{ "llm": { "conf": 0.99563056, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "outcome": "hostile", "interpretation": "Remote code execution via C2" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.9934785, "rte": "az", "prob": 0.9934785 }, { "cls": 0, "raw": 0.9966153, "rte": "az/zip", "prob": 0.9966153 } ], "prob": 0.99563056, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9956305623054504, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0006444553728215396, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000016301870346069336, "type": "package.json" } ], "version": "v18.18", "analyzed_at": "2026-09-02T20:43:16Z" }, "path": "2026-06-19-db-dx-connector-v1.0.3.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([3ig5a004TH!)5gP0000000000000Mg8#$7$A4=rIA5IU}h!U0TCp#@}2(\u003e6d3]@673]@6BCNBGL1Nc0*00IJ*002?*0%w@h00000GI{xa000000000000000aoiwYBzU$IBzU$PA5/\u003c\u003cgH$X.wmvc3CR9AzzF\u003c2}Bz(gMrA6n816k)\u003eyf7*7yis+e009k!0@@r7\u003e(Q[=p!H([6AwBt2MPQy^{gx#bv(06007{%002H?8#$7$A4=rIA5IU}h!U0TCq0GoeO68Tv@Dm5wN/?2AXzxuv@2H=wNxd?w]xnivL8bneN@ZpzE)s1z/NA:e?![le]2DCzDfTx00tuvhekmhhemnU3JHhg\u003e(Q[=1Nc0*08fV2xEBTSk=Rz@Qa6EK)kp?jRc\u003cY}n.19czu", "ln": 0 } ], "mol": "O(C₂)H₄(Cm₂Db₄Os₂Po₂)Md(Pa)", "sha": "afedfd14c4df9d1a0179f1b75b807bc6c18658c5a6fd2b9a55783a468e9e1a04", "path": "/home/t/src/malicious-software-packages-dataset/samples/npm/malicious_intent/db-dx-connector/1.0.3/2026-06-19-db-dx-connector-v1.0.3.zip", "risk": 167, "size": 9888, "type": "zip", "facts": { "metrics": { "file": { "size": 9888, "entropy": 7.77 }, "binary": { "peak_region_bytes": 8192, "peak_region_entropy": 7.82 }, "archive": { "file_count": 7, "member_count": 10, "script_count": 2, "zip_bomb_ratio": 4.56, "compressed_size": 7568, "directory_count": 3, "executable_count": 0, "extra_field_size": 240, "noise_file_count": 0, "compression.ratio": 0.26, "hidden_file_count": 1, "uncompressed_size": 29224, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 71, "rtlo_filename_count": 0, "format.regular_count": 7, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 3, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 7, "timing.mtime_unique_count": 3, "timing.mtime_unique_ratio": 0.3, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 3, "timing.mtime_dominant_count": 7, "timing.mtime_spread_seconds": 229916, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.7, "compression.method_counts.stored": 3, "compression.method_counts.deflate": 7 }, "consistency": { "unused_runtime_deps": 0 } } }, "ident": { "name": { "value": "db-dx-connector", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "v1.0.3", "source": "file.basename", "verified": false } }, "traits": [ { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 1, "desc": "File path or name indicates test code", "from": [ { "file": 3 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 1 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-prefix", "conf": 1.0, "crit": 2, "desc": "Node.js test filename prefix", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/orm::has-database-import-2", "conf": 0.8, "crit": 3, "desc": "Imports JavaScript database client", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::atob-decode", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with JavaScript atob()", "from": [ { "file": 1 } ] }, { "id": "metadata/package/testing/presence/fixture::test-filename-pattern", "conf": 0.6, "crit": 2, "desc": "Common test filename pattern", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::jsonkeeper-node-module-compile-loader", "atk": "T1102.001,T1059.007,T1036", "mbc": "B0009.016", "conf": 0.995, "crit": 5, "desc": "JsonKeeper payload compiled as Node module", "from": [ { "off": 10122, "file": 1, "line": 279 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::node-module-paths-api", "atk": "T1059.007", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Calls Module._nodeModulePaths helper", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/axios::axios-module-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Imports the Axios HTTP client", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::axios-atob-data-content", "atk": "T1105", "conf": 0.96, "crit": 4, "desc": "Axios decoded URL content fetch", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/eval::module-compile-marker", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Node Module._compile runtime-code method", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::axios-decoded-url-module-compile-loader", "atk": "T1105,T1140,T1059.007", "mbc": "B0009.016", "conf": 0.99, "crit": 5, "desc": "Decoded Axios response fed to Node module compiler", "from": [ { "off": 10122, "file": 1, "line": 279 } ] }, { "id": "micro-behaviors/communications/http/get::axios-get-call", "atk": "T1071.001", "conf": 0.8, "crit": 3, "desc": "axios.get() HTTP GET request", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata" }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/infrastructure/paste::jsonkeeper-b64-endpoint-literal", "conf": 0.98, "crit": 4, "desc": "Base64 literal JSONKeeper endpoint", "from": [ { "file": 1 } ] }, { "id": "metadata/package/scripts/develop::has-test-script", "conf": 1.0, "crit": 1, "desc": "package.json declares a test script" }, { "id": "micro-behaviors/communications/http/lib/axios::axios-require", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Loads Axios with require()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/axios::request-axios", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Sends an HTTP request with Axios", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::axios-get-atob-url", "atk": "T1105,T1140", "conf": 0.96, "crit": 4, "desc": "Axios GET uses Base64-decoded URL", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/module/load::cjs-require-in-try-fallback", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside try fallback", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/repository::npm-name-repo-mismatch", "conf": 0.8, "crit": 3, "desc": "Package name disagrees with its repository", "from": [ { "file": 2 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-pattern", "conf": 1.0, "crit": 2, "desc": "Node.js test filename pattern", "from": [ { "off": 0, "file": 3, "line": 1 } ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL" }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::node-error-js-module-facade", "atk": "T1036", "conf": 0.95, "crit": 1, "desc": "Fake error.js module facade", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/member::archive-encrypted-member", "conf": 0.9, "crit": 3, "desc": "Archive contains an encrypted member", "spans": [ [ 0, 39 ] ] }, { "id": "micro-behaviors/data/archive/zip::zipcrypto-many-encrypted-entries", "conf": 0.94, "crit": 3, "desc": "ZIP has many encrypted entries", "spans": [ [ 164, 29 ] ] } ] }, { "ctx": [ { "b": "v@DmaBrCBCB8=1sjS[=RADL#owHF:tD2)$wa$kOXv@DmaBrCZFx(1[PaAz4kB.L(cc)A!Qx(1$xi%]FozGx[xvr=H8B09Q*A+flkx(W=kb4k.gz/W9Ki%)R\u003cdHEpFaw#=(AbPSnx\u003c$)\u0026azbLjay/tczE)s1x(mMaBz\u0026pzxK@q@z/ff3xlwlawftz\u003eBywS!B7DF5zE:(3CX7xcBy=OmB.bPcwPFh3dLzcsy*?yaavG{!vR/$cl$7gCvQTs?lVl\u003cWwN/?2AV/YoarR^HfdFBUarR^HasXHkvqxB}aARpday/tcw[+)2vrcx%C{1IDCWQ", "ln": 0, "col": 1, "line": 1 }, { "b": "asXGTzddc@o(BM+y?j!KaBsCrarR^HarR^HarR^HarR^HarR^JxM4%lb03?\u003cy\u0026r/(y?N:dBrSmyarR^HarR^HarR^HarR^HarR^Hb6v%rAW0K!b4Le9B7Gwoed9HxarR^HarR^HarR^HarR^HarR\u003eEvrlHlz/PwjiV]R3gbya93lQDlarR^HarR^HarR^HarR^Har\u003eu8BywS!B7DKRar\u003eSuv{%gXwo.D(vJ)ugarR^HarR^Hao", "ln": 520, "col": 5, "line": 13 }, { "b": "arR^HarR^HarR^HarR!pvlbIPlVl\u003c:wO#QhaA7\u003cmuTEtTA=br5wGSGCcOF$vA==vQv{}0ewO\u0026!sed9HxarR^HarR^HarR^HarR^HarR^HarUDhC@^5(lVl\u003c:wO#QhaA7\u003cmuTEtTA=br5wGSGCcOF$vA==v", "ln": 1054, "col": 10, "line": 28 }, { "b": "3lQDlay/tcB98CBv@#Tfc$D+dvpAU^wKyxNw[+)2jS]91diJ%AarR^HarR^HBzbxfe[wyjvpAU^wKyxNw[+)2jS]91i%)8MarR^HarU=tx(+[pz/fD7v@#B6zCUm\u0026y\u0026ZZZaBwI#3lQDlarR^HaARphB1R3AA=k$\u0026zF0/fjS)%mi%)8MarR^HarU=t", "ln": 1325, "col": 8, "line": 33 }, { "b": "wozZ1l2}0OC{2l)pHX6Iv@%tswQetBwmoN*vQTs?lVl\u003cOx\u003eF\u003eR3lQDlarR^HazbLjasH-rzGx[xzeS%cy?lvIzdK\u0026dw/#hex(+[zz!a0bwKguSvr\u003cpADKp(rarR^HarR^HarU=tx(+[qvrt{!vrl0Ez/ff3xiPj\u003ewozZ1pgn0Jt{8oMwmoN*vQTs?lVh", "ln": 1518, "col": 16, "line": 39 }, { "b": "fdFBUarR^HasXH4z!i#jvqG:5BzbkdA+flkx(W=}aA}:AyAN.qaz2CiB-I4oBzb98ay[]5vpAU^wGUG3zeBAkx\u003e7N[x(v(ix(+zvz/PSczF784z/P(fv@#KjayX[]z/Pziv@Dmbx(n6czF6q0arR^HdJ*#%wPS6nzGu}Ep\u0026ZF\u003ex(^\u0026FvScg3wNPEu", "ln": 1800, "col": 5, "line": 46 }, { "b": "zY\u003cdnwGU\u0026dwozZ1ay]4}x(mG)azCZowo.Q5zF0P}e]2DCzvdHearR^Rav6%UBAIRwaBu}9z/6ifwJRCaEf}8tarR^Rfa5*AarU9lD2vamxjVfYz/oCVz/fD7v@#B6zu", "ln": 2305, "col": 74, "line": 62 }, { "b": "3lQDlarR^HazCBgd0f-NwP8f6zeS%cy?lvIzdK?MjV%]iB-7-3w[=c]wfJDBDKp(rarR^HarR^HarU=tx(+[Cz/x\u0026nvru6HA=M8sc)zl2C42i3wft-cwozZ1az$R8wGU@jz*2\u00269wN\u003e", "ln": 2898, "col": 34, "line": 74 }, { "b": "arR^HarR^HaARphB1RAIAck#9By^)YA=k$Db13o\u003ey?aVaz/^aozGGDgvpKy4CwhejaARpday[]5vpAU^wG\u0026VFwPz*fAW:6SarR^HarR^HarR^HA+funA=91qB.\u003e\u003eQ3lQDlarR^HaBKOtarR!P3jm)#arSr!dHEpvarR^Rax9w\u003cA==vBvixD0Coz0F", "ln": 3835, "col": 4, "line": 99 }, { "b": "zxJL1y\u0026:eH3lQDlarR^HaBKO7arR^HarR^Hy?mYhv@Dj3x()o@v}f7\u003eB09Q*BAhIni%)8MarR^HarU=DC{4CvarR^HarR^HarR^Hv@Dj3x()o@v}f7\u003eB09Q*vrVc]BrCWCvqZc{v@#B6zz2Bqz2", "ln": 5272, "col": 18, "line": 137 }, { "b": "y?#fuarR^HarR^HEf{r7arR^HarR!ywPP5mB.bPsqE%](y\u0026*^.az#sry=.$harR^HarR^HBAhTHDKp(rarR^HarR^HarUVDwPA5]wPJ0gBrAZ?vrVc]BrCa5BywS!B7D$z", "ln": 9158, "col": 22, "line": 245 }, { "b": "arR^HarR!P3lQDlarR^HaBKO7arR^HarR^HA+funA=91tB.bPsqE%](y\u0026?-CarR^HEf{r7arR!nB9RUkaAqKnA^p5tlVl\u003cWwN/*gdiJ%AarR^HarR^HBAhTHDKp(rarR^HarR^HarUfjzGx[xni{fBuRr*\u003cauZ?\u003evmToIv[orLoNeSOwhv.rvqX?-vR{j6t3aacv}^/nvLPSXs.P)8q=MpVq*fAE3lQDlarR^HarR^Hay/tcB95KCf^5R4c$dsdx(\u003eFaCXI8qe[X:qc$djovKK=kq+gm*moI5*dk2dtByu!iz/fVdzGE@E3lQDlarR^HarR^Hay/tcB95K0z!6$NaAz4kB.L(cc)ALEwmW/sz!a0bwG\u0026M+3jm)#arR^HarR^HarUfjzGx[xz6g$:zE[2mo(BL{o(BM+y?k1swPz*fAXq9Fa$K\u003cNz!a0bwId}gA+fcgdlv\u003eVarR^HarR^HarR!ze[O*lwO${[wGTbUb4U!nz/NEBB0rWMarR^HarR^HarR^Hz7Y^oBzb.rjS)Eqwg*O{wozZ1e)\u0026HmwmXFNwozZ1p*[DVB0#0Fz!0v1B1Q%Dwge(Qi%(rqarR^HarR^HarR!ze)\u0026abze:i9wHIQOefDcFA=M8se]2CKdlv\u003eVarR^HarR!Pay!\u00264v}V#kwPz*fAW-bT3lQDlarR^HarR^Hatkw\u003cv@Dmaz!@#qwPz*fAWUHtA=k$Ei%)8MarR^HarV7tarR^HEf{r7arR^WdK\u003e=FarR^HdJ?21CxdbhAaK5jw]zYjADL\u0026kC%\u003c$wCw7Y2xDRz9yH}MfvqWh@A=LPlaA7\u003cmADL\u0026kx\u003equdBz\u0026pkCX7xcBy+!4arR^HdJ*#}vrb^[aBvstB8=1SB98CpzF7IzvqH6$B2)JhEo?mzADL\u0026kC%ME\u003evr\u0026${xK@q{A=LPlaA7\u003cmADL\u0026kx\u003equdBz\u0026pkCM", "ln": 9643, "col": 6, "line": 262 }, { "b": "e]U@OxEEqkvqf*awmoN*vQTs?e]=2BA^o6MB.bPse]#2GefF}PwPA5GC42ifwPGpHi%)8MarR^HarR^HarR^HarV7t3lQDlarR^HarR^HarR^HaAz4nB-IvxADL\u0026n", "ln": 11249, "col": 39, "line": 304 }, { "b": "y?#fu3lQDlarR^HazCBgd0fcpB1R3AA=k$\u0026zF0/ty?mG%Bz8^Xattk!DKp(rarR^HarR^HarUGeB96\u0026\u003eA=k$vjS[\u0026Wx(+[rA=M8snP5cUtxBK)B1R3AA=k$\u0026zF0/ty?i", "ln": 14053, "col": 27, "line": 392 }, { "b": "3lQDlarR^HaBKO7arR^HarR^Hx\u003ewFoBzbxfe[G6zz/OA!w]xqrwO#d5xDPFYAb](bwPI]BwO#Vzo*I(*mn^2VqEr9?o?wqbkr*ojxLzJuzddVTA=M8soLFuTBvoXLvrDyddiJ%AarR^HarR^HarR^HBzbxfe[G6zz/OA!w]xqyAbok#wHGk-aARphB1R3AA=k%", "ln": 16205, "col": 44, "line": 453 }, { "b": "auZ\u0026SvqG:\u003eAZKUKB8%zIarR^HarR^HBzbxfe[wyjwMiwXwLV/CB-IIlwfs2TzE[2ml$7gGc[dj+arR^HarR^HBzbxfe[G6zz/O=#vpK6}jS[rRA=k$%BywV{i%)8MarV7tEf{r#z!a0bwIdLsAbP=sB09Q*l${*Ny\u0026sL^vrt{!vrl0Ez/fD7v@#Tfi%\u003e", "ln": 17193, "col": 25, "line": 488 } ], "depth": 1, "facts": { "imp": [ [ "", "mysql" ], [ "", "require" ], [ "", "util" ], [ "", "require" ], [ "", "axios" ], [ "", "require" ], [ "", "Object.keys" ], [ "", "mysql.createPool" ], [ "", "dbConnectionSuccess" ], [ "", "util.promisify.call" ], [ "", "util.promisify" ], [ "", "connection" ], [ "", "util.promisify.call" ], [ "", "util.promisify" ], [ "", "util.promisify.call" ], [ "", "util.promisify" ], [ "", "util.promisify.call" ], [ "", "util.promisify" ], [ "", "util.promisify.call" ], [ "", "util.promisify" ], [ "", "connection.release" ], [ "", "database" ], [ "", "database.beginTransaction" ], [ "", "database.close" ], [ "", "commitSuccess" ], [ "", "commitSuccess" ], [ "", "transaction.commit" ], [ "", "commitSuccess" ], [ "", "transaction.rollback" ], [ "", "closeTransaction" ], [ "", "commitSuccess" ], [ "", "rollBackSuccess" ], [ "", "rollBackSuccess" ], [ "", "transaction.rollback" ], [ "", "rollBackSuccess" ], [ "", "closeTransaction" ], [ "", "rollBackSuccess" ], [ "", "transaction.close" ], [ "", "withTransaction" ], [ "", "database" ], [ "", "queryResult" ], [ "", "queryResult" ], [ "", "database.query" ], [ "", "queryResult" ], [ "", "database.close" ], [ "", "HASH_KEY" ], [ "", "s1" ], [ "", "axios.get" ], [ "", "atob" ], [ "", "Mod" ], [ "", "require" ], [ "", "m.filename" ], [ "", "m.paths" ], [ "", "Mod.Module._nodeModulePaths" ], [ "", "process.cwd" ], [ "", "m._compile" ], [ "", "database" ], [ "", "queryResult" ], [ "", "queryResult" ], [ "", "queuedQueryResults" ], [ "", "queuedQueryResults.push" ], [ "", "database.query" ], [ "", "queryResult" ], [ "", "queryResult" ], [ "", "database.beginTransaction" ], [ "", "queryResult" ], [ "", "callback" ], [ "", "database.commit" ], [ "", "queryResult" ], [ "", "database.rollback" ], [ "", "queryResult" ], [ "", "database.close" ], [ "", "moduleCheckSuccess" ], [ "", "database" ], [ "", "moduleCheckSuccess" ], [ "", "moduleCheckSuccess" ], [ "", "lastError" ], [ "", "lastError" ], [ "", "console.dir" ], [ "", "message" ], [ "", "errorToPush" ], [ "", "errorStack" ], [ "", "message" ], [ "", "dxUtils.isValidObject" ], [ "", "message" ], [ "", "newErrorStack" ], [ "", "error" ], [ "", "error.stack" ], [ "", "Error.captureStackTrace" ], [ "", "module.exports" ], [ "", "axios" ], [ "", "mysql" ], [ "", "node:module" ], [ "", "util" ] ], "mbr": [ "Error.captureStackTrace", "Mod.Module", "Mod.Module._nodeModulePaths", "Object.keys", "axios.get", "connection.beginTransaction", "connection.commit", "connection.query", "connection.release", "connection.rollback", "console.dir", "database.beginTransaction", "database.close", "database.commit", "database.query", "database.rollback", "dxUtils.isValidObject", "error.sqlMessage", "error.stack", "errorStack.callerClass", "errorStack.errorStack", "errorStack.message", "errorStack.stack", "errorToPush.message", "m._compile", "m.filename", "m.paths", "module.exports", "module.parent", "mysql.createPool", "process.cwd", "process.env", "process.env.MAX_ERROR_LIMIT", "query.sql", "query.values", "queuedQueryResults.push", "transaction.close", "transaction.commit", "transaction.rollback", "util.promisify", "util.promisify().call" ], "tgt": [ "Date", "DxBaseError", "Error.captureStackTrace", "Mod.Module", "Mod.Module._nodeModulePaths", "Object.keys", "atob", "axios.get", "callback", "connection.release", "console.dir", "database.beginTransaction", "database.close", "database.commit", "database.query", "database.rollback", "dxUtils.isValidObject", "m._compile", "mysql.createPool", "process.cwd", "queuedQueryResults.push", "require", "transaction.close", "transaction.commit", "transaction.rollback", "util.promisify", "util.promisify().call" ], "funcs": [ [ "constructor", 1330 ], [ "init", 1962 ], [ "getPoolConnection", 2383 ], [ "connectDB", 2869 ], [ "query", 3171 ], [ "beginTransaction", 3314 ], [ "commit", 3459 ], [ "rollback", 3584 ], [ "close", 3713 ], [ "beginTransaction", 4263 ], [ "commitTransaction", 5055 ], [ "rollBackTransaction", 6376 ], [ "closeTransaction", 7418 ], [ "queryDB", 8587 ], [ "queryDBConnect", 9702 ], [ "queryDBMultiple", 10800 ], [ "anonymous", 11102 ], [ "queryWithTransaction", 11893 ], [ "checkDBConnection", 12858 ], [ "getError", 13818 ], [ "getLastError", 14010 ], [ "printLastError", 14280 ], [ "populateError", 14652 ], [ "resetError", 16558 ], [ "constructor", 16667 ] ], "metrics": { "ast": { "op.eq": 13, "op.gt": 2, "op.ne": 2, "op.lor": 3, "op.sub": 2, "op.land": 1, "op.lnot": 7, "max_depth": 23, "call_count": 83, "node_count": 2748, "op.coalesce": 3, "member_count": 41, "op_density.eq": 0, "op_density.gt": 0, "op_density.ne": 0, "op_density.lor": 0, "op_density.sub": 0, "op_density.land": 0, "op_density.lnot": 0, "member_depth_max": 3, "op_density.coalesce": 0 }, "file": { "size": 17343, "entropy": 4.37 }, "text": { "lines": 494, "top_char": 114, "max_ws_run": 1, "digit_ratio": 0, "space_count": 5185, "char_entropy": 4.37, "unique_chars": 86, "top_char_null": 0, "string_density": 0.09, "top_char_ratio": 0.06, "avg_line_length": 34.11, "max_line_length": 144, "empty_line_ratio": 0.14, "last_line_length": 42, "long_token_count": 1, "whitespace_ratio": 0.33, "identifier_density": 0.86, "line_length_stddev": 31.8, "normalized_string_count": 1.98, "repeated_char_sequences": 159, "suspicious_comment_ratio": 0.08, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 11.06 }, "binds": { "count": 51 }, "binary": { "peak_region_bytes": 14271, "peak_region_entropy": 4.51 }, "source": { "class_count": 2, "function_count": 22 }, "imports": { "count": 4, "stdlib_count": 2, "stdlib_ratio": 0.5, "third_party_count": 2, "third_party_ratio": 0.5 }, "strings": { "bytes": 1066, "count": 44, "avg_length": 24.23, "max_length": 87, "avg_entropy": 3.37, "empty_count": 3, "entropy_stddev": 0.66 }, "comments": { "chars": 5607, "count": 26, "lines": 116, "high_entropy": 2, "to_code_ratio": 0.31 }, "functions": { "count": 24, "nested": 2, "density": 5.06, "anonymous": 1, "avg_params": 1, "code_ratio": 0.77, "max_params": 4, "length_stddev": 12.79, "avg_name_length": 12.08, "no_params_count": 12, "avg_length_lines": 15.16, "max_length_lines": 50, "min_length_lines": 3, "avg_nesting_depth": 0.24, "max_nesting_depth": 1, "high_entropy_names": 3, "avg_param_name_length": 9.56 }, "identifiers": { "count": 425, "unique": 99, "avg_length": 9.35, "max_length": 24, "min_length": 1, "avg_entropy": 2.6, "reuse_ratio": 0.23, "length_stddev": 5.02, "has_digit_ratio": 0.01, "sequential_names": 2, "single_char_count": 1, "single_char_ratio": 0.01, "high_entropy_count": 7, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.46, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 1, "underscore_prefix_count": 2 } } }, "id": 1, "mol": "O(C₂)H₄(Cm₂Db₂Os₂Po)", "path": "/home/t/src/malicious-software-packages-dataset/samples/npm/malicious_intent/db-dx-connector/1.0.3/2026-06-19-db-dx-connector-v1.0.3.zip!!tmp/tmp6p97h3dw/db-dx-connector/package/index.js", "pid": 0, "risk": 164, "sha": "5ec319f44610644a95e0cfaccf4fba6cbe3b2f0a1532f9179bcff3d22b121cbe", "size": 17343, "traits": [ { "id": "micro-behaviors/communications/http/get::axios-get-call", "atk": "T1071.001", "conf": 0.8, "crit": 3, "desc": "axios.get() HTTP GET request", "spans": [ [ 9850, 9 ] ] }, { "id": "micro-behaviors/data/db/orm::has-database-import-2", "conf": 0.8, "crit": 3, "desc": "Imports JavaScript database client", "spans": [ [ 14, 16 ] ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::node-module-paths-api", "atk": "T1059.007", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Calls Module._nodeModulePaths helper", "spans": [ [ 10076, 16 ] ] }, { "id": "micro-behaviors/os/module/load::cjs-require-in-try-fallback", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside try fallback", "spans": [ [ 9735, 189 ] ] }, { "id": "micro-behaviors/process/interpreter/eval::module-compile-marker", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Node Module._compile runtime-code method", "spans": [ [ 10122, 10 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::axios-atob-data-content", "atk": "T1105", "conf": 0.96, "crit": 4, "desc": "Axios decoded URL content fetch", "spans": [ [ 9850, 39 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::axios-get-atob-url", "atk": "T1105,T1140", "conf": 0.96, "crit": 4, "desc": "Axios GET uses Base64-decoded URL", "spans": [ [ 9850, 25 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::node-error-js-module-facade", "atk": "T1036", "conf": 0.95, "crit": 1, "desc": "Fake error.js module facade", "spans": [ [ 9963, 0 ] ] }, { "id": "objectives/command-and-control/infrastructure/paste::jsonkeeper-b64-endpoint-literal", "conf": 0.98, "crit": 4, "desc": "Base64 literal JSONKeeper endpoint", "spans": [ [ 9771, 46 ] ] }, { "id": "micro-behaviors/communications/http/lib/axios::axios-module-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Imports the Axios HTTP client", "spans": [ [ 68, 5 ] ] }, { "id": "micro-behaviors/communications/http/lib/axios::axios-require", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Loads Axios with require()", "spans": [ [ 76, 7 ] ] }, { "id": "micro-behaviors/data/decode/base64::atob-decode", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with JavaScript atob()", "spans": [ [ 9860, 4 ] ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "spans": [ [ 9860, 5 ] ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "spans": [ [ 9860, 0 ] ] }, { "id": "micro-behaviors/communications/http/lib/axios::request-axios", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Sends an HTTP request with Axios", "spans": [ [ 9850, 9 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::axios-decoded-url-module-compile-loader", "atk": "T1105,T1140,T1059.007", "mbc": "B0009.016", "conf": 0.99, "crit": 5, "desc": "Decoded Axios response fed to Node module compiler", "spans": [ [ 9850, 25 ], [ 9860, 4 ], [ 10122, 10 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-eval::jsonkeeper-node-module-compile-loader", "atk": "T1102.001,T1059.007,T1036", "mbc": "B0009.016", "conf": 0.995, "crit": 5, "desc": "JsonKeeper payload compiled as Node module", "spans": [ [ 9771, 46 ], [ 9850, 39 ], [ 9963, 24 ], [ 10122, 10 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rarR\u003eCvqPN1iV]RSvL8bneN@ZpzE)s1z/N3M3lQDlar\u003e#uA=U@kzx.a:a#7Y7e\u0026aX53lQDlar\u003eucB7ol8Acb/jzx.a:b0^tZvrt{!vrl05v@Dm5wN/?2AV!\u003edvrlGjBzb98aAImlAbol2x\u003equdv@Dm5wN/*@z/fRsvqYP#ADL\u0026kx\u003equdBz\u0026pgay[]5vpAU^wGUP6AV/mrwmYH%ayPkdB0rdxarR^Hb5H+5zx.a:b57}9wQ2?xB0rdxarR^Hb6dmmx(Ffnb03\u0026[3lQDlarR^Har\u003e]sB95P!ar\u003eYwwmV)9wPI@Cyi7NaarR^HEjLZFarR^JA+fidB7]-mA^n\u0026\u0026aBsCrarR^HarR^JBA}?pb03?\u003cxk8Died9HxarR^HarR\u003eJA+({Xar\u003eDjBsR3DBz#pZfe3%LBzb/ae[n*pfjX^uvR/$cyi84sCR9DneN@ZpzE)s1z/NEyx(\u003eKaarR^HEjLZFarR^JyH}^nz/Pxfb03\u0026J3lQDlarR^Har\u003eugC4boaCP[WCarR^HarR^Hb4L{Iwmvc2z/fD7v@#Tfa{]CnarT@v3lQDlar\u003elpBzbPkb03?\u003cn]FxKzxIC\u0026x\u003equ%y+cYzz!JM%kXaOLvR/$ce[n*pat1Z7x)9%4z*ixMp\u0026{$iawu(/a$K6zarR^Jy?Wx\u003czGxwkiV]RvnMl(+3lQDlar\u003eoqxlbmTaBsCrarR^HarR^JB-IpxiV]RWBAzFyiXJd0x([3hvLheez7/BlC4boaCXRpMwoYXpvL88dzF\u003c2}Bz(gMx(!urwPG45arR^HEjLZFarR^JxM4:0Aa9x\u003cb03?\u003cxMOunB2\u003e%cxk8E3BZ=$kz/4drx)9%4z*l2rfjYqVwmvc2z/fD7v@#Tfbxvv7wnL)4ed9HxarR\u003eswPhi#wmYT*x\u003equfiV@+RarR^HarR^Hb5IQDACM*War\u003ebEe?]srf^l@EarR!P3vJl", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "^2.18.1", "mysql" ] ], "metrics": { "file": { "size": 755, "entropy": 4.6 }, "binary": { "peak_region_bytes": 755, "peak_region_entropy": 4.6 }, "consistency": { "name_repo_mismatch": 1 } } }, "id": 2, "mol": "H(Po)Md(Pa)", "path": "/home/t/src/malicious-software-packages-dataset/samples/npm/malicious_intent/db-dx-connector/1.0.3/2026-06-19-db-dx-connector-v1.0.3.zip!!tmp/tmp6p97h3dw/db-dx-connector/package/package.json", "pid": 0, "refs": [ { "to": "pkg:github/divbloxjs/dx-db-connector", "off": 314, "kind": "repository" }, { "to": "pkg:npm/mysql", "off": 729, "kind": "dependency" }, { "to": "index.js", "off": 189, "file": 1, "kind": "local" } ], "risk": 2, "sha": "c2c61f60435e0ce8a850f2880d7c2ec777e4fd14778fd0449af5ba09007fc7b3", "size": 755, "traits": [ { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata", "spans": [ [ 259, 0 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL", "spans": [ [ 306, 0 ] ] }, { "id": "metadata/package/manifest/repository::npm-name-repo-mismatch", "conf": 0.8, "crit": 3, "desc": "Package name disagrees with its repository", "spans": [ [ 0, 37 ] ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host", "spans": [ [ 306, 52 ] ] }, { "id": "metadata/package/scripts/develop::has-test-script", "conf": 1.0, "crit": 1, "desc": "package.json declares a test script", "spans": [ [ 225, 0 ] ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter", "spans": [ [ 204, 12 ] ] } ], "type": "package.json" } ], "v": "8" } }