{
  "llm": {
    "conf": 0.9431448,
    "grade": "hostile",
    "model": "Qwen/Qwen3.8-27B",
    "before": {
      "lvl": -1,
      "prob": 0.9151415,
      "class": "benign"
    },
    "outcome": "hostile",
    "interpretation": "Downloads and executes remote payloads"
  },
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9151415,
        "rte": "az",
        "prob": 0.9151415
      },
      {
        "cls": 0,
        "raw": 0.89232916,
        "rte": "az/tar",
        "prob": 0.89232916
      }
    ],
    "prob": 0.9431448,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9431447982788086,
        "type": "crate"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000008841355338518042,
        "type": "json"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0005229611997492611,
        "type": "rust"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001473228167014895,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-26T13:30:42Z"
  },
  "path": "solana_util-0.1.0.crate",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(C)H₂(Cm₂Po₇)Md₂(In₂Pa)",
        "sha": "a7cd0e08ef5e6d9c1edf18bc0b46ecfb0a483c446b410c888c4a9449035fe370",
        "path": "solana_util-0.1.0.crate",
        "risk": 122,
        "size": 3539,
        "type": "crate",
        "facts": {
          "metrics": {
            "file": {
              "size": 3539,
              "entropy": 7.94
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 3539,
              "peak_region_entropy": 7.8
            }
          }
        },
        "ident": {
          "name": {
            "value": "solana_util",
            "source": "crate.name",
            "verified": false
          },
          "urls": [
            {
              "url": "https://github.com/yourusername/solana_util",
              "kind": "repository",
              "source": "crate.repository"
            }
          ],
          "trust": "unsigned",
          "version": {
            "value": "0.1.0",
            "source": "crate.version",
            "verified": false
          },
          "identifier": {
            "value": "solana_util",
            "source": "crate.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "objectives/command-and-control/dropper/execution/pipe::process-curl-pipe-shell-call",
            "conf": 0.92,
            "crit": 1,
            "desc": "Process API occurs near shell pipeline",
            "from": [
              {
                "file": 5
              }
            ],
            "uses": [
              12,
              13
            ]
          },
          {
            "id": "metadata/import/rust/std/process/command::std/process/command",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports std::process::Command",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-embedded-text",
            "atk": "T1105",
            "conf": 0.86,
            "crit": 3,
            "desc": "Non-shell curl text contains quiet flags",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/version::cargo-package-version",
            "conf": 0.85,
            "crit": 2,
            "desc": "Cargo package has version"
          },
          {
            "id": "micro-behaviors/data/runtime/keywords::pipe-to-bash",
            "conf": 0.88,
            "crit": 1,
            "desc": "Pipe to bash interpreter token",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "conf": 0.7,
            "crit": 3,
            "desc": "Invokes PowerShell with command-line options",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/name/convention::cargo-license-field",
            "conf": 0.85,
            "crit": 2,
            "desc": "Cargo package declares license"
          },
          {
            "id": "micro-behaviors/process/interpreter/powershell/command::encoded-command-line",
            "atk": "T1059.001,T1027",
            "conf": 0.94,
            "crit": 3,
            "desc": "PowerShell encoded-command launch",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-spawn",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Spawns a child process via Rust Command",
            "from": [
              {
                "file": 5
              }
            ],
            "uses": [
              19,
              32
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/pipe::spawned-curl-pipe-shell-rce",
            "atk": "T1059.004",
            "conf": 0.97,
            "crit": 5,
            "desc": "Spawned curl-pipe-shell remote code execution",
            "from": [
              {
                "file": 5
              }
            ],
            "uses": [
              0,
              12
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-powershell",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.96,
            "crit": 3,
            "desc": "Rust launches PowerShell",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/name/convention::cargo-meaningful-description",
            "conf": 0.78,
            "crit": 2,
            "desc": "Cargo package has meaningful description"
          },
          {
            "id": "micro-behaviors/process/create/shell/pipeline::curl-pipe-shell-text",
            "atk": "T1059.004",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a curl- or wget-to-shell pipeline",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call",
            "conf": 0.9,
            "crit": 1,
            "desc": "Process API invocation",
            "from": [
              {
                "file": 5
              }
            ],
            "uses": [
              31
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-from-import",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.95,
            "crit": 3,
            "desc": "Constructs a Rust command using imported Command",
            "from": [
              {
                "file": 5
              }
            ],
            "uses": [
              21,
              31
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::rust-cfg-test",
            "conf": 0.9,
            "crit": 2,
            "desc": "#[cfg(test)] attribute",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-curl-wget",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.92,
            "crit": 3,
            "desc": "Constructs curl or wget process command",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-process-command",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.95,
            "crit": 3,
            "desc": "Constructs a Rust child-process command",
            "from": [
              {
                "off": 152,
                "file": 5,
                "line": 7
              }
            ],
            "uses": [
              15
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-status-call",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.92,
            "crit": 3,
            "desc": "Rust Command runs child synchronously",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-process-command-import",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.95,
            "crit": 3,
            "desc": "Imports Rust process::Command",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/import/rust/std/process/stdio::std/process/stdio",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports std::process::Stdio",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::rust-test-attr",
            "conf": 0.9,
            "crit": 2,
            "desc": "#[test] attribute",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/name/convention::cargo-package-name",
            "conf": 0.85,
            "crit": 2,
            "desc": "Cargo package has name"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/system::rust-command",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Executes proc via Rust std::proc::cmd",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::rust-test",
            "conf": 0.95,
            "crit": 3,
            "desc": "Rust test marker or harness",
            "from": [
              {
                "off": 5401,
                "file": 5,
                "line": 107
              }
            ],
            "uses": [
              16,
              23
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation",
            "atk": "T1059.001,T1059.003",
            "conf": 0.94,
            "crit": 3,
            "desc": "Windows shell command-mode invocation syntax",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/name/convention::cargo-repository-field",
            "conf": 0.85,
            "crit": 2,
            "desc": "Cargo package declares repository"
          },
          {
            "id": "micro-behaviors/communications/http/url/path::image-file-url",
            "conf": 0.85,
            "crit": 3,
            "desc": "HTTP URL targets an image file",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::rust-command-new-call",
            "atk": "T1059",
            "conf": 0.85,
            "crit": 3,
            "desc": "Constructs a Rust process command",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-spawn-call",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Rust Command spawns a child process",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/rust/super::super",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports super::*",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/name/convention::cargo-readme-field",
            "conf": 0.85,
            "crit": 2,
            "desc": "Cargo package declares readme"
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 94,
              "entropy": 4.65
            },
            "json": {
              "parsed_bytes": 94,
              "parse_limit_bytes": 76800
            },
            "binary": {
              "peak_region_bytes": 94,
              "peak_region_entropy": 4.65
            }
          }
        },
        "id": 1,
        "path": "solana_util-0.1.0.crate!!solana_util-0.1.0/.cargo_vcs_info.json",
        "pid": 0,
        "risk": 1,
        "sha": "ffe3148d32c54dea6134a90a8d624d5c25de3c200a962ea7f6f101bed491c7bf",
        "size": 94,
        "traits": [
          {
            "id": "metadata/file/extension/identity::json-txt-md-basename",
            "conf": 1.0,
            "crit": 2,
            "desc": "JSON, text, or markdown filename extension"
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 2,
            "desc": "Common web or JSON file extension"
          },
          {
            "id": "metadata/file/format/conformance::json-document-opening",
            "conf": 0.95,
            "crit": 2,
            "desc": "File begins with a JSON document",
            "spans": [
              [
                0,
                0
              ]
            ]
          }
        ],
        "type": "json"
      },
      {
        "ctx": [
          {
            "b": "B-RapB97}Ni=GaTv}x.5iY.QPz/6u1zE+pvq/(L:z*:XO3nj4=awuG!B:b}\u0026v%8*dat4hDq+Oq@B-IpZaBCqvvrl8?w]n-iB-7M5x(n6rc[co=3lQDlaAhvnzGGYjaT!KsdQse}Aa9%dx(mMaoLFx!CPZ%lD2dzcwg/F!a$kOX3lQDlaz+Rhay/Lmy-\u003e\u003e-lVl*UvqYQpi=nIMc)AezA+({G3lQDlarR^Hatd8yxlbF93lQDlarR^HarR^Har\u0026yHB5L:Red9HxarR^HarR^HarR\u003ewBAzFyiXJc@xLzr{A+P2(y+oEtvqPB8wNWROv}dcewPR:5w{D1qAbWEtvrl9#x(n6re]$XIed9HxarR^HarT@s3lQDlarR^Hatd.Swn=Qjc@Uj#x(u3[Aa%o5wge(Q3lQDlarR^Hatd.OvrVPqdgdguarR^HarSpFCYmk7BsntBvqfK?wft#jaAIHgCwXKkB-Ipxdlv\u003ezarR^Hy?mYhB97\u0026jB-OV*avy6:zddr)iY.d\u0026CpjUAvrl9adgdguarR^HarSpTByY96c$vyuy+x^Jwn=Qje{h5QA:-]ndjCPDarR^HarR^VB97\u0026jB-O@W3lQDlarR^HatdkIAaJK3c)Anix(4u\u003eaARJAB8UMizxJy%B7=:Di%(rqarR!CA+PAky\u0026gyAb3MK5ayX=2xDQ(hx()]%aA}KwxGvn.iZn3pefG1QvruTkdlv(+3jnBtfcCauv]32:ay/Lmy-\u003erwB5L:PjAUWXj%kj}vQTs\u003e3tae#A=(nbzdc{)B0@EWDKp(rarUSzx(n3ezxQzLtpJ]3q/De?zFs03az\u003eK%pG5xPvr(WcvpQ#ye*q-a3jm)#arUGiBrC7oA+(\u003cYavy6:zddr)iY.d\u0026CpjUBB-IpxdgdguarR^HarSpBA+xCwtm8F}arR^HarR^HarR\u003cWw]*)Aa$K6zarR^HarR^HarR^JxMOunB2\u003e%cBAI5ny*?uov{%C1vrt{fg?nA%whk=PwPR:5w{D1qAbWEEvpH{hxD!#marR^HarR^Ht}3a6arR^HarR^VB97@hB-Y3gByY97iY.j]AaJMddjCPDarR^HarR^VB8UMizyu}varR^HarR^He[GoDwN/*gb4+m$y?mc1Bz\u0026pyAa9%day/Lmy:7q\u00263jm)#arUGiBrCTDvruTkauZ\u0026mz/6u1zE+^?zE[2ub4s#4xD!(jarR^HarR^He]#bBx(kteB-IpJB97@hB-YlUzG*bfA40d:3lQDlarR^Hat9",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "aAhvnzGGYjaT!KsdQsfavrl98wQ4{hwN({cx([2HaBudlEiHi+B97\u0026jB-O#[3vJl*fe1$3s7#L.z*cm-aAhmywPz\u003c9wO=f9ePbGCat4^WxDO)rA3eRnAa9*eat331v@C)?wj7oLzddr)auTawB7El^j{\u003e[taAzQxuW3j4wn=Wkc[co=3lQDlaAhvnzGGYjaT!KsdQse}Aa9%dx(mMas7#L.z*cmBAaa3dz^^fee?Os%i%(rqarR^Hatkw\u003ceIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIdqLarR^Wfcz#4avHc(zFTl1wft#cwGUY7vp%c]Bz\u0026pzxK@q@B-IIlzGE1ix(W={Bz(hBasICEwPzu8Bzbkdp/vYzarR^WfczwWaAI4kx(FepCwg(faz+$myANkcAV/7raA?EcasIhMwgoccvruf9fczJpq=vgDx(Fe(z/o.uw)]H(vQS+ZdgdguarSr\u003cat2e%eIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeKYarR^Hy?mYhx(do\u003ewNxO2y-\u003e\u003e-b4#7uAc15[flztCB.\u003eGbeN@jgB76f0eI{#{fK#{\u003ezE){ax\u003ezSyvq{fsB7ol4wO#N5z//twe]UYvb0cbOarR!ywPP5ezdd6*uVoB}xDPCXb6dmmwO2+2xM501ga)J-xcGzA3lQDlaAhvnzGGYjaT!KsdQse+z*c8nz^^f\u003czF78sEipc{e*q??x(do\u003ewNxO2y:?BM3lQDlaz+Rhay]p}B97\u0026jB-OV*avy6:zddr)iY.d\u0026CpjUBB-IpxdgdguarR^HarSpBA+xCwtm8F}arR^HarR^HarR\u003cWw]*)Aa$K6zarR^HarR^HarR^JePh*:azCX3xjUB?vrufl3lQDlarR^HarR^HazCX3xjUB)A+)olarR^HarR^Ht}3a6arR^HarR^VB97\u0026jB-O@W3lQDlarR^HatdkIAaJK3c)Anix(4u\u003eaARJAB8UMizxJCiA+(\u003egz/M$hz*c8nz^^f2dlv\u003ezarR^Hx\u003ewFhwnCQ]ByxolB1RJRv}f7\u003eB0@EWDKp(rarR^HarUlmA+PAky\u0026gyAb3MT8aw3AUxjSh@z*c8nz^^f0w)]x",
            "ln": 1052,
            "col": 4,
            "line": 42
          },
          {
            "b": "eIdqLarR^WfcA25avQJ^v%8)8aARpdaz2C2z!9A\u0026aw^02wPyZ.wO=f9Aaa3dz^^e-arR^Hfe1C1eIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLa",
            "ln": 2168,
            "col": 72,
            "line": 73
          },
          {
            "b": "z*b=kq!P-Uy-)X9D2dzcwg/F!a$kOX3lQDlatkw\u003cp*[A!wGV8dwGTAzk%[P]wO#0@wmYo]v@Dj3vqYP#w].*baBd)FAV/pvx\u003eIc$vqE66wPI{3xjSi0wPzuy3lQDlaz+Rhaz2C2z!9A\u0026auZ?\u003enQ0Ekk$jNmrZx5Mk$ajdrCaS#k%)s(r+B-#k$aHlrcHU$k$a^toI[a",
            "ln": 2323,
            "col": 30,
            "line": 76
          },
          {
            "b": "rC+=It17]4vNS)DwjGWDog8P@vPN5UoHzV}vTifkvRGTslUwLBb0cbsarR^Hy?mYhAc2xcByxolB09Q*lVl*UvqYQpi=nIMc)ARGCv+/oxK#0@a$i\u003cwarR^HarR^Vvrc14c%E33arR^HarR^HarR^JePbGCa$K6zarR^HarR^HarR^JeQ5x\u0026ar\u003eFyed9HxarR^HarR^HarR\u003cWwPe?Aar\u003eouAa9*ea$K6zarR^HarR^HarR^JeK:L!z!9A\u0026lVl*UvqYQ1ed9HxarR^HarR^HarUlkv@C)?wgO6garR^HarR!jdgdguarR^HarSpTByxolB0@EAarR^HarR^He[GoDwN/*gb4+m$y?mc1Bz\u0026pyAa9%daAhmywPz\u003c9wO=fbdlv\u003ezarR^HAb]VgBzL?rc)z\u003eBt{8%ZCv+![xK#0@az2!iBy!#9CwhejiV@=gkyB.baAhyeB97\u0026jB-O#[3vJl*w]n-9zFsi1B8L(4v@z",
            "ln": 4783,
            "col": 2364,
            "line": 79
          },
          {
            "b": "z//V7AV^Ieaz2Ijx(n3ezxQzLrC((2AbY-oBy!#9Abn%8w]zZbiV@=$a$K\u003cPBzbladj+/jarR^HEf$xfbu[U\u0026xdd\u003ekB95\u003cp3t\u003cY(aARgoBAnNK3lQDlaA.:paAIWAwPx*)dMW$AarR^Hbu]n3B97W{arR^Hw]n-9ByflgA+/.AdiJ%A2{pvcvru0)aAITniYZ?\u0026B#?V]z/fSrB2(uTqY{z]2)?!(x(n6ra%o3jaAzQxuU\u003cB]B:bq-ed8W\u0026b5H:#z/W9BjW70eB-7M6vpKj%c[cXO2)?/1x(mE1Cxj@JjW70eB-7Mgx(mC",
            "ln": 5293,
            "col": 3,
            "line": 100
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "std::process::Command::new.args.stdout.spawn.expect"
            ],
            [
              "",
              "std::process::Command::new.args.stdout.spawn"
            ],
            [
              "",
              "std::process::Command::new.args.stdout"
            ],
            [
              "",
              "std::process::Command::new.args"
            ],
            [
              "",
              "std::process::Command::new"
            ],
            [
              "",
              "std::process::Stdio::piped"
            ],
            [
              "",
              "std::process::Command::new.stdin.status.expect"
            ],
            [
              "",
              "std::process::Command::new.stdin.status"
            ],
            [
              "",
              "std::process::Command::new.stdin"
            ],
            [
              "",
              "std::process::Command::new"
            ],
            [
              "",
              "curl.stdout.unwrap"
            ],
            [
              "",
              "std::process::Command::new.args.stdout.spawn.expect"
            ],
            [
              "",
              "std::process::Command::new.args.stdout.spawn"
            ],
            [
              "",
              "std::process::Command::new.args.stdout"
            ],
            [
              "",
              "std::process::Command::new.args"
            ],
            [
              "",
              "std::process::Command::new"
            ],
            [
              "",
              "std::process::Stdio::piped"
            ],
            [
              "",
              "std::process::Command::new.stdin.status.expect"
            ],
            [
              "",
              "std::process::Command::new.stdin.status"
            ],
            [
              "",
              "std::process::Command::new.stdin"
            ],
            [
              "",
              "std::process::Command::new"
            ],
            [
              "",
              "curl.stdout.unwrap"
            ],
            [
              "",
              "std::process::Command::new.args.status.expect"
            ],
            [
              "",
              "std::process::Command::new.args.status"
            ],
            [
              "",
              "std::process::Command::new.args"
            ],
            [
              "",
              "std::process::Command::new"
            ],
            [
              "",
              "dl_status.success"
            ],
            [
              "",
              "std::process::Command::new.args.status.expect"
            ],
            [
              "",
              "std::process::Command::new.args.status"
            ],
            [
              "",
              "std::process::Command::new.args"
            ],
            [
              "",
              "std::process::Command::new"
            ],
            [
              "",
              "run_linux"
            ],
            [
              "",
              "run_macos"
            ],
            [
              "",
              "run_windows"
            ],
            [
              "",
              "run_linux"
            ],
            [
              "",
              "run_macos"
            ],
            [
              "",
              "run_windows"
            ],
            [
              "",
              "std::process::Command"
            ],
            [
              "",
              "std::process::Stdio"
            ],
            [
              "",
              "super::*"
            ]
          ],
          "mbr": [
            "Command::new.args",
            "Command::new.args.status",
            "Command::new.args.status.expect",
            "Command::new.args.stdout",
            "Command::new.args.stdout.spawn",
            "Command::new.args.stdout.spawn.expect",
            "Command::new.stdin",
            "Command::new.stdin.status",
            "Command::new.stdin.status.expect",
            "curl.stdout",
            "curl.stdout.unwrap",
            "dl_status.success"
          ],
          "tgt": [
            "curl.stdout.unwrap",
            "dl_status.success",
            "run_linux",
            "run_macos",
            "run_windows",
            "std::process::Command::new",
            "std::process::Command::new.args",
            "std::process::Command::new.args.status",
            "std::process::Command::new.args.status.expect",
            "std::process::Command::new.args.stdout",
            "std::process::Command::new.args.stdout.spawn",
            "std::process::Command::new.args.stdout.spawn.expect",
            "std::process::Command::new.stdin",
            "std::process::Command::new.stdin.status",
            "std::process::Command::new.stdin.status.expect",
            "std::process::Stdio::piped"
          ],
          "funcs": [
            [
              "run_linux",
              72
            ],
            [
              "run_macos",
              609
            ],
            [
              "run_windows",
              1174
            ],
            [
              "init_sol_config",
              5155
            ],
            [
              "it_works",
              5417
            ]
          ],
          "metrics": {
            "ast": {
              "max_depth": 15,
              "call_count": 37,
              "node_count": 826,
              "member_count": 12,
              "max_array_len": 7,
              "member_depth_max": 5
            },
            "file": {
              "size": 5619,
              "entropy": 5.7
            },
            "text": {
              "lines": 116,
              "top_char": 45,
              "tab_count": 19,
              "max_ws_run": 4,
              "digit_ratio": 0.06,
              "space_count": 693,
              "char_entropy": 5.7,
              "mixed_indent": 1,
              "unique_chars": 88,
              "top_char_null": 0,
              "lines_over_200": 1,
              "lines_over_500": 1,
              "string_density": 0.39,
              "top_char_ratio": 0.05,
              "ascii_art_lines": 4,
              "avg_line_length": 47.44,
              "lines_over_1000": 1,
              "max_line_length": 2405,
              "empty_line_ratio": 0.16,
              "last_line_length": 1,
              "long_token_count": 1,
              "whitespace_ratio": 0.15,
              "identifier_density": 0.91,
              "line_length_stddev": 220.97,
              "encoded_string_ratio": 0.02,
              "normalized_string_count": 4.18,
              "repeated_char_sequences": 16,
              "suspicious_string_ratio": 0.11,
              "normalized_unique_identifiers": 4.96
            },
            "binds": {
              "count": 9
            },
            "binary": {
              "peak_region_bytes": 3072,
              "peak_region_entropy": 5.71
            },
            "source": {
              "function_count": 5
            },
            "imports": {
              "count": 3,
              "wildcard": 1,
              "third_party_count": 3,
              "third_party_ratio": 1
            },
            "strings": {
              "bytes": 3145,
              "count": 45,
              "shell": 5,
              "url_count": 3,
              "very_long": 1,
              "avg_length": 69.89,
              "max_length": 2384,
              "avg_entropy": 3.09,
              "entropy_stddev": 1.14,
              "base64_candidates": 1,
              "high_entropy_count": 1
            },
            "comments": {
              "chars": 635,
              "count": 11,
              "lines": 11,
              "to_code_ratio": 0.1
            },
            "functions": {
              "count": 5,
              "density": 4.31,
              "code_ratio": 0.88,
              "length_stddev": 14.65,
              "avg_name_length": 10.4,
              "no_params_count": 5,
              "avg_length_lines": 20.4,
              "max_length_lines": 48,
              "min_length_lines": 8
            },
            "identifiers": {
              "count": 105,
              "unique": 34,
              "avg_length": 6.41,
              "max_length": 15,
              "min_length": 2,
              "avg_entropy": 2.29,
              "reuse_ratio": 0.32,
              "length_stddev": 2.68,
              "all_lowercase_ratio": 0.91,
              "all_uppercase_ratio": 0.03
            }
          }
        },
        "id": 5,
        "mol": "O(C)H₂(Cm₂Po₇)Md₂(In₂Pa)",
        "path": "solana_util-0.1.0.crate!!solana_util-0.1.0/src/lib.rs",
        "pid": 0,
        "risk": 122,
        "sha": "e8c5841e424bceb2bde2e200fd9dd0f475596d38f992b3db5839a34ba9685985",
        "size": 5619,
        "traits": [
          {
            "id": "metadata/import/rust/std/process/command::std/process/command",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports std::process::Command",
            "spans": [
              [
                19,
                21
              ]
            ]
          },
          {
            "id": "metadata/import/rust/std/process/stdio::std/process/stdio",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports std::process::Stdio",
            "spans": [
              [
                28,
                19
              ]
            ]
          },
          {
            "id": "metadata/import/rust/super::super",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports super::*",
            "spans": [
              [
                5390,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                1338,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                1414,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "spans": [
              [
                549,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::rust-cfg-test",
            "conf": 0.9,
            "crit": 2,
            "desc": "#[cfg(test)] attribute",
            "spans": [
              [
                5357,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::rust-test-attr",
            "conf": 0.9,
            "crit": 2,
            "desc": "#[test] attribute",
            "spans": [
              [
                5401,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-embedded-text",
            "atk": "T1105",
            "conf": 0.86,
            "crit": 3,
            "desc": "Non-shell curl text contains quiet flags",
            "spans": [
              [
                48,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::image-file-url",
            "conf": 0.85,
            "crit": 3,
            "desc": "HTTP URL targets an image file",
            "spans": [
              [
                1557,
                59
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-curl-wget",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.92,
            "crit": 3,
            "desc": "Constructs curl or wget process command",
            "spans": [
              [
                152,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-powershell",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.96,
            "crit": 3,
            "desc": "Rust launches PowerShell",
            "spans": [
              [
                4847,
                26
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-spawn-call",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Rust Command spawns a child process",
            "spans": [
              [
                152,
                188
              ],
              [
                689,
                181
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-status-call",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.92,
            "crit": 3,
            "desc": "Rust Command runs child synchronously",
            "spans": [
              [
                401,
                74
              ],
              [
                1733,
                138
              ],
              [
                4847,
                194
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-process-command-import",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.95,
            "crit": 3,
            "desc": "Imports Rust process::Command",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::rust-command-new-call",
            "atk": "T1059",
            "conf": 0.85,
            "crit": 3,
            "desc": "Constructs a Rust process command",
            "spans": [
              [
                152,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation",
            "atk": "T1059.001,T1059.003",
            "conf": 0.94,
            "crit": 3,
            "desc": "Windows shell command-mode invocation syntax",
            "spans": [
              [
                1117,
                15
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/system::rust-command",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Executes proc via Rust std::proc::cmd",
            "spans": [
              [
                152,
                44
              ],
              [
                401,
                39
              ],
              [
                1733,
                38
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/powershell/command::encoded-command-line",
            "atk": "T1059.001,T1027",
            "conf": 0.94,
            "crit": 3,
            "desc": "PowerShell encoded-command launch",
            "spans": [
              [
                1117,
                47
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/runtime/keywords::pipe-to-bash",
            "conf": 0.88,
            "crit": 1,
            "desc": "Pipe to bash interpreter token",
            "spans": [
              [
                64,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "conf": 0.7,
            "crit": 3,
            "desc": "Invokes PowerShell with command-line options",
            "spans": [
              [
                1116,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/pipeline::curl-pipe-shell-text",
            "atk": "T1059.004",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a curl- or wget-to-shell pipeline",
            "spans": [
              [
                48,
                23
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-command-from-import",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.95,
            "crit": 3,
            "desc": "Constructs a Rust command using imported Command",
            "uses": [
              14,
              15
            ],
            "spans": [
              [
                0,
                26
              ],
              [
                152,
                13
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/pipe::process-api-call",
            "conf": 0.9,
            "crit": 1,
            "desc": "Process API invocation",
            "uses": [
              15
            ],
            "spans": [
              [
                152,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-process-command",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.95,
            "crit": 3,
            "desc": "Constructs a Rust child-process command",
            "uses": [
              22
            ],
            "spans": [
              [
                0,
                26
              ],
              [
                152,
                13
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/pipe::process-curl-pipe-shell-call",
            "conf": 0.92,
            "crit": 1,
            "desc": "Process API occurs near shell pipeline",
            "uses": [
              21,
              23
            ],
            "spans": [
              [
                152,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::rust-spawn",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Spawns a child process via Rust Command",
            "uses": [
              12,
              24
            ],
            "spans": [
              [
                0,
                26
              ],
              [
                152,
                188
              ],
              [
                689,
                181
              ]
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::rust-test",
            "conf": 0.95,
            "crit": 3,
            "desc": "Rust test marker or harness",
            "uses": [
              6,
              7
            ],
            "spans": [
              [
                5357,
                12
              ],
              [
                5401,
                11
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/pipe::spawned-curl-pipe-shell-rce",
            "atk": "T1059.004",
            "conf": 0.97,
            "crit": 5,
            "desc": "Spawned curl-pipe-shell remote code execution",
            "uses": [
              21,
              25
            ],
            "spans": [
              [
                48,
                23
              ],
              [
                152,
                13
              ]
            ]
          }
        ],
        "type": "rust"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 852,
              "entropy": 4.73
            },
            "binary": {
              "peak_region_bytes": 852,
              "peak_region_entropy": 4.73
            },
            "registry": {
              "age_days": 0,
              "published_at": 1790407283,
              "releases_24h": 1,
              "releases_48h": 1,
              "is_deprecated": 0,
              "release_count": 1,
              "unpacked_size": 3539,
              "downloads_total": 0,
              "version_removed": 0,
              "package_age_days": 0,
              "first_published_at": 1790407283
            }
          }
        },
        "id": 6,
        "mol": "Md(Re)",
        "path": "solana_util@0.1.0.registry.json",
        "pid": 0,
        "rel": "registry",
        "risk": 1,
        "role": "sidecar",
        "sha": "5c9707245a50d03af8a26ca8b10cfe50cde88272f6266bdb638ccfa9ceae78f6",
        "size": 852,
        "traits": [
          {
            "id": "metadata/registry::brand-new-package",
            "conf": 1.0,
            "crit": 3,
            "desc": "Package first published within seven days"
          },
          {
            "id": "metadata/registry::few-releases",
            "conf": 1.0,
            "crit": 3,
            "desc": "Three or fewer releases"
          },
          {
            "id": "metadata/registry::recent-package",
            "conf": 1.0,
            "crit": 3,
            "desc": "Package under two months old"
          },
          {
            "id": "metadata/registry::freshly-published",
            "conf": 1.0,
            "crit": 3,
            "desc": "Release published within seven days"
          }
        ],
        "type": "registry"
      }
    ],
    "rev": "c1ea9",
    "v": "8"
  }
}