{
  "ml": {
    "v": "7",
    "eng": "2.4.0",
    "lvl": -1,
    "conf": 0,
    "prob": 0.10906318,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.10906317830085754,
        "type": "npm"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-27T21:57:27Z"
  },
  "path": "extension-floating-menu@3.29.1",
  "raw": {
    "v": "8",
    "rev": "50048",
    "files": [
      {
        "id": 0,
        "mol": "H(Cm)Md₂(Pa₂)",
        "sha": "c882690ed591349be68c1819b64a2151249ac42c0a9512bc15d6f621831c989b",
        "path": "extension-floating-menu-3.29.1.tgz",
        "risk": 9,
        "size": 15453,
        "type": "npm",
        "facts": {
          "metrics": {
            "file": {
              "size": 15453.0,
              "entropy": 7.98,
              "size_bytes": 15453.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 7.98,
              "peak_region_bytes": 15360.0,
              "peak_region_entropy": 7.81
            }
          }
        },
        "traits": [
          {
            "id": "metadata/package/scripts::has-build-script-build",
            "conf": 0.7,
            "crit": 2,
            "desc": "Package declares build script"
          },
          {
            "id": "micro-behaviors/fs/path/extension::js-reference",
            "conf": 0.7,
            "crit": 1,
            "desc": "JavaScript extension reference"
          },
          {
            "id": "metadata/library/runtime::js-module-exports",
            "conf": 1.0,
            "crit": 2,
            "desc": "Exports a JavaScript module"
          },
          {
            "id": "metadata/lang/source::interface-only-source",
            "conf": 1.0,
            "crit": 1,
            "desc": "TypeScript interface declaration in source"
          },
          {
            "id": "micro-behaviors/data/manipulation::remove-call",
            "conf": 0.8,
            "crit": 1,
            "desc": "Removes a DOM element"
          },
          {
            "id": "metadata/package/files/included::package-json-basename",
            "conf": 0.95,
            "crit": 1,
            "desc": "Filename is package.json"
          },
          {
            "id": "metadata/package/manifest/description::has-description",
            "conf": 0.75,
            "crit": 2,
            "desc": "Package has meaningful description"
          },
          {
            "id": "metadata/file/profile/identity::documentation-page-term",
            "conf": 0.82,
            "crit": 1,
            "desc": "Documentation page terminology"
          },
          {
            "id": "metadata/package/manifest/entrypoint::main-dist-entrypoint",
            "conf": 0.8,
            "crit": 2,
            "desc": "Package main targets dist output"
          },
          {
            "id": "metadata/package/config::short-sidecar-file",
            "conf": 0.8,
            "crit": 1,
            "desc": "Short sidecar-sized source"
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::browser-append-child",
            "conf": 0.8,
            "crit": 1,
            "desc": "Appends child DOM node"
          },
          {
            "id": "metadata/package/files/included::javascript-dist-tree-artifact",
            "conf": 0.95,
            "crit": 1,
            "desc": "JavaScript file under dist"
          },
          {
            "id": "metadata/file/metrics::javascript-small-file-5k",
            "conf": 0.7,
            "crit": 1,
            "desc": "JavaScript file under 5KB"
          },
          {
            "id": "metadata/package/files/package-json::files-dist-ref",
            "conf": 0.85,
            "crit": 2,
            "desc": "Package files list includes the dist directory"
          },
          {
            "id": "metadata/package/manifest/repository::has-bugs-url-field",
            "conf": 0.8,
            "crit": 2,
            "desc": "Package has bugs/issues URL"
          },
          {
            "id": "objectives/collection/stealer/browser::js-cookie-harvest-recognized-marker",
            "atk": "T1539",
            "conf": 0.85,
            "crit": 1,
            "desc": "Recognized all-cookie helper marker"
          },
          {
            "id": "metadata/file/extension/identity::type-stub-or-map-basename",
            "conf": 0.85,
            "crit": 1,
            "desc": "Type stub or source map filename"
          },
          {
            "id": "metadata/file/metrics::file-has-30-plus-lines",
            "conf": 0.9,
            "crit": 1,
            "desc": "File has 30 or more lines"
          },
          {
            "id": "metadata/lang/scripted::dts-declaration-file",
            "conf": 0.99,
            "crit": 2,
            "desc": "TypeScript declaration file"
          },
          {
            "id": "metadata/package/scripts::pkg-build-script-field",
            "conf": 0.6,
            "crit": 3,
            "desc": "Package declares a build script"
          },
          {
            "id": "metadata/file/format::sourcemap-sources-content",
            "conf": 0.9,
            "crit": 1,
            "desc": "Source map sourcesContent array"
          },
          {
            "id": "objectives/supply-chain/install-hook/project-rewrite::postinstall-host-entry-list",
            "conf": 0.9,
            "crit": 1,
            "desc": "Install helper lists host entry files"
          },
          {
            "id": "metadata/package/manifest/repository::repo-url-git-host",
            "conf": 0.9,
            "crit": 2,
            "desc": "Repository URL uses GitHub, GitLab, or Bitbucket"
          },
          {
            "id": "metadata/lang/scripted::plain-js-identifier-assignment",
            "conf": 1.0,
            "crit": 1,
            "desc": "Plain JavaScript identifier assignment"
          },
          {
            "id": "metadata/lang/scripted::js-export-boundary",
            "crit": 1,
            "desc": "JS module export syntax"
          },
          {
            "id": "metadata/package/dependencies::npm-no-dependencies-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "npm manifest omits dependencies field"
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::generated-or-bundled-source",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.95,
            "crit": 1,
            "desc": "Generated or bundled source marker"
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-url",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json declares a repository URL"
          },
          {
            "id": "micro-behaviors/communications/http/url/path::remote-extension-catalog-url",
            "conf": 0.92,
            "crit": 3,
            "desc": "Remote extension/shortcut listing URL path"
          },
          {
            "id": "supply-chain/missing-author",
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "micro-behaviors/data/format/html::iframe-visibility-hidden",
            "conf": 0.88,
            "crit": 1,
            "desc": "Hides iframe with visibility property"
          },
          {
            "id": "metadata/import/package::require-scoped-package",
            "conf": 0.8,
            "crit": 2,
            "desc": "Requires a scoped npm package"
          },
          {
            "id": "metadata/lang/scripted::undefined-literal",
            "conf": 1.0,
            "crit": 1,
            "desc": "JavaScript undefined literal"
          },
          {
            "id": "metadata/file/extension/identity::javascript-source-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "JavaScript source filename extension"
          },
          {
            "id": "metadata/file/invisible-unicode::test-file-context",
            "atk": "T1027",
            "conf": 0.85,
            "crit": 1,
            "desc": "File is test, generated, or declaration code"
          },
          {
            "id": "metadata/file/metrics::file-under-12-lines",
            "conf": 0.8,
            "crit": 1,
            "desc": "Very short file (under 12 lines)"
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::js-function-call-method",
            "conf": 0.84,
            "crit": 2,
            "desc": "Invokes function with .call()"
          },
          {
            "id": "metadata/package/dependencies::has-dev-deps",
            "conf": 0.8,
            "crit": 1,
            "desc": "Package declares development dependencies"
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-line-nonshell-filename-marker",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 2,
            "desc": "Non-shell filename marker"
          },
          {
            "id": "metadata/package/quality/source::has-multiple-entries",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package has multiple entry points"
          },
          {
            "id": "metadata/file/metrics::script-peak-region-over-1k",
            "conf": 0.8,
            "crit": 1,
            "desc": "Peak-entropy source region exceeds 1KB"
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Common web or JSON file extension"
          },
          {
            "id": "metadata/build/minifier::esmodule-export",
            "conf": 0.6,
            "crit": 1,
            "desc": "Defines the CommonJS __esModule flag"
          },
          {
            "id": "metadata/file/metrics::js-readable-source-context",
            "conf": 0.9,
            "crit": 1,
            "desc": "Readable JavaScript source context"
          },
          {
            "id": "objectives/impact/destroy/keywords::destroy-verb",
            "conf": 0.9,
            "crit": 1,
            "desc": "Destructive-action word: destroy"
          },
          {
            "id": "metadata/file/metrics::high-comment-to-code-ratio",
            "conf": 1.0,
            "crit": 1,
            "desc": "High comment-to-code ratio"
          },
          {
            "id": "metadata/library/nodeunit::nodeunit-module-exports-tests",
            "conf": 1.0,
            "crit": 1,
            "desc": "module.exports object literal (composite-only)"
          },
          {
            "id": "micro-behaviors/communications/ipc/message::js-serialise",
            "conf": 0.85,
            "crit": 1,
            "desc": "Uses serialise function"
          },
          {
            "id": "metadata/package/config::vscode-contributes-absent",
            "conf": 0.9,
            "crit": 1,
            "desc": "Manifest has no contributes section"
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-evidence",
            "conf": 0.85,
            "crit": 2,
            "desc": "Package has repository metadata"
          },
          {
            "id": "metadata/package/manifest/entrypoint::pkg-exports-dist-entrypoint",
            "conf": 0.85,
            "crit": 2,
            "desc": "Package exports dist entrypoint"
          },
          {
            "id": "metadata/package/manifest/name::scoped-package-name",
            "conf": 0.84,
            "crit": 1,
            "desc": "Package uses npm scope name"
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "package.json declares repository metadata"
          },
          {
            "id": "metadata/package/documentation::has-jsdoc-type",
            "conf": 0.7,
            "crit": 2,
            "desc": "Code has JSDoc @type"
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "conf": 0.3,
            "crit": 2,
            "desc": "for loop (content)"
          },
          {
            "id": "micro-behaviors/ui/window/manage/visibility::scroll-activity-listener",
            "conf": 0.78,
            "crit": 1,
            "desc": "Browser scroll activity listener"
          },
          {
            "id": "micro-behaviors/time/schedule/interval::setTimeout",
            "crit": 2,
            "desc": "Schedules a JavaScript callback with setTimeout"
          },
          {
            "id": "metadata/file/extension/identity::script-content-extension-mismatch",
            "conf": 0.9,
            "crit": 1,
            "desc": "Script content mismatches extension"
          },
          {
            "id": "metadata/file/metrics::file-one-liner",
            "conf": 0.95,
            "crit": 1,
            "desc": "File is a one-liner"
          },
          {
            "id": "metadata/file/format::sourcemap",
            "conf": 1.0,
            "crit": 3,
            "desc": "JavaScript source map"
          },
          {
            "id": "metadata/build/package::cloud-marketplace-cleanup-path",
            "conf": 0.95,
            "crit": 1,
            "desc": "Cloud marketplace cleanup path"
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::command-substitution-unless-cond-0--rx-1",
            "conf": 1.0,
            "crit": 1,
            "desc": "Inline-code bytes or property documentation"
          },
          {
            "id": "metadata/package/versioning::conventional-version-base",
            "conf": 1.0,
            "crit": 2,
            "desc": "Package version uses numeric SemVer format"
          },
          {
            "id": "metadata/file/profile/identity::install-doc-basename",
            "conf": 0.85,
            "crit": 1,
            "desc": "Installation documentation basename"
          },
          {
            "id": "metadata/lang/scripted::require-symbol",
            "conf": 1.0,
            "crit": 1,
            "desc": "CommonJS require symbol"
          },
          {
            "id": "metadata/package/manifest/entrypoint::pkg-module-field",
            "conf": 0.6,
            "crit": 2,
            "desc": "\"module\": field in package.json"
          },
          {
            "id": "metadata/file/metrics::low-string-density-large-file",
            "conf": 0.9,
            "crit": 1,
            "desc": "Low string density in source"
          },
          {
            "id": "metadata/package/documentation::has-jsdoc-example",
            "conf": 0.7,
            "crit": 2,
            "desc": "Code has JSDoc @example"
          },
          {
            "id": "metadata/package/quality/empty::npm-has-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package name"
          },
          {
            "id": "metadata/file/metrics::js-typescript-source-file-context",
            "conf": 0.9,
            "crit": 1,
            "desc": "TypeScript source file context"
          },
          {
            "id": "metadata/package/versioning::mature-package-version",
            "conf": 0.65,
            "crit": 2,
            "desc": "Mature package version"
          },
          {
            "id": "metadata/file/extension/identity::declaration-file-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "File uses a source declaration extension"
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::dom-text-content-read",
            "conf": 0.82,
            "crit": 1,
            "desc": "Reads DOM text content"
          },
          {
            "id": "metadata/file/metrics::single-long-line",
            "conf": 0.9,
            "crit": 1,
            "desc": "Very long line"
          },
          {
            "id": "metadata/package/files/included::typescript-source-tree-artifact",
            "conf": 0.95,
            "crit": 1,
            "desc": "Source file under src"
          },
          {
            "id": "metadata/package/versioning::npm-has-version",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package version"
          },
          {
            "id": "micro-behaviors/ui/window/manage/style::size-prop--width",
            "conf": 1.0,
            "crit": 1,
            "desc": "DOM or CSS size property (width)"
          },
          {
            "id": "metadata/build/bundler::js-dist-sourcemap-output",
            "conf": 0.9,
            "crit": 1,
            "desc": "Distribution JavaScript references a source map"
          },
          {
            "id": "metadata/library/structure::js-distribution-output-path",
            "conf": 0.96,
            "crit": 2,
            "desc": "JavaScript distribution output path"
          },
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "File uses a document or configuration extension"
          },
          {
            "id": "metadata/package/quality/source::terser-output",
            "conf": 0.85,
            "crit": 2,
            "desc": "JavaScript transpiler or minifier markers"
          },
          {
            "id": "metadata/file/invisible-unicode::benign-invisible-unicode-text-context",
            "atk": "T1027",
            "conf": 0.85,
            "crit": 1,
            "desc": "Benign invisible Unicode source text"
          },
          {
            "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.95,
            "crit": 1,
            "desc": "Encoded URL benign documentation or test context"
          },
          {
            "id": "metadata/package/manifest/homepage::has-homepage-field",
            "conf": 0.8,
            "crit": 2,
            "desc": "Package has homepage URL"
          },
          {
            "id": "metadata/package/manifest/entrypoint::has-exports-field",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json declares an exports map"
          },
          {
            "id": "metadata/package/keywords/identity::has-keywords",
            "conf": 0.75,
            "crit": 2,
            "desc": "Package declares keywords"
          },
          {
            "id": "objectives/supply-chain/install-hook/hook-only::preinstall-only-package-entrypoints",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 1,
            "desc": "Package exposes runtime entrypoints"
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/prepare::files-src-only",
            "atk": "T1195.002",
            "conf": 0.96,
            "crit": 1,
            "desc": "package files list only src"
          },
          {
            "id": "metadata/build/bundler::js-dist-basename",
            "conf": 0.9,
            "crit": 1,
            "desc": "JavaScript file under a distribution directory"
          },
          {
            "id": "metadata/build/minifier::use-strict-quote",
            "conf": 0.6,
            "crit": 1,
            "desc": "Contains a JavaScript use strict directive"
          },
          {
            "id": "metadata/lang/scripted::js-require-binding",
            "conf": 0.4,
            "crit": 1,
            "desc": "CommonJS require() binding declaration"
          },
          {
            "id": "metadata/file/extension/identity::markdown-file-basename",
            "conf": 1.0,
            "crit": 1,
            "desc": "Markdown document file extension"
          },
          {
            "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-files-array",
            "conf": 0.9,
            "crit": 1,
            "desc": "package.json defines files array"
          },
          {
            "id": "objectives/credential-access/phishing/tactics::full-window-iframe-shell--rx-2",
            "atk": "T1566.002",
            "mbc": "B0030",
            "conf": 0.9,
            "crit": 1,
            "desc": "References the CSS position property"
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 1,
            "desc": "Average identifier length \u003e= 22 chars"
          },
          {
            "id": "metadata/package/config::small-sidecar-file",
            "conf": 0.8,
            "crit": 1,
            "desc": "Small sidecar-sized file"
          },
          {
            "id": "micro-behaviors/data/control-flow/analysis::string-literal-equality-check",
            "conf": 0.92,
            "crit": 1,
            "desc": "String literal equality or membership check"
          },
          {
            "id": "metadata/lang/source::js-ts-source-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "JavaScript or TypeScript source filename"
          },
          {
            "id": "metadata/file/metrics::low-overall-entropy-source",
            "conf": 0.9,
            "crit": 2,
            "desc": "Source file has low overall entropy"
          },
          {
            "id": "metadata/package/manifest/entrypoint::pkg-types-field",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares TypeScript types entry"
          },
          {
            "id": "metadata/package/quality/scoring::npm-source-native-paths",
            "conf": 0.99,
            "crit": 1,
            "desc": "Native addon source paths in npm files"
          },
          {
            "id": "metadata/package/versioning::mature-version",
            "conf": 0.7,
            "crit": 2,
            "desc": "Major version is 1 or higher"
          },
          {
            "id": "metadata/library/structure::js-esbuild-bundle-defprop",
            "conf": 0.95,
            "crit": 1,
            "desc": "esbuild __defProp helper"
          },
          {
            "id": "metadata/package/manifest/entrypoint::has-side-effects",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package declares sideEffects metadata"
          },
          {
            "id": "metadata/package/manifest/entrypoint::has-module-entry",
            "conf": 0.85,
            "crit": 2,
            "desc": "Package has ESM module entry"
          },
          {
            "id": "objectives/supply-chain/install-hook/hook-only::preinstall-only-package-activity",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 1,
            "desc": "Package exposes install or test activity"
          },
          {
            "id": "metadata/build/bundler::has-sourcemap",
            "conf": 0.9,
            "crit": 2,
            "desc": "Code has source map reference"
          },
          {
            "id": "metadata/package/quality/profile::has-tests",
            "crit": 2,
            "desc": "Embedded test-code markers present"
          },
          {
            "id": "metadata/package/manifest/entrypoint::module-dist-entrypoint",
            "conf": 0.8,
            "crit": 2,
            "desc": "Package module targets dist output"
          },
          {
            "id": "metadata/package/manifest/entrypoint::types-dist-entrypoint",
            "conf": 0.8,
            "crit": 2,
            "desc": "Package types targets dist output"
          },
          {
            "id": "metadata/file/profile/language::lang-english",
            "conf": 0.8,
            "crit": 2,
            "desc": "Contains common English function words"
          },
          {
            "id": "metadata/package/documentation::package-doc-reference-basename",
            "conf": 0.9,
            "crit": 1,
            "desc": "Package documentation basename"
          },
          {
            "id": "metadata/library/structure::js-any-bundle-output",
            "conf": 0.95,
            "crit": 2,
            "desc": "Contains bundled or minified JavaScript"
          },
          {
            "id": "metadata/package/files/included::wheel-lacks-start-shell",
            "conf": 0.9,
            "crit": 1,
            "desc": "Wheel has no start.sh launcher member"
          },
          {
            "id": "metadata/package/files/included::archive-container-path",
            "conf": 0.95,
            "crit": 2,
            "desc": "Archive container path",
            "spans": [
              [
                0,
                34
              ]
            ]
          }
        ]
      }
    ]
  }
}