{ "llm": { "conf": 0.99950147, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 0, "prob": 0.9992559, "class": "hostile" }, "outcome": "hostile", "interpretation": "Preinstall executes packed ELF binary" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 0, "raw": 0.9971507, "rte": "az", "prob": 0.9971507 }, { "cls": 2, "raw": 0.9992559, "rte": "az/npm", "prob": 0.9992559 } ], "prob": 0.9992559, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.999255895614624, "type": "npm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000014871358871459961, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0001647472381591797, "type": "package.json" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0003385742602404207, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-09-07T03:01:13Z" }, "path": "weavedb-offchain-0.45.4.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000@}S=2vFlC7E5s-9+[2oxEoxI49t)jNoq!@![*I])Q\u0026/Uy^HZ9C4M9\u0026Y9XMMl@s1{0yl-p7mGs]0r\u003e[X.2^7SIgt{sF}wNW)008vdm5k2EG6ovElO^B)981Zxym}S*\u0026H*qOM\u003c)l.a6?{:L{:.Af/4v[gTY(.9sEgYj\u003cqmbyzXjhEar5AN$sn0CI(uGmr]]PyO\u003eSc\u0026wF^PtxTY}p1!9{FR\u003e8Sc0}[:]97ye*\u0026.g?naziTB-ta!2f20O9\u003c\u0026J0Gio+g1n\u0026R7\u00265oQf7(A9c)djmx]5Qqejj6#art0#V\u0026k6?8=7prT04^WUO+?V42GETl{\u003eA0.Y2I8?9k{\u003cI-m?^7n?JE\u0026p*aNZI^8.Nq$6aWW.Krm/", "ln": 0 } ], "mol": "O₂(S₂As)H₂(DbOs)Md₄(Bi₃BkHePa₃)", "sha": "9b0726c66be031b205d94c1cefe11bcab138fb985d9f4f0ed0d557fdfd02553f", "path": "weavedb-offchain-0.45.4.tgz", "risk": 160, "size": 986246, "type": "npm", "facts": { "metrics": { "file": { "size": 986246, "entropy": 8 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 986112, "peak_region_entropy": 7.85 }, "consistency": { "self_dependency": 0, "unused_runtime_deps": 3 } } }, "ident": { "name": { "value": "weavedb-offchain", "source": "npm.name", "verified": false }, "trust": "unsigned", "version": { "value": "0.45.4", "source": "npm.version", "verified": false }, "identifier": { "value": "weavedb-offchain", "source": "npm.name", "verified": false } }, "traits": [ { "id": "metadata/package/manifest/freeform::pkg-skeleton-small", "conf": 0.7, "crit": 3, "desc": "Tiny package.json manifest", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/pack/detect::stripped-packed", "atk": "T1027.002", "mbc": "F0001", "conf": 0.85, "crit": 4, "desc": "Packed ELF binary", "from": [ { "file": 3 } ], "uses": [ 6, 19 ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook" }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::sparse-package-install-hook", "conf": 0.85, "crit": 3, "desc": "Sparse package metadata accompanies install hook", "from": [ { "file": 2 } ], "uses": [ 5 ] }, { "id": "micro-behaviors/os/syscall/raw::x64-mmap-syscall-sectionless", "conf": 0.9, "crit": 3, "desc": "x86-64 mmap syscall in sectionless code", "from": [ { "file": 3 } ] }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 2, "desc": "Package has install hooks", "from": [ { "file": 2 } ], "uses": [ 2 ] }, { "id": "objectives/anti-static/pack/detect::no-section-headers", "atk": "T1027.002", "mbc": "F0001", "conf": 0.8, "crit": 3, "desc": "No section headers", "from": [ { "file": 3 } ], "uses": [ 12 ] }, { "id": "metadata/binary/anomaly/section-header::elf64-zero-section-header-offset", "conf": 0.95, "crit": 1, "desc": "ELF64 section header offset is zero", "from": [ { "file": 3 } ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "package.json defines a package name" }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::script-hidden-file-1", "conf": 0.75, "crit": 3, "desc": "Script hidden file (base)" }, { "id": "metadata/binary/anomaly/format::elf-entry-in-last-segment", "conf": 0.7, "crit": 3, "desc": "ELF entry in final PT_LOAD", "from": [ { "file": 3 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.8, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/anomaly/section-header::elf-no-section-headers", "conf": 0.95, "crit": 3, "desc": "ELF binary without section headers", "from": [ { "file": 3 } ], "uses": [ 7 ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 1 } ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook" }, { "id": "metadata/package/manifest/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point" }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version" }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-70", "conf": 0.85, "crit": 3, "desc": "Binary overall entropy at least 7.0", "from": [ { "file": 3 } ] }, { "id": "metadata/package/quality/empty::npm-no-keywords", "conf": 0.5, "crit": 2, "desc": "package.json has no keywords" }, { "id": "metadata/build/artifact::stripped-toolchain-comment", "conf": 1.0, "crit": 3, "desc": "ELF omits compiler metadata (.comment)" }, { "id": "objectives/supply-chain/install-hook/dropper/native-loader::preinstall-runs-bundled-executable", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "Executes bundled payload from preinstall" }, { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install" }, { "id": "metadata/package/dependencies/manifest::npm-phantom-runtime-dependency", "conf": 0.82, "crit": 3, "desc": "Declared runtime dependency lacks module import", "spans": [ [ 0, 38 ] ] }, { "id": "objectives/supply-chain/install-hook/dropper/native-loader::npm-archive-bundled-machine-code-member", "atk": "T1195.002", "conf": 0.94, "crit": 3, "desc": "npm tarball ships bundled machine-code member", "from": [ { "file": 3 } ], "uses": [ 10, 12 ], "spans": [ [ 0, 41 ] ] }, { "id": "objectives/supply-chain/install-hook/dropper/native-loader::npm-install-hook-runs-bundled-executable", "atk": "T1195.002", "conf": 0.88, "crit": 4, "desc": "Install hook directly executes bundled file", "from": [ { "off": 116, "file": 2, "line": 7 } ], "uses": [ 22 ], "spans": [ [ 0, 41 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::npm-preinstall-sectionless-elf-dropper", "atk": "T1195.002,T1105", "mbc": "B0024,F0011", "conf": 0.97, "crit": 5, "desc": "npm preinstall executes sectionless bundled ELF", "from": [ { "off": 116, "file": 2, "line": 7 }, { "file": 3 } ], "uses": [ 10, 12, 22 ], "spans": [ [ 0, 41 ] ] }, { "id": "objectives/supply-chain/install-hook/dropper/native-loader::npm-install-bundled-native-binary", "atk": "T1195.002", "conf": 0.95, "crit": 5, "desc": "npm install hook executes a bundled native binary", "uses": [ 25, 26 ], "spans": [ [ 0, 41 ] ] } ] }, { "ctx": [ { "b": "v@DmaBrC]MByw)1efFUFphaI}ay/kazE\u003evwzdN:2wLuVEBrC#OjS[=RADL#owHF:yvqPK-a$i\u003eez/fSravoHTwGTbUA+flkx(W=kb6NQbC4Ch[eN\u0026dfwG\u0026Mgy?mYhvrcN6vrMi8jS[=RADL#owHF:hA^886C4z\u003cD3tB8{c)rqCphaI)vrcN6", "ln": 0, "col": 1, "line": 1 }, { "b": "vqH0@ed9HxarU33z/fVqvpKz2auZ?\u003eCv+iawN]m4v@DmbA:-E1B0rdxarV7PjS]91diJ%AarR^HB9hCkAWSvzarR^HBzbxfe)\u0026abzGG]cv@#=mjS[9wz/fVqvpKz23lQDlaA?spB7]MguT^$@auZ\u0026/wPq\u003cbA+cUbbZTSDx(+[lv@DmbA:-E1Ba2Y=wNP:[wmvc1Ac9:Hx\u003c@-swPz\u003caz/e@i", "ln": 420, "col": 14, "line": 16 }, { "b": "c[co=3lQDlazCBgd0f-NwP8f6Bzbxfe[ns1xK@qHjV%]iz^)D)v@@[zayPF5x(\u003eFtxLzJuv{@\u003eXwIdXmx([5$y?Xibd0fcpB14CsaBKO7arU9lD2vamxjVf:CU8A]x(m)jBsXLBvru6faBsCrarR!pz/fSraAITBauZ\u0026tq+{dvB98CpzF9V}C{[1DarR^HarUfjzGG]cv@$W{nN%\u003e8Bzbxfe[n*qBAg/1Bx0GRwgO6garR^HazC.jB-YewarR^HarU=uzdN^gvqP%Aay[]5wH[fharR!PdgdguarUYoBAIRwao", "ln": 1979, "col": 19, "line": 82 }, { "b": "DKp(rarUGiBrCvxB09Q*DWMkzarR!qvru66kr?pNl$7gGe]CPKc[bGCarR!EwPS6nzxKokarR^HarUDyiV@+RarR^HarR^HxjVfCayPtpzET/8wQbyYj{\u0026zParR^HarR^HaP", "ln": 2356, "col": 28, "line": 97 }, { "b": "vrufnA=l8rwgg$%By=NFatCM7fEXKWarR^HarR^HxK$)\u003cxMMoTd\u003etZPx(+[uwOC^\u003cBsW+warR^HaBL^FarR^HarU=DvqZc{v@#B6zAn[!azCvEayPF5x(\u003eFtxLzJuxjVe", "ln": 2794, "col": 21, "line": 113 }, { "b": "q/b@-Bxr3ZC4A9farR^HarR^HarV7Pv{%E?xDOZmdiJ%AarR^HarR^HarR^Hv@Dmaz!@#qy\u0026r@mwHN%earR^HarR^HaBKOtarR^HarR!Ped9HxarR^HEjLZFarR!P3lQEt3jm)#vrlZiv\u003c2/6vpQ^2zG6-uefFFiBy=)zDKp(rarUfjzGx[xB9w-\u0026ayPF5x(\u003eD", "ln": 3172, "col": 55, "line": 121 }, { "b": "B97\u0026jwH[%zB.bPcwPGyBwmoN\u003ediJ%AarR^Hy?mYhA+frmy\u0026\u003c.vjS)%m3lQDlazbLjasH-rzGx[xB%7ZnaAqKnA+P9aaBFLVtu@W2DKp(rarR^Hy?mYhA+fqmjS]7]B9g#5wPI]Nazb4#B7D)BwPz/Laz#sry+cYHwPJ0gBugKZB.\u003e\u003epEf}8tarR^Hv@DmaBrCpnAclmBjS]7]w{503BzkVhiV@PIfKljLADL\u0026kC@^6\u0026vqfKaB$1LZ3lP", "ln": 3503, "col": 17, "line": 136 }, { "b": "wPz\u003caz/d9GB9x5uarR^HarU=DC{4CvarR^HarR^HA+fqAA+frmy\u0026*^.asHVxvqf*axKL^?y?k28y\u0026si5d06GsBy=)LaBtkBzG6-uaBL^-B9x5Ze]\u003eJAB.(dbarR^HarR^HA+b", "ln": 3801, "col": 55, "line": 142 }, { "b": "z/fiax(mMjaBsCrarR^HazCBgd0fcpB1RDPwP.Mpy?mG%Bz8^Xattk!DKp(rarR^HarU=tx(+[BzF9)4zF77PaARTDwEoL5arR^HarUfjzGx[xAuEy!Bzbxfe]=2BB.9gDxLz72c[bGCarR^HarR!nCvticaApQtt{%c9vqf*aBzbxfe)\u0026*yx()]Nz/fVqvpKyce?O+@tqozjdgdguarR^HarU=tx(+[BzF9)4zF77Pazb4#B7CX3arR^HarR!vw/@HzxLzJuADL\u0026nwId!gzFa68au/", "ln": 4056, "col": 15, "line": 154 }, { "b": "arV7tarU9lD2vamCxdztwHGe-e]UltvqQ6maBsCrarR!EwPS6nzxJwivqf*azE[2mp\u0026ZF\u003ex(^\u0026lA+fqmjW70n3lQDlarR!GxLzJuADL\u0026nwId}AB7=$aA+fqyaAg+fvqQ6\u003edgdguarR^HBzbxfe]ClBBsnNBarR^HEjkHCaBKOtayPtpzET!@CxdztwKyxNBAg/1", "ln": 4312, "col": 1, "line": 163 }, { "b": "vr\u0026$Uazb4#B7D)farR^Hz/d%-C#]32By^0garR^HwmoN\u003eed9HxarUf5y\u00260W6ed9HxdiJ%AarR^Hx\u003ewFon(FIXe]#bPx(mM$w{C!zvrb^[dk2BFzFa68au*]5h83ZrdiJ%AarR^HarUYoBAIRwaBsCrarR^HarR!Az/f5@iV@xIA:-/qzF%A5wH[fharR^HarR!Fx\u003eIr{AYLsZvrb^[e[nsay?mSr3lQDlarR^Hay!?\u0026xK%jEw)]H%wH[fharR^HarQ", "ln": 4525, "col": 8, "line": 175 }, { "b": "auZ\u0026OADL\u0026kC)UVparR^HEf}8tarR^HA+funA=91uwPFh3arR!P3lQEt3vJl*zeS%cy?kkgCYmOwBAnM/awVPYlUG[xzvc", "ln": 6920, "col": 25, "line": 256 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "Base" ], [ "", "require" ], [ "", "arweave" ], [ "", "require" ], [ "", "isNil" ], [ "", "arweave" ], [ "", "contracts" ], [ "", "handle_bpt" ], [ "", "version" ], [ "", "version_bpt" ], [ "", "version_bpt" ], [ "", "require" ], [ "", "require" ], [ "", "arweave.init" ], [ "", "mergeLeft" ], [ "", "clone" ], [ "", "str" ], [ "", "JSON.stringify" ], [ "", "arweave.utils.bufferTob64Url" ], [ "", "arweave.crypto.hash" ], [ "", "arweave.utils.stringToBuffer" ], [ "", "kvs" ], [ "", "Date.now" ], [ "", "isNil" ], [ "", "clone" ], [ "", "kvs.key" ], [ "", "Math.round" ], [ "", "require" ], [ "", "handle" ], [ "", "console.log" ], [ "", "sw" ], [ "", "handle" ], [ "", "handle" ], [ "", "clone" ], [ "", "results" ], [ "", "res" ], [ "", "input" ], [ "", "tail" ], [ "", "sw" ], [ "", "handle" ], [ "", "res.result" ], [ "", "handle" ], [ "", "clone" ], [ "", "res.success" ], [ "", "res.err" ], [ "", "results.push" ], [ "", "JSON.stringify" ], [ "", "error" ], [ "", "tx" ], [ "", "sw" ], [ "", "input" ], [ "", "handle" ], [ "", "tx" ], [ "", "handle" ], [ "", "clone" ], [ "", "console.log" ], [ "", "error" ], [ "", "start" ], [ "", "Date.now" ], [ "", "results" ], [ "", "isNil" ], [ "", "results" ], [ "", "res" ], [ "", "Date.now" ], [ "", "func" ], [ "", "query" ], [ "", "func" ], [ "", "query" ], [ "", "res.relayedFunc" ], [ "", "res.relayedQuery" ], [ "", "module.exports" ], [ "", "arweave" ], [ "", "ramda" ], [ "", "weavedb-base" ] ], "mbr": [ "Date.now", "JSON.stringify", "JSON.stringify().length", "Math.round", "arweave.crypto", "arweave.crypto.hash", "arweave.default", "arweave.init", "arweave.utils", "arweave.utils.bufferTob64Url", "arweave.utils.stringToBuffer", "console.log", "e.message", "module.exports", "onDryWrite.read", "param.caller", "param.function", "param.nonce", "param.query", "res.err", "res.relayedFunc", "res.relayedQuery", "res.result", "res.success", "results.push", "sw.block", "sw.transaction", "sw.transaction.id", "tx.result", "tx.result.attributes", "tx.result.block", "tx.result.doc", "tx.result.docID", "tx.result.events", "tx.result.kvs", "tx.result.messages", "tx.result.path", "tx.result.transaction", "tx.result.transaction.id", "tx.state" ], "tgt": [ "Date.now", "JSON.stringify", "Math.round", "Promise", "arweave.crypto.hash", "arweave.init", "arweave.utils.bufferTob64Url", "arweave.utils.stringToBuffer", "clone", "console.log", "handle", "isNil", "mergeLeft", "require", "results.push", "tail" ], "funcs": [ [ "constructor", 265 ], [ "initialize", 1963 ], [ "getTxId", 2065 ], [ "getSW", 2331 ], [ "key", 2437 ], [ "anonymous", 2654 ], [ "anonymous", 2981 ], [ "read", 3280 ], [ "dryRead", 3489 ], [ "next", 4027 ], [ "write", 4318 ], [ "res", 4372 ], [ "_writeContract", 4449 ] ], "metrics": { "ast": { "op.eq": 10, "op.gt": 3, "op.div": 1, "op.lor": 3, "op.sub": 1, "op.lnot": 4, "max_depth": 20, "call_count": 53, "node_count": 2355, "op.coalesce": 12, "member_count": 40, "max_array_len": 5, "op_density.eq": 0, "op_density.gt": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.sub": 0, "op_density.lnot": 0, "member_depth_max": 4, "op_density.coalesce": 0.01 }, "file": { "size": 6994, "entropy": 4.45 }, "text": { "lines": 263, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 2001, "char_entropy": 4.45, "unique_chars": 77, "top_char_null": 0, "string_density": 0.12, "top_char_ratio": 0.06, "avg_line_length": 25.59, "max_line_length": 79, "empty_line_ratio": 0.03, "last_line_length": 25, "whitespace_ratio": 0.32, "identifier_density": 1.72, "line_length_stddev": 17.53, "normalized_string_count": 1.91, "repeated_char_sequences": 22, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 16.42 }, "binds": { "count": 35 }, "binary": { "peak_region_bytes": 6994, "peak_region_entropy": 4.63 }, "source": { "class_count": 1, "function_count": 9 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 329, "count": 31, "avg_length": 10.61, "max_length": 42, "avg_entropy": 2.62, "entropy_stddev": 0.88 }, "functions": { "count": 10, "nested": 2, "density": 4.94, "anonymous": 4, "avg_params": 1.85, "code_ratio": 1.02, "max_params": 8, "one_liners": 1, "length_stddev": 27.52, "avg_name_length": 7.44, "no_params_count": 4, "avg_length_lines": 20.54, "max_length_lines": 91, "min_length_lines": 1, "avg_nesting_depth": 0.31, "many_params_count": 1, "max_nesting_depth": 1, "avg_param_name_length": 13.38 }, "identifiers": { "count": 452, "unique": 132, "avg_length": 6.44, "max_length": 17, "min_length": 1, "avg_entropy": 2.29, "reuse_ratio": 0.29, "length_stddev": 3.13, "has_digit_ratio": 0.01, "sequential_names": 4, "base64_like_names": 1, "single_char_count": 4, "single_char_ratio": 0.03, "high_entropy_count": 2, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.77, "all_uppercase_ratio": 0.01, "underscore_prefix_count": 4 } } }, "id": 1, "mol": "H(Db)", "path": "weavedb-offchain-0.45.4.tgz!!package/index.js", "pid": 0, "risk": 1, "sha": "750ce65956f326eb164ec10972400a621648c4647fe0cbfc5febbbedc167049f", "size": 6994, "traits": [ { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "spans": [ [ 4589, 14 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb6NQbC4Ch[ePklkv}Yp+zxZRsarR\u003eKwPz\u003caz/c:War\u0026G(g=l)xa$K6zar\u003eVhx(kaQar\u003eJqwmZ0ryi7NI3lQDny?Wx\u003czGxwkiV]RvnMl(+3lQDnB7ol8AccdBiV@+RarR^Hb5?Nlx(n0lvqG:7iV]R0fd{)KBzb/aflpSzx(Ffnfk$@yv}YB-yA:9daBL^FarR\u003eswPhi#wmYT*x\u003equfiV@+RarR^Hb0Z0RByx2{B89BBwOkBYC}BkKvLYh?ar\u003ebEe?![ia$K6zarR^JvrcN6vrMiaiV]RMf!Lgne\u0026j+63lQDlar\u003eVkh6L77b3)2SgCgv9ed9HxarR\u003eGvqPK-b03?\u003cun9#!i4=)eed9HxarR\u003eLwNP:[wmvc1vrl07iV]RMfFkgte\u00261R43lQDlar(2vvrMi)vL88dzGG]cv@#=oiV]RMfFkgte?[KSarV7tEf]", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "^0.45.2", "weavedb-base" ], [ "^1.11.4", "arweave" ], [ "^0.28.0", "ramda" ], [ "^0.45.1", "weavedb-contracts" ], [ "^2.3.0", "md5" ], [ "^2.0.0", "@metamask/legacy-web3" ] ], "metrics": { "file": { "size": 366, "entropy": 4.7 }, "binary": { "peak_region_bytes": 366, "peak_region_entropy": 4.7 } } }, "id": 2, "mol": "O(S₂)Md(Pa₂)", "path": "weavedb-offchain-0.45.4.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "pkg:npm/%40metamask/legacy-web3", "off": 189, "kind": "dependency" }, { "to": "pkg:npm/arweave", "off": 228, "kind": "dependency" }, { "to": "pkg:npm/md5", "off": 254, "kind": "dependency" }, { "to": "pkg:npm/ramda", "off": 275, "kind": "dependency" }, { "to": "pkg:npm/weavedb-base", "off": 299, "kind": "dependency" }, { "to": "pkg:npm/weavedb-contracts", "off": 330, "kind": "dependency" }, { "to": "index.js", "off": 66, "file": 1, "kind": "local" } ], "risk": 38, "sha": "ecaed6149b9b9aae1bd4cbd9ee4612c80f709adff6d9712271b24a4355e9e7b1", "size": 366, "traits": [ { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field", "spans": [ [ 0, 21 ] ] }, { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install", "spans": [ [ 116, 26 ] ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "package.json defines a package name", "spans": [ [ 4, 0 ] ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version", "spans": [ [ 34, 0 ] ] }, { "id": "objectives/supply-chain/install-hook/dropper/native-loader::preinstall-runs-bundled-executable", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "Executes bundled payload from preinstall", "spans": [ [ 116, 26 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::script-hidden-file-1", "conf": 0.75, "crit": 3, "desc": "Script hidden file (base)", "spans": [ [ 99, 43 ] ] }, { "id": "metadata/package/manifest/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point", "spans": [ [ 57, 0 ] ] }, { "id": "metadata/package/manifest/freeform::pkg-skeleton-small", "conf": 0.7, "crit": 3, "desc": "Tiny package.json manifest", "spans": [ [ 0, 20 ] ] }, { "id": "metadata/package/quality/empty::npm-no-keywords", "conf": 0.5, "crit": 2, "desc": "package.json has no keywords" }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook", "spans": [ [ 116, 26 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook", "spans": [ [ 116, 26 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook", "spans": [ [ 116, 13 ] ] }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 2, "desc": "Package has install hooks", "uses": [ 10 ], "spans": [ [ 116, 0 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::sparse-package-install-hook", "conf": 0.85, "crit": 3, "desc": "Sparse package metadata accompanies install hook", "uses": [ 12 ], "spans": [ [ 116, 0 ] ] } ], "type": "package.json" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91Xp#Km00000kMy=:00000000000000000000kMA+z1opW!000000rr911][S600000000000000000000000000000001Ybg00000)4$^60000001Ybg000000rr911POJ500000000000i^Ez000000i^Ez00000]5pbV00000]5pbV0000001Ybg00000qrq[g1][S60000000000000000000000000000000000000000000000000000000000001onA41onA4aoqDx00000aoqDx00000aoqDx00000l\u0026Wh!00000l\u0026Wh!000001onA4000001onA45c8Xg", "ln": 0 }, { "b": "dK(SAg=dgmWf%S$2Wg!Wz*(:U3b+iadcLeVwm+KO[aEl8vitNJ0tkOz0S@MUBzU$iZ1ng\u003c1\u0026%tJzR]jt}(^{jzGP=iwkAw21oOYaq/vb3uK4)Kw0OlDj#@@PlRmCEPQKsehZz@Sz/M%%k#ZxGk#6{2yej9O2]VYXH?]lS*MkrwC9)aH?tR93NG-]", "ln": 30837 }, { "b": "eN!#%azVDdd7LB$9%hU#fU\u003c[S1SbIRYDNpY1{$.D4mOzgjpR(k%nSb[lUG)hgb6?.z/M$Bi5Ub4g+o+pqDV*}pE^YBW/p\u0026{qY]/$jyJhFA=jiYAaJ{dB8iE7xfI7IE*Qxg4H\u0026*O3jc$y1{Cbi0S^=WzuU*j0MMqZ3Ow.Zao8uS*rZR)0E[O$@@m:tmn\u003e^knGZI\u003co^1p\u003ewozZ1f+=fDaPW5#5r5:R000l*BJ[FEEgtAC1U%]a\u003c@1y8Hx!+)9$e}w.+1-by:6ARF/%%p1\u0026k5O@%6bvF+Ae4@6%pzq+j@V0sfbB{cDr-.43IO1kXLk3MGJuI.hdma]", "ln": 333647 }, { "b": "[BK#r3vJRIurtzZ(qdXt]e#[XnwsWT=*}R+J8Myy[P/]oXd-1u4+g\u0026E]e99kEP^j7do/tc=*%oBtUx3nGT:d\u003c]e%ng:LtN4=3e@qtY74}uQf!2YkHKRvj\u00264^vQoL:-p9jsi5\u003cV%ujGk)\u003em6RQw:Q5QxB5m}h#0\u003en4TR\u003eM4MOnPYkM5MLN.V74=?\u003c44=ldd\u003cca^wL}EE-4.0jC\u003exP+:u]@^O]e$v\u003c4SWwYOsE{%jKpmq-k{P/6ZtiK)dppzJ^-0j=Pw\u0026JasI[]ZqUq*\u003emi}\u003e0!NM+34$H2z\u003eKVKw)L%HIt\u0026cCp(7DALFdJ]O/W9!8*\u0026bjPDkf+H^d?+D%eFOfrL/2Xu\u0026sF!cj*}{{rkLhNV?qGyp#lXvR8r7}U!rDerX\u0026H[C\u003c5)HG3kE4$SI2!*=USkP!/ilcroh}O$n9U6-Ck\u003e(a!\u003eA]kU:/V9\u003c+^V\u003evX2}%z4WXu/JZ9dBX\u003ct45akwEUSnuEbYkDFP?[DqLJ*^@IDeoOLb?L6Z\u0026srPr\u003eEzVAu(m)L4Tv4NY.rD64.g+vN)ccF4/4%q\u00268]Jv5aX^v}v8oiR$=URuySRJ74cEr=*}Uwwy}6:Xdc{z\u003ef{%W4/\u0026fm7.dnKD7Kd787mEbXeUmDyH73:91Eu(a8RM\u003cbe0K7R#dwUpm:S#4W=1Z\u003ejumre6]}24IklN\u003c@nZ4eE\u003c3=e!ewUfKso}O{p4uXh8nYgI/mSyyYn#g.fc{h3/(DjwUMb9c:f\u0026Mfewcl[ZF.faI!V8[:=WV{c\u0026]P]IUx4^9vB=ZnnrCVWHx]lD{^Xs?FE\u003eWdnvn{Z/mQfZ}iH?XL?2K^6JsBuZq4T$1Auy}.@Es\u003esm", "ln": 353232 }, { "b": "E*fx-182gHOm7m$B/Z%E}#uX\u003eo(B]\u003exk.S#A^n^4B.(elAbok#vgrhoE\u003e@OBz/M$Bi5Ub4g+o+pqDV*}pE^YBqY]Md)F?93jyJhFA=jiYAaJ{dB8iE7xfDrS1UIXAaiT:#0w16H17}WhJta@yF^K2qOj}G@M8Pw6J5Jq?gGxdvo/.J8w\u003cl=s5ezGVmgr6pfONt1k\u0026SeBRX82*5uH-", "ln": 948844 }, { "b": "sYw:9qCr6ktMB*8f#ct-B]j!lB]ksL01Ybgup.hLZ\u0026P\u003cm{Y:o\u003eB[p+#nCy?op?T#\u003cso8rcy7KZYklg-:4*vW5C].RjBoBt((*ml5h6@t70iIA^r*E9c0:aT[0rr9\u003eInSK/JxJg0%nN#/ngz\u003eQJwS3-006c+l5BB1L7QQ.qFMkkngAj?nceP^r9-3z!jtkMZ/jWyp{1tZ{YtKr]JjS+[k9at*Cc/vJtp1A003^luhQT%%i+@+Jx)QB^H\u003cp{^Stho\u003eMp", "ln": 972476 }, { "b": "=u69Vnq/[\u003cnqND{oO[cx2Uo\u003eNav}dI5l8$fIrv=K0A!LD0000\u00260MDO9B[5^rtUM@{o]m!y0yo[71ZiwPy6!2a82%Tpp!lBi7^Q#9y6dMG1Z1rFZ.3L7]a8]s.+Z\u003cEsX7WQ[C\u0026Je0RBpB0rr9306{PrwmY{qB7/y\u003c]a8]s0O.X$]tuFcnq3vd5.(]{D\u0026TiE3K)7o[^bo@0SSi2{8^\u0026a0pZ0*]a8]soO)Qu1fIL4%lb9[0sqganqVH5mka^=2s%Bj01Zm-9@BZ(\u003ev$o9]gkYGGfxX", "ln": 972744 }, { "b": "@q.1[^e@K/X-\u003eW0Wah:xKo0+CtG(:tW@o=-}b*^Rir[#\u003c+!(8MA=kCvQ*a-nB7Gf1fj/y}Xiz]RpJ6GEeSB\u0026Ppv4rh)ze+R?/6t?k(-MGwP/Usz2^[ALc4=JQK)\u0026/u!XYD8xT^L3:b57!ami9{*pXNJVl-)UNb)6Kh9^Ws*2g#vok\u003cq2b$@gB9uhaWKOi", "ln": 975182 }, { "b": "aA8oyzE)x\u0026!C*Sw7+Wo*pHv6}p!12ImjY\u003e/0c\u003eWNn={ss0093a03\u003ecNw]xZMra]#!azbt7wGUYday/tbAb]JhB7F(8Cwhejave)$ayPq2xLzT3AV/4qBz%n]flIkUe]$RSzE)]jbNKI%nN%\u003e8k#Hq$h7*Qsavy6^D2^RixMLvBlN:cjixn#Hgb7EwaARpdave)$axh]Xz7V}%y?$j(x\u003eIa3B0av(B7GxnwN)zobNKIK05%@U015Ya00\u0026M803?\u003cUK]LFinS%bi2(\u003c%A0@@rb00030?#rTClQJ)Sc}v3jdiHu6e?)zIgb7Ew", "ln": 975415 } ], "depth": 1, "facts": { "tgt": [ "fcn.002c8829", "int.0022b1ba" ], "funcs": [ [ "fcn.001ed745", 2021189 ], [ "fcn.001f2e30", 2043440 ], [ "fcn.001fa4a9", 2073769 ], [ "fcn.0020455a", 2114906 ], [ "fcn.0020c3c8", 2147272 ], [ "fcn.0020cf19", 2150169 ], [ "fcn.00210536", 2164022 ], [ "fcn.002106ea", 2164458 ], [ "fcn.0021928b", 2200203 ], [ "fcn.0021aa0a", 2206218 ], [ "fcn.0021d13c", 2216252 ], [ "fcn.0021e0a2", 2220194 ], [ "fcn.0021e6ca", 2221770 ], [ "fcn.0021f5fd", 2225661 ], [ "fcn.00222d88", 2239880 ], [ "int.0022b1ba", 2273722 ], [ "entry0", 2918072 ], [ "fcn.002c8829", 2918441 ] ], "metrics": { "elf": { "bits": 64, "entry": 2918072, "has_got": 0, "has_plt": 0, "has_note": 0, "note_count": 2, "nx_enabled": 1, "dynrel_count": 0, "dynsym_count": 0, "has_build_id": 1, "has_eh_frame": 0, "no_gnu_stack": 0, "symtab_count": 0, "dynrela_count": 0, "little_endian": 1, "pltreloc_count": 0, "build_id_length": 20, "executable_stack": 0, "wx_segment_count": 0, "direct_syscall_count": 15, "program_header_count": 4, "stripped_with_symtab": 0, "entry_in_last_segment": 1, "executable_segment_count": 1, "load_segment_max_file_size": 975602, "load_segment_max_memory_size": 1943276, "section_relocation_group_count": 0, "stripped_metadata_section_count": 8 }, "file": { "size": 976568, "entropy": 7.9 }, "binary": { "is_pie": 0, "is_stripped": 1, "basic_blocks": 65, "avg_complexity": 2.78, "max_complexity": 18, "huge_func_count": 0, "leaf_func_count": 15, "tiny_func_count": 12, "avg_basic_blocks": 3.61, "peak_region_bytes": 924672, "peak_region_entropy": 7.77 }, "functions": { "count": 18 }, "dependencies": { "count": 0 } } }, "id": 3, "mol": "O(As)H₂(MgOs)Md₃(Bi₄BkHe)", "path": "weavedb-offchain-0.45.4.tgz!!package/.github/scripts/precheck", "pid": 0, "risk": 44, "sha": "36abd242ddaa27f0160c539377a0e92cf781c1695137850acc87e3892b436d36", "size": 976568, "traits": [ { "id": "metadata/binary/header/identity::binary-format-checked", "conf": 1.0, "crit": 2, "desc": "Binary format is identified" }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-70", "conf": 0.85, "crit": 3, "desc": "Binary overall entropy at least 7.0" }, { "id": "metadata/binary/layout/entropy::very-high-overall-entropy-75", "conf": 0.95, "crit": 3, "desc": "Binary overall entropy at least 7.5" }, { "id": "metadata/binary/linking/static::elf-needed-libs-zero", "conf": 0.9, "crit": 2, "desc": "ELF imports zero needed libraries" }, { "id": "metadata/binary/section/header::elf64-zero-section-header-offset", "conf": 0.95, "crit": 3, "desc": "ELF64 section header offset is zero", "spans": [ [ 0, 104 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 30885, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 975564, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 333698, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 975487, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 975463, 0 ] ] }, { "id": "micro-behaviors/mem/create/fileless::syscall-memfd-create", "conf": 0.8, "crit": 3, "desc": "Calls memfd_create syscall", "spans": [ [ 972540, 14 ] ] }, { "id": "micro-behaviors/os/syscall/raw::x64-mmap-syscall-sectionless", "conf": 0.9, "crit": 3, "desc": "x86-64 mmap syscall in sectionless code", "spans": [ [ 972808, 21 ] ] }, { "id": "metadata/binary/header/program::elf-entry-in-last-segment", "conf": 0.7, "crit": 3, "desc": "ELF entry in final PT_LOAD" }, { "id": "metadata/build/artifact::stripped-toolchain-comment", "conf": 1.0, "crit": 3, "desc": "ELF omits compiler metadata (.comment)" }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.8, "crit": 3, "desc": "No full symbol table (likely stripped)" }, { "id": "metadata/binary/linking/static::static-linked-heuristic", "conf": 0.75, "crit": 3, "desc": "ELF lacks dynamic linker sections", "uses": [ 0 ] }, { "id": "metadata/binary/section/header::elf-no-section-headers", "conf": 0.95, "crit": 3, "desc": "ELF binary without section headers", "uses": [ 4 ], "spans": [ [ 0, 104 ] ] }, { "id": "metadata/binary/linking/static::static-linked", "conf": 0.8, "crit": 3, "desc": "Statically linked binary", "uses": [ 3, 15 ] }, { "id": "metadata/hardening/missing::static-linked", "conf": 0.8, "crit": 3, "desc": "Statically linked binary", "uses": [ 15 ] }, { "id": "objectives/anti-static/pack/detect::no-section-headers", "atk": "T1027.002", "mbc": "F0001", "conf": 0.8, "crit": 3, "desc": "No section headers", "uses": [ 16 ], "spans": [ [ 0, 104 ] ] }, { "id": "metadata/hardening/missing::minimal-hardening", "conf": 0.8, "crit": 3, "desc": "Binary lacks security hardening features", "uses": [ 14, 18 ] }, { "id": "objectives/anti-static/pack/detect::sectionless-elf-with-packing-indicators", "atk": "T1027.002", "mbc": "F0001", "conf": 0.92, "crit": 4, "desc": "Sectionless ELF with multiple packing indicators", "uses": [ 2, 3, 15, 17, 19 ], "spans": [ [ 0, 104 ] ] }, { "id": "objectives/anti-static/pack/detect::stripped-packed", "atk": "T1027.002", "mbc": "F0001", "conf": 0.85, "crit": 4, "desc": "Packed ELF binary", "uses": [ 1, 19 ], "spans": [ [ 0, 104 ] ] } ], "type": "elf" } ], "rev": "479f3", "v": "8" } }