETWv@33(Bz8^GwfrEvatt-ih6sF?aAy[3x)1FTA:-G)B-OVUA=(mMA:-G)B-R7231ETWv@2N)zF0P}3vJl*v}YB-yH.p2w[+)adiJ%A31WNSxk8lab133Pv@2^@xcnEqvqPM#v@Dl%x\u003eINevruj4zxYz]bX7+fzddr)as7DnzeAZ0wm5+=xlbgElM*=7as7DnzeAZ0wfrdcz/6u1zE^9.A+xCoeKK+9eO]GIwn=Qj3jgoPzE:\u003enkmh/C3uxY]z^^f0c[co=3jgoMwOkZ{ar\u003cY{y\u0026r-)x(mMabYm4cwG?D*329#]toCanB9hCkA=#erz/N3At@%fJxK#5*2)?\u003e#B-p]jC4(2oAV=LKqBs!\u0026rZPRFo*{lGeIh3TxkRc]av]He3jgoWB7CW+33gh%A=-)OBz(aIwmo4^z/cWHePUSszEEu7nl5FeeIg{Qwm/K(wGSfxAa@\u0026{x(4u83jgrU3jgoPzE:\u003enkmh/C",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "need"
            ],
            [
              "",
              "after"
            ],
            [
              "",
              "use"
            ],
            [
              "",
              "checkpath"
            ],
            [
              "",
              "checkconfig"
            ],
            [
              "",
              "ebegin"
            ],
            [
              "",
              "$command"
            ],
            [
              "",
              "$command"
            ],
            [
              "",
              "eend"
            ],
            [
              "",
              "ebegin"
            ],
            [
              "",
              "$supervisor"
            ],
            [
              "",
              "start-stop-daemon"
            ],
            [
              "",
              "eend"
            ]
          ],
          "tgt": [
            "$command",
            "$supervisor",
            ":",
            "after",
            "checkconfig",
            "checkpath",
            "ebegin",
            "eend",
            "need",
            "start-stop-daemon",
            "use"
          ],
          "funcs": [
            [
              "depend",
              503
            ],
            [
              "start_pre",
              552
            ],
            [
              "checkconfig",
              664
            ],
            [
              "reload",
              797
            ]
          ],
          "metrics": {
            "ast": {
              "op.mod": 2,
              "max_depth": 8,
              "call_count": 14,
              "node_count": 272,
              "op_density.mod": 0.01
            },
            "file": {
              "size": 980,
              "entropy": 5.22
            },
            "text": {
              "lines": 48,
              "top_char": 101,
              "tab_count": 18,
              "digit_ratio": 0.01,
              "space_count": 58,
              "char_entropy": 5.22,
              "unique_chars": 68,
              "top_char_null": 0,
              "string_density": 0.35,
              "top_char_ratio": 0.06,
              "avg_line_length": 19.42,
              "max_line_length": 85,
              "empty_line_ratio": 0.21,
              "last_line_length": 1,
              "whitespace_ratio": 0.13,
              "identifier_density": 1.54,
              "line_length_stddev": 19.73,
              "max_whitespace_run": 1,
              "normalized_string_count": 2.45,
              "suspicious_comment_ratio": 0.33,
              "normalized_function_count": 0.58,
              "strings_to_functions_ratio": 4.25,
              "normalized_unique_identifiers": 7.7,
              "identifiers_to_functions_ratio": 10.75
            },
            "binds": {
              "count": 11
            },
            "calls": {
              "dynamic_target_count": 3
            },
            "binary": {
              "peak_region_bytes": 980,
              "peak_region_entropy": 5.22
            },
            "source": {
              "function_count": 4
            },
            "strings": {
              "bytes": 294,
              "count": 17,
              "avg_length": 17.29,
              "max_length": 70,
              "path_count": 3,
              "avg_entropy": 3.32,
              "entropy_stddev": 0.7
            },
            "comments": {
              "chars": 92,
              "count": 3,
              "lines": 3,
              "xxx_count": 1,
              "high_entropy": 1,
              "to_code_ratio": 0.07
            },
            "functions": {
              "count": 4,
              "density": 8.33,
              "code_ratio": 0.52,
              "length_stddev": 2.17,
              "avg_name_length": 8,
              "no_params_count": 4,
              "avg_length_lines": 6.25,
              "max_length_lines": 10,
              "min_length_lines": 5
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.script_as_unknown": 1
            },
            "identifiers": {
              "count": 74,
              "unique": 43,
              "avg_length": 8.44,
              "max_length": 23,
              "min_length": 1,
              "avg_entropy": 2.42,
              "reuse_ratio": 0.58,
              "length_stddev": 5.41,
              "single_char_count": 1,
              "single_char_ratio": 0.02,
              "high_entropy_count": 4,
              "high_entropy_ratio": 0.09,
              "all_lowercase_ratio": 0.6,
              "all_uppercase_ratio": 0.07
            }
          }
        },
        "id": 1,
        "mol": "O(P)H(Po₂)Md",
        "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/freeradius-openrc/freeradius-openrc-3.0.27-r3.apk!!etc/init.d/radiusd",
        "pid": 0,
        "risk": 3,
        "sha": "0ee124a55db8da9eff1ded0cac6175a6393216fb0458a2d9ca39e601cec11f8f",
        "size": 980,
        "traits": [
          {
            "id": "metadata/file/extension/mismatch::script-content-unregistered-extension",
            "conf": 0.9,
            "crit": 3,
            "desc": "Script content under an unregistered suffix"
          },
          {
            "id": "micro-behaviors/process/create/local-exec::shell-variable-exec-with-args",
            "atk": "T1059.004",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell runs a variable command with args",
            "spans": [
              [
                719,
                24
              ],
              [
                864,
                28
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.95,
            "crit": 3,
            "desc": "Shell command variable at a command boundary",
            "spans": [
              [
                720,
                8
              ],
              [
                866,
                11
              ]
            ]
          },
          {
            "id": "objectives/persistence/system/init/boot::openrc-init-script-header",
            "atk": "T1037.004",
            "conf": 0.85,
            "crit": 3,
            "desc": "OpenRC init script header",
            "spans": [
              [
                0,
                18
              ]
            ]
          },
          {
            "id": "metadata/build/archive::github-versioned-source-archive-member",
            "conf": 0.95,
            "crit": 2,
            "desc": "GitHub versioned source archive member"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                301,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                577,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::control-route-path",
            "conf": 0.92,
            "crit": 1,
            "desc": "HTTP route uses control or execution",
            "spans": [
              [
                453,
                0
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "ctx": [
          {
            "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM",
            "n": [
              {
                "c": 1,
                "d": "Alpine/Wolfi package info file",
                "i": "metadata/package/files/system-package::alpine-pkginfo-basename",
                "o": 0,
                "z": 1,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026",
            "ln": 2,
            "addr": 36
          },
          {
            "b": "Abf97vqPM#jS[uSwO2)\u003cwncgcePkPtzGoj",
            "n": [
              {
                "c": 2,
                "d": "Alpine/Wolfi package info metadata",
                "i": "metadata/package/files/system-package::alpine-apk-pkginfo",
                "o": 68,
                "z": 27,
                "cf": 0.9700000286102295
              }
            ],
            "ln": 3,
            "addr": 68
          },
          {
            "b": "Abf9fwPw[RatUS7e\u00262vqAX^",
            "n": [
              {
                "c": 1,
                "d": "Alpine/Wolfi package version field",
                "i": "metadata/package/files/system-package::alpine-pkginfo-version-field",
                "o": 96,
                "z": 18,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 4,
            "addr": 96
          },
          {
            "b": "Abf8%wPIu7jS)S*l}HxSasHc0zeTJcavgc(xK#76x\u003e7N[x(v(il${7CeLf?5rDz.(ax8\u0026(C4\u003eC$diJXyA=#2masH38wO$ykazC.cBrCTmA+PGmB14",
            "ln": 5,
            "addr": 115
          },
          {
            "b": "B-IpvjS[AWBz#pZfe3{TwO2)\u003cwncgce]L=yf8",
            "ln": 6,
            "addr": 206
          },
          {
            "b": "B7]@iauZ\u00264gbHV",
            "ln": 9,
            "addr": 317
          },
          {
            "b": "vrb\u003c\u003eauZ\u0026+z^^V@xA",
            "ln": 10,
            "addr": 329
          },
          {
            "b": "z/PM8x(k4RazbU9wPzi\u0026x)1E",
            "n": [
              {
                "c": 1,
                "d": "Alpine/Wolfi package origin field",
                "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field",
                "o": 343,
                "z": 19,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 11,
            "addr": 343
          },
          {
            "b": "v@Dj3x(\u003eEXau0Z\u0026vLxJFfK!N4v(N%NfK#\u003eEwh=g%vRduaiBKZ1fFLv)ggJj3w=",
            "ln": 12,
            "addr": 363
          },
          {
            "b": "zddc@Byw)3wPw[Rawuu+zEEM@zY?t^wO${0jAtsFy\u0026T5KvqG)%zE)S#zGQgRz/PFO",
            "ln": 13,
            "addr": 413
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 636.0,
              "entropy": 5.16,
              "size_bytes": 636.0
            },
            "binary": {
              "overall_entropy": 5.16,
              "peak_region_bytes": 636.0,
              "peak_region_entropy": 5.16
            }
          }
        },
        "id": 2,
        "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/freeradius-openrc/freeradius-openrc-3.0.27-r3.apk!!.PKGINFO",
        "risk": 1,
        "sha": "5a89700dc2c3b13a3598fa4fb05d730aad42c803d5c6c9383c28ba614484442f",
        "size": 636,
        "traits": [
          {
            "id": "metadata/package/files/system-package::arch-pkgver-field",
            "conf": 0.9399999976158142,
            "crit": 1,
            "desc": "Arch pkgver metadata field",
            "spans": [
              [
                96,
                18
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package origin field",
            "spans": [
              [
                343,
                19
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-version-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package version field",
            "spans": [
              [
                96,
                18
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-package-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package name field",
            "spans": [
              [
                68,
                27
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package info file"
          },
          {
            "id": "metadata/package/files/system-package::arch-pkgname-field",
            "conf": 0.9399999976158142,
            "crit": 1,
            "desc": "Arch pkgname metadata field",
            "spans": [
              [
                68,
                27
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-apk-pkginfo",
            "conf": 0.9700000286102295,
            "crit": 2,
            "desc": "Alpine/Wolfi package info metadata",
            "spans": [
              [
                68,
                27
              ],
              [
                96,
                18
              ],
              [
                343,
                19
              ]
            ]
          }
        ],
        "type": "text"
      }
    ],
    "rev": "af11a",
    "v": "8"
  }
}