{
  "llm": {
    "conf": 0.99829227,
    "grade": "hostile",
    "model": "Qwen/Qwen3.8-27B",
    "outcome": "hostile",
    "interpretation": "obfuscated eval dropper in preinstall"
  },
  "ml": {
    "v": "7",
    "id": 1,
    "lvl": 25,
    "conf": 92,
    "prob": 0.9950000047683716,
    "type": "npm",
    "version": "v18.18",
    "analyzed_at": "2026-09-01T12:47:44Z"
  },
  "path": "@7nohe-openapi-react-query-codegen-1.6.4.tgz",
  "raw": {
    "files": [
      {
        "id": 1,
        "ctx": [
          {
            "b": "abZy80000000zq}?l9RTA?27PlG\u003ckS3uxc\u003cs9CD\u003e9sqiA{}T9q8Z3z?Q9Qui5H\u003eHhEdb77gOb#NT.E7vPALAsq8v3dDW!oCt}n#*wjkH[@J?1zUM9@x%noUc?t-Ak}ty6WfjhG[:)RAy@{[m:fz\u0026JZ\u003etcN3\u003c)9Bw@Q/c@kMyxKM/0k\u003c]3-}$Fbkw^EF}#KH5.8rZX:G+}[}\u003e^FbWvy@@hUw@!HKpUFRgnFb.+5PrdoMkM7DLWz8KgF1bT3\u003ca3!/@iH[MFbWTa@u86qZX(dL(+At]@t.B]FbYnwPmlb4%m2\u003cIff/Hc.W\u003eS?%ds/u]6#s^}(/HYZY1ib]z+pA@2+%$=\u0026r}",
            "ln": 0
          }
        ],
        "mol": "O₃(S₄XeAs₂)H₃(Db₄F₂Po)Md(Pa₈)",
        "pid": 0,
        "rel": "fetched",
        "sha": "a8c00f59e629e5bc4fc6a116fa1ceb8fcf328893a9c798ca446fdcacb0fbdc18",
        "via": "https://registry.npmmirror.com/@7nohe/openapi-react-query-codegen/-/openapi-react-query-codegen-1.6.4.tgz",
        "path": "https://registry.npmmirror.com/@7nohe/openapi-react-query-codegen/-/openapi-react-query-codegen-1.6.4.tgz",
        "refs": [
          {
            "to": "pkg:github/7nohe/openapi-react-query-codegen",
            "off": 0,
            "kind": "repository"
          }
        ],
        "risk": 403,
        "size": 1089870,
        "type": "npm",
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1089870,
              "entropy": 7.99
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 1088512,
              "peak_region_entropy": 7.86
            }
          }
        },
        "ident": {
          "name": {
            "value": "@7nohe/openapi-react-query-codegen",
            "source": "npm.name",
            "verified": false
          },
          "urls": [
            {
              "url": "git+https://github.com/7nohe/openapi-react-query-codegen.git",
              "kind": "repository",
              "source": "npm.repository.url"
            },
            {
              "url": "https://github.com/7nohe/openapi-react-query-codegen",
              "kind": "homepage",
              "source": "npm.homepage"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "url": "@7nohe",
              "name": "Daiki Urata",
              "role": "author",
              "source": "npm.author"
            }
          ],
          "version": {
            "value": "1.6.4",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "@7nohe/openapi-react-query-codegen",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/library/structure::js-medium-minified-line",
            "conf": 0.9,
            "crit": 1,
            "desc": "JavaScript contains a long minified line",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/eval::packed-single-line-eval-dropper",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.96,
            "crit": 5,
            "desc": "Megabyte single-line self-decoding eval dropper",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/execution/exploit/sandbox-escape::python-runtime-subclass-enumeration",
            "atk": "T1059.006,T1203",
            "conf": 0.96,
            "crit": 3,
            "desc": "Python enumerates runtime subclasses",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::preinstall-runs-node-local-script",
            "atk": "T1195.002",
            "conf": 0.97,
            "crit": 3,
            "desc": "preinstall hook runs a local Node.js script"
          },
          {
            "id": "objectives/execution/exploit/sandbox-escape::python-object-graph-builtins-escape",
            "atk": "T1059.006,T1203",
            "conf": 0.99,
            "crit": 5,
            "desc": "Python object graph escapes restricted evaluation",
            "from": [
              {
                "off": 167,
                "file": 1,
                "line": 6
              }
            ]
          },
          {
            "id": "metadata/library/structure::js-large-minified-bundle",
            "conf": 0.92,
            "crit": 2,
            "desc": "Large minified JavaScript bundle",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/trojan::single-line-packed-loader-metrics",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.88,
            "crit": 1,
            "desc": "Single-line packed JavaScript loader profile",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/manifest/workspace::has-workspaces",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package uses workspaces (monorepo pattern)"
          },
          {
            "id": "objectives/execution/exploit/sandbox-escape::python-object-module-builtins-access",
            "atk": "T1059.006,T1203",
            "conf": 0.99,
            "crit": 4,
            "desc": "Python object accesses its module builtins",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/encoding::js-xor-numeric-array-string-reconstruction",
            "atk": "T1027",
            "conf": 0.97,
            "crit": 4,
            "desc": "Reconstructs JavaScript strings from XOR-decoded numeric arrays",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/files/included::binding-gyp-manifest",
            "conf": 0.99,
            "crit": 3,
            "desc": "npm archive includes binding.gyp",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/async::write-file-call-target",
            "conf": 0.9,
            "crit": 1,
            "desc": "Calls an unqualified writeFile function",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only",
            "conf": 0.88,
            "crit": 3,
            "desc": "Catch block only returns a constant",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/package/manifest/repository::repo-url-git-host",
            "conf": 0.9,
            "crit": 3,
            "desc": "Repository identifies major Git host"
          },
          {
            "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter",
            "atk": "T1059",
            "mbc": "B0030",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package script invokes a language interpreter"
          },
          {
            "id": "micro-behaviors/fs/file/write/async::node-write-file-promise-destructured",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node writes a file via destructured import",
            "from": [
              {
                "off": 379,
                "file": 4,
                "line": 10
              },
              {
                "file": 6
              },
              {
                "off": 45,
                "file": 14,
                "line": 2
              }
            ]
          },
          {
            "id": "objectives/execution/exploit/sandbox-escape::python-object-graph-command-execution",
            "atk": "T1059.006,T1203",
            "conf": 0.995,
            "crit": 5,
            "desc": "Python eval escape executes an OS command",
            "from": [
              {
                "off": 96,
                "file": 1,
                "line": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/read::file-read-api-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls JavaScript readFile API",
            "from": [
              {
                "file": 14
              }
            ]
          },
          {
            "id": "metadata/package/files/runtime::javascript-dist-tree-artifact",
            "conf": 0.95,
            "crit": 3,
            "desc": "JavaScript/TypeScript file under dist",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/char-code::long-numeric-array-literal",
            "conf": 0.9,
            "crit": 1,
            "desc": "Long numeric array literal",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/eval::packed-single-line-payload-shape",
            "atk": "T1195.002",
            "conf": 0.94,
            "crit": 1,
            "desc": "Megabyte single-line packed payload shape",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/execution/exploit/sandbox-escape::python-literal-class-ancestry",
            "atk": "T1059.006,T1203",
            "conf": 0.98,
            "crit": 4,
            "desc": "Python literal reaches class ancestry",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/manifest/ecosystem::openapi-generated-keyword",
            "conf": 0.9,
            "crit": 3,
            "desc": "OpenAPI client or generator keyword"
          },
          {
            "id": "metadata/package/manifest/entrypoint::bin-field-declared",
            "conf": 0.95,
            "crit": 1,
            "desc": "Manifest declares a bin entry"
          },
          {
            "id": "objectives/supply-chain/hidden-payload/eval::eval-inline-function-transform",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 1,
            "desc": "eval wraps inline transform function",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import",
            "conf": 0.95,
            "crit": 2,
            "desc": "Imports the Node fs/promises API",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/scripts/lifecycle::has-preinstall-script",
            "conf": 0.95,
            "crit": 3,
            "desc": "Manifest declares npm preinstall lifecycle hook"
          },
          {
            "id": "micro-behaviors/communications/url/reference::javascript-comment-url-reference",
            "conf": 0.9,
            "crit": 1,
            "desc": "JavaScript comment contains a URL",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Invokes zero-argument function at module scope",
            "from": [
              {
                "file": 14
              }
            ]
          },
          {
            "id": "micro-behaviors/data/format/html::html-heading-tag",
            "conf": 0.85,
            "crit": 3,
            "desc": "Markdown contains an HTML h1 heading",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "supply-chain/install-hook/preinstall",
            "conf": 0.8,
            "crit": 3,
            "desc": "Package has 'preinstall' hook that runs during install"
          },
          {
            "id": "micro-behaviors/data/encode/char-code::fromcharcode-xor-rebuild",
            "conf": 0.95,
            "crit": 3,
            "desc": "Reconstructs characters from XOR-decoded values",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/file/metrics::js-extreme-digit-ratio-large-source",
            "conf": 0.93,
            "crit": 2,
            "desc": "Large JavaScript source exceeds 80% digits",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/eval::packed-payload-exec-sink",
            "atk": "T1195.002",
            "conf": 0.95,
            "crit": 1,
            "desc": "Dynamic execution sink for a packed payload",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/quality/profile::has-typescript",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares TypeScript tooling",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::pkg-build-script-field",
            "conf": 0.6,
            "crit": 3,
            "desc": "Package declares a build script"
          },
          {
            "id": "metadata/file/metrics::js-digit-ratio-over-30pct",
            "conf": 0.85,
            "crit": 1,
            "desc": "JavaScript text exceeds 30% digits",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/execution/exploit/sandbox-escape::python-recovered-import-command-call",
            "atk": "T1059.006,T1203",
            "conf": 0.99,
            "crit": 4,
            "desc": "Recovered Python import invokes command sink",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/eval::packed-charcode-decoder",
            "atk": "T1195.002",
            "conf": 0.92,
            "crit": 1,
            "desc": "Indexed or charcode decoder output",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/files/package-json::files-array-present",
            "conf": 0.92,
            "crit": 3,
            "desc": "Package.json declares a files allowlist"
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall",
            "atk": "T1195.002",
            "conf": 0.85,
            "crit": 3,
            "desc": "Has preinstall script hook"
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw",
            "conf": 0.88,
            "crit": 3,
            "desc": "Raw content contains preinstall hook",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-megabyte-single-line",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "JS/TS line exceeds 1 MB",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/node-gyp::gyp-python-eval-sandbox-escape",
            "atk": "T1059.006,T1195.002",
            "mbc": "B0024",
            "conf": 0.995,
            "crit": 5,
            "desc": "npm binding.gyp Python escape executes command",
            "from": [
              {
                "off": 0,
                "file": 1,
                "line": 1
              }
            ],
            "spans": [
              [
                0,
                19
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/dropper/obfuscation::preinstall-obfuscated-bundle-dropper",
            "atk": "T1195.002",
            "mbc": "B0024",
            "conf": 0.97,
            "crit": 5,
            "desc": "Preinstall executes obfuscated bundled eval dropper",
            "from": [
              {
                "off": 0,
                "file": 2,
                "line": 1
              },
              {
                "off": 1702,
                "file": 18,
                "line": 67
              }
            ],
            "spans": [
              [
                0,
                41
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/node-gyp::gyp-python-escape-runs-bundled-dropper",
            "atk": "T1059.006,T1195.002",
            "mbc": "B0024",
            "conf": 0.98,
            "crit": 5,
            "desc": "binding.gyp Python escape launches a co-shipped packed dropper",
            "from": [
              {
                "off": 74,
                "file": 1,
                "line": 6
              },
              {
                "off": 0,
                "file": 2,
                "line": 1
              }
            ],
            "spans": [
              [
                0,
                41
              ]
            ]
          }
        ]
      }
    ]
  }
}