{
  "ml": {
    "v": "7",
    "id": 38615,
    "lvl": -1,
    "conf": 0,
    "prob": 0.000013768672943115234,
    "type": "swift",
    "version": "v18.18",
    "analyzed_at": "2026-09-23T09:42:42Z"
  },
  "path": "actions-3/dist/index.js.map##unicode-escape@0",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 61942,
        "mol": "K₂(Li₂Te)O₆(AsCCaIS₃Xe)H₈(Cm₁₈CrDb₁₉F₈MgOs₇Po₈U)Md₂(Bk)",
        "pid": 1687,
        "rel": "fetched",
        "sha": "a05659b5fa50f55ff757b0a7183b3a919cfb821b8b2a1fced08fccb3ac48bd14",
        "via": "https://codeload.github.com/pulumi/actions/tar.gz/v3",
        "path": "pkg:github/pulumi/actions@v3!!actions-3/dist/index.js.map!!actions-3/dist/index.js.map##unicode-escape@0",
        "risk": 40,
        "size": 997601,
        "type": "javascript",
        "depth": 6,
        "facts": {
          "metrics": {
            "file": {
              "size": 997601,
              "entropy": 4.34
            },
            "binary": {
              "peak_region_bytes": 66560,
              "peak_region_entropy": 5.44
            }
          }
        },
        "traits": [
          {
            "id": "metadata/build/bundler/asset::has-sourcemap",
            "conf": 0.9,
            "crit": 2,
            "desc": "Code has source map reference",
            "spans": [
              [
                438332,
                0
              ]
            ]
          },
          {
            "id": "metadata/build/bundler/wrapper::js-tsc-reexport-getter",
            "conf": 0.97,
            "crit": 2,
            "desc": "Transpiled re-export getter (tsc/babel barrel)",
            "spans": [
              [
                435411,
                0
              ]
            ]
          },
          {
            "id": "metadata/build/bundler/wrapper::js-tslib-reexport-helper",
            "conf": 0.97,
            "crit": 2,
            "desc": "Calls a tslib/TypeScript re-export helper",
            "spans": [
              [
                435246,
                0
              ]
            ]
          },
          {
            "id": "metadata/build/minifier::js-min-or-map-basename",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript minified or map basename"
          },
          {
            "id": "metadata/file/catalog/service::service-name-github",
            "conf": 0.6,
            "crit": 3,
            "desc": "GitHub service name",
            "spans": [
              [
                506210,
                6
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap",
            "conf": 1.0,
            "crit": 3,
            "desc": "JavaScript source map",
            "spans": [
              [
                0,
                19
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::sourcemap-sources-content",
            "conf": 0.9,
            "crit": 3,
            "desc": "Source map sourcesContent array",
            "spans": [
              [
                435206,
                18
              ]
            ]
          },
          {
            "id": "metadata/file/policy/config/identity::android-build-context",
            "conf": 0.85,
            "crit": 3,
            "desc": "Android build or manifest context",
            "spans": [
              [
                873946,
                13
              ]
            ]
          },
          {
            "id": "metadata/file/string/identity::hostname-field-token",
            "conf": 0.4,
            "crit": 1,
            "desc": "Contains a hostname field token",
            "spans": [
              [
                529544,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-code-de",
            "conf": 0.97,
            "crit": 2,
            "desc": "German UI language code",
            "spans": [
              [
                741593,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-code-en",
            "conf": 0.97,
            "crit": 2,
            "desc": "English UI language code",
            "spans": [
              [
                556739,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-table-name",
            "conf": 0.95,
            "crit": 2,
            "desc": "Contains a UI language-label table",
            "spans": [
              [
                764001,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                436438,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                441342,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "spans": [
              [
                440848,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "spans": [
              [
                456505,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                435940,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "spans": [
              [
                446113,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                435265,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::joyent-copyright",
            "conf": 1.0,
            "crit": 2,
            "desc": "Joyent copyright header Node.js",
            "spans": [
              [
                488106,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/dns/label::common-source-dns-query-api",
            "atk": "T1071.004",
            "conf": 0.88,
            "crit": 1,
            "desc": "Source references a common DNS query API",
            "spans": [
              [
                400210,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/dns/label::javascript-dns-api-reference",
            "atk": "T1071.004",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript DNS API reference",
            "spans": [
              [
                853896,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/dns/lookup/txt::resolve-txt-reference",
            "atk": "T1071.004",
            "mbc": "C0011",
            "conf": 0.9,
            "crit": 3,
            "desc": "References the Node.js DNS resolveTxt API",
            "spans": [
              [
                853842,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Auth-like constant assignment",
            "spans": [
              [
                538047,
                29
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.72,
            "crit": 3,
            "desc": "HTTP Bearer authorization header prefix",
            "spans": [
              [
                512809,
                25
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::bearer-token-from-env-var",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.95,
            "crit": 3,
            "desc": "Bearer credential interpolated from an env var",
            "spans": [
              [
                993246,
                99
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/body::request-write-raw-data-variable",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.84,
            "crit": 3,
            "desc": "HTTP request writes a raw data variable",
            "spans": [
              [
                533317,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/post::post",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "HTTP POST method string literal",
            "spans": [
              [
                522867,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/body::req-write",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8,
            "crit": 3,
            "desc": "Write data to HTTP request stream",
            "spans": [
              [
                533317,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/configuration::node-http-options-request-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "HTTP request consumes an options identifier",
            "spans": [
              [
                785739,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-401-unauthorized",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP 401 unauthorized response text",
            "spans": [
              [
                516967,
                21
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::http-403-forbidden",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP 403 forbidden response text",
            "spans": [
              [
                517110,
                18
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::source-http-200-status",
            "atk": "T1190",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Compares HTTP response status property to 200",
            "spans": [
              [
                785943,
                22
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-api-host",
            "conf": 0.86,
            "crit": 3,
            "desc": "GitHub API host reference",
            "spans": [
              [
                503966,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-contents-template-api",
            "conf": 0.86,
            "crit": 3,
            "desc": "GitHub contents API template",
            "spans": [
              [
                596856,
                23
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-git-trees-api-endpoint",
            "conf": 0.92,
            "crit": 3,
            "desc": "GitHub Git trees API endpoint",
            "spans": [
              [
                596870,
                34
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-graphql-api-endpoint",
            "conf": 0.96,
            "crit": 3,
            "desc": "GitHub GraphQL API endpoint",
            "spans": [
              [
                504208,
                22
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-recursive-query-enabled",
            "conf": 0.9,
            "crit": 1,
            "desc": "Enabled recursive query parameter",
            "spans": [
              [
                559207,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/build::network-destination-function-binding",
            "mbc": "C0002",
            "conf": 0.94,
            "crit": 3,
            "desc": "Network destination assigned from call",
            "spans": [
              [
                780632,
                16
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "spans": [
              [
                470774,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/user-agent::mobile-user-agent-header-map-read",
            "conf": 0.94,
            "crit": 3,
            "desc": "Reads User-Agent from a header map",
            "spans": [
              [
                534788,
                19
              ],
              [
                996021,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/connect::net-connect",
            "conf": 0.86,
            "crit": 3,
            "desc": "Node net.connect or createConnection usage",
            "spans": [
              [
                961424,
                12
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/framing::node-be32-frame-length-read",
            "mbc": "C0001",
            "conf": 0.95,
            "crit": 3,
            "desc": "Reads BE32 frame length at offset zero",
            "spans": [
              [
                941256,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/listen::node-server-listen-named",
            "mbc": "C0001",
            "conf": 0.86,
            "crit": 3,
            "desc": "Node named server listens on endpoint",
            "spans": [
              [
                914766,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/ssl::node-check-server-identity-callback",
            "mbc": "C0001",
            "conf": 0.88,
            "crit": 3,
            "desc": "Configures a TLS server-identity callback",
            "spans": [
              [
                697481,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/ssl::reject-unauthorized-false",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node TLS check disabled by option",
            "spans": [
              [
                538372,
                25
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/url/host::url-host-property-assignment",
            "conf": 0.82,
            "crit": 3,
            "desc": "Assigns a request or URL host property",
            "spans": [
              [
                534354,
                16
              ],
              [
                785122,
                16
              ]
            ]
          },
          {
            "id": "micro-behaviors/crypto/asymmetric/key::private-key-identifier",
            "conf": 0.75,
            "crit": 3,
            "desc": "Private-key identifier",
            "spans": [
              [
                905676,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/crypto/library/provider::require-crypto",
            "conf": 0.6,
            "crit": 2,
            "desc": "require('crypto') call",
            "spans": [
              [
                646629,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/zip::powershell-expand-archive-text",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.85,
            "crit": 3,
            "desc": "References PowerShell Expand-Archive cmdlet",
            "spans": [
              [
                588848,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "conf": 0.3,
            "crit": 2,
            "desc": "for loop (content)",
            "spans": [
              [
                435939,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Calls a matcher in a conditional expression",
            "spans": [
              [
                444567,
                23
              ],
              [
                444623,
                24
              ],
              [
                453516,
                17
              ],
              [
                453661,
                28
              ],
              [
                489621,
                18
              ],
              [
                528301,
                86
              ],
              [
                530271,
                90
              ],
              [
                556793,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler",
            "conf": 0.85,
            "crit": 3,
            "desc": "Registers asynchronous named event handler",
            "spans": [
              [
                533096,
                21
              ],
              [
                533419,
                21
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission",
            "conf": 0.82,
            "crit": 3,
            "desc": "Emits object through named JavaScript event",
            "spans": [
              [
                497758,
                27
              ],
              [
                497888,
                27
              ],
              [
                500991,
                23
              ],
              [
                749010,
                27
              ],
              [
                749869,
                23
              ],
              [
                888716,
                19
              ],
              [
                900021,
                26
              ],
              [
                902926,
                21
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/dispatch::object-type-dispatch-switch",
            "conf": 0.93,
            "crit": 3,
            "desc": "Switch dispatches on an object type field",
            "spans": [
              [
                923620,
                21
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::c-family-full-byte-search-loop",
            "conf": 0.88,
            "crit": 3,
            "desc": "C-family loops over all byte values",
            "spans": [
              [
                645813,
                24
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add",
            "conf": 0.85,
            "crit": 3,
            "desc": "Length-bounded loop uses compound addition",
            "spans": [
              [
                701668,
                38
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript iterates enumerable object keys",
            "spans": [
              [
                435940,
                18
              ],
              [
                529656,
                29
              ],
              [
                619417,
                19
              ],
              [
                835722,
                36
              ],
              [
                933773,
                24
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::commonjs-module-reexport",
            "conf": 0.92,
            "crit": 3,
            "desc": "CommonJS module re-exports required package",
            "spans": [
              [
                982545,
                46
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close",
            "conf": 0.86,
            "crit": 3,
            "desc": "Calls a parenthesized function expression",
            "spans": [
              [
                542300,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/decompress/zlib::node-inflate-function",
            "conf": 0.8,
            "crit": 3,
            "desc": "Node zlib inflate decompression call",
            "spans": [
              [
                762566,
                13
              ],
              [
                763288,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/manipulation::log-redaction-option",
            "conf": 0.85,
            "crit": 3,
            "desc": "Log redaction option or call",
            "spans": [
              [
                440395,
                11
              ],
              [
                442141,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/parse/vocabulary::auth-route-auth-word",
            "conf": 0.45,
            "crit": 1,
            "desc": "auth route vocabulary word",
            "spans": [
              [
                396627,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/parse/vocabulary::auth-route-login-word",
            "conf": 0.45,
            "crit": 1,
            "desc": "login route vocabulary word",
            "spans": [
              [
                435145,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/parse/vocabulary::auth-route-session-word",
            "conf": 0.45,
            "crit": 1,
            "desc": "session route vocabulary word",
            "spans": [
              [
                903189,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::command-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Command field or assignment key",
            "spans": [
              [
                436211,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::result-assignment-key",
            "conf": 0.4,
            "crit": 1,
            "desc": "Result field or assignment key",
            "spans": [
              [
                435905,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/schema-object::result-field-key",
            "conf": 0.9,
            "crit": 1,
            "desc": "JSON-like object result field",
            "spans": [
              [
                476059,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source",
            "conf": 1.0,
            "crit": 3,
            "desc": "Source contains low-bit mask syntax",
            "spans": [
              [
                550943,
                5
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/arithmetic::source-xor-operation",
            "conf": 1.0,
            "crit": 3,
            "desc": "Source references XOR syntax",
            "spans": [
              [
                486554,
                3
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls a computed this method",
            "spans": [
              [
                747655,
                41
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster",
            "conf": 0.86,
            "crit": 3,
            "desc": "Dense computed-property call cluster (3+)",
            "spans": [
              [
                439676,
                21
              ],
              [
                747655,
                41
              ],
              [
                870877,
                35
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/identity::host-user-object-fields",
            "conf": 0.9,
            "crit": 3,
            "desc": "Host or user object field keys",
            "spans": [
              [
                536913,
                7
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/read::result-dot-member-read",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads result through dot or arrow access",
            "spans": [
              [
                456278,
                12
              ],
              [
                456356,
                10
              ],
              [
                540337,
                15
              ],
              [
                541377,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy",
            "conf": 0.8,
            "crit": 2,
            "desc": "Copies one indexed array element to another",
            "spans": [
              [
                435537,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-fill-call",
            "conf": 0.8,
            "crit": 3,
            "desc": "JavaScript array fill call",
            "spans": [
              [
                940501,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Joins array with a short delimiter",
            "spans": [
              [
                462448,
                9
              ],
              [
                589637,
                10
              ],
              [
                613359,
                10
              ],
              [
                627377,
                11
              ],
              [
                858546,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Sorts a JavaScript array",
            "spans": [
              [
                600267,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read",
            "conf": 0.8,
            "crit": 2,
            "desc": "Reads an array element into a variable",
            "spans": [
              [
                474013,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "References the toString conversion method",
            "spans": [
              [
                436640,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/replace::keyed-replacement-call",
            "conf": 0.96,
            "crit": 3,
            "desc": "Replaces text using a keyed replacement table",
            "spans": [
              [
                627840,
                30
              ],
              [
                627997,
                25
              ],
              [
                628087,
                25
              ],
              [
                636374,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/search::compiled-js-pattern-set",
            "conf": 0.9,
            "crit": 3,
            "desc": "Compiles a set of JavaScript regex patterns",
            "spans": [
              [
                607902,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/string/search::regexp-compiled-from-table-entry",
            "conf": 0.88,
            "crit": 3,
            "desc": "Builds regex from table entry",
            "spans": [
              [
                610475,
                17
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/directory::node-modules-delete-target",
            "conf": 0.9,
            "crit": 3,
            "desc": "Delete command directly targets node_modules",
            "spans": [
              [
                407023,
                61
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/file/library::js-repeated-unlink-call",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.6,
            "crit": 3,
            "desc": "Repeated Node unlink calls",
            "spans": [
              [
                557877,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::node-dirent-isdirectory",
            "conf": 0.72,
            "crit": 2,
            "desc": "Checks whether Node.js entries are directories",
            "spans": [
              [
                545282,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/enumerate/directory::fs-readdir",
            "conf": 0.6,
            "crit": 3,
            "desc": "Calls Node.js readdir at least twice",
            "spans": [
              [
                592620,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call",
            "conf": 0.84,
            "crit": 3,
            "desc": "Calls Node.js synchronous directory enumeration",
            "spans": [
              [
                592620,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/construct::invocation-root-path-join",
            "conf": 0.9,
            "crit": 3,
            "desc": "Builds a path under the invocation directory",
            "spans": [
              [
                493232,
                21
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/os::linux-release-file-reference",
            "conf": 0.85,
            "crit": 3,
            "desc": "Linux OS release filename reference",
            "spans": [
              [
                570643,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/self::cwd-reference",
            "conf": 0.84,
            "crit": 3,
            "desc": "References the Node.js current working directory",
            "spans": [
              [
                491515,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::read-text-utf8",
            "conf": 0.72,
            "crit": 2,
            "desc": "Reads file content as utf8",
            "spans": [
              [
                503108,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::js-fs-write-sync",
            "conf": 1.0,
            "crit": 3,
            "desc": "Writes file via Node.js fs",
            "spans": [
              [
                599419,
                17
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/shell::shell-profile-append-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Appends with the appendFile API",
            "spans": [
              [
                453005,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/stage::source-temp-api-reference",
            "conf": 0.92,
            "crit": 1,
            "desc": "Source references temporary directory API",
            "spans": [
              [
                578238,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/mem/alloc/heap::megabyte-buffer-allocation",
            "conf": 0.86,
            "crit": 3,
            "desc": "Source allocates a megabyte-sized buffer",
            "spans": [
              [
                769956,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::github-actions-oidc-token-request-env",
            "conf": 0.96,
            "crit": 3,
            "desc": "Actions OIDC token request env vars",
            "spans": [
              [
                455392,
                30
              ],
              [
                455652,
                28
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::github-env-file",
            "conf": 0.85,
            "crit": 3,
            "desc": "GITHUB_ENV environment file",
            "spans": [
              [
                441765,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::github-path-file",
            "conf": 0.85,
            "crit": 3,
            "desc": "GITHUB_PATH environment file",
            "spans": [
              [
                442418,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-bracket-github",
            "conf": 0.8,
            "crit": 3,
            "desc": "process.env bracket access for github vars",
            "spans": [
              [
                441752,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-bracket-runner",
            "conf": 0.85,
            "crit": 3,
            "desc": "process.env bracket access for runner vars",
            "spans": [
              [
                446577,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::process-env-github-repository",
            "conf": 0.78,
            "crit": 3,
            "desc": "Reads GITHUB_REPOSITORY CI variable",
            "spans": [
              [
                504468,
                29
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/read::process-env",
            "conf": 0.8,
            "crit": 2,
            "desc": "Node process.env access",
            "spans": [
              [
                441696,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/vcs::github-token-name-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "References the GITHUB_TOKEN environment variable",
            "spans": [
              [
                506268,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/network/webextension::proxy-host-assignment-from-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Proxy host assigned from a call",
            "spans": [
              [
                785513,
                60
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "DirectoryEntry property write API call",
            "spans": [
              [
                525543,
                5
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-darwin-check",
            "conf": 0.6,
            "crit": 2,
            "desc": "process.platform macOS check",
            "spans": [
              [
                577736,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-win32-check",
            "conf": 0.6,
            "crit": 2,
            "desc": "Checks whether Node.js runs on Windows",
            "spans": [
              [
                478669,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the Node.js process.platform value",
            "spans": [
              [
                478669,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/channel-agent::ai-agent-message-receive-c",
            "atk": "T1059",
            "mbc": "B0022",
            "conf": 0.86,
            "crit": 1,
            "desc": "Incoming-message handler name",
            "spans": [
              [
                412810,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::native-process-launch-call-text",
            "conf": 0.92,
            "crit": 3,
            "desc": "References a native child-process launch call",
            "spans": [
              [
                558653,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::node-execfile-reference",
            "atk": "T1059",
            "conf": 0.86,
            "crit": 3,
            "desc": "References Node execFile API",
            "spans": [
              [
                553386,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/flags::code-powershell-noninteractive-options",
            "conf": 0.96,
            "crit": 3,
            "desc": "Code invokes noninteractive PowerShell",
            "spans": [
              [
                590325,
                426
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/path::shell-executable-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a shell executable",
            "spans": [
              [
                481522,
                7
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/variable-spawn::spawn-destination-variable",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node spawns destination path variable",
            "spans": [
              [
                494626,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call",
            "conf": 0.95,
            "crit": 3,
            "desc": "Invokes preserved console method with arguments",
            "spans": [
              [
                602138,
                26
              ],
              [
                830384,
                17
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/hook/console/assignment::js-console-method-preservation",
            "conf": 0.95,
            "crit": 3,
            "desc": "Preserves original JavaScript console methods",
            "spans": [
              [
                996698,
                26
              ],
              [
                996740,
                27
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-data-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream data handler",
            "spans": [
              [
                494821,
                16
              ],
              [
                495662,
                16
              ],
              [
                519994,
                17
              ],
              [
                675268,
                16
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::node-stream-end-event",
            "conf": 0.88,
            "crit": 3,
            "desc": "Registers a Node stream end handler",
            "spans": [
              [
                520131,
                16
              ],
              [
                675664,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/io/stream::process-stdout-data-listener",
            "conf": 0.9,
            "crit": 3,
            "desc": "Registers a process stdout data listener",
            "spans": [
              [
                494821,
                16
              ]
            ]
          },
          {
            "id": "micro-behaviors/time/query::js-triple-new-date",
            "conf": 0.4,
            "crit": 3,
            "desc": "3+ new Date() calls",
            "spans": [
              [
                539616,
                9
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-3f",
            "mbc": "B0032",
            "conf": 0.5,
            "crit": 3,
            "desc": "0x3f hex byte token",
            "spans": [
              [
                647222,
                4
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/array::js-string-split",
            "conf": 0.6,
            "crit": 3,
            "desc": "Split to empty-delimiter char array",
            "spans": [
              [
                487504,
                10
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/channel/covert::port-443-constant-assignment",
            "atk": "T1573,T1043",
            "mbc": "C0022.002",
            "conf": 0.7,
            "crit": 3,
            "desc": "Assigns 443 to a port variable",
            "spans": [
              [
                542929,
                13
              ],
              [
                853776,
                18
              ]
            ]
          },
          {
            "id": "objectives/execution/automation/agent::agent-target-operation-forward",
            "atk": "T1059,T1190,T1595",
            "conf": 0.88,
            "crit": 3,
            "desc": "Agent names target probing activity",
            "spans": [
              [
                995343,
                78
              ]
            ]
          },
          {
            "id": "objectives/impact/system/directory::windows-recursive-delete-rd",
            "atk": "T1485",
            "conf": 1.0,
            "crit": 3,
            "desc": "Windows recursive deletion via rmdir/rd",
            "spans": [
              [
                557135,
                5
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/dropper/shell::github-ci-identity-fields",
            "atk": "T1195.002,T1574.007",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads GitHub CI actor and repository",
            "spans": [
              [
                503663,
                24
              ],
              [
                504468,
                29
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/hook-file::postinstall-dns-resolve-report",
            "atk": "T1041",
            "conf": 0.86,
            "crit": 3,
            "desc": "postinstall resolves report through DNS",
            "spans": [
              [
                853838,
                11
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/hook-file::process-env-report-field",
            "atk": "T1552.001",
            "conf": 0.94,
            "crit": 3,
            "desc": "Places process.env in report field",
            "spans": [
              [
                502933,
                38
              ],
              [
                503082,
                50
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/trojanized/app/replace::vscode-host-main-file-reference",
            "atk": "T1195.002,T1608.004",
            "conf": 0.94,
            "crit": 3,
            "desc": "Extension targets VS Code main.js",
            "spans": [
              [
                413555,
                9
              ]
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::comparator-prototype-test",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver Comparator.prototype.test",
            "spans": [
              [
                623899,
                25
              ]
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::range-prototype-test",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver Range.prototype.test",
            "spans": [
              [
                637287,
                20
              ]
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::semver-invalid-version-typeerror",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver invalid-version TypeError",
            "spans": [
              [
                611806,
                15
              ]
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::semver-spec-version-export",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver SEMVER_SPEC_VERSION export",
            "spans": [
              [
                602344,
                27
              ]
            ]
          },
          {
            "id": "well-known/lib/web/whatwg-url::bundled-path-marker",
            "conf": 0.99,
            "crit": 3,
            "desc": "Bundled whatwg-url library path marker",
            "spans": [
              [
                417685,
                32
              ]
            ]
          },
          {
            "id": "well-known/tool/sysadmin/github-runner::worker",
            "conf": 0.95,
            "crit": 3,
            "desc": "GitHub Actions Runner.Worker identifier",
            "spans": [
              [
                470822,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::bearer-header-from-token",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.93,
            "crit": 3,
            "desc": "Bearer header from token",
            "spans": [
              [
                512809,
                38
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/authorization-header::javascript-basic-auth-header",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "JavaScript Basic Authorization header",
            "spans": [
              [
                512039,
                37
              ],
              [
                513576,
                38
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/client::generic-request-method-call",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.4,
            "crit": 3,
            "desc": "Generic .request() method call",
            "spans": [
              [
                785739,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::certificate-ref",
            "conf": 0.5,
            "crit": 2,
            "desc": "References certificate terminology",
            "spans": [
              [
                695246,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/decode/base64::base64-decode-call-text",
            "conf": 0.86,
            "crit": 3,
            "desc": "JavaScript invokes a Base64 decoder",
            "spans": [
              [
                847774,
                27
              ],
              [
                848249,
                28
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/encode/base64::tostring-base64",
            "conf": 0.8,
            "crit": 3,
            "desc": "Base64 encoding via toString (JS)",
            "spans": [
              [
                512095,
                18
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/parse/vocabulary::auth-route-token-word",
            "conf": 0.45,
            "crit": 1,
            "desc": "token route vocabulary word",
            "spans": [
              [
                401729,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair",
            "conf": 0.8,
            "crit": 3,
            "desc": "password/passwd key with inline value",
            "spans": [
              [
                511835,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find",
            "conf": 0.85,
            "crit": 2,
            "desc": "Traverses directories using common APIs",
            "spans": [
              [
                592620,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::readfilesync-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls readFileSync",
            "spans": [
              [
                503103,
                18
              ],
              [
                570747,
                16
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-darwin-branch",
            "conf": 0.7,
            "crit": 2,
            "desc": "Branches on macOS platform value",
            "spans": [
              [
                569427,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-linux-branch",
            "conf": 0.7,
            "crit": 2,
            "desc": "Branches on Linux platform value",
            "spans": [
              [
                569539,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-win32-branch",
            "conf": 0.7,
            "crit": 2,
            "desc": "Branches on Windows platform value",
            "spans": [
              [
                478677,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-method-call",
            "conf": 0.75,
            "crit": 3,
            "desc": "Calls a Node OS platform method",
            "spans": [
              [
                567569,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::cmd-exe-reference",
            "conf": 0.8,
            "crit": 3,
            "desc": "References Windows cmd.exe interpreter",
            "spans": [
              [
                481521,
                9
              ],
              [
                482680,
                9
              ],
              [
                482787,
                9
              ],
              [
                551250,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program",
            "conf": 0.82,
            "crit": 3,
            "desc": "Node spawns a variable program path",
            "spans": [
              [
                494626,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text",
            "mbc": "F0011",
            "conf": 0.86,
            "crit": 3,
            "desc": "Detaches a handle with unref()",
            "spans": [
              [
                808857,
                18
              ],
              [
                812570,
                19
              ],
              [
                881612,
                22
              ],
              [
                963012,
                15
              ],
              [
                973197,
                12
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/keywords::download-status-msg",
            "conf": 0.8,
            "crit": 3,
            "desc": "Download status message",
            "spans": [
              [
                580991,
                15
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/fragmentation::js-join-empty-assignment-tail",
            "conf": 0.97,
            "crit": 3,
            "desc": "Variable assigned join('') deobfuscation tail",
            "spans": [
              [
                936506,
                30
              ]
            ]
          },
          {
            "id": "metadata/build/bundler/wrapper::js-tsc-reexport-barrel",
            "conf": 0.96,
            "crit": 2,
            "desc": "Transpiled CommonJS re-export barrel",
            "uses": [
              1,
              2
            ],
            "spans": [
              [
                435246,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-table-codes-a",
            "conf": 0.9,
            "crit": 2,
            "desc": "Common UI language-code pair",
            "uses": [
              10
            ],
            "spans": [
              [
                556739,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/locale::language-label-table-codes-b",
            "conf": 0.9,
            "crit": 2,
            "desc": "European UI language-code pair",
            "uses": [
              9
            ],
            "spans": [
              [
                741593,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/dns/label::source-dns-query-api",
            "atk": "T1071.004",
            "conf": 0.9,
            "crit": 1,
            "desc": "Source invokes a DNS query API",
            "uses": [
              20
            ],
            "spans": [
              [
                400210,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/envelope::command-result-word",
            "conf": 0.4,
            "crit": 1,
            "desc": "Command/result assignment pair",
            "uses": [
              65,
              66
            ],
            "spans": [
              [
                436561,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/secret-name::credential-env-read",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads a credential-bearing environment variable",
            "uses": [
              103
            ],
            "spans": [
              [
                506268,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::multi-platform-branch",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.8,
            "crit": 3,
            "desc": "Multi-platform OS branching logic",
            "uses": [
              106,
              107
            ],
            "spans": [
              [
                478669,
                28
              ],
              [
                577736,
                29
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/branch::node-os-platform-alias-branch",
            "conf": 0.82,
            "crit": 3,
            "desc": "Node OS alias platform branch",
            "uses": [
              146,
              147,
              148,
              149
            ],
            "spans": [
              [
                478677,
                20
              ],
              [
                567569,
                13
              ],
              [
                569427,
                17
              ],
              [
                569539,
                16
              ],
              [
                577744,
                21
              ]
            ]
          },
          {
            "id": "well-known/lib/development/npm-semver::legacy-single-file",
            "conf": 0.98,
            "crit": 3,
            "desc": "npm semver legacy single-file module",
            "uses": [
              130,
              131,
              133
            ],
            "spans": [
              [
                602344,
                27
              ],
              [
                623899,
                25
              ],
              [
                637287,
                20
              ]
            ]
          },
          {
            "id": "metadata/build/bundler/asset::js-any-bundle-output",
            "conf": 0.95,
            "crit": 2,
            "desc": "Contains bundled or minified JavaScript",
            "uses": [
              155
            ],
            "spans": [
              [
                435411,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/dns/lookup/query::source-resolver-query",
            "conf": 0.92,
            "crit": 3,
            "desc": "Source or bytecode performs DNS resolution",
            "uses": [
              158
            ],
            "spans": [
              [
                400210,
                6
              ],
              [
                853838,
                14
              ],
              [
                853896,
                10
              ],
              [
                927405,
                6
              ]
            ]
          },
          {
            "id": "objectives/credential-access/env/secrets/source-control::github-token-indicators",
            "atk": "T1552.001",
            "conf": 0.7,
            "crit": 3,
            "desc": "GitHub token variable indicators",
            "uses": [
              103
            ],
            "spans": [
              [
                506268,
                14
              ]
            ]
          },
          {
            "id": "objectives/credential-access/env/secrets/source-control::github-token",
            "atk": "T1552.001",
            "conf": 0.7,
            "crit": 3,
            "desc": "GitHub token environment variable access",
            "uses": [
              102,
              166
            ],
            "spans": [
              [
                441696,
                11
              ],
              [
                506268,
                14
              ]
            ]
          }
        ]
      }
    ]
  }
}