{ "ml": { "v": "7", "id": 214, "lvl": -1, "conf": 0, "prob": 0.00010354319965699688, "type": "gz", "version": "v18.18", "analyzed_at": "2026-09-23T15:56:15Z" }, "path": "docker-image-update-checker@f97e2a3cdbf2d8f9788fb87081a76542645a4252", "raw": { "rev": "a041b", "files": [ { "id": 214, "mol": "K₃(AmLi₈Te₆)O₉(AlAs₈C₇CaErEuI₃S₉Xe₆)H₈(Cm₅₁Cr₃Db₄₂F₉MgOs₉Po₁₅U₄)Md₇(Bk₉In₄Pa₁₅PtV)", "pid": 8, "rel": "fetched", "sha": "9f413ca235e541f28f6e4b399b071d686ab10994ba8efe3149d5aded66e0949e", "via": "https://codeload.github.com/lucacome/docker-image-update-checker/tar.gz/f97e2a3cdbf2d8f9788fb87081a76542645a4252", "path": "pkg:github/lucacome/docker-image-update-checker@f97e2a3cdbf2d8f9788fb87081a76542645a4252", "risk": 87, "size": 2150883, "type": "gz", "depth": 2, "facts": { "metrics": { "file": { "size": 2150883, "entropy": 8 }, "binary": { "peak_region_bytes": 2144739, "peak_region_entropy": 7.85 }, "consistency": { "self_dependency": 0, "unused_runtime_deps": 0 } } }, "traits": [ { "id": "metadata/import/npm/relative/1/ecr/js::relative/1/ecr/js", "conf": 0.95, "crit": 2, "desc": "imports ./ecr.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 2 } ] }, { "id": "well-known/lib/development/npm-semver::range-class-text", "conf": 0.98, "crit": 3, "desc": "npm semver Range class text", "from": [ { "file": 51 } ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/backdoor::dnr-response-headers-marker", "conf": 0.86, "crit": 3, "desc": "DNR response headers marker", "from": [ { "file": 51 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Gmail consumer email domain suffix", "from": [ { "file": 51 } ] }, { "id": "objectives/execution/automation/autonomous::llm-exfiltration-data", "atk": "T1059,T1587.004", "conf": 0.9, "crit": 3, "desc": "LLM data exfiltration stage", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/build::network-destination-function-binding", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Network destination assigned from call", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-start", "conf": 0.86, "crit": 3, "desc": "Starts a synchronous function expression", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-darwin-branch", "conf": 0.7, "crit": 2, "desc": "Branches on macOS platform value", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-api-host", "conf": 0.86, "crit": 3, "desc": "GitHub API host reference", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/2/src/docker-hub/js::relative/2/src/docker-hub/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/docker-hub.js", "from": [ { "file": 57 } ] }, { "id": "metadata/build/ci/secret::github-token-secret", "conf": 0.88, "crit": 3, "desc": "References Actions-provided GITHUB_TOKEN", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/telemetry/logging/llm::console-log-json-stringify-call", "mbc": "C0069", "conf": 0.86, "crit": 3, "desc": "Console logs JSON stringified payload", "from": [ { "file": 51 } ] }, { "id": "metadata/build/bundler/asset::has-sourcemap", "conf": 0.9, "crit": 2, "desc": "Code has source map reference", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/token-auth::bearer-header-from-variable", "conf": 0.94, "crit": 3, "desc": "Builds Bearer authorization header from variable", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/typescript-eslint/eslint-plugin::typescript-eslint/eslint-plugin", "conf": 0.95, "crit": 2, "desc": "imports @typescript-eslint/eslint-plugin", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-recipient-slice-byte-map", "conf": 0.9, "crit": 3, "desc": "Maps over a byte slice variable", "from": [ { "file": 51 } ] }, { "id": "metadata/package/scripts/build::has-build-script-build", "conf": 0.7, "crit": 3, "desc": "Package declares build script" }, { "id": "well-known/lib/development/npm-semver::semver-class", "conf": 0.98, "crit": 3, "desc": "npm semver SemVer class module", "from": [ { "file": 239 }, { "off": 1253083, "file": 265, "line": 36062 } ], "uses": [ 49, 245 ] }, { "id": "metadata/package/scripts/develop::pkg-format-script-field", "conf": 0.6, "crit": 3, "desc": "\"format\": script in package.json" }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/cloud/azure-storage-js::package-reference", "conf": 0.98, "crit": 3, "desc": "Azure Storage JavaScript SDK package reference", "from": [ { "file": 51 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-3f", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0x3f hex byte token", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-object", "conf": 0.86, "crit": 3, "desc": "HTTP options object with host or port", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/ui/window/dom-access::current-script-src-read", "conf": 0.88, "crit": 3, "desc": "Reads document.currentScript src URL", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call", "conf": 0.95, "crit": 3, "desc": "Invokes preserved console method with arguments", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/registry-test-utils/js::relative/1/registry-test-utils/js", "conf": 0.95, "crit": 2, "desc": "imports ./registry-test-utils.js", "from": [ { "file": 55 } ] }, { "id": "metadata/package/agent-skill::agent-skill-frontmatter-fields", "conf": 0.86, "crit": 3, "desc": "Agent skill frontmatter fields", "from": [ { "file": 174 } ] }, { "id": "micro-behaviors/data/db/sql::sql-update", "conf": 0.5, "crit": 3, "desc": "SQL UPDATE syntax reference", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/encode/char-code::multiple-fromcharcode-calls", "conf": 0.92, "crit": 3, "desc": "Calls String.fromCharCode multiple times" }, { "id": "micro-behaviors/communications/http/authorization-header::basic-auth-credential-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Basic auth credential literal", "from": [ { "file": 55 } ] }, { "id": "metadata/import/npm/relative/2/src/github/js::relative/2/src/github/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/github.js", "from": [ { "file": 57 } ] }, { "id": "metadata/package/scripts/develop::has-test-script", "conf": 1.0, "crit": 2, "desc": "package.json declares a test script" }, { "id": "micro-behaviors/communications/http/websocket::websocket-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "WebSocket protocol headers", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-method-preservation", "conf": 0.95, "crit": 3, "desc": "Preserves original JavaScript console methods", "from": [ { "file": 51 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes", "from": [ { "file": 2 } ] }, { "id": "metadata/import/npm/actions/core::actions/core", "conf": 0.95, "crit": 2, "desc": "imports @actions/core", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/request/body::request-body-property-access", "conf": 0.84, "crit": 3, "desc": "Accesses a request body property" }, { "id": "metadata/build/ci/agent::github-actions-runner-image", "conf": 0.96, "crit": 3, "desc": "GitHub Actions runner image configuration", "from": [ { "file": 51 } ] }, { "id": "metadata/file/string/cicd::cicd-runtime-fingerprint--rx-11", "conf": 0.94, "crit": 3, "desc": "GitHub Actions environment marker", "from": [ { "file": 51 } ] }, { "id": "metadata/import/builtin::import-dns", "conf": 0.8, "crit": 3, "desc": "ESM import of the Node.js dns module", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL public documentation", "from": [ { "file": 51 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call", "conf": 0.94, "crit": 3, "desc": "DirectoryEntry property write API call", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/socket/send::node-socket-write", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node socket writes a data payload", "from": [ { "file": 51 } ] }, { "id": "objectives/supply-chain/trojanized/build-pipeline::gha-release-publish-step", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "GitHub Actions package publish step", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call", "conf": 0.88, "crit": 3, "desc": "Calls a matcher in a conditional expression" }, { "id": "metadata/import/npm/relative/2/src/generic-registry/js::relative/2/src/generic-registry/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/generic-registry.js", "from": [ { "file": 57 } ] }, { "id": "well-known/lib/development/npm-semver::semver-invalid-version-typeerror", "conf": 0.98, "crit": 3, "desc": "npm semver invalid-version TypeError", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/scripted::after-each-call", "conf": 0.6, "crit": 3, "desc": "afterEach hook", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/data/string/conversion::js-fromcharcode-alias", "conf": 0.9, "crit": 3, "desc": "Aliases String.fromCharCode conversion function", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/cloud/azure-storage-js::shared-key-credential-symbol", "conf": 0.98, "crit": 3, "desc": "Azure StorageSharedKeyCredential symbol", "from": [ { "file": 51 } ] }, { "id": "objectives/execution/automation/agent::vulnerability-state-marker-vulnerable", "atk": "T1059,T1190,T1595", "conf": 0.82, "crit": 3, "desc": "Vulnerable or CVE state marker", "from": [ { "file": 51 } ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/2/src/ocir/js::relative/2/src/ocir/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/ocir.js", "from": [ { "file": 56 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-spawnsync", "conf": 0.98, "crit": 3, "desc": "Calls spawnSync() to run a child process", "from": [ { "file": 17 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0xff hex byte token", "from": [ { "file": 51 } ] }, { "id": "metadata/package/manager::declares-pinned-package-manager", "conf": 0.95, "crit": 3, "desc": "Manifest pins package manager" }, { "id": "metadata/build/ci/permission::id-token-write-permission", "conf": 0.9, "crit": 3, "desc": "GitHub Actions OIDC write permission", "from": [ { "file": 152 } ] }, { "id": "metadata/build/minifier::js-min-or-map-basename", "conf": 0.9, "crit": 3, "desc": "JavaScript minified or map basename" }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "child_process module name literal", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/data/source/property/identity::repository-object-fields", "conf": 0.9, "crit": 3, "desc": "Repository identity object field keys", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-8-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 8 bits", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/framing::node-be32-frame-length-read", "mbc": "C0001", "conf": 0.95, "crit": 3, "desc": "Reads BE32 frame length at offset zero", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/decode/base64::embedded-atob-call-text", "conf": 0.9, "crit": 3, "desc": "Data contains JavaScript atob call", "from": [ { "file": 23 } ] }, { "id": "objectives/anti-static/obfuscation/syntax::js-prototype-extension", "conf": 0.8, "crit": 3, "desc": "String.prototype extension", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::basic-auth", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Basic authentication", "from": [ { "file": 55 } ] }, { "id": "metadata/import/npm/relative/2/src/gitlab/js::relative/2/src/gitlab/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/gitlab.js", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/communications/http/url/query::ai-prompt-query-encoded-url-value", "conf": 0.95, "crit": 3, "desc": "Query value contains an encoded remote URL", "from": [ { "file": 71 } ] }, { "id": "micro-behaviors/process/create/exec::node-child-process-capability", "conf": 0.8, "crit": 3, "desc": "Imports or invokes Node.js child-process APIs", "from": [ { "off": 130, "file": 231, "line": 3 } ], "uses": [ 135 ] }, { "id": "micro-behaviors/communications/http/post::url-encoded-content-type", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses URL-encoded HTTP form content", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-protocol-reference", "conf": 0.5, "crit": 3, "desc": "References the OAuth 2 protocol", "from": [ { "file": 2 } ] }, { "id": "metadata/import/npm/typescript-eslint/parser::typescript-eslint/parser", "conf": 0.95, "crit": 2, "desc": "imports @typescript-eslint/parser", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/crypto/hash/digest::javascript-sha256-operation", "mbc": "C0029", "conf": 0.88, "crit": 3, "desc": "Performs JavaScript SHA-256 operation", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/buffer/alloc::node-buffer-tostring-call", "conf": 0.88, "crit": 3, "desc": "Converts Node.js Buffer output to text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/user-agent::ua-curl", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "curl User-Agent", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/development/npm-semver::range-class", "conf": 0.98, "crit": 3, "desc": "npm semver Range class module", "from": [ { "file": 239 }, { "off": 1276178, "file": 265, "line": 37011 } ], "uses": [ 2, 430 ] }, { "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detaches a handle with unref()", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-array-from-byte-map", "conf": 0.9, "crit": 3, "desc": "Maps sliced bytes via Array.from", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/browser-automation::authentication-token-name-literal", "conf": 0.9, "crit": 3, "desc": "Authentication token name literal", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-liveness-field", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Structured object contains a liveness field", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/fs/write/file/target::node-temp-script-path", "conf": 0.82, "crit": 3, "desc": "Temporary script.js path", "from": [ { "file": 51 } ] }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/scripted::js-bdd-describe-text", "conf": 0.75, "crit": 2, "desc": "JavaScript describe() test call", "from": [ { "file": 53 } ] }, { "id": "metadata/import/npm/relative/1/digitalocean/js::relative/1/digitalocean/js", "conf": 0.95, "crit": 2, "desc": "imports ./digitalocean.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable-call", "conf": 0.9, "crit": 3, "desc": "Calls exec with a command-named variable", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/scripted::jest", "conf": 0.95, "crit": 3, "desc": "Jest test framework", "from": [ { "file": 53 } ], "uses": [ 312 ] }, { "id": "micro-behaviors/communications/http/user-agent::mobile-user-agent-header-map-read", "conf": 0.94, "crit": 3, "desc": "Reads User-Agent from a header map", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-proxy-get-trap", "conf": 0.9, "crit": 3, "desc": "Proxy intercepts property reads", "from": [ { "file": 51 } ] }, { "id": "metadata/package/agent-skill::agent-instructions-md-basename", "conf": 0.95, "crit": 3, "desc": "Agent instructions markdown file name", "from": [ { "file": 72 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-application-or-font-data-uri", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains base64 application or font data URI", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/scripted::coverage-markers-a", "conf": 1.0, "crit": 2, "desc": "Coverage marker family A", "from": [ { "off": 652, "file": 236, "line": 21 } ], "uses": [ 453 ] }, { "id": "metadata/build/ecosystem::artifact-integrity-verification-routine", "conf": 0.95, "crit": 3, "desc": "Checks artifact integrity before use", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/navigation::js-url-host-read", "conf": 0.8, "crit": 3, "desc": "Reads hostname from URL variable", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/socket/ssl::reject-unauthorized-false", "conf": 0.9, "crit": 3, "desc": "Node TLS check disabled by option", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/fragment::location-hash-read", "conf": 0.85, "crit": 3, "desc": "Reads the URL fragment from location.hash", "from": [ { "file": 51 } ] }, { "id": "metadata/build/ci/step::actions-setup-node", "conf": 0.92, "crit": 3, "desc": "actions/setup-node workflow step" }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "from": [ { "file": 51 } ] }, { "id": "metadata/file/comment::source-at-most-two-comments", "conf": 0.88, "crit": 2, "desc": "Source has at most two comments", "from": [ { "file": 4 } ] }, { "id": "well-known/app/ai/knowledge/agent-skills::skill-definition-file", "conf": 0.98, "crit": 3, "desc": "Agent Skills SKILL.md definition file", "from": [ { "file": 174 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 2 } ] }, { "id": "metadata/build/docker::docker-env-prefix", "conf": 0.8, "crit": 3, "desc": "DOCKER_ environment prefix", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/interpreter/wasm::webassembly-instantiate", "conf": 0.85, "crit": 3, "desc": "Instantiates a WebAssembly module", "from": [ { "file": 51 } ] }, { "id": "metadata/package/config::excludes-identifier", "conf": 0.7, "crit": 3, "desc": "Uses an excludes identifier", "from": [ { "file": 51 } ] }, { "id": "objectives/anti-static/obfuscation/payload/data-file::data-file-js-decoder-runtime", "atk": "T1027", "mbc": "F0001", "conf": 0.88, "crit": 3, "desc": "JavaScript decoder runtime in data", "from": [ { "file": 23 } ] }, { "id": "metadata/import/npm/relative/1/acr/js::relative/1/acr/js", "conf": 0.95, "crit": 2, "desc": "imports ./acr.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/webdav::propfind-method", "conf": 0.95, "crit": 3, "desc": "References the WebDAV PROPFIND method", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/body::request-end-body-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.92, "crit": 3, "desc": "Ends request-like object with a body argument", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-session-word", "conf": 0.45, "crit": 1, "desc": "session route vocabulary word", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/property/identity::host-user-object-fields", "conf": 0.9, "crit": 3, "desc": "Host or user object field keys", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/string/concat::dot-joined-array-values", "conf": 0.94, "crit": 1, "desc": "Array values joined with dots", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/relative/1/ocir/js::relative/1/ocir/js", "conf": 0.95, "crit": 2, "desc": "imports ./ocir.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster", "conf": 0.86, "crit": 3, "desc": "Dense computed-property call cluster (3+)", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--azure", "conf": 0.4, "crit": 3, "desc": "Public cloud provider name (Azure)", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/string/concat::array-join-empty-separator-text", "conf": 0.78, "crit": 3, "desc": "Array expression joined without separator", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/string/replace::keyed-replacement-call", "conf": 0.96, "crit": 3, "desc": "Replaces text using a keyed replacement table", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::multi-platform-branch", "atk": "T1082", "mbc": "E1082", "conf": 0.8, "crit": 3, "desc": "Multi-platform OS branching logic", "from": [ { "file": 215 }, { "file": 238 }, { "file": 239 }, { "file": 241 }, { "file": 242 }, { "file": 265 } ], "uses": [ 182, 232 ] }, { "id": "micro-behaviors/os/module/require::dynamic-external-import-string-literal", "conf": 0.9, "crit": 3, "desc": "Dynamically imports a non-relative module path" }, { "id": "micro-behaviors/fs/delete/file/library::js-repeated-unlink-call", "atk": "T1070.004", "mbc": "C0047", "conf": 0.6, "crit": 3, "desc": "Repeated Node unlink calls", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/header/retry-after::retry-after-header-name-reference", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "References the Retry-After header name", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::node-createhmac-text-call", "mbc": "C0029", "conf": 0.92, "crit": 3, "desc": "Node.js HMAC call in source text", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-win32-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Windows platform value", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/socket/create::net-socket-connect-method", "conf": 0.85, "crit": 3, "desc": "Node net.Socket constructor", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/image-utils/js::relative/1/image-utils/js", "conf": 0.95, "crit": 2, "desc": "imports ./image-utils.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/message::raw-http-control-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP control request line", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/content-length::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-login-word", "conf": 0.45, "crit": 1, "desc": "login route vocabulary word", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/buffer/alloc::uint8array-constructor", "conf": 0.9, "crit": 2, "desc": "Constructs a Uint8Array buffer" }, { "id": "metadata/import/npm/child_process::child_process", "conf": 0.95, "crit": 3, "desc": "imports child_process", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/data/buffer/alloc::buffer-from-call", "conf": 0.4, "crit": 3, "desc": "Calls Buffer.from at least three times", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/communications/http/response::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-methods-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Methods header name", "from": [ { "file": 51 } ] }, { "id": "objectives/supply-chain/recon-exfil/pipeline::gha-interesting-secret-keywords--rx-1", "atk": "T1195.002, T1552.001", "conf": 0.9, "crit": 3, "desc": "NPM or Docker credential variable name", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/decode/custom::fromcharcode-apply-array", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "Converts character-code array to string" }, { "id": "objectives/impact/dos/amplification::amplification-payload-common-chr-suffix", "conf": 1.0, "crit": 3, "desc": "Amplification chr() payload suffix", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission", "conf": 0.82, "crit": 3, "desc": "Emits object through named JavaScript event" }, { "id": "metadata/package/completeness::has-typescript", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript tooling", "from": [ { "file": 20 } ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64" }, { "id": "micro-behaviors/data/source/syntax/assignment::indexed-call-assignment", "conf": 0.85, "crit": 3, "desc": "Indexed call assignment target", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-header-from-token", "atk": "T1071.001", "mbc": "C0002", "conf": 0.93, "crit": 3, "desc": "Bearer header from token", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::structured-sequence-field", "conf": 0.9, "crit": 3, "desc": "Structured object names a sequence field", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::javascript-basic-auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JavaScript Basic Authorization header", "from": [ { "file": 2 } ] }, { "id": "metadata/package/scripts/build::pkg-build-script-field", "conf": 0.6, "crit": 3, "desc": "Package declares a build script" }, { "id": "micro-behaviors/communications/http/url/query::query-parameter-mutation", "conf": 0.82, "crit": 3, "desc": "Mutates a URL query parameter collection", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/encode/base64::node-buffer-base64-encode", "mbc": "C0026", "conf": 0.95, "crit": 3, "desc": "Encodes Node.js Buffer output as Base64", "from": [ { "file": 2 } ] }, { "id": "metadata/package/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL" }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 231 }, { "off": 1516, "file": 265, "line": 39 } ], "uses": [ 486 ] }, { "id": "objectives/supply-chain/hidden-payload/trojan::ci-env-marker-string", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "CI environment marker string", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/upload::form-data-append", "conf": 0.7, "crit": 3, "desc": "Appends data to FormData", "from": [ { "file": 51 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "from": [ { "file": 51 } ] }, { "id": "well-known/tool/detection/sast::scorecard-tool", "conf": 1.0, "crit": 3, "desc": "OpenSSF Scorecard reference", "from": [ { "file": 152 } ] }, { "id": "metadata/import/npm/relative/1/token-utils/js::relative/1/token-utils/js", "conf": 0.95, "crit": 2, "desc": "imports ./token-utils.js", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-string-function", "conf": 0.9, "crit": 3, "desc": "Top-level non-require string call", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/fixture::test-filename-pattern", "conf": 0.6, "crit": 2, "desc": "Common test filename pattern", "from": [ { "file": 53 } ] }, { "id": "objectives/evasion/masquerade/traffic::browser-html-accept-header", "atk": "T1071.001", "mbc": "B0030", "conf": 0.8, "crit": 3, "desc": "Browser HTML Accept header literal", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-origin-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Origin header name", "from": [ { "file": 51 } ] }, { "id": "metadata/package/documentation/agent-safety::security-markdown-basename", "conf": 0.94, "crit": 3, "desc": "Security documentation markdown file", "from": [ { "file": 70 } ] }, { "id": "metadata/build/bundler/wrapper::js-tsc-reexport-getter", "conf": 0.97, "crit": 2, "desc": "Transpiled re-export getter (tsc/babel barrel)", "from": [ { "file": 51 } ] }, { "id": "objectives/execution/automation/skill::skill-definition-marker", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "Declares an executable agent skill", "from": [ { "file": 388 } ], "uses": [ 212 ] }, { "id": "micro-behaviors/data/serialize/schema-object::content-object-field", "conf": 0.8, "crit": 3, "desc": "JSON content object field", "from": [ { "file": 51 } ] }, { "id": "metadata/file/literal::cve-pattern-many", "conf": 0.85, "crit": 3, "desc": "File contains six or more CVE references", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/manipulation::string-replace-result-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns a string replace result" }, { "id": "micro-behaviors/fs/build-artifacts::copy-create-file-message", "conf": 1.0, "crit": 3, "desc": "Copy create file status", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/relative/2/src/digitalocean/js::relative/2/src/digitalocean/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/digitalocean.js", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-expose-headers-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Expose-Headers header name", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 2, "desc": "File path or name indicates test code", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy", "conf": 0.8, "crit": 2, "desc": "Copies one indexed array element to another", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connection-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket connection upgrade header", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/read::js-filtered-env-copy", "conf": 0.9, "crit": 3, "desc": "Filters and copies process.env values", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/scripted::before-each-call", "conf": 0.6, "crit": 3, "desc": "beforeEach hook", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/communications/http/request/reference::js-fetch-reference", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "Passes fetch as a call argument", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/os/env/cicd::multi-ci-provider-env-refs-three-plus", "conf": 0.95, "crit": 3, "desc": "References three or more distinct CI providers", "from": [ { "file": 242 }, { "off": 1501149, "file": 265, "line": 44027 } ], "uses": [ 188, 332, 360, 395, 415 ] }, { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-win32-check", "conf": 0.6, "crit": 2, "desc": "Checks whether Node.js runs on Windows", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/response::http-401-unauthorized", "conf": 0.75, "crit": 3, "desc": "HTTP 401 unauthorized response text", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-invoke", "conf": 0.86, "crit": 3, "desc": "Immediately invokes a synchronous function", "from": [ { "file": 215 }, { "off": 784874, "file": 237, "line": 1 }, { "file": 238 }, { "file": 239 }, { "file": 242 }, { "file": 244 }, { "file": 245 }, { "off": 105814, "file": 265, "line": 3734 } ], "uses": [ 8, 276 ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Encoded URL references MDN documentation", "from": [ { "file": 51 } ] }, { "id": "metadata/lang/locale::language-label-table-codes-a", "conf": 0.9, "crit": 2, "desc": "Common UI language-code pair", "from": [ { "file": 215 }, { "off": 1761, "file": 236, "line": 69 }, { "file": 238 }, { "file": 240 }, { "file": 241 }, { "file": 242 }, { "off": 46559, "file": 265, "line": 1579 } ], "uses": [ 428 ] }, { "id": "micro-behaviors/data/llm/agent::agent-identity-coding-agent", "conf": 0.8, "crit": 3, "desc": "References the generic term \"coding agent\"", "from": [ { "file": 72 } ] }, { "id": "micro-behaviors/os/env/cicd::multi-ci-provider-env-refs--travis", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (TRAVIS)", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/message::http-message-json-call", "conf": 0.9, "crit": 3, "desc": "Calls JSON method on HTTP-style object", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::silent-getexecoutput-text", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Silenced output-capturing exec call", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/query::function-encoded-template-query-parameter", "conf": 0.92, "crit": 3, "desc": "Encodes query value with function", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/delete/directory::fs-rm-recursive", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Node.js fs.rm with recursive option", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/proxy/env::no-proxy-exclusion-write", "atk": "T1090", "conf": 0.9, "crit": 3, "desc": "Writes the NO_PROXY exclusion list", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/curl::curl-command-remote-url", "conf": 0.85, "crit": 3, "desc": "curl command names a remote HTTP(S) URL", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/fixture::wpt-security-features-resource", "conf": 0.9, "crit": 2, "desc": "WPT security-features resource helper", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/response::source-http-400-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 400", "from": [ { "file": 51 } ] }, { "id": "objectives/supply-chain/recon-exfil/pipeline::gha-interesting-secret-keywords--rx-3", "atk": "T1195.002, T1552.001", "conf": 0.9, "crit": 3, "desc": "AWS or private-key credential variable name", "from": [ { "file": 74 } ] }, { "id": "metadata/import/npm/relative/2/src/image-utils/js::relative/2/src/image-utils/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/image-utils.js", "from": [ { "file": 58 } ] }, { "id": "objectives/anti-static/obfuscation/steganography/image::powershell-system-drawing-addtype", "atk": "T1027.003", "mbc": "B0032.001", "conf": 0.88, "crit": 3, "desc": "PowerShell System.Drawing load", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-token-from-env-var", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Bearer credential interpolated from an env var", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/encoded/unicode-escape::ansi-escape-sequence", "conf": 0.98, "crit": 3, "desc": "ANSI color escape sequence encoded", "from": [ { "file": 23 } ] }, { "id": "metadata/file/string/telemetry::platform-profile-field", "conf": 0.95, "crit": 3, "desc": "Platform profile field name", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-static/obfuscation/eval/require::decode-named-function-decl", "atk": "T1059.007", "mbc": "B0024", "conf": 0.5, "crit": 3, "desc": "Function whose name contains Decode", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-bracket-runner", "conf": 0.85, "crit": 3, "desc": "process.env bracket access for runner vars", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source", "conf": 1.0, "crit": 3, "desc": "Source contains low-bit mask syntax", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/network/proxy-agent::node-proxy-agent-connect-tls", "conf": 0.96, "crit": 3, "desc": "Node proxy-agent CONNECT TLS upgrade client", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/module/require::dynamic-import-string-literal", "conf": 0.8, "crit": 3, "desc": "Dynamically imports a literal module path" }, { "id": "metadata/package/agent-skill::agent-skill-frontmatter", "conf": 0.9, "crit": 2, "desc": "Agent skill manifest frontmatter", "from": [ { "file": 388 } ], "uses": [ 28, 485 ] }, { "id": "metadata/package/dependencies/manifest/presence::has-optional-deps", "conf": 0.8, "crit": 3, "desc": "Package has optional dependencies" }, { "id": "metadata/vendor/string::microsoft-reverse-dns-identifier", "conf": 0.92, "crit": 3, "desc": "Microsoft com.microsoft.* reverse-DNS identifier", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript split()", "from": [ { "file": 8 } ] }, { "id": "metadata/import/npm/relative/1/gcr/js::relative/1/gcr/js", "conf": 0.95, "crit": 2, "desc": "imports ./gcr.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-http-url-literal-in-file-tail", "conf": 0.85, "crit": 3, "desc": "HTTP(S) URL literal in file tail", "from": [ { "file": 53 } ] }, { "id": "metadata/file/format/structured::sourcemap", "conf": 1.0, "crit": 3, "desc": "JavaScript source map", "from": [ { "file": 23 } ] }, { "id": "objectives/supply-chain/trojanized/build-pipeline::gha-package-publish-secret-name--rx-8", "atk": "T1195.002", "conf": 0.88, "crit": 3, "desc": "Container registry credential variable name", "from": [ { "file": 74 } ] }, { "id": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "conf": 0.75, "crit": 3, "desc": "Indirect string replacement call", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 3 } ] }, { "id": "metadata/file/string/count::few-string-literals", "conf": 0.4, "crit": 3, "desc": "File has very few string literals" }, { "id": "micro-behaviors/data/decode/base64::base64-typed-array-reconstruction", "conf": 0.96, "crit": 3, "desc": "Rebuilds Base64 data as typed bytes", "from": [ { "file": 215 }, { "file": 231 }, { "off": 414700, "file": 237, "line": 1 }, { "file": 238 }, { "file": 240 }, { "file": 241 }, { "off": 266822, "file": 265, "line": 4685 } ], "uses": [ 134, 364, 375 ] }, { "id": "metadata/build/ci/step::action-main-entrypoint", "conf": 1.0, "crit": 3, "desc": "Action declares a main entrypoint" }, { "id": "metadata/build/ci/github-actions::workflow-definition-path", "conf": 0.99, "crit": 3, "desc": "GitHub Actions workflow definition path" }, { "id": "metadata/import/npm/relative/2/src/quay/js::relative/2/src/quay/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/quay.js", "from": [ { "file": 55 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-token-word", "conf": 0.45, "crit": 1, "desc": "token route vocabulary word", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/cloud/azure-storage-js::sas-signature-values-symbol", "conf": 0.98, "crit": 3, "desc": "Azure SAS signature-values builder symbol", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/auth::www-authenticate-header-read", "conf": 0.94, "crit": 3, "desc": "Reads WWW-Authenticate response header", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call", "conf": 0.9, "crit": 3, "desc": "Calls a computed this method", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-darwin-check", "conf": 0.6, "crit": 2, "desc": "process.platform macOS check", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/docker/actions-toolkit/lib/util/js::docker/actions-toolkit/lib/util/js", "conf": 0.95, "crit": 2, "desc": "imports @docker/actions-toolkit/lib/util.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/io/stream::process-stdout-data-listener", "conf": 0.9, "crit": 3, "desc": "Registers a process stdout data listener", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/gitlab/js::relative/1/gitlab/js", "conf": 0.95, "crit": 2, "desc": "imports ./gitlab.js", "from": [ { "file": 6 } ] }, { "id": "well-known/lib/ui/monaco-editor::monaco-editor-microsoft-banner", "conf": 0.99, "crit": 3, "desc": "Microsoft Monaco editor bundle banner", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/ui/window/probe::console-firebug-property", "conf": 0.86, "crit": 3, "desc": "Checks the browser console Firebug property", "from": [ { "file": 51 } ] }, { "id": "metadata/lang/javascript-features::template-literal", "conf": 0.9, "crit": 2, "desc": "ES6 template literal syntax", "from": [ { "file": 2 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-suffix", "conf": 1.0, "crit": 2, "desc": "Node.js test filename suffix", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::user-collection-path-token", "conf": 0.92, "crit": 3, "desc": "user collection URL path segment", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/email/mime::mime-octet-stream", "conf": 0.85, "crit": 3, "desc": "Uses the application/octet-stream MIME type", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Module scope assigns zero-argument call", "from": [ { "file": 51 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-of-long-base64-literals", "conf": 0.85, "crit": 3, "desc": "Array of long Base64-looking strings", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/development/npm-semver::semver-class-text", "conf": 0.98, "crit": 3, "desc": "npm semver SemVer class text", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/gar/js::relative/1/gar/js", "conf": 0.95, "crit": 2, "desc": "imports ./gar.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/oauth::access-token", "conf": 0.5, "crit": 3, "desc": "access_token field reference" }, { "id": "metadata/build/ci/secret::step-token-input-secret-reference", "conf": 0.95, "crit": 3, "desc": "Step token input references an Actions secret" }, { "id": "metadata/build/bundler/wrapper::js-tslib-reexport-helper", "conf": 0.97, "crit": 2, "desc": "Calls a tslib/TypeScript re-export helper", "from": [ { "file": 51 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-override-flag", "atk": "T1059.001", "conf": 0.95, "crit": 3, "desc": "ExecutionPolicy override flag", "from": [ { "file": 51 } ] }, { "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps", "conf": 0.85, "crit": 3, "desc": "Package declares a runtime dependency", "from": [ { "file": 20 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Very short domain in URL", "from": [ { "file": 62 } ] }, { "id": "metadata/import/npm/relative/2/src/token-utils/js::relative/2/src/token-utils/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/token-utils.js", "from": [ { "file": 53 } ] }, { "id": "metadata/import/npm/relative/2/src/registry/js::relative/2/src/registry/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/registry.js", "from": [ { "file": 58 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-recipient-dotted-join", "conf": 0.9, "crit": 3, "desc": "Joins byte values with dots", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::token-getter-call", "conf": 0.65, "crit": 3, "desc": "Generic token getter function", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/jest/globals::jest/globals", "conf": 0.95, "crit": 2, "desc": "imports @jest/globals", "from": [ { "file": 53 } ] }, { "id": "metadata/package/repository::npm-name-repo-mismatch", "conf": 0.8, "crit": 3, "desc": "Package and repository names differ", "from": [ { "file": 20 } ] }, { "id": "metadata/import/npm/zod::zod", "conf": 0.95, "crit": 2, "desc": "imports zod", "from": [ { "file": 3 } ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "from": [ { "file": 51 } ], "uses": [ 199, 280, 433, 477 ] }, { "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-24-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 24 bits", "from": [ { "file": 51 } ] }, { "id": "objectives/anti-static/obfuscation/string/fragmentation::js-join-empty-assignment-tail", "conf": 0.97, "crit": 3, "desc": "Variable assigned join('') deobfuscation tail", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/rollup/plugin-json::rollup/plugin-json", "conf": 0.95, "crit": 2, "desc": "imports @rollup/plugin-json", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/url/reference::javascript-comment-url-reference", "conf": 0.9, "crit": 3, "desc": "JavaScript comment contains a URL", "from": [ { "file": 19 } ] }, { "id": "metadata/import/package::dep-eslint", "conf": 0.9, "crit": 3, "desc": "Depends on ESLint", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/communications/http/webdav::mkcol-method", "conf": 0.95, "crit": 3, "desc": "References the WebDAV MKCOL method", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/socket/connect::net-connect", "conf": 0.86, "crit": 3, "desc": "Node net.connect or createConnection usage", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-insert-mutate-method-reference", "conf": 0.85, "crit": 3, "desc": "References a DOM insertion or mutation method", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::commonjs-require-barrel-exports", "conf": 0.9, "crit": 3, "desc": "CommonJS exports object of relative require()s" }, { "id": "micro-behaviors/communications/http/request/credentials::fetch-credentials-include", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Fetch sends browser credentials", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression" }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-recipient-array-from-map", "conf": 0.9, "crit": 3, "desc": "Maps bytes collected with Array.from", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/cicd::multi-ci-provider-env-refs", "conf": 0.92, "crit": 3, "desc": "Multiple CI provider environment references", "from": [ { "file": 242 }, { "off": 1501149, "file": 265, "line": 44027 } ], "uses": [ 188, 332, 360, 395, 415 ] }, { "id": "micro-behaviors/process/info/commandline::check-argv", "conf": 0.8, "crit": 3, "desc": "Reads Node.js arguments through process.argv", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 53 } ], "uses": [ 174 ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 3 } ] }, { "id": "metadata/package/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata" }, { "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler", "conf": 0.85, "crit": 3, "desc": "Registers asynchronous named event handler", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "from": [ { "file": 51 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/ipc/message::js-message-event-listener", "conf": 0.85, "crit": 3, "desc": "Registers an event listener for message events", "from": [ { "file": 51 } ] }, { "id": "metadata/package/dependencies/manifest/name-form::optional-native-linux-dep-name", "conf": 0.9, "crit": 3, "desc": "Optional Linux native dependency name", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/fs/write/file/shell::shell-profile-append-call", "conf": 0.9, "crit": 3, "desc": "Appends with the appendFile API", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/mem/alloc/heap::megabyte-buffer-allocation", "conf": 0.86, "crit": 3, "desc": "Source allocates a megabyte-sized buffer", "from": [ { "file": 51 } ] }, { "id": "objectives/impact/ransom/encrypt/runtime-generated::destructive-action-b", "atk": "T1486", "conf": 0.94, "crit": 3, "desc": "Destructive or exfiltration verb with target", "from": [ { "file": 51 } ] }, { "id": "metadata/file/format/structured::sourcemap-sources-content", "conf": 0.9, "crit": 3, "desc": "Source map sourcesContent array", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/http/response::http-403-forbidden", "conf": 0.75, "crit": 3, "desc": "HTTP 403 forbidden response text", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/property/attributes::define-property-variable-arguments", "conf": 0.92, "crit": 3, "desc": "Defines an object property using variables", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/user-paths::userprofile-var", "conf": 0.5, "crit": 3, "desc": "USERPROFILE path environment variable", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/rollup/plugin-typescript::rollup/plugin-typescript", "conf": 0.95, "crit": 2, "desc": "imports @rollup/plugin-typescript", "from": [ { "file": 19 } ] }, { "id": "metadata/build/bundler/runtime::js-emscripten-module-marker", "conf": 0.98, "crit": 2, "desc": "Contains an Emscripten module wrapper identifier", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/message::header-stringify-scan", "conf": 0.8, "crit": 3, "desc": "Converting HTTP headers to string for scanning", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call", "conf": 0.84, "crit": 3, "desc": "Calls Node.js synchronous directory enumeration", "from": [ { "file": 51 } ] }, { "id": "objectives/anti-static/obfuscation/string/array::js-string-split", "conf": 0.6, "crit": 3, "desc": "Split to empty-delimiter char array", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/rollup/plugin-node-resolve::rollup/plugin-node-resolve", "conf": 0.95, "crit": 2, "desc": "imports @rollup/plugin-node-resolve", "from": [ { "file": 19 } ] }, { "id": "metadata/package/dependencies/manifest/name-form::platform-optional-native-deps", "conf": 0.9, "crit": 3, "desc": "Platform-specific optional native dependencies", "from": [ { "off": 1222, "file": 234, "line": 39 } ], "uses": [ 213, 287 ] }, { "id": "micro-behaviors/communications/http/header/custom::boundary-param", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 2, "desc": "Contains an HTTP multipart boundary parameter", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/registry/js::relative/1/registry/js", "conf": 0.95, "crit": 2, "desc": "imports ./registry.js", "from": [ { "file": 6 } ] }, { "id": "metadata/import/npm/relative/1/github/js::relative/1/github/js", "conf": 0.95, "crit": 2, "desc": "imports ./github.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-secret-file-body", "conf": 0.86, "crit": 3, "desc": "Serializes secret-like fields", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-method-call", "conf": 0.75, "crit": 3, "desc": "Calls a Node OS platform method", "from": [ { "file": 51 } ] }, { "id": "metadata/build/ci/step::actions-upload-artifact", "conf": 0.9, "crit": 3, "desc": "GitHub Actions uploads a workflow artifact" }, { "id": "micro-behaviors/communications/http/request/credentials::js-bearer-header-from-auth-token", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Uses an auth token in Bearer header", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::command-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object command field", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "from": [ { "file": 17 } ] }, { "id": "objectives/credential-access/cloud/datastore::json-service-account-type", "atk": "T1552.001,T1555", "mbc": "E1552", "conf": 0.9, "crit": 3, "desc": "JSON service-account type field", "from": [ { "file": 62 } ] }, { "id": "metadata/package/testing/scripted::jest-word", "conf": 0.7, "crit": 3, "desc": "jest module import", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-text", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "curl text contains silent or fail flags", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/encode/hex::hex-literal-function-argument", "atk": "T1048", "mbc": "C0026", "conf": 0.78, "crit": 3, "desc": "Function call receives long hexadecimal literal", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/decode/base64::buffer-from-base64-to-utf8", "conf": 0.85, "crit": 3, "desc": "Buffer base64 decode to UTF-8", "from": [ { "file": 17 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::computed-response-body-read", "atk": "T1105", "conf": 0.92, "crit": 3, "desc": "Reads response body through computed method", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/2/src/gcr/js::relative/2/src/gcr/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/gcr.js", "from": [ { "file": 57 } ] }, { "id": "metadata/import/npm/globals::globals", "conf": 0.95, "crit": 2, "desc": "imports globals", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 3, "desc": "charCodeAt() method call" }, { "id": "metadata/file/string/cicd::cicd-runtime-fingerprint--rx-15", "conf": 0.94, "crit": 3, "desc": "GitLab CI environment marker", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/embedded/script::embedded-php-open-tag", "conf": 0.98, "crit": 3, "desc": "PHP code fragment embedded in JavaScript", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/auth::access-token-field-reference", "conf": 0.96, "crit": 3, "desc": "Access-token field reference" }, { "id": "objectives/anti-static/obfuscation/multi-layer::js-base64-shard-array", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "Array of base64 payload shards", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/create/flags::code-powershell-noninteractive-options", "conf": 0.96, "crit": 3, "desc": "Code invokes noninteractive PowerShell", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/fs/read/file/full::readfilesync-call", "conf": 0.9, "crit": 3, "desc": "Calls readFileSync", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/create/spawn::node-spawnsync-import", "conf": 0.95, "crit": 3, "desc": "Imports Node.js spawnSync process execution API", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/crypto/hash/digest::digest-method-call", "conf": 0.8, "crit": 3, "desc": "Calls a digest() method", "from": [ { "file": 51 } ] }, { "id": "objectives/command-and-control/channel/tunnel/relay::node-cli-worker-env-flag", "atk": "T1090, T1572", "mbc": "B0030", "conf": 0.84, "crit": 3, "desc": "Node CLI worker environment guard", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-fill-call", "conf": 0.8, "crit": 3, "desc": "JavaScript array fill call" }, { "id": "micro-behaviors/data/db/sql::sql-drop-database", "conf": 0.92, "crit": 3, "desc": "SQL DROP DATABASE or SCHEMA statement", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-auth-word", "conf": 0.45, "crit": 1, "desc": "auth route vocabulary word", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/cicd::multi-ci-provider-env-refs--circleci", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (CIRCLECI)", "from": [ { "file": 51 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::test-basename-path", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 3, "desc": "Test file path or basename", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::json-object-variable-field", "conf": 0.84, "crit": 3, "desc": "JSON object includes a variable-valued field", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/eslint/js::eslint/js", "conf": 0.95, "crit": 2, "desc": "imports @eslint/js", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/data/buffer/integer-codec::uint16-be-buffer-write", "conf": 0.85, "crit": 3, "desc": "Writes 16-bit big-endian buffer value", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-nested-concat-this-call", "conf": 0.94, "crit": 3, "desc": "Nested this-concat calls a computed member", "from": [ { "file": 51 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"" }, { "id": "metadata/package/scripts/build::has-build-script-1", "conf": 1.0, "crit": 3, "desc": "Package has compiled build script", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/fs/path/construct::invocation-root-path-join", "conf": 0.9, "crit": 3, "desc": "Builds a path under the invocation directory", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-ci", "conf": 0.75, "crit": 3, "desc": "Reads CI environment flag", "from": [ { "file": 51 } ] }, { "id": "metadata/file/string/cicd::github-workflow-file-path", "conf": 0.98, "crit": 3, "desc": "GitHub Actions workflow file path", "from": [ { "file": 73 } ] }, { "id": "metadata/package/agent-skill::agent-skill-directory-member", "conf": 0.95, "crit": 3, "desc": "File inside an agent skill directory", "from": [ { "file": 174 } ] }, { "id": "micro-behaviors/communications/dns/label::source-dns-query-api", "atk": "T1071.004", "conf": 0.9, "crit": 1, "desc": "Source invokes a DNS query API", "from": [ { "file": 238 }, { "file": 265 }, { "file": 267 } ], "uses": [ 365, 392 ] }, { "id": "objectives/execution/exploit/watering-hole::html-loopback-host-reference", "atk": "T1203", "conf": 0.9, "crit": 3, "desc": "HTML references loopback host", "from": [ { "file": 51 } ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "file": 215 }, { "file": 239 }, { "file": 241 }, { "file": 242 }, { "file": 243 }, { "file": 246 }, { "file": 265 } ], "uses": [ 85, 355 ] }, { "id": "metadata/import/npm/relative/1/quay/js::relative/1/quay/js", "conf": 0.95, "crit": 2, "desc": "imports ./quay.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::fs-readdir", "conf": 0.6, "crit": 3, "desc": "Calls Node.js readdir at least twice", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-key-password-body", "conf": 0.88, "crit": 3, "desc": "Serializes key or password fields", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program", "conf": 0.82, "crit": 3, "desc": "Node spawns a variable program path", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/data/decode/base64::node-base64-tostring-token", "conf": 0.86, "crit": 3, "desc": "Node base64 toString token", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 2 } ] }, { "id": "metadata/package/documentation/security-advisory::ghsa-identifier", "conf": 0.92, "crit": 3, "desc": "References a GitHub Security Advisory identifier", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 9 } ] }, { "id": "metadata/build/minifier::js-large-minified-bundle", "conf": 0.92, "crit": 2, "desc": "Large minified JavaScript bundle", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-svg-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains an inline SVG data URI", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format", "conf": 0.9, "crit": 3, "desc": "Code formats a zero-padded integer", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/socket/create::node-socket-constructor", "conf": 0.8, "crit": 3, "desc": "Constructs a Socket on any receiver", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/web/whatwg-encoding::encoding-get-spec-comment", "conf": 0.99, "crit": 3, "desc": "WHATWG encoding-get concept comment", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/cicd::multi-ci-provider-env-refs--gitlab", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (GITLAB_CI)", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-lower", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "References the lowercase websocket keyword", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::content-type-header", "conf": 0.5, "crit": 3, "desc": "References an HTTP Content-Type header", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/header/custom::file-upload-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "HTTP file upload header stack", "from": [ { "file": 215 }, { "file": 242 }, { "off": 382788, "file": 265, "line": 8393 } ], "uses": [ 72, 241, 431 ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/communications/dns/label::common-source-dns-query-api", "atk": "T1071.004", "conf": 0.88, "crit": 1, "desc": "Source references a common DNS query API", "from": [ { "file": 53 } ] }, { "id": "well-known/tool/development/build/autorest::autorest-generated-header", "conf": 0.96, "crit": 3, "desc": "AutoRest code-generator header comment", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/create/variable-spawn::spawn-destination-variable", "conf": 0.9, "crit": 3, "desc": "Node spawns destination path variable", "from": [ { "file": 51 } ] }, { "id": "objectives/command-and-control/channel/deaddrop/blockchain::evm-result-task-url-parser", "atk": "T1102,T1059", "conf": 0.94, "crit": 3, "desc": "Splits task or command identifier", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/cloud/azure-identity::package-reference", "conf": 0.98, "crit": 3, "desc": "Azure Identity package reference", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/harness/runtime::correct-example-comment", "conf": 0.85, "crit": 3, "desc": "Standalone \"// correct\" example annotation", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/read::node-process-env-object-copy", "conf": 0.93, "crit": 3, "desc": "Copies full Node environment into object", "from": [ { "file": 51 } ] }, { "id": "well-known/tool/sysadmin/github-runner::worker", "conf": 0.95, "crit": 3, "desc": "GitHub Actions Runner.Worker identifier", "from": [ { "file": 51 } ] }, { "id": "metadata/build/ci/permission::job-contents-write-permission", "conf": 0.92, "crit": 3, "desc": "Job grants contents write permission" }, { "id": "micro-behaviors/process/hook/webextension::dnr-referer-header", "conf": 0.8, "crit": 3, "desc": "DNR rule names Referer header", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment", "conf": 0.94, "crit": 3, "desc": "Assigns character code to array element", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/generic-registry/js::relative/1/generic-registry/js", "conf": 0.95, "crit": 2, "desc": "imports ./generic-registry.js", "from": [ { "file": 4 } ] }, { "id": "metadata/import/npm/relative/2/src/main/js::relative/2/src/main/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/main.js", "from": [ { "file": 57 } ] }, { "id": "metadata/file/catalog/service::service-name-github", "conf": 0.6, "crit": 3, "desc": "GitHub service name", "from": [ { "file": 6 } ] }, { "id": "metadata/build/bundler/runtime::js-emscripten-wasm-marker", "conf": 0.98, "crit": 2, "desc": "Contains Emscripten WebAssembly support text", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-url-origin-read", "conf": 0.94, "crit": 3, "desc": "Derives an origin from a URL", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/arithmetic::source-xor-operation", "conf": 1.0, "crit": 3, "desc": "Source references XOR syntax", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-subprotocol-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket subprotocol header", "from": [ { "file": 51 } ] }, { "id": "objectives/execution/automation/agent::agent-target-operation-forward", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 3, "desc": "Agent names target probing activity", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::aws-api-endpoint", "conf": 0.8, "crit": 3, "desc": "References an AWS API endpoint", "from": [ { "file": 6 } ] }, { "id": "objectives/supply-chain/hidden-payload/runtime::bun-data-child-process-reference", "atk": "T1195.002", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Bun data payload references child_process", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL documentation context", "from": [ { "file": 51 } ] }, { "id": "objectives/supply-chain/credential-theft/registry::js-octet-stream-upload", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "JavaScript uploads octet-stream body", "from": [ { "file": 51 } ] }, { "id": "objectives/execution/interpreter/eval/dynamic::constructor-property-access", "atk": "T1059.007", "mbc": "B0032", "conf": 0.65, "crit": 3, "desc": "JavaScript accesses constructor property", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/eslint/eslintrc::eslint/eslintrc", "conf": 0.95, "crit": 2, "desc": "imports @eslint/eslintrc", "from": [ { "file": 22 } ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/communications/dns/label::portable-source-dns-query-api", "atk": "T1071.004", "conf": 0.9, "crit": 1, "desc": "Source references a portable DNS query API", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/fixture::mocha-describe-call", "conf": 0.6, "crit": 2, "desc": "Mocha describe() call", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "WebSocket class reference", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/cicd::multi-ci-provider-env-refs--buildkite", "conf": 0.92, "crit": 3, "desc": "CI provider environment reference (BUILDKITE)", "from": [ { "file": 51 } ] }, { "id": "objectives/anti-analysis/debugger-detect/browser::js-getter-defined-on-probe-object", "atk": "T1622", "mbc": "B0001", "conf": 0.88, "crit": 3, "desc": "Defines a getter on an object", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/string/search::compiled-js-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of JavaScript regex patterns" }, { "id": "objectives/supply-chain/trojanized/app/replace::client-installer-package-name", "atk": "T1195.002,T1505.003", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Client package installer name", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-image-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains an inline image data URI", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/rollup/plugin-commonjs::rollup/plugin-commonjs", "conf": 0.95, "crit": 2, "desc": "imports @rollup/plugin-commonjs", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/manipulation::log-redaction-option", "conf": 0.85, "crit": 3, "desc": "Log redaction option or call", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/auth/js::relative/1/auth/js", "conf": 0.95, "crit": 2, "desc": "imports ./auth.js", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/eslint/compat::eslint/compat", "conf": 0.95, "crit": 2, "desc": "imports @eslint/compat", "from": [ { "file": 22 } ] }, { "id": "metadata/import/npm/docker/actions-toolkit/lib/docker/docker/js::docker/actions-toolkit/lib/docker/docker/js", "conf": 0.95, "crit": 3, "desc": "imports @docker/actions-toolkit/lib/docker/docker.js", "from": [ { "file": 17 } ] }, { "id": "metadata/import/npm/eslint-plugin-import::eslint-plugin-import", "conf": 0.95, "crit": 2, "desc": "imports eslint-plugin-import", "from": [ { "file": 22 } ] }, { "id": "metadata/import/npm/relative/2/src/acr/js::relative/2/src/acr/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/acr.js", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/data/parse/json::json-body-identifier-parse", "conf": 0.9, "crit": 3, "desc": "Parses a body identifier with JSON.parse", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/data/source/unsafe::zlib-implementation-reference", "conf": 0.9, "crit": 3, "desc": "References a zlib implementation", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--cloudflare", "conf": 0.4, "crit": 3, "desc": "Public cloud provider name (Cloudflare)", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/fs/delete/directory::rimraf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Calls the rimraf recursive-deletion API", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::json-object-body-field", "conf": 0.9, "crit": 3, "desc": "Serializes an object into a body field", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/data/decode/symbol-base64::buffer-from-base64", "conf": 0.8, "crit": 3, "desc": "Base64 decoding via Buffer.from (JS)", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/os/env/cicd::github-actions-flag", "conf": 0.85, "crit": 3, "desc": "GITHUB_ACTIONS runtime flag", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/oauth::bearer-auth-header-template", "conf": 0.82, "crit": 3, "desc": "Constructs a Bearer authorization header", "from": [ { "file": 3 } ] }, { "id": "objectives/execution/automation/agent::vulnerability-state-marker-service-version", "atk": "T1059,T1190,T1595", "conf": 0.82, "crit": 3, "desc": "Service-version compound marker", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/body::req-write", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Write data to HTTP request stream", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/time/query::js-triple-new-date", "conf": 0.4, "crit": 3, "desc": "3+ new Date() calls", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-host-port", "conf": 0.86, "crit": 3, "desc": "HTTP options contain hostname and port", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-headers-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Headers header name", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/fs/path/self::cwd-reference", "conf": 0.84, "crit": 3, "desc": "References the Node.js current working directory", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/module/require::node-lazy-net-builtin-import", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Defers loading a Node network builtin", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 51 } ], "uses": [ 174, 264, 490 ] }, { "id": "micro-behaviors/communications/http/authorization-header::authorization-header-index-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Authorization header property assignment", "from": [ { "file": 11 } ] }, { "id": "metadata/build/ci/permission::job-pull-requests-write-permission", "conf": 0.92, "crit": 3, "desc": "Job grants pull-request write permission" }, { "id": "micro-behaviors/data/serialize/schema-object::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/locale::language-label-code-en", "conf": 0.97, "crit": 2, "desc": "English UI language code", "from": [ { "file": 22 } ] }, { "id": "metadata/package/files/runtime::typescript-source-tree-artifact", "conf": 0.95, "crit": 3, "desc": "Source file under src", "from": [ { "file": 2 } ] }, { "id": "well-known/lib/development/npm-semver::range-testset-helper", "conf": 0.98, "crit": 3, "desc": "npm semver range testSet helper", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/header/custom::multipart-upload", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "Multipart form data upload", "from": [ { "file": 242 }, { "file": 265 } ], "uses": [ 302 ] }, { "id": "metadata/import/npm/eslint-plugin-jest::eslint-plugin-jest", "conf": 0.95, "crit": 2, "desc": "imports eslint-plugin-jest", "from": [ { "file": 22 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-pattern", "conf": 1.0, "crit": 2, "desc": "Node.js test filename pattern", "from": [ { "file": 53 } ], "uses": [ 239 ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-number-parse", "conf": 0.9, "crit": 3, "desc": "JavaScript hex-to-integer conversion" }, { "id": "metadata/lang/generated::automatically-generated-source-marker", "conf": 0.85, "crit": 2, "desc": "Generated source provenance marker", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/server/route::javascript-get-route-condition-cluster", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Server defines several HTTP GET routes", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/create/shell/path::shell-executable-reference", "conf": 0.9, "crit": 3, "desc": "References a shell executable", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/body::request-write-raw-data-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "HTTP request writes a raw data variable", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode" }, { "id": "well-known/lib/ui/dompurify::library-marker", "conf": 0.95, "crit": 3, "desc": "DOMPurify sanitization library", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call", "conf": 0.72, "crit": 3, "desc": "Sorts a JavaScript array", "from": [ { "file": 51 } ] }, { "id": "objectives/command-and-control/dropper/execution/wsh-reconstruct::token-array-create-text-fragment", "atk": "T1059.007", "conf": 0.9, "crit": 3, "desc": "-array FSO CreateText fragment", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-microsoft-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Encoded URL references Microsoft documentation", "from": [ { "file": 51 } ] }, { "id": "well-known/lib/network/public-suffix-list::psl-github-io", "conf": 0.9, "crit": 3, "desc": "Public suffix github.io", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/header/content-length::content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/ui/help::command-run-instruction", "conf": 0.84, "crit": 3, "desc": "Command execution help instruction", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/io/stream::stream-write-buffer-arg", "conf": 0.9, "crit": 3, "desc": "Writes a buffer argument to a stream", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/main/js::relative/1/main/js", "conf": 0.95, "crit": 2, "desc": "imports ./main.js", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-16-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 16 bits", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-bracket-github", "conf": 0.8, "crit": 3, "desc": "process.env bracket access for github vars", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/module/require::cjs-require-in-try", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside a try block", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/scripted::coverage-marker-coverage", "conf": 1.0, "crit": 2, "desc": "References code-coverage tooling", "from": [ { "file": 22 } ] }, { "id": "objectives/supply-chain/hidden-payload/eval::js-buffer-from-hex-text", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Buffer.from decodes a hex string", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/verb::javascript-mutating-method-branch-cluster", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "Branches on mutating HTTP request methods", "from": [ { "file": 51 } ] }, { "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest", "atk": "T1195.002", "conf": 0.98, "crit": 3, "desc": "GitHub Action action.yml manifest", "from": [ { "file": 52 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/scripted::it-call", "conf": 0.6, "crit": 3, "desc": "it() function call", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/data/db/sql::sql-drop-object", "conf": 0.8, "crit": 3, "desc": "DROP SQL object syntax reference", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/syntax/schema::username-object-key", "conf": 0.9, "crit": 3, "desc": "Object literal declares a username key", "from": [ { "file": 17 } ] }, { "id": "metadata/import/npm/relative/2/src/ecr/js::relative/2/src/ecr/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/ecr.js", "from": [ { "file": 57 } ] }, { "id": "metadata/build/ci/trigger::scheduled-workflow-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub scheduled workflow trigger" }, { "id": "micro-behaviors/communications/url/host::url-host-property-assignment", "conf": 0.82, "crit": 3, "desc": "Assigns a request or URL host property", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/dns/lookup/query::source-resolver-query", "conf": 0.92, "crit": 3, "desc": "Source or bytecode performs DNS resolution", "from": [ { "file": 238 }, { "file": 265 }, { "file": 267 } ], "uses": [ 344 ] }, { "id": "metadata/package/testing/presence/fixture::expect-call", "conf": 0.6, "crit": 2, "desc": "expect() function call", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-token-secret-body", "conf": 0.88, "crit": 3, "desc": "Serializes token or secret fields", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/communications/http/url/build::http-url-template-literal", "conf": 0.94, "crit": 3, "desc": "Builds an HTTP URL with interpolation", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/response::http-versions", "conf": 0.75, "crit": 3, "desc": "HTTP protocol version strings", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/create/workers::worker-threads-import", "atk": "T1059.007", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Imports worker_threads module", "from": [ { "file": 51 } ] }, { "id": "metadata/import/npm/relative/1/docker-hub/js::relative/1/docker-hub/js", "conf": 0.95, "crit": 2, "desc": "imports ./docker-hub.js", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/url/query::encoded-template-query-parameter", "conf": 0.9, "crit": 3, "desc": "Encodes value in a URL query template", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-percent-encoded-url-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JavaScript commented encoded URL context", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-empty-module-exports", "conf": 0.8, "crit": 3, "desc": "CommonJS module exports an empty object", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/verb::http-post-method-condition", "conf": 0.95, "crit": 3, "desc": "Checks for an HTTP POST method", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-api-reference", "mbc": "C0029", "conf": 0.9, "crit": 3, "desc": "References an HMAC API", "from": [ { "file": 23 } ] }, { "id": "metadata/package/testing/scripted::js-bdd-suite", "conf": 0.85, "crit": 2, "desc": "JavaScript BDD test suite", "from": [ { "file": 53 } ], "uses": [ 86, 459 ] }, { "id": "metadata/file/catalog/unicode::escaped-unicode-codepoint", "conf": 0.99, "crit": 3, "desc": "Escaped Unicode codepoint in source", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/body::oauth-token-field-in-body", "conf": 0.92, "crit": 3, "desc": "Builds body containing OAuth token fields", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-os-platform-alias-branch", "conf": 0.82, "crit": 3, "desc": "Node OS alias platform branch", "from": [ { "file": 215 }, { "file": 238 }, { "file": 239 }, { "file": 241 }, { "file": 242 }, { "off": 1047961, "file": 265, "line": 30103 } ], "uses": [ 9, 127, 306 ] }, { "id": "well-known/tool/detection/security-scanner::sensitive-dir-guard-prohibition", "conf": 0.9, "crit": 3, "desc": "Sensitive-data guard prohibition phrase", "from": [ { "file": 51 } ] }, { "id": "metadata/file/catalog/service::service-name-digitalocean", "conf": 0.6, "crit": 3, "desc": "DigitalOcean service name", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::js-bearer-header-from-secret-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Uses a credential variable in Bearer header", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/time/query::js-triple-date-now", "conf": 0.4, "crit": 3, "desc": "3+ Date.now() calls", "from": [ { "file": 51 } ] }, { "id": "metadata/package/agent-skill::agent-skill-md-basename", "conf": 0.95, "crit": 3, "desc": "Agent skill markdown file name", "from": [ { "file": 174 } ] }, { "id": "metadata/import/builtin::child-process-import-runtime", "conf": 0.85, "crit": 3, "desc": "Imports Node child_process through ESM", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/communications/http/put::presigned-url-reference", "conf": 0.92, "crit": 3, "desc": "References a pre-signed upload URL", "from": [ { "file": 51 } ] }, { "id": "objectives/command-and-control/dropper/delivery/http::suspicious-cloud-image-object--rx-2", "atk": "T1105", "mbc": "B0024", "conf": 0.86, "crit": 3, "desc": "Azure Blob Storage domain reference", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-bounded-while-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript bounded while loop", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/presence/harness::spec-test-filename", "conf": 0.85, "crit": 2, "desc": "Spec or test filename markers", "from": [ { "file": 53 } ] }, { "id": "metadata/import/npm/relative/2/src/gar/js::relative/2/src/gar/js", "conf": 0.95, "crit": 2, "desc": "imports ../src/gar.js", "from": [ { "file": 57 } ] }, { "id": "well-known/tool/development/ci/docker-actions-toolkit::copyright-header", "conf": 0.99, "crit": 3, "desc": "Docker actions-toolkit copyright header", "from": [ { "file": 51 } ] }, { "id": "objectives/execution/automation/autonomous::llm-credential-harvest", "atk": "T1059,T1587.004", "conf": 0.9, "crit": 3, "desc": "LLM credential harvest stage", "from": [ { "file": 51 } ] }, { "id": "well-known/tool/detection/redaction::redacted-replacement-marker", "conf": 0.9, "crit": 3, "desc": "REDACTED replacement marker", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/fs/write/file/full::js-fs-write-sync", "conf": 1.0, "crit": 3, "desc": "Writes file via Node.js fs", "from": [ { "file": 51 } ] }, { "id": "objectives/command-and-control/channel/covert::port-443-constant-assignment", "atk": "T1573,T1043", "mbc": "C0022.002", "conf": 0.7, "crit": 3, "desc": "Assigns 443 to a port variable", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/prototype::return-this-body", "conf": 0.7, "crit": 3, "desc": "Function body returns this", "from": [ { "file": 51 } ] }, { "id": "metadata/package/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "objectives/exfiltration/sensitive-data::js-input-value-data-field", "atk": "T1041", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "DOM input value in object data", "from": [ { "file": 51 } ] }, { "id": "objectives/supply-chain/trojanized/app/replace::vscode-host-main-file-reference", "atk": "T1195.002,T1608.004", "conf": 0.94, "crit": 3, "desc": "Extension targets VS Code main.js", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/eslint-plugin-prettier::eslint-plugin-prettier", "conf": 0.95, "crit": 2, "desc": "imports eslint-plugin-prettier", "from": [ { "file": 22 } ] }, { "id": "objectives/impact/ui/manipulation/traffic::hostname-includes-call", "atk": "T1176,T1185,T1041", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Branches on URL hostname.includes", "from": [ { "file": 51 } ] }, { "id": "metadata/package/testing/scripted::go-fuzz-corpus-entry-basename", "conf": 0.96, "crit": 3, "desc": "Go fuzz corpus entry basename (sha1[-index])" }, { "id": "micro-behaviors/data/string/assembly::sh-template-opening-delimiter", "conf": 0.85, "crit": 3, "desc": "Shell contains a template delimiter", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-amd64", "conf": 0.94, "crit": 3, "desc": "x86 or AMD64 architecture reference", "from": [ { "file": 77 } ] }, { "id": "metadata/file/string/identity::multi-architecture-name-set--arm-mips", "conf": 0.9, "crit": 1, "desc": "ARM or MIPS architecture reference", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::arch-arm64", "conf": 1.0, "crit": 3, "desc": "arm64 architecture string", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-arm", "conf": 0.94, "crit": 1, "desc": "x86 or ARM architecture reference", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--arc-or-arm", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 3, "desc": "Shell ARC or ARM architecture selector", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/process/create/shell/build::yarn-install-command", "atk": "T1059", "conf": 0.82, "crit": 3, "desc": "Yarn package install command", "from": [ { "file": 158 } ] } ] } ] } }