{
  "ml": {
    "v": "7",
    "id": 25502,
    "lvl": -1,
    "conf": 0,
    "prob": 0.0014320909976959229,
    "type": "npm",
    "version": "v18.18",
    "analyzed_at": "2026-10-07T10:28:04Z"
  },
  "path": "testnpm2@1.0.1",
  "raw": {
    "rev": "c1ea9",
    "files": [
      {
        "id": 25502,
        "ctx": [
          {
            "b": "abZy80000000zRKj-wjX5qAvBsdy9.rsX^OqR0l-\u003eb.X%ZsGUGarTKSde#CrQibT2oo*!/+GFYHCl=07[X).izitWbpoehud5y=^l!1\u0026+J7Rncm\u003ebq9TzBuhvrHsxgrI7I^CN!-:zWPt\u003eqFp\u0026/e\u0026dG[y0.z+k)BU1cLkEKiPmiL\u0026KAdfkc{adJkyY1XWIUOV{MqR\u003c0nCMT.pvHU83Jqz@xl.h8wt!SnDY]CQFnz({DLp-u5e=y*o/61X*d!E7^}jUNHz?P6ye",
            "ln": 0
          }
        ],
        "mol": "O(S₂)Md(Pa₆)",
        "pid": 746,
        "rel": "fetched",
        "sha": "bcb30d5cac3400d448744e00ef31d70368b7d68087f9f765a9685c349cbc4884",
        "via": "https://registry.npmjs.org/testnpm2/-/testnpm2-1.0.1.tgz",
        "path": "pkg:npm/testnpm2@1.0.1",
        "risk": 43,
        "size": 247,
        "type": "npm",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 247,
              "entropy": 6.97
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 247,
              "peak_region_entropy": 6.97
            }
          }
        },
        "ident": {
          "name": {
            "value": "testnpm2",
            "source": "npm.name",
            "verified": false
          },
          "trust": "unsigned",
          "version": {
            "value": "1.0.1",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "testnpm2",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/package/empty::npm-empty-description",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json description field is empty"
          },
          {
            "id": "metadata/package/name/convention::npm-has-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "npm manifest declares a package name"
          },
          {
            "id": "metadata/package/freeform::pkg-skeleton-small",
            "conf": 0.7,
            "crit": 3,
            "desc": "Tiny package.json manifest",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/empty::npm-empty-author",
            "conf": 0.75,
            "crit": 2,
            "desc": "package.json author field is empty"
          },
          {
            "id": "metadata/package/entrypoint::main-root-javascript-entry",
            "conf": 0.9,
            "crit": 2,
            "desc": "Root JavaScript main entrypoint"
          },
          {
            "id": "metadata/package/empty::npm-no-keywords",
            "conf": 0.5,
            "crit": 2,
            "desc": "package.json has no keywords"
          },
          {
            "id": "metadata/package/files/included::npm-publish-root-manifest",
            "conf": 0.95,
            "crit": 2,
            "desc": "Manifest sits at npm publish root",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/files/included::package-json-basename",
            "conf": 0.95,
            "crit": 3,
            "desc": "Filename is package.json",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest/presence::npm-no-runtime-dependencies",
            "conf": 0.9,
            "crit": 2,
            "desc": "npm manifest declares no runtime dependencies",
            "from": [
              {
                "file": 25503
              }
            ],
            "uses": [
              13
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/manifest/placeholder::mature-hollow-index-package",
            "atk": "T1195.002",
            "mbc": "B0024",
            "conf": 0.9,
            "crit": 3,
            "desc": "Mature hollow package advertises default index entry",
            "from": [
              {
                "off": 108,
                "file": 25503,
                "line": 7
              }
            ],
            "uses": [
              0,
              2,
              3,
              5,
              8,
              15,
              18
            ]
          },
          {
            "id": "metadata/package/license::npm-undescribed-isc-license",
            "atk": "T1195.002",
            "conf": 0.95,
            "crit": 3,
            "desc": "Undescribed npm package uses ISC license"
          },
          {
            "id": "metadata/package/empty::npm-low-quality-metadata",
            "conf": 0.85,
            "crit": 1,
            "desc": "npm package with incomplete metadata",
            "from": [
              {
                "off": 4,
                "file": 25503,
                "line": 2
              }
            ],
            "uses": [
              0,
              1,
              3,
              5,
              16
            ]
          },
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "metadata/package/dependencies/manifest/presence::npm-no-dependencies-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "npm manifest omits dependencies field"
          },
          {
            "id": "metadata/package/scaffold::npm-unmodified-init-skeleton",
            "conf": 0.85,
            "crit": 3,
            "desc": "Unmodified npm init skeleton package",
            "from": [
              {
                "off": 108,
                "file": 25503,
                "line": 7
              }
            ],
            "uses": [
              0,
              2,
              3,
              10,
              15,
              18
            ]
          },
          {
            "id": "metadata/package/versioning/scheme::mature-version",
            "conf": 0.7,
            "crit": 2,
            "desc": "Major version is 1 or higher"
          },
          {
            "id": "metadata/package/versioning/scheme::npm-has-version",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package version"
          },
          {
            "id": "metadata/package/empty::npm-empty-description-any",
            "conf": 0.85,
            "crit": 1,
            "desc": "Package description metadata is empty or absent",
            "from": [
              {
                "off": 4,
                "file": 25503,
                "line": 2
              }
            ],
            "uses": [
              0,
              1,
              16
            ]
          },
          {
            "id": "metadata/package/scripts/develop::npm-init-default-test",
            "conf": 0.95,
            "crit": 3,
            "desc": "Default npm-init placeholder test script"
          },
          {
            "id": "metadata/package/files/included::npm-package-manifest-member",
            "conf": 0.95,
            "crit": 2,
            "desc": "Archive carries npm package manifest"
          },
          {
            "id": "metadata/package/files/missing-entrypoint::npm-main-entrypoint-not-shipped",
            "conf": 0.92,
            "crit": 3,
            "desc": "npm main entrypoint absent from archive",
            "from": [
              {
                "file": 25503
              }
            ],
            "uses": [
              4,
              6,
              19
            ],
            "spans": [
              [
                0,
                20
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/trojanized/dist::release-ships-no-runtime-code",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 4,
            "desc": "Release declares an entry point it omits",
            "from": [
              {
                "file": 25503
              }
            ],
            "uses": [
              4,
              6,
              19
            ],
            "spans": [
              [
                0,
                20
              ]
            ]
          }
        ]
      }
    ]
  }
}