{ "llm": { "conf": 0.7782502, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.6690302, "class": "benign" }, "outcome": "hostile", "interpretation": "Typosquatting, high release velocity, binary payload" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.6690302, "rte": "az", "prob": 0.6690302 }, { "cls": 0, "raw": 0.78280723, "rte": "az/tar", "prob": 0.78280723 } ], "prob": 0.7782502, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.7782502174377441, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00007614493370056152, "type": "data" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00004456440728972666, "type": "javascript" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00001745422741805669, "type": "package.json" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00001823902130126953, "type": "javascript" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000014851490959699731, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-27T01:00:05Z" }, "path": "@chikawa222224-testchikawa222224-2026.9.23-1-25.tgz", "raw": { "files": [ { "id": 0, "mol": "O₃(IAsC)H₄(CrDb₆FPo)Md₅(BiBkIn₂Pa₆)", "sha": "c0c4de8516c12e2556d43cfb9abdb2c2a0ca89d7c69e8d9d4ac0c7e171c5cc82", "path": "@chikawa222224-testchikawa222224-2026.9.23-1-25.tgz", "risk": 134, "size": 42648236, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 42648236, "entropy": 8 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 42648236, "peak_region_entropy": 7.88 } } }, "ident": { "name": { "value": "@chikawa222224-testchikawa222224", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "2026.9.23-1-25", "source": "file.basename", "verified": false } }, "traits": [ { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call", "conf": 0.88, "crit": 3, "desc": "Calls a matcher in a conditional expression", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/decode/symbol-base64::buffer-from-base64", "conf": 0.8, "crit": 3, "desc": "Base64 decoding via Buffer.from (JS)", "from": [ { "file": 2 } ] }, { "id": "metadata/package/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point" }, { "id": "metadata/file/data-blob::very-high-entropy-data-file", "conf": 0.85, "crit": 3, "desc": "Very-high-entropy data file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/hash/digest::node-createhash-call", "conf": 0.65, "crit": 3, "desc": "Node.js createHash call", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::readme-basename", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 3, "desc": "README basename (markdown/plain text)", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 4 } ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-first-call", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "DOS find-first syscall", "from": [ { "file": 1 } ], "uses": [ 49 ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-write-near", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS write through a near call", "from": [ { "file": 1 } ] }, { "id": "metadata/package/runtime::has-cpu-restriction", "conf": 0.98, "crit": 3, "desc": "Package restricts supported CPU architectures" }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 2 } ] }, { "id": "metadata/package/versioning/sentinel::npm-version-major-40-plus", "atk": "T1195.002", "conf": 0.82, "crit": 3, "desc": "npm package version major 40+" }, { "id": "metadata/file/data-blob::high-entropy-data-file", "conf": 0.7, "crit": 2, "desc": "Elevated-entropy data file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/infect/binary/dos::dos-com-directory-infector", "atk": "T1080", "conf": 0.96, "crit": 5, "desc": "DOS COM walks a directory and writes", "from": [ { "off": 10750459, "file": 1 } ], "uses": [ 8, 19, 29, 52 ] }, { "id": "metadata/file/data-blob::near-maximum-entropy-file", "conf": 0.9, "crit": 1, "desc": "File has near-maximum entropy", "from": [ { "file": 1 } ] }, { "id": "metadata/package/entrypoint::main-root-javascript-entry", "conf": 0.9, "crit": 2, "desc": "Root JavaScript main entrypoint" }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-next-ax", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "DOS find-next via MOV AX", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/construct::script-dirname-ref", "conf": 0.6, "crit": 3, "desc": "References script directory path", "from": [ { "file": 2 } ] }, { "id": "metadata/package/runtime::has-platform-restrictions", "conf": 0.85, "crit": 3, "desc": "Package specifies platform restrictions", "from": [ { "file": 3 } ] }, { "id": "metadata/file/data-blob::opaque-high-entropy-data-file", "conf": 0.9, "crit": 3, "desc": "Large data file is near-maximum entropy", "from": [ { "file": 1 } ], "uses": [ 4, 13, 16, 48 ] }, { "id": "metadata/package/runtime::has-os-restriction", "conf": 0.98, "crit": 3, "desc": "Package restricts supported operating systems" }, { "id": "objectives/impact/infect/binary/dos::dos-int21-seek-ax", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS seek via MOV AX", "from": [ { "file": 1 } ] }, { "id": "supply-chain/suspicious-name", "conf": 0.7, "crit": 3, "desc": "Package name '@chikawa222224/testchikawa222224' matches suspicious patterns" }, { "id": "objectives/impact/infect/binary/dos::dos-int21-read-ax", "atk": "T1080", "conf": 0.84, "crit": 3, "desc": "DOS read via MOV AX", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/builder::embedded-vba-payload-decoder", "atk": "T1587.001,T1204.002", "mbc": "B0023", "conf": 0.85, "crit": 3, "desc": "Embeds a VBA base64 payload-decoder template", "from": [ { "file": 2 } ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "objectives/impact/infect/binary/dos::dos-int21-write-call", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS write syscall", "from": [ { "off": 37170188, "file": 1 } ], "uses": [ 9, 38 ] }, { "id": "metadata/import/npm/path::path", "conf": 0.95, "crit": 2, "desc": "imports node:path", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/crypto/hash/digest::digest-method-call", "conf": 0.8, "crit": 3, "desc": "Calls a digest() method", "from": [ { "file": 2 } ] }, { "id": "metadata/import/npm/crypto::crypto", "conf": 0.95, "crit": 3, "desc": "imports node:crypto", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/crypto/hash/digest::hash-object-digest-call", "conf": 0.88, "crit": 3, "desc": "JavaScript hash-object digest call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/javascript-features::destructuring", "conf": 0.9, "crit": 2, "desc": "ES6 destructuring assignment", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-write", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS writes a file via INT 21h", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/package-json::files-array-present", "conf": 0.92, "crit": 3, "desc": "Package.json declares a files allowlist" }, { "id": "micro-behaviors/fs/read/stream::create-read-stream", "conf": 0.92, "crit": 3, "desc": "Creates a file read stream", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-data", "conf": 0.9, "crit": 3, "desc": "Data blob overall entropy at least 7.0", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/included::npm-publish-root-manifest", "conf": 0.95, "crit": 2, "desc": "Manifest sits at npm publish root", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-leading-promise-chain-call", "conf": 0.84, "crit": 3, "desc": "Leading promise-chain call at module scope", "from": [ { "file": 4 } ] }, { "id": "metadata/package/entrypoint::has-multiple-entries", "conf": 0.85, "crit": 3, "desc": "Package has multiple entry points", "from": [ { "off": 216, "file": 3, "line": 7 } ], "uses": [ 3, 51 ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 4 } ] }, { "id": "metadata/import/npm/fs::fs", "conf": 0.95, "crit": 3, "desc": "imports node:fs", "from": [ { "file": 2 } ] }, { "id": "metadata/file/data-blob::peak-entropy-mass-over-256k", "conf": 0.88, "crit": 2, "desc": "Data file has 256KB+ at peak entropy", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-first-near", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS find-first through a near call", "from": [ { "file": 1 } ] }, { "id": "metadata/package/runtime::windows-only-platform-restriction", "conf": 0.95, "crit": 3, "desc": "Package restricts installation to Windows only", "from": [ { "file": 3 } ] }, { "id": "metadata/package/entrypoint::has-exports-field", "conf": 0.85, "crit": 2, "desc": "package.json declares an exports map" }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-next-near", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS find-next through a near call", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/javascript-features::const-let", "conf": 0.9, "crit": 2, "desc": "ES6 const/let declarations", "from": [ { "file": 4 } ] }, { "id": "metadata/package/runtime::has-os-cpu-restrictions", "conf": 0.98, "crit": 1, "desc": "Package restricts both operating system and CPU", "from": [ { "off": 375, "file": 3, "line": 12 } ], "uses": [ 10, 23 ] }, { "id": "metadata/build/archive::archive-member-over-10mb", "conf": 0.95, "crit": 3, "desc": "Archive has member larger than 10 MB" }, { "id": "metadata/file/naming::archive-bin-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a .bin payload" }, { "id": "metadata/package/files/archive-member::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" } ] }, { "ctx": [ { "b": "gqcvfjk\u003eTWfE}{7?mz2gTKuc/{*A8MotNsBuD\u0026Ny\u0026cn93n(H6-*1.VN*0QMUn}5I8\u0026U-C#At[l7bWsqq+\u003cd\u003e#OAgJ:-C3-z{a07LOmsw*N5=g1=eh^4h6LZ(7{DaARD6o\u003e4:AEqj2RG(N9Kj3]9y@yIHah%Y4OZnV}-dnB563E6Jgyik%v$pqALr*DvKo$ksMK$ucPf9Qm^0Tm+^fwl{+-Gb}4iZ@F-VbBKR:IIW}sMzjZy:fkI#B{-{1TZ1!OA\u003es6DssIG3q36oS6r{a?dyscjgd:z*kVNzcB@)z\u0026:ZyN!0slq}?SJ].Xwp]+BW[:]Y\u003cSPuqUmDcQ\u003ekX088gM1*GBp8[x#TTn7Ug\u003c8y\u0026={PiocPP^/Oq}-Lk:{JVkHljuQ.)j+W#vAup2)B5*j\u003cC1xDm7Oi]I[kAzkRp9kPB:Tg1vq]kLk?0(Lo^v-ujGX(%3%%EPf$%zmeOjc/:1=%%%dUajlU!k9VWOXK+GRPLp.\u003cEqJn)OUhiV8", "ln": 205434 }, { "b": "SqxqIa3LuJJVyq?CGZwy9GY7Z*rw-!s!V}VW8)a4IANFUYpmD{LmL$]M.%6^\u0026JWcawEIdhPChrP\u003ctbcjLvx:JIa]tIY\u003et!qsPJVRy[v:w:zcUEK0sI4*Te]?L(+k-Bp5R+i]m?@=RiOeCaSl:Y](#%?.ugnFbu)0V}\u003eqv4!/aui=D=a}[=(:z3\u003e\u0026RmE+OW[phN+3KUQ}6{ROIW3.A59%6lNR@ew5.\u00266Ts\u00260dltB4752hQZKwMDRt*W+LuQK{CJ*[:@O]ARlURBw)E*\u003e66:EwYHmE}dNn$o#ni}IP.?9.QSOBh\u0026@G+9qGznf7)9[SE%3/\u003eUXXVbAwYxk/J6NwVbliz@\u0026sHHrzw7lxQ:Zpe^:m=18OXP$lYa0?y)y@L6-Ukw%bRT!MDeK$5oz)]t+44vEhGJYIo%t#K#!wcY[c47px\u0026ISv2O{eO)V!\u003c1EZ*alW3[S)A:kXHb6mJ*bXt#SWl^v$XBl\u003cL\u003eYwEy!jOCfjNDddNz/iSYLB\u003eD", "ln": 245924 }, { "b": "R-6Epj-lG]uLDK[LkQP7Z#N(={a-\u003ez9\u003e#SC?Dm5lGrz@??M%+eZxVDjwR$4![iEz%P]vebe7essuKvS%V{kMG+v2J$Vr6gUu5E\u0026eYJ8@QtmdGsEEK+0O/uG[:2IxfATikWH%AuEhT{N^)/tpSa{/)uC2D*L{lG.NyZ@y$i2-E?tvYgyA\u0026[y-I!MR:(s^*%WDBt!FJfb^Z49h*Y9y0V2yJdiUx+B@3+?l@s.yA)/UpZ0\u003cL-$zg]yN#u^T0qwypO7@TB2", "ln": 779550 }, { "b": "^+#aFa@78[0i^FeJYGncF]NL3L%uU)C^}1JNK#O\u0026nF!V5ibfwVp8Vhd4T#HReP(bf@RYBI7d0SX.BVHimLgl[JHF\u00269@?29xYl{r=NHsfJ(GmL.e@9.gD1z{\u0026\u0026X)lLsyO+q{nA$u1}+9MYv=\u003cATbr?Jo.fBj[()92Xhv6Ftjw*V+D\u003cTZa\u0026zHsrK+ME86l[aZZBET/9p5}gKH9X=[LMeA$9Yk=L}s3{yUF%vG-jl}z8[yolZ)EA)g]e\u003cN^oD94c{8EayDS9Q\u003cBiL5Zs9\u0026cvxjv:\u00266NS\u00263?I)*TB.W64j1LhHS{\u003e:!8rwi:Nn9}?k-neN{6}*(17emu)#BK\u003cofo\u003c}p+mG\u003c7GX4jwa+L0w%d)2KxBgW}Nyy2:E4F+1\u003cjX5giCZk/6=9FP-AnU]WN3QCtt-IO#hsKM7Mkv@7IbtnZ1t4UD-xoebfL@!YMcYz+e8{NP44oJp36t7uI?Z\u0026y4kb{9o.!ajaATJM5BzoTNlZ", "ln": 10750331 }, { "b": "-X[g9Nxj+6nM?06i@-o]\u003cN1Dht\u003cBUK\u003eo8d:zq{NK\u0026D^fEQ=+10jWNZdpqj\u003c)zwKCO8KSiB7K\u003euL\u0026iQWr\u0026jxhlnpOR?{vH5W1K2\u003e?v/q0G^v/gSy+n\u003c%G]$M=O)N^*ehC=vz95ylN^o]eLcvI}LuXt+{rp$OYQE+:l6Uy%**msqU(bq@]fHx}s$}I\u003eq2", "ln": 20071628 }, { "b": "uWbmo4]U](P2Ow31ag6e\u0026r\u003eT0ly/\u0026rB5w}mqPl\u003eokn/VSziA2X1VZnPu5zcmUO8Ive0tZdrp^!:+k}6nXi\u0026G%1OP%=\u0026k:7=mv4YP7AoOL[hWlZ?GrV.]l4gS70BfrlJgAH@c%h\u0026\u003cdhGvr\u003ci)uViJ?W)h^%h7+RN@e04Vycr+4DMZ!r=)(t-GRt3:f[a2Wqdf)XrAxyn)O$$Ax1GA\u00267*%.]egy[y)[-=ngxm]OIZGItdNxi6Gg13", "ln": 31688019 }, { "b": "F.JDmfQjNWqCqn*0-W\u0026TqMXY?au^K5jkNP\u003e@RA(nOyQ[W]LjcXYOB$5T)tY-sOfqM9RPN]=X\u0026#Q{Pk2CV{lRupkkAafqV\u003e8P\u003c=[uosc@\u003em}zZNWF5\u003ea)AD!U/B[?=9{gNzww*QzlG]\u0026z.DFmbvz37EXaZ+NWVSJGquLbC-DA/73RP?i7.C)Xmu:*6F!xk\u003c)nz+i\u003c1EG?dHG}JjT]*=Gg[[h!T\u003e\u0026ISDN3**-1a[e+jMhEX7q0og2OhrFEUr+iEr\u0026K9TKyHJJ", "ln": 37170124 }, { "b": "vX5T7cLcMpSYcxzgU]\u003eW8dnX9/gQ#kx6GDiibsd]W*OuGvPiZKBG)P$oc@6xokSDOcu%l/5n:P\u003cbjz{PXkU^2i}#DM3^x\u003cF\u003cQ5I)NUdF!L6QFXTJirNX4N[RvG)2nK^O)I9Aq/7QM!zxHuZU.-zsyZRYwVMdB?cG^#n}@?r?Nhabe}[=k++vsYx0$1v=h))5(8k\u0026}y66\u0026*jhEqd7%ycNRWT6GDqI:KT-PSBOxW8z#@iTDj^R@qV", "ln": 39469110 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 42633304, "entropy": 8 }, "binary": { "peak_region_bytes": 42633216, "peak_region_entropy": 7.87 } } }, "id": 1, "mol": "O(I)Md₂(Bi)", "path": "@chikawa222224-testchikawa222224-2026.9.23-1-25.tgz!!package/bin/_chikawa222224_testchikawa222224.bin", "pid": 0, "risk": 117, "sha": "d63a77b075358375846b20734d481c3fe8a09bcab21fd4038396b0675600c5b2", "size": 42633304, "traits": [ { "id": "metadata/binary/layout/entropy::high-overall-entropy-data", "conf": 0.9, "crit": 3, "desc": "Data blob overall entropy at least 7.0" }, { "id": "metadata/file/data-blob::peak-entropy-mass-over-256k", "conf": 0.88, "crit": 2, "desc": "Data file has 256KB+ at peak entropy" }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-first-near", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS find-first through a near call", "spans": [ [ 205562, 15 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-next-ax", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "DOS find-next via MOV AX", "spans": [ [ 10750459, 2 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-next-near", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS find-next through a near call", "spans": [ [ 246052, 14 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-read-ax", "atk": "T1080", "conf": 0.84, "crit": 3, "desc": "DOS read via MOV AX", "spans": [ [ 31688083, 2 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-seek-ax", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS seek via MOV AX", "spans": [ [ 39469174, 2 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-write", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS writes a file via INT 21h", "spans": [ [ 37170188, 18 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-write-near", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS write through a near call", "spans": [ [ 779614, 15 ] ] }, { "id": "metadata/file/data-blob::high-entropy-data-file", "conf": 0.7, "crit": 2, "desc": "Elevated-entropy data file" }, { "id": "metadata/file/data-blob::near-maximum-entropy-file", "conf": 0.9, "crit": 1, "desc": "File has near-maximum entropy" }, { "id": "metadata/file/data-blob::very-high-entropy-data-file", "conf": 0.85, "crit": 3, "desc": "Very-high-entropy data file" }, { "id": "objectives/impact/infect/binary/dos::dos-int21-find-first-call", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "DOS find-first syscall", "uses": [ 2 ], "spans": [ [ 205562, 15 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-int21-write-call", "atk": "T1080", "conf": 0.86, "crit": 3, "desc": "DOS write syscall", "uses": [ 7, 8 ], "spans": [ [ 779614, 15 ], [ 37170188, 18 ] ] }, { "id": "metadata/file/data-blob::opaque-high-entropy-data-file", "conf": 0.9, "crit": 3, "desc": "Large data file is near-maximum entropy", "uses": [ 1, 9, 10, 11 ] }, { "id": "objectives/impact/infect/binary/dos::dos-com-directory-infector", "atk": "T1080", "conf": 0.96, "crit": 5, "desc": "DOS COM walks a directory and writes", "uses": [ 3, 4, 12, 13 ], "spans": [ [ 205562, 15 ], [ 246052, 14 ], [ 779614, 15 ], [ 10750459, 2 ], [ 37170188, 18 ] ] } ], "type": "data" }, { "ctx": [ { "b": "[4lsUB-RapB98Cpv@@[R4giKKv@DmaBrC]Mv@=c?By!0KB7=XAauZ\u0026/wPq\u003cbA+cTyzF%5%i+9hQAcc1xdlv$Cv@DmaBrC]Mv@=c?By!uYvpSqUA+eV@aBLv}aAz4kB.L(cc)ALEwmW/lB0r4{4glP-zGx[xDMW6wx(k5wauZ\u0026/wPq\u003cbA+cTyzF%5%i=FIHxD!(!4giKKv@DmaBrC4bzEENhp*[DVauZ\u0026Zz!T8quTEtTA=br5wH[@FvRGZ7efDczv}YN(vrVcngbpQug*+uoB97]9x\u003e}d3vkoO[gbpWsvRGZ7dlv$C4glY\u0026zEW^5z/cXdwN/T?wKo*DwI#v[C42ifwHO:G4gjj2arUxgasItSAaJ%1aA?gfB.8WsjV%]iB98CpzF7dxaBsL8arR^HarR^HBzbYkCoy^mCox\u003egAaIEUA=k$Db4s#4wI#whBAy@3xL?r#BrCByB95KlwGUz7B98CpzF7dxi$hJtarR!P4giKKarR^Hv@DmaBrC7ize-][BrAZ?C42ifwIe1mAbn@)wHGipB1n[RefDbXdlv$CarR^Hx\u003ewFov@Dj6vpKyiy?mG%Bz8^WjV%]wdiJ%D3lQDlarR^HaAz4nB-IvxluM)LwPxziy\u0026131c[)8i4gjj2arV7w3lQDlazCBgc)plItr%\u0026Avj=^VeJCsmt}e0:fF1#cbRH=(wPI@wv@Dj6vpKyddiJ%D3lQDlarR^HaARpqz*9swwP]m@D2Ns-A=M8sc)AbeB7El^l3diSv}YZ\u003czGE1nB0bvsBrC:ny?WA5lsB}Dhz=Qbi$hJtarR!P4giKKarR^Hv@DmaBrCZzAa9o/wN(]Day/tbAa9l#e]\u003eJxy***+", "ln": 0, "col": 1, "line": 1 }, { "b": "l3diSv}YZ\u003czGE1nB0bvsBrC:ny?WA5lsB}Dhz=Qbi$hJtarR!P4giKKarR^Hv@DmaBrCa9v@C)?wfs2TluM)LwPxznA=k!yB-8ebwmPmZefDcCvrl0rg:jwg4gjj2arUxgasH=iv@C)?wg?$xq/)4]zF7vwvQTs?hz=Qbe]\u003eJxy***+c[^.lbRHX\u003ea%FDUaW4$hB-8ebwmPmZdiJ%D3lQDlarR^HaARpqz*9swwP]m@D2Ns-A=M8sc)AbeB7El^l3diSv}YZ\u003czGE1nB0bvsBrC:ny?WA5lsB}Dhz=Qbi$hJtarR!P4gjj2arUYoBAIRway]3", "ln": 767, "col": 36, "line": 24 }, { "b": "y?4Q7vru6Kvrl9gvQTs?hz^ZwBywV)zdNQbauZ?\u003ea$K\u003cBy?EWbx([39auZ?\u003eB7!#qh8VTcaBsL8arR^HA+funA=91qwP]m[A=k/eB7D:FA+frgy\u003c6wvaAz4dwN/*hau.[hDKQr8arR^HarR!ywPP5dvrl9z4gjj2arR^HarUGiBrC1lBywV)zdNQbi$hJtarR^HarR!GA^n^O4gjj2arR^HarR^HarUuaB7=WVay/C6vru6Kvrl9gvqGN{A+PSez7dKQ3lQDlarR^HarR^HayPwlvpJ$/wO#PjjS[oDv@C)?lsB}Dhz=*\u003evrl0rg^Mk9vpJ$/wO#Psi$hJtarR^HarR!P4gjj2arR^HarUf5ByO#bc$NBtz/NoHDKQr8arR^HarR^HarR!EwOL^^BspZvA=k$Ei$hJtarR^HarR^HarR!EwPS6nzAwpmarR^HarR^HEglI)3lQDlarR^Hay/tcB95KszG6-uauZ\u0026SA+eW3wM08Fwk^O\u003cwNPB7vRGZ*A^pF\u0026Bz99+4gjj2arR^HarUxoAclmPz/c%EwPz*fAW04SA+e#%v@%dY4gjj2arR^HarUxoAclmPz/c%EwmoN*a$K\u0026+v}Z15yBHw?j%jJEB7^gGAaAy0wHI54B-7$zdlv$CarR^HarR^Hx(m)jBs}GHc)AkuwfJMEc[co4j%kgY3lQDlarR^HarR^Hazth8xFaBDwmoN\u003ec$djtvpJ$/wO#Psi$hJtarR^HarR^HarR!EwPI^aC4A7nvrl9mwnbW/B95/OxK#AjdjEs/3lQDlarR^HaBLX24gjj2arV7Yi$hKB4giKKzeS%cy?kkgCYmOwBAnM/ay!?@v%8P@By!0KB7^SA3t\u003cY(B.\u003eRwwQ5fjA==vPv{%g-B.\u003eGdwK{lJxDPCXv{%g-B.\u003eGdwK{lJxGDUgzeS%cy?kkgCYmOwBAo6zx(mv1C#d{\u003exDPCXvRGZ*A^pF\u0026Bz9-B3i", "ln": 1050, "col": 12, "line": 34 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "join" ], [ "", "TypeError" ], [ "", "value.replace" ], [ "", "Buffer.alloc" ], [ "", "TypeError" ], [ "", "compact.replace" ], [ "", "TypeError" ], [ "", "Buffer.from" ], [ "", "decoded.toString.replace" ], [ "", "decoded.toString" ], [ "", "TypeError" ], [ "", "Promise" ], [ "", "createHash" ], [ "", "decodeBase64" ], [ "", "reject" ], [ "", "createReadStream" ], [ "", "input.on" ], [ "", "input.on" ], [ "", "hash.update" ], [ "", "input.on" ], [ "", "hash.update" ], [ "", "resolve" ], [ "", "hash.digest" ], [ "", "node:crypto" ], [ "", "node:fs" ], [ "", "node:path" ] ], "mbr": [ "Buffer.alloc", "Buffer.from", "compact.length", "compact.replace", "decoded.toString", "decoded.toString.replace", "hash.digest", "hash.update", "input.on", "module.exports", "module.exports.binaryPath", "module.exports.calculateHash", "unpadded.length", "value.replace" ], "tgt": [ "Buffer.alloc", "Buffer.from", "Promise", "TypeError", "compact.replace", "createHash", "createReadStream", "decodeBase64", "decoded.toString", "decoded.toString.replace", "hash.digest", "hash.update", "input.on", "join", "reject", "require", "resolve", "value.replace" ], "funcs": [ [ "decodeBase64", 246 ], [ "calculateHash", 1039 ], [ "anonymous", 1133 ], [ "anonymous", 1529 ], [ "anonymous", 1586 ] ], "metrics": { "ast": { "op.eq": 2, "op.ne": 2, "op.mod": 1, "op.lnot": 1, "max_depth": 19, "call_count": 27, "node_count": 579, "member_count": 14, "op_density.eq": 0, "op_density.ne": 0, "op_density.mod": 0, "op_density.lnot": 0, "member_depth_max": 3 }, "file": { "size": 1823, "entropy": 4.82 }, "text": { "lines": 59, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 384, "char_entropy": 4.82, "unique_chars": 71, "top_char_null": 0, "string_density": 0.37, "top_char_ratio": 0.07, "avg_line_length": 28.9, "max_line_length": 82, "non_ascii_ratio": 0, "empty_line_ratio": 0.15, "last_line_length": 39, "whitespace_ratio": 0.28, "identifier_density": 1.42, "line_length_stddev": 23.18, "normalized_string_count": 2.86, "repeated_char_sequences": 6, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 5.95 }, "binds": { "count": 10 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.01 }, "source": { "function_count": 2 }, "imports": { "count": 3, "stdlib_count": 3, "stdlib_ratio": 1 }, "strings": { "bytes": 256, "count": 22, "avg_length": 11.64, "max_length": 36, "avg_entropy": 2.75, "empty_count": 4, "entropy_stddev": 0.9 }, "functions": { "count": 2, "nested": 2, "density": 8.47, "anonymous": 3, "avg_params": 1.2, "code_ratio": 1.2, "max_params": 2, "one_liners": 1, "length_stddev": 9.68, "avg_name_length": 12.5, "no_params_count": 1, "avg_length_lines": 14.2, "max_length_lines": 24, "min_length_lines": 1, "avg_nesting_depth": 1, "max_nesting_depth": 2, "avg_param_name_length": 8 }, "identifiers": { "count": 84, "unique": 35, "avg_length": 7.37, "max_length": 16, "min_length": 2, "avg_entropy": 2.44, "reuse_ratio": 0.42, "length_stddev": 3.14, "has_digit_ratio": 0.06, "base64_like_names": 2, "all_lowercase_ratio": 0.71, "numeric_suffix_count": 1, "underscore_prefix_count": 1 } } }, "id": 2, "mol": "O(C)H₄(CrDb₅FPo)Md(In₂)", "path": "@chikawa222224-testchikawa222224-2026.9.23-1-25.tgz!!package/index.js", "pid": 0, "risk": 9, "sha": "626a1a13908c5d1000cd897aa5cb921024d6e50d5b35ac9a86d82d890a3d93a4", "size": 1823, "traits": [ { "id": "metadata/import/npm/crypto::crypto", "conf": 0.95, "crit": 3, "desc": "imports node:crypto", "spans": [ [ 51, 11 ] ] }, { "id": "metadata/import/npm/fs::fs", "conf": 0.95, "crit": 3, "desc": "imports node:fs", "spans": [ [ 105, 7 ] ] }, { "id": "metadata/import/npm/path::path", "conf": 0.95, "crit": 2, "desc": "imports node:path", "spans": [ [ 143, 0 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::digest-method-call", "conf": 0.8, "crit": 3, "desc": "Calls a digest() method", "spans": [ [ 1657, 8 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::hash-object-digest-call", "conf": 0.88, "crit": 3, "desc": "JavaScript hash-object digest call", "spans": [ [ 1653, 11 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call", "conf": 0.88, "crit": 3, "desc": "Calls a matcher in a conditional expression", "spans": [ [ 517, 35 ] ] }, { "id": "micro-behaviors/data/decode/symbol-base64::buffer-from-base64", "conf": 0.8, "crit": 3, "desc": "Base64 decoding via Buffer.from (JS)", "spans": [ [ 831, 11 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "spans": [ [ 873, 16 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 881, 8 ] ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "spans": [ [ 1512, 15 ] ] }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "spans": [ [ 1570, 14 ] ] }, { "id": "objectives/command-and-control/dropper/builder::embedded-vba-payload-decoder", "atk": "T1587.001,T1204.002", "mbc": "B0023", "conf": 0.85, "crit": 3, "desc": "Embeds a VBA base64 payload-decoder template", "spans": [ [ 255, 12 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::node-createhash-call", "conf": 0.65, "crit": 3, "desc": "Node.js createHash call", "spans": [ [ 1235, 10 ] ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "spans": [ [ 831, 30 ] ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "spans": [ [ 880, 18 ] ] }, { "id": "micro-behaviors/fs/path/construct::script-dirname-ref", "conf": 0.6, "crit": 3, "desc": "References script directory path", "spans": [ [ 184, 9 ] ] }, { "id": "micro-behaviors/fs/read/stream::create-read-stream", "conf": 0.92, "crit": 3, "desc": "Creates a file read stream", "spans": [ [ 1437, 16 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "[4ltY4gjj2arR\u003eCvqPN1iV]K?kX1FwyHIA}gbpQugbHUawPI%6xLzl\u003cCvrlZgbpQwa$KfgarR^Hb6EKrB7]Mgb03??a#g\u0026chzd0xgbyHpeIYgcedz}earR^JwmY*(A+PGmx(v(kiV]K?nmuNMaA.^uy?X0pazbLjaARpdayYFhwnC*/ayY55vrcSoA+f5#vrl05vrlH3BrSmB3lQDlar\u003e=Bx)9{bwG\u003ceTazb4#B7D)i3lQDlar\u003eVhx(kaQarR\u003exzE^s6e]2CKedz}earR^JwQ5fjA==vDiV]K?e?Z{RwmZ0ryi7NI4gjj2arR\u003eux(4v4b03??tmy]ZarR^HarR^HarR^HarR^Har\u003eJqwmZ0ryi7NI4gjj2arR^HarR^HarR^HarR^Hb4tn7fjej5x\u003e}d3vkoO[gbpW[By/Jnv}YN(vrVcngbpQug+JlKzxYI%arR^HarR^HarR^HarT@v4gjj2arR\u003eDB0rT/ax]oZarR^HarR^HarR^HarR^JCwg}Jg9NemarR^HarR^HarR!jedz}earR^Jv@MMmiV]LH4gjj2arR^HarR^HarR^HarR\u003eMhz=P!3lQDlarR^HarR^HaycJc3lQDlar\u003exmxk8l{B0rT/aBsL8arR^HarR^HarR^HarR^HarR^Hb5RsfwG\u003ceTar\u003e6kfFCp]jUX=Cf/Q^ta}j(4arR^HarR^HarR^HarR!Pedz}earR^Jy?Wx\u003czGxwkiV]K?rzDjVlQ::Gmmnse3vJu\u003c", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 597, "entropy": 4.17 }, "binary": { "peak_region_bytes": 597, "peak_region_entropy": 4.17 } } }, "id": 3, "mol": "Md(Pa₅)", "path": "@chikawa222224-testchikawa222224-2026.9.23-1-25.tgz!!package/package.json", "pid": 0, "risk": 5, "sha": "8ec48f69c281a9b87d9d8946fd403c6406673fb14166258204643576407c4be4", "size": 597, "traits": [ { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field", "spans": [ [ 0, 21 ] ] }, { "id": "supply-chain/suspicious-name", "conf": 0.7, "crit": 3, "desc": "Package name '@chikawa222224/testchikawa222224' matches suspicious patterns", "spans": [ [ 7, 32 ] ] }, { "id": "metadata/package/entrypoint::has-exports-field", "conf": 0.85, "crit": 2, "desc": "package.json declares an exports map", "spans": [ [ 216, 0 ] ] }, { "id": "metadata/package/entrypoint::main-root-javascript-entry", "conf": 0.9, "crit": 2, "desc": "Root JavaScript main entrypoint", "spans": [ [ 190, 0 ] ] }, { "id": "metadata/package/files/included::npm-publish-root-manifest", "conf": 0.95, "crit": 2, "desc": "Manifest sits at npm publish root" }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json" }, { "id": "metadata/package/files/package-json::files-array-present", "conf": 0.92, "crit": 3, "desc": "Package.json declares a files allowlist", "spans": [ [ 247, 52 ] ] }, { "id": "metadata/package/runtime::has-cpu-restriction", "conf": 0.98, "crit": 3, "desc": "Package restricts supported CPU architectures", "spans": [ [ 428, 5 ] ] }, { "id": "metadata/package/runtime::has-os-restriction", "conf": 0.98, "crit": 3, "desc": "Package restricts supported operating systems", "spans": [ [ 375, 7 ] ] }, { "id": "metadata/package/runtime::has-platform-restrictions", "conf": 0.85, "crit": 3, "desc": "Package specifies platform restrictions", "spans": [ [ 375, 8 ], [ 428, 9 ] ] }, { "id": "metadata/package/runtime::windows-only-platform-restriction", "conf": 0.95, "crit": 3, "desc": "Package restricts installation to Windows only", "spans": [ [ 375, 46 ] ] }, { "id": "metadata/package/versioning/sentinel::npm-version-major-40-plus", "atk": "T1195.002", "conf": 0.82, "crit": 3, "desc": "npm package version major 40+", "spans": [ [ 57, 14 ] ] }, { "id": "metadata/package/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point", "spans": [ [ 190, 0 ] ] }, { "id": "metadata/package/runtime::has-os-cpu-restrictions", "conf": 0.98, "crit": 1, "desc": "Package restricts both operating system and CPU", "uses": [ 7, 8 ], "spans": [ [ 375, 0 ] ] }, { "id": "metadata/package/entrypoint::has-multiple-entries", "conf": 0.85, "crit": 3, "desc": "Package has multiple entry points", "uses": [ 2, 12 ], "spans": [ [ 190, 8 ], [ 216, 10 ] ] } ], "type": "package.json" }, { "ctx": [ { "b": "gbpWtBy/Jnv}YN(vrVcngbpQugZ%^33pb!fz!9Aiyi7Ihvrl98y?Wv0vrcSow]zYjBzbkdvS=N0y?mc1u%^zSx\u003e}d3vkoO[gbpW[By/Jnv}YN(vrVcngbpQug+JlKzEsO@x(mv1C{3Zky?kjd3jNs!boPJ=B7=XavqGB@y*?B1z/c0\u003e4gl6FwGU/6vSC)$C{3Q9y?4Q7vru74ao", "ln": 16, "col": 17, "line": 1 }, { "b": "vpJ$/wO#Psdps+q3jNtwxK@q%wObv[y\u0026*!dy?EWbx([39azC)tq+fhagbQ%jvqYP#BzbkdA+frmy\u0026*!lB0bHmBAIRwwN(](B0a)ly\u0026sJeA:@K0wGUU$CWUb]v}/^*y-)!vA+PA7e!5c%3l{=rrDzOYwEO$Q3sEmHyi6*\u003ev@DmaBrC]Mv{%g-B.\u003eGdwK{lJxDRZCjS[=RADL#owHF-/v}YN(vrVcngbpQug+S@ZB97]9x\u003e}d3vkoO[gbpWgdlv$C4glP-zGx[xvruQ1v}YZ\u003czGFiNB7El^auZ\u0026lB.kk%AXp%Az/3)DvruQ1v}YZ\u003czGE1gD30Rsa$kc^z=p:#x(mMib4s#4wI#v?dlv$Cv{%g-B.\u003eGdwK{lJxEEqhBywV)zdNQblsB}Dhz=\u003cnBzbl6c$vgkB8L(ae]kDsdlv$Cu%)vK3jNtfvqGB@y*?A%aA8dlC{4ixwGUD8zE^M{wftF#y?j-5vrl98vTf8mze19lx(mMaBzbkdvruQ1v}YZ\u003czGE]G3jNtIu%).\u003c4glPNy?4Q7vru6Kvrl9gdk2ZQwO@]az/fSmy?kknz!yHX4glGJu\u003e0CL3rqdUayPeaBzblaayP80z/PMlxL!(kB-qqrA=+(6ayYQsph:VOe]2C*4giKKu%)wSA$5E^vqGB@y*?A%nmuNMc$djtvpJ$/wO#PRvrl0rg+o:[B7!#tf!%}4e{7=rzyx1kzGxZ", "ln": 373, "col": 57, "line": 12 }, { "b": "y?4Q7vru6Kvrl9gvQTs?hz^ZwBywV)zdNQbauZ?\u003ea$K\u003cBy?EWbx([39auZ?\u003eB7!#qh8VTcu\u003e0CL3q$CSB-IwvayMy2p\u0026ZF\u003ex(^\u0026FB98CpzF8dvay/tcByw)3x(mMaBzbkdv{%g-B.\u003eGdwN(]%vrl9maw3D]vqGT*avoHTwI#v/x(m)jBrCHxayPdgB-4", "ln": 974, "col": 8, "line": 39 } ], "depth": 1, "facts": { "imp": [ [ "", "bundled" ], [ "", "words" ], [ "", "string.Usage" ], [ "", "string.Usage" ], [ "", "string.Usage" ], [ "", "by.js" ], [ "", "by.js" ], [ "", "by.js" ], [ "", "Returns.Invalid" ], [ "", "Returns" ] ], "mbr": [ "Returns.Invalid", "argument.In", "by.js", "bytes.The", "chikawa222224.js", "file.Hash", "string.Usage", "words.The" ], "tgt": [ "Returns", "Returns.Invalid", "bundled", "by.js", "string.Usage", "words" ], "metrics": { "ast": { "op.sub": 1, "max_depth": 9, "call_count": 12, "node_count": 227, "member_count": 8, "op_density.sub": 0, "member_depth_max": 2 }, "file": { "size": 1244, "entropy": 5.01 }, "text": { "lines": 45, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.07, "space_count": 110, "char_entropy": 5.01, "unique_chars": 67, "top_char_null": 0, "string_density": 0.31, "top_char_ratio": 0.08, "avg_line_length": 25.64, "max_line_length": 129, "non_ascii_ratio": 0, "empty_line_ratio": 0.4, "last_line_length": 54, "whitespace_ratio": 0.16, "identifier_density": 2.13, "line_length_stddev": 33.09, "normalized_string_count": 2.09, "suspicious_string_ratio": 0.07, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 11.47 }, "binary": { "peak_region_bytes": 1244, "peak_region_entropy": 5.02 }, "strings": { "bytes": 481, "count": 14, "avg_length": 34.36, "max_length": 208, "avg_entropy": 4.04, "email_count": 1, "empty_count": 6, "entropy_stddev": 0.56, "embedded_code_candidates": 1 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_text": 1 }, "identifiers": { "count": 96, "unique": 63, "avg_length": 5.97, "max_length": 17, "min_length": 1, "avg_entropy": 2.16, "reuse_ratio": 0.66, "length_stddev": 3.22, "has_digit_ratio": 0.05, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.03, "all_lowercase_ratio": 0.75, "all_uppercase_ratio": 0.05, "numeric_suffix_count": 3 } } }, "id": 4, "mol": "O(As)H(Db₃)", "path": "@chikawa222224-testchikawa222224-2026.9.23-1-25.tgz!!package/README.md", "pid": 0, "risk": 4, "sha": "790d8b3b9b53c5e75ffa496db907db8ae8dafb623bab747302dacc5c412bff8f", "size": 1244, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 68, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 421, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 64, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-leading-promise-chain-call", "conf": 0.84, "crit": 3, "desc": "Leading promise-chain call at module scope", "spans": [ [ 791, 21 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 636, 8 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::readme-basename", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 3, "desc": "README basename (markdown/plain text)" }, { "id": "metadata/lang/javascript-features::const-let", "conf": 0.9, "crit": 2, "desc": "ES6 const/let declarations", "spans": [ [ 579, 0 ] ] }, { "id": "metadata/lang/javascript-features::destructuring", "conf": 0.9, "crit": 2, "desc": "ES6 destructuring assignment", "spans": [ [ 505, 0 ] ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "spans": [ [ 635, 18 ] ] } ], "type": "javascript" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 858, "entropy": 4.92 }, "binary": { "peak_region_bytes": 858, "peak_region_entropy": 4.92 }, "registry": { "age_days": 0, "file_count": 4, "maintainers": 1, "published_at": 1790463728, "releases_24h": 7, "releases_48h": 13, "is_deprecated": 0, "release_count": 1006, "security_hold": 0, "unpacked_size": 42636971, "version_removed": 0, "downloads_recent": 92073, "package_age_days": 64, "first_published_at": 1784862104, "has_install_script": 0, "previous_published_at": 1790454329, "publisher_in_maintainers": 1, "days_since_previous_release": 0 } } }, "id": 5, "mol": "Md(Re)", "path": "@chikawa222224_testchikawa222224@2026.9.23-1-25.registry.json", "pid": 0, "rel": "registry", "risk": 1, "role": "sidecar", "sha": "9aac03e2e5867977fdda05495353f575babdc1fcb18e7f0e213c65abfc5bd858", "size": 858, "traits": [ { "id": "metadata/registry::many-releases", "conf": 1.0, "crit": 3, "desc": "Twenty or more releases" }, { "id": "metadata/registry::publish-burst-24h", "conf": 1.0, "crit": 3, "desc": "Three releases published within 24 hours" }, { "id": "metadata/registry::publish-burst-48h", "conf": 1.0, "crit": 3, "desc": "Three releases published within 48 hours" }, { "id": "metadata/registry::single-maintainer", "conf": 1.0, "crit": 3, "desc": "Registry package lists one maintainer" }, { "id": "metadata/registry::widely-installed", "conf": 1.0, "crit": 3, "desc": "Large registry install base (10k+ downloads)" }, { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Release published within seven days" } ], "type": "registry" } ], "rev": "c1ea9", "v": "8" } }