{
  "llm": {
    "conf": 0.98660004,
    "grade": "hostile",
    "model": "Qwen/Qwen3.8-27B",
    "outcome": "hostile",
    "interpretation": "Shai-Hulud worm preinstall hook"
  },
  "ml": {
    "v": "7",
    "id": 1,
    "lvl": 25,
    "conf": 92,
    "prob": 0.9800000190734863,
    "type": "npm",
    "version": "v18.18",
    "analyzed_at": "2026-09-01T12:47:43Z"
  },
  "path": "@7nohe-openapi-react-query-codegen-0.0.0-365d4eb738d3146583431948d3ba6e27a32556be.tgz",
  "raw": {
    "files": [
      {
        "id": 1,
        "ctx": [
          {
            "b": "abZy80000000zS4*JIsvWKw.U]+wjYj0}S?p{KSz7J4\u003cc!*jhlMEI8M\u003e]L\u003c^2MWvb5EoHcp.Gbsj\u003ev/4j8YF9]r=\u0026@ULO\u003cQ}$VGQG7xpY+VL-Y6:=jeVeRNkf+Pyf?d$PyD7QGDOCrovDaQL[VWYTVfq4ocsY{3:Ze0RzM6A9Y?\u003c78\u0026=^{jX*oY@)Te\u003cNsUDeAj{VV+\u0026fdSVag$BD{G}Fy*+b\u003e",
            "ln": 0
          }
        ],
        "mol": "K(Mc)O(S₄)H₃(Db₂F₂Po)Md(Pa₇)",
        "pid": 0,
        "rel": "fetched",
        "sha": "c555a1ab1a2e0425d6d7f965bae55af83b5aceab2177494a00ec43451c863c63",
        "via": "https://registry.npmmirror.com/@7nohe/openapi-react-query-codegen/-/openapi-react-query-codegen-0.0.0-365d4eb738d3146583431948d3ba6e27a32556be.tgz",
        "path": "https://registry.npmmirror.com/@7nohe/openapi-react-query-codegen/-/openapi-react-query-codegen-0.0.0-365d4eb738d3146583431948d3ba6e27a32556be.tgz",
        "refs": [
          {
            "to": "pkg:github/7nohe/openapi-react-query-codegen",
            "off": 0,
            "kind": "repository"
          }
        ],
        "risk": 348,
        "size": 25430,
        "type": "npm",
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 25430,
              "entropy": 7.99
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 25430,
              "peak_region_entropy": 7.83
            }
          }
        },
        "ident": {
          "name": {
            "value": "@7nohe/openapi-react-query-codegen",
            "source": "npm.name",
            "verified": false
          },
          "urls": [
            {
              "url": "git+https://github.com/7nohe/openapi-react-query-codegen.git",
              "kind": "repository",
              "source": "npm.repository.url"
            },
            {
              "url": "https://github.com/7nohe/openapi-react-query-codegen",
              "kind": "homepage",
              "source": "npm.homepage"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "url": "@7nohe",
              "name": "Daiki Urata",
              "role": "author",
              "source": "npm.author"
            }
          ],
          "version": {
            "value": "0.0.0-365d4eb738d3146583431948d3ba6e27a32556be",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "@7nohe/openapi-react-query-codegen",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/fs/file/write/async::write-file-call-target",
            "conf": 0.9,
            "crit": 1,
            "desc": "Calls an unqualified writeFile function",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::script-wget",
            "conf": 0.8,
            "crit": 3,
            "desc": "Script uses wget"
          },
          {
            "id": "metadata/package/scripts/lifecycle::has-preinstall-script",
            "conf": 0.95,
            "crit": 3,
            "desc": "Manifest declares npm preinstall lifecycle hook"
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw",
            "conf": 0.88,
            "crit": 3,
            "desc": "Raw content contains preinstall hook",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/worm::install-hook-self-targeting-worm-env",
            "atk": "T1195.002",
            "mbc": "F0001",
            "conf": 0.95,
            "crit": 4,
            "desc": "Hook exports package self-identity env",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::script-http-url",
            "conf": 0.75,
            "crit": 3,
            "desc": "Script contains HTTP URL"
          },
          {
            "id": "well-known/malware/supply-chain/shai-hulud::shai-hulud-self-targeting-preinstall",
            "atk": "T1195.002",
            "mbc": "F0001",
            "conf": 0.98,
            "crit": 5,
            "desc": "Preinstall declares Shai-Hulud worm config",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/manifest/ecosystem::openapi-generated-keyword",
            "conf": 0.9,
            "crit": 3,
            "desc": "OpenAPI client or generator keyword"
          },
          {
            "id": "metadata/package/manifest/repository::repo-url-git-host",
            "conf": 0.9,
            "crit": 3,
            "desc": "Repository identifies major Git host"
          },
          {
            "id": "metadata/lang/javascript-features::arrow-function",
            "conf": 0.9,
            "crit": 1,
            "desc": "ES6 arrow function syntax",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "metadata/lang/scripted::dts-declaration-file",
            "conf": 0.99,
            "crit": 2,
            "desc": "TypeScript declaration file",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-or-declaration-file",
            "conf": 0.85,
            "crit": 1,
            "desc": "File is a test or type-declaration source file",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "evasion/hidden-file",
            "atk": "T1564.001",
            "conf": 0.85,
            "crit": 4,
            "desc": "Script 'preinstall' references hidden file(s): ~/.bun/bin/bun"
          },
          {
            "id": "metadata/package/scripts/develop::has-test-script",
            "conf": 1.0,
            "crit": 1,
            "desc": "package.json declares a test script"
          },
          {
            "id": "objectives/supply-chain/install-hook/build/behavioral::npm-preinstall-curl",
            "atk": "T1195.002",
            "conf": 0.95,
            "crit": 4,
            "desc": "preinstall script with curl/wget",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import",
            "conf": 0.95,
            "crit": 2,
            "desc": "Imports the Node fs/promises API",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/lang/javascript-features::spread-operator",
            "conf": 0.9,
            "crit": 1,
            "desc": "ES6 spread operator (in array/object context)",
            "from": [
              {
                "file": 15
              }
            ]
          },
          {
            "id": "metadata/package/files/package-json::files-array-present",
            "conf": 0.92,
            "crit": 3,
            "desc": "Package.json declares a files allowlist"
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall",
            "atk": "T1195.002",
            "conf": 0.85,
            "crit": 3,
            "desc": "Has preinstall script hook"
          },
          {
            "id": "metadata/package/quality/profile::has-typescript",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares TypeScript tooling",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/manifest/workspace::has-workspaces",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package uses workspaces (monorepo pattern)"
          },
          {
            "id": "micro-behaviors/fs/file/write/async::node-write-file-promise-destructured",
            "conf": 0.9,
            "crit": 3,
            "desc": "Node writes a file via destructured import",
            "from": [
              {
                "off": 379,
                "file": 4,
                "line": 10
              },
              {
                "file": 7
              },
              {
                "off": 3786,
                "file": 33,
                "line": 92
              },
              {
                "off": 45,
                "file": 38,
                "line": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/read::file-read-api-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls JavaScript readFile API",
            "from": [
              {
                "file": 33
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::declaration-file-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "File uses a source declaration extension",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Invokes zero-argument function at module scope",
            "from": [
              {
                "file": 38
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/package::npm-script-shell",
            "atk": "T1059",
            "mbc": "B0030",
            "conf": 0.85,
            "crit": 3,
            "desc": "npm script invokes shell or eval"
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only",
            "conf": 0.88,
            "crit": 3,
            "desc": "Catch block only returns a constant",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/package/manifest/entrypoint::has-exports-field",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json declares an exports map"
          },
          {
            "id": "objectives/supply-chain/recon-exfil/registry/lifecycle::meta-preinstall-wget",
            "atk": "T1041",
            "conf": 0.9,
            "crit": 4,
            "desc": "Preinstall hook invokes wget remotely",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "supply-chain/install-hook/preinstall",
            "conf": 0.8,
            "crit": 3,
            "desc": "Package has 'preinstall' hook that runs during install"
          },
          {
            "id": "objectives/supply-chain/install-hook/build/behavioral::npm-install-trojan",
            "atk": "T1195.002",
            "conf": 0.95,
            "crit": 5,
            "desc": "npm package executes a high-risk install-time command",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/scripts/build::pkg-build-script-field",
            "conf": 0.6,
            "crit": 3,
            "desc": "Package declares a build script"
          },
          {
            "id": "metadata/package/files/runtime::javascript-dist-tree-artifact",
            "conf": 0.95,
            "crit": 3,
            "desc": "JavaScript/TypeScript file under dist",
            "from": [
              {
                "file": 2
              }
            ]
          }
        ]
      }
    ]
  }
}