{
  "ml": {
    "v": "7",
    "eng": "2.3.1-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00021027525,
        "rte": "az",
        "prob": 0.00021027525
      }
    ],
    "prob": 0.00021027525,
    "skip": [
      {
        "rte": "az/zip",
        "why": "unavailable"
      },
      {
        "rte": "az/zip",
        "why": "unavailable"
      }
    ],
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00021027524780947715,
        "type": "zip"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000014573335647583008,
        "type": "github_actions"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000014911095604475122,
        "type": "github_actions"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000021060308426967822,
        "type": "github_actions"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000014026959433977026,
        "type": "github_actions"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000016570091247558594,
        "type": "github_actions"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000014056761756364722,
        "type": "github_actions"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000016470750779262744,
        "type": "dockerfile"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000015228986740112305,
        "type": "text"
      },
      {
        "id": 9,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00002195437809859868,
        "type": "makefile"
      },
      {
        "id": 10,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000009844700798566919,
        "type": "markdown"
      },
      {
        "id": 11,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000015020370483398438,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-20T10:18:40Z"
  },
  "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "p!H([6Awys2MK\u00268000000000000000002{$003UCBzb/ae[n*pflgGsv}YB]fkkoixjSV7B.LV5eOn*czF\u003c34kZ1?lgb{)AeN\u0026\u003cpy?bpPgbZ*BfG7Npxk8E3BZ^1mwPhi#wmn}=Bs}\u0026Qy]\u0026/Co7:\u003eH-Rj!rQ2ko\u003cA6XZ334/+Ta/rw^4q^F7gvp]RfwZ%NaC.dLM=1)4",
            "n": [
              {
                "c": 2,
                "d": "Zip archive path",
                "i": "metadata/package/files/included::zip-archive-path",
                "o": 0,
                "z": 64,
                "cf": 0.949999988079071
              }
            ],
            "ln": 0
          }
        ],
        "mol": "H(Os)Md(Bk₂)",
        "sha": "c8b0fa9ba3a873afdfbc33fe3b4cb03e60db7d41d3082cc6c02750aeb4d10403",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip",
        "risk": 3,
        "size": 17486,
        "type": "zip",
        "facts": {
          "metrics": {
            "file": {
              "size": 17486.0,
              "entropy": 7.69,
              "size_bytes": 17486.0
            },
            "binary": {
              "overall_entropy": 7.69,
              "peak_region_bytes": 14336.0,
              "peak_region_entropy": 7.83
            },
            "archive": {
              "file_count": 17.0,
              "member_count": 17.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 3.56,
              "directory_count": 0.0,
              "executable_count": 0.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 12940.0,
              "compression.ratio": 0.38,
              "hidden_file_count": 7.0,
              "total_uncompressed": 33894.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 103.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 17.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "misplaced_executable_count": 0.0,
              "timing.mtime_dominant_count": 17.0,
              "timing.sentinel_mtime_count": 17.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 1.0,
              "compression.method_counts.deflate": 17.0
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multi-arch-target",
            "atk": "T1082",
            "mbc": "Discovery",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Script targets multiple CPU architectures",
            "from": [
              {
                "off": 198,
                "file": 9,
                "line": 8
              }
            ]
          },
          {
            "id": "metadata/build/docker::docker-env-prefix",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "DOCKER_ environment prefix",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-arm64",
            "conf": 1.0,
            "crit": 1,
            "desc": "arm64 architecture string"
          },
          {
            "id": "metadata/build/github-actions::mutable-main-action-ref",
            "conf": 0.8799999952316284,
            "crit": 3,
            "desc": "Workflow action pinned to main",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/build/github-actions::contents-write-permission",
            "conf": 0.9200000166893005,
            "crit": 3,
            "desc": "GitHub Actions contents write permission"
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::architecture-selection-wordlist",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": "Selects among multiple CPU architecture payloads"
          },
          {
            "id": "metadata/build/github-actions::id-token-write-permission",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "GitHub Actions OIDC write permission",
            "from": [
              {
                "file": 2
              }
            ],
            "spans": [
              [
                150,
                20
              ]
            ]
          },
          {
            "id": "metadata/build/github-actions::scheduled-workflow-trigger",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "GitHub scheduled workflow trigger"
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-aarch64",
            "conf": 1.0,
            "crit": 1,
            "desc": "AArch64 (ARM64) architecture string"
          },
          {
            "id": "metadata/package/files/included::github-module-zip-basename",
            "conf": 0.8600000143051147,
            "crit": 1,
            "desc": "GitHub versioned zip filename",
            "spans": [
              [
                0,
                64
              ]
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "z/dP",
            "n": [
              {
                "c": 2,
                "d": "actions/checkout workflow step",
                "i": "metadata/build/github-actions::actions-checkout-yaml",
                "o": 0,
                "z": 1,
                "cf": 0.9200000166893005
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "arUSCB7^P",
            "ln": 2,
            "addr": 4
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 2717.0,
              "entropy": 4.95,
              "size_bytes": 2717.0
            },
            "binary": {
              "overall_entropy": 4.95,
              "peak_region_bytes": 2717.0,
              "peak_region_entropy": 4.95
            }
          }
        },
        "id": 1,
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/.github/workflows/build.yml",
        "pid": 0,
        "risk": 1,
        "sha": "0947c6aa0c8d147b74c95b6e08e654075b26133ac4c4d12c4b9c2bcbd2038f25",
        "size": 2717,
        "traits": [
          {
            "id": "metadata/build/github-actions::actions-checkout-yaml",
            "conf": 0.9200000166893005,
            "crit": 2,
            "desc": "actions/checkout workflow step"
          }
        ],
        "type": "github_actions"
      },
      {
        "ctx": [
          {
            "b": "iTM#LarUclvqYN*wPG)PtoW])x(kaCar\u003eVhB97#la$K\u0026XA+f5#vrl0kdK(SF3lQEnz/PS9y\u0026sJ8wnca7vru0)iTMjkwPzT4B8#5lzGv\u0026CarUfjzGGDcBAoF=A+eV\u00263lQE9wg.[wyH}xAaA}\u003cuBy+^^yhWN5iTM#Lw]z:ivj=LgvqY%%zF80qarR^HA=(nvePkI/aA.dozGH1My*?A%B94:iarR!Gx(dB1B-YiLx(n6nwPG)PgCxdUarR!FBy/AjiTM#LarSlUzEEx[iV{!6wN/H]B-W%karR^HaA.:pB2\u003eBLv@#B6zGt",
            "ln": 32,
            "col": 7,
            "line": 4
          },
          {
            "b": "B-RbniV@3MB8$=hfj]czB73Uev@#B6zA@5Ex(jn2arR^HaA}KwxGuFyarR^HarR!nAa{[twQcrVbZT\u003eXwO#VzmO=@Yl0(]OnNCaVsZL09q+gm\u003epe1!kEshCBarR^HarR^KawV(\u003eC{4cIzGu}xxK@rcv{%l$vqYP#wn-Pdz/^avA=lbnwmWAmwPS6nzGu}ezH0vBwPJ0gBAnNlvpK6}Bz\u0026pzxK}I[arR^HarR^KaAh4lwO=6#wIarjarR^HarR!EB-5^MwD",
            "ln": 718,
            "col": 7,
            "line": 29
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 938,
              "entropy": 4.8
            },
            "binary": {
              "peak_region_bytes": 938,
              "peak_region_entropy": 4.8
            }
          }
        },
        "id": 2,
        "mol": "O(Eu)Md₂(Bk₃)",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/.github/workflows/fossa.yml",
        "pid": 0,
        "refs": [
          {
            "to": "pkg:github/actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
            "off": 271,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/rancher-eio/read-vault-secrets@main",
            "off": 537,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/fossas/fossa-action@main",
            "off": 724,
            "kind": "dependency"
          }
        ],
        "risk": 3,
        "sha": "3504a2687ee49e87d46fcc55f824638d5dfe9ffbf7e630d0a274426d46cc14cb",
        "size": 938,
        "traits": [
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path"
          },
          {
            "id": "metadata/build/ci/permission::id-token-write-permission",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub Actions OIDC write permission",
            "spans": [
              [
                132,
                18
              ]
            ]
          },
          {
            "id": "metadata/build/ci/step::mutable-main-action-ref",
            "conf": 0.88,
            "crit": 3,
            "desc": "Workflow action uses mutable main ref"
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path"
          },
          {
            "id": "objectives/exfiltration/stealer/credential/env::workflow-env-secret-filter",
            "atk": "T1552.001,T1041",
            "mbc": "E1020",
            "conf": 0.94,
            "crit": 3,
            "desc": "Workflow handles environment secrets",
            "spans": [
              [
                782,
                17
              ]
            ]
          }
        ],
        "type": "github_actions"
      },
      {
        "ctx": [
          {
            "b": "z/dPyarUYoy?m3@wJyevarR!GD2NtoiV}TCBZ/f3B7/b}t)Z{IzGX5FarTfCr7H1QuQm4UnL-8*r6:2nas8qXazkzgxMW=pA+e\u0026\u0026zEEx[aBOUB3tKG*B2\u003cTJaAhEAxF17zy\u0026\u003cx1A:@=z3lQDlaAg[jze16jx(v)giTM#LarR^Hv@DmbwO#QhiV@DOvpPY/arR^HazCvrBz\u003e@azAn[:A+PSb3lQDlaAzQxB1IrFiV@MOB-8qzeO[\u003cqwPI@2arR^HB97#jB2\u003cTJarR^Uaz$R8wJy@3xK$W?aA8yAay/t2wEoL5arR^HB-RbniV}\u003cvBzkVhB1.3pwN/H]B-Y(ev\u003eY[$vQ.8EvMd^Kv\u003e?HGixn*6vMub4wh(OXg?wWT",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "wn+%[wPzEbvLo0NDMV%nBzb/ae]\u003eJxz/YSmz/Qbgz*c8gAV/^UfjP3lwmYU2x\u003c\u003e?0aAg+gB9zLywfumxl@cfymn^F?k#QY-pF%O6i%)8MarR^HarR^HB7F\u003c4wPPOovrt{hxk8E3BZ^1AwPhMvbZT\u003eXxk8E3BZ=$zwPhNex([olC{4J-flgGsv}YB]ePt-AzdLqtwOkZ#BAhTWv@=c\u003ewO#Q7vqH0cA+e($B98CFaBCqdqB%OKuS6r.nMeO^sS/^karR^",
            "ln": 665,
            "col": 60,
            "line": 23
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 2582,
              "entropy": 5.15
            },
            "binary": {
              "peak_region_bytes": 2582,
              "peak_region_entropy": 5.1
            }
          }
        },
        "id": 3,
        "mol": "O(S₂)Md₂(Bk₂)",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/.github/workflows/release.yml",
        "pid": 0,
        "refs": [
          {
            "to": "pkg:github/actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
            "off": 250,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6",
            "off": 357,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/rancher/ecm-distro-tools@016551c414f82e64af8c4c18315ea3093d10be7c",
            "off": 1589,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/rancher/ecm-distro-tools@016551c414f82e64af8c4c18315ea3093d10be7c",
            "off": 1589,
            "kind": "dependency"
          }
        ],
        "risk": 4,
        "sha": "fce4abf68b95fdd18fcada81e7c1a4565d36449241774c4fe52f41d8bb1ee974",
        "size": 2582,
        "traits": [
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path"
          },
          {
            "id": "metadata/build/ci/permission::id-token-write-permission",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub Actions OIDC write permission",
            "spans": [
              [
                150,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path"
          },
          {
            "id": "objectives/supply-chain/recon-exfil/pipeline::gha-interesting-secret-keywords--rx-1",
            "atk": "T1195.002, T1552.001",
            "conf": 0.9,
            "crit": 3,
            "desc": "NPM or Docker credential variable name",
            "spans": [
              [
                729,
                15
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/trojanized/build-pipeline::gha-package-publish-secret-name--rx-8",
            "atk": "T1195.002",
            "conf": 0.88,
            "crit": 3,
            "desc": "Container registry credential variable name",
            "spans": [
              [
                729,
                15
              ]
            ]
          }
        ],
        "type": "github_actions"
      },
      {
        "ctx": [
          {
            "b": "iTM#LarR^HeG![sB97#l3lQDlaAg+hxMDiwarR^HarSlUcQ.(.yH}J#x(4ud3lQEnz/PS9y\u0026sJ8wnca7vru0)iTMjkwPzT4B8#5lzGv\u0026CarR^Hv@DmbwO#QhiV@S!x()[[arR^Hx\u003ee/qz!\u0026{4iV@S!x()[[3tKG*B2\u003cTJaAI*Cv(:@tarR!EB-8mLz/dPUBZ/GhBAGfKvru74Bp6ckarU-EwPhYK3lQDlarR^Uaz$R8wJy}TqE%oEax8\u0026YA+fula{]CnarR^HarU/FwPG)PA:-\u0026}xK#iowOD6oA+eV\u0026eP$MBy\u0026?mIwN/:(BAoX",
            "ln": 47,
            "col": 13,
            "line": 4
          },
          {
            "b": "3lQDlarR^HarR!nAbWyywi7?UDWu(DzGWS#p/7H\u003cl)c]a3lQDlarR^HarR!CA+PY9By^4twQcrVbZT\u003eXwO#Vzp/o\u003e=k#ZoWogq#aEshCfarR^HarSlUzEEx[iV}siAckSax(^@goKS3OB95K5wO+{^B7CX3arR^HarR!HB7GzNaAy[dv}YB]fj!TgeO5NpBAhpKBz(8lB1Z%iBzkVhB1.MBAckSax(^@ty*?A%B96V3f/y)Df\u003ei3{g?FZ5wI#wNw\u0026Ko",
            "ln": 828,
            "col": 14,
            "line": 28
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1272,
              "entropy": 4.85
            },
            "binary": {
              "peak_region_bytes": 1272,
              "peak_region_entropy": 4.82
            }
          }
        },
        "id": 4,
        "mol": "O(Eu)Md₂(Bk₂)",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/.github/workflows/republish-latest.yml",
        "pid": 0,
        "refs": [
          {
            "to": "pkg:github/rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6",
            "off": 267,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1",
            "off": 737,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/rancher/ecm-distro-tools@016551c414f82e64af8c4c18315ea3093d10be7c",
            "off": 965,
            "kind": "dependency"
          }
        ],
        "risk": 3,
        "sha": "cf6912ff306b550957a4891c715a03e781185ce82a326c46d2dff2e4f8f61adf",
        "size": 1272,
        "traits": [
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path"
          },
          {
            "id": "metadata/build/ci/permission::contents-write-permission",
            "conf": 0.92,
            "crit": 3,
            "desc": "GitHub Actions contents write permission"
          },
          {
            "id": "metadata/build/ci/permission::id-token-write-permission",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub Actions OIDC write permission",
            "spans": [
              [
                150,
                20
              ]
            ]
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path"
          },
          {
            "id": "objectives/exfiltration/stealer/credential/env::workflow-env-secret-filter",
            "atk": "T1552.001,T1041",
            "mbc": "E1020",
            "conf": 0.94,
            "crit": 3,
            "desc": "Workflow handles environment secrets",
            "spans": [
              [
                892,
                15
              ]
            ]
          }
        ],
        "type": "github_actions"
      },
      {
        "ctx": [
          {
            "b": "vqNb=D2va0z/dPyarU-nxK$Z%y?kTmarR^HeG!Lzz/dPUa$$b]hY%N)dJ*h+3lQEnz/PS9y\u0026sJ8wnca7vru0)iTMjkwPzT4B8#5lzGv\u0026CarR^Hv@DmbwO#QhiV@S!x()[[arR^Hx\u003ee/qz!\u0026{4iV@S!x()[[3tKG*B2\u003cTJaAI*Cv(:@tarR!EB-8mLz/dPUBZ/GhBAGfKvru74Bp6ckarU-EwPhYK3lQDlarR^Uaz$R8wJy}TqE%oEax8\u0026YA+fula{]CnarR^HarU/FwPG)PA:-\u0026}xK#iowOD6oA+eV\u0026eP$MBy\u0026?mIwN/:(BAoX",
            "ln": 36,
            "col": 17,
            "line": 2
          },
          {
            "b": "3lQDlarR^HarR!nAbWyywi7?UDWu(DzGWS#p/7H\u003cl)c]a3lQDlarR^HarR!CA+PY9By^4twQcrVbZT\u003eXwO#Vzp/o\u003e=k#ZoWogq#aEshCfarR^HarSlUzEEx[iV}vDzET!?Ac3bwwNPA#qE%VQvrl133lQDlarR^HaA.:pB2\u003eB:vqYN*wPxCnv@i/dx(!xpz.l6Hz!%FFvpKy[z/fRHB9RUkeP(2NBAg@3z7P^ty?m3@wK4}7hz)uDv(b[%w\u0026ILShz!?",
            "ln": 817,
            "col": 14,
            "line": 26
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1357,
              "entropy": 4.89
            },
            "binary": {
              "peak_region_bytes": 1357,
              "peak_region_entropy": 4.88
            }
          }
        },
        "id": 5,
        "mol": "O(Eu)Md₂(Bk₃)",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/.github/workflows/sync-upstream.yml",
        "pid": 0,
        "refs": [
          {
            "to": "pkg:github/rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6",
            "off": 256,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1",
            "off": 726,
            "kind": "dependency"
          },
          {
            "to": "pkg:github/rancher/ecm-distro-tools@016551c414f82e64af8c4c18315ea3093d10be7c",
            "off": 952,
            "kind": "dependency"
          }
        ],
        "risk": 3,
        "sha": "cd1317e1e27e5aa38d3bbf9b7a6ad1cc542854780ce29f90658491f836beee79",
        "size": 1357,
        "traits": [
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path"
          },
          {
            "id": "metadata/build/ci/permission::contents-write-permission",
            "conf": 0.92,
            "crit": 3,
            "desc": "GitHub Actions contents write permission"
          },
          {
            "id": "metadata/build/ci/permission::id-token-write-permission",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub Actions OIDC write permission",
            "spans": [
              [
                139,
                20
              ]
            ]
          },
          {
            "id": "metadata/build/ci/trigger::scheduled-workflow-trigger",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub scheduled workflow trigger"
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path"
          },
          {
            "id": "objectives/exfiltration/stealer/credential/env::workflow-env-secret-filter",
            "atk": "T1552.001,T1041",
            "mbc": "E1020",
            "conf": 0.94,
            "crit": 3,
            "desc": "Workflow handles environment secrets",
            "spans": [
              [
                881,
                15
              ]
            ]
          }
        ],
        "type": "github_actions"
      },
      {
        "id": 6,
        "mol": "Md(Bk)",
        "sha": "ffff9fece52beb8b1ca9dd81f299904a132f1c3220e6659376a5c058767ddb71",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/.github/workflows/updatecli.yml",
        "risk": 1,
        "size": 1883,
        "type": "github_actions",
        "depth": 1
      },
      {
        "id": 7,
        "sha": "de634d726e324a8133018e6cb681a537fe14a7548e6030241e6a17e70e5e9520",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/Dockerfile",
        "risk": 1,
        "size": 2456,
        "type": "dockerfile",
        "depth": 1
      },
      {
        "id": 8,
        "sha": "0d7b27a8f3b3d5297ce21a062f93aaef2124687ba52953795871061d8b3708b2",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/LICENSE",
        "risk": 1,
        "size": 10147,
        "type": "text",
        "depth": 1
      },
      {
        "ctx": [
          {
            "b": "q:\u003c.QqB%?Vmn\u003er(av]6]ngWbanMnnGk$?",
            "n": [
              {
                "c": 2,
                "d": "shell code embedded in string",
                "i": "metadata/lang/embedded::shell",
                "o": 0,
                "z": 1457,
                "cf": 1.0
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "",
            "ln": 2,
            "addr": 27
          },
          {
            "b": "rzC?Ompe+ijS(0#B7/c3y-)\u003ervqPM#eO#{",
            "ln": 3,
            "addr": 28
          },
          {
            "b": "x\u003ezl[wO95:k#Hiwr9@D}k#ZrHqCy6",
            "ln": 4,
            "addr": 56
          },
          {
            "b": "32a0.AuDUPc@\u003c2do*@z-dj=P^i5Ub4g:@",
            "n": [
              {
                "c": 3,
                "d": "Selects among multiple CPU architecture payloads",
                "i": "micro-behaviors/os/sysinfo/platform/arch::architecture-selection-wordlist",
                "o": 99,
                "z": 6,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 5,
            "addr": 80
          },
          {
            "b": "2)\u003cM%qB:ePuR\u003cAZr7oUYo\u0026B8oy?W^fCRrGxwhVm",
            "ln": 6,
            "addr": 107
          },
          {
            "b": "31W{]wGUY0wPn?vbQ=U/k$%^Po^}Rovpsg^xF}W@",
            "n": [
              {
                "c": 3,
                "d": "Script targets multiple CPU architectures",
                "i": "micro-behaviors/os/sysinfo/platform/arch::multi-arch-target",
                "o": 163,
                "z": 7,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 7,
            "addr": 139
          },
          {
            "b": "2)\u003cM%qB:ePuR\u003cAZr7oUYo\u0026B8oy?W^fCRrGCz8Ki",
            "n": [
              {
                "c": 1,
                "d": "arm64 architecture string",
                "i": "micro-behaviors/os/sysinfo/platform/arch::arch-arm64",
                "o": 198,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 8,
            "addr": 172
          },
          {
            "b": "31W{]wGQ",
            "ln": 9,
            "addr": 204
          },
          {
            "b": "2)\u003cM%qB:ePuR\u003cAZr7oUYo\u0026B8oy?W^fCRpr\u003crzC?Ompe+r",
            "ln": 10,
            "addr": 211
          },
          {
            "b": "31X0+x\u003ev",
            "ln": 11,
            "addr": 248
          },
          {
            "b": "",
            "ln": 13,
            "addr": 261
          },
          {
            "b": "lrcPJl%\u0026USr6-V0vS=y3wf-NAxK#0@ay[]5wGSGHsTv]hwgm",
            "ln": 14,
            "addr": 262
          },
          {
            "b": "p!Kq3krQc4x([3hvLheez7/HqvqY%]y+ovtfj]3ezF\u003c34",
            "n": [
              {
                "c": 1,
                "d": "References a GitHub or Google domain",
                "i": "metadata/file/catalog/identity::platform-domain",
                "o": 308,
                "z": 10,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 15,
            "addr": 301
          },
          {
            "b": "q=k$9krQc4x([3hvLheez7/HqvqY%]y+ovtfj]3ezF\u003c34",
            "ln": 16,
            "addr": 338
          },
          {
            "b": "r6:1%krQbmDQ*Ubnl4#-k%[QypFLm@k$ut",
            "ln": 17,
            "addr": 375
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 8.0,
              "bind_count": 11.0,
              "call_count": 4.0,
              "node_count": 396.0,
              "identifier_count": 18.0
            },
            "file": {
              "size": 1515.0,
              "entropy": 5.7,
              "size_bytes": 1515.0
            },
            "text": {
              "tab_count": 46.0,
              "digit_ratio": 0.02,
              "space_count": 85.0,
              "total_lines": 70.0,
              "char_entropy": 5.7,
              "unique_chars": 74.0,
              "avg_line_length": 20.64,
              "max_line_length": 77.0,
              "empty_line_ratio": 0.14,
              "last_line_length": 45.0,
              "whitespace_ratio": 0.13,
              "most_common_ratio": 0.04,
              "identifier_density": 1.31,
              "line_length_stddev": 16.06,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 5.38
            },
            "binds": {
              "count": 11.0
            },
            "calls": {
              "count": 4.0
            },
            "binary": {
              "overall_entropy": 5.7,
              "peak_region_bytes": 1515.0,
              "peak_region_entropy": 5.65
            },
            "source": {
              "function_count": 5.0
            },
            "functions": {
              "count": 5.0
            },
            "identifiers": {
              "count": 18.0,
              "total": 92.0,
              "avg_length": 10.3,
              "max_length": 21.0,
              "min_length": 3.0,
              "avg_entropy": 2.9,
              "reuse_ratio": 0.36,
              "unique_count": 33.0,
              "length_stddev": 5.32,
              "has_digit_ratio": 0.06,
              "high_entropy_count": 6.0,
              "high_entropy_ratio": 0.18,
              "all_lowercase_ratio": 0.03,
              "all_uppercase_ratio": 0.36
            }
          }
        },
        "id": 9,
        "mol": "H(Os)",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/Makefile",
        "pid": 0,
        "risk": 1,
        "sha": "85529c7357a733602ba8dfd8c41f6b49beab8579f0ad29909defe6fae87c25d2",
        "size": 1515,
        "traits": [
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-arm64",
            "conf": 1.0,
            "crit": 1,
            "desc": "arm64 architecture string",
            "spans": [
              [
                198,
                5
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-aarch64",
            "conf": 1.0,
            "crit": 1,
            "desc": "AArch64 (ARM64) architecture string",
            "spans": [
              [
                163,
                7
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::architecture-selection-wordlist",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": "Selects among multiple CPU architecture payloads",
            "spans": [
              [
                99,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multi-arch-target",
            "atk": "T1082",
            "mbc": "Discovery",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Script targets multiple CPU architectures",
            "spans": [
              [
                99,
                6
              ],
              [
                163,
                7
              ],
              [
                198,
                5
              ]
            ]
          }
        ],
        "type": "makefile"
      },
      {
        "id": 10,
        "sha": "c4a04ed0a98e31a7d35e14800e81ef021e2528ef1809ac0342de1e0ef9bc6cba",
        "path": "github.com-rancher-image-build-flannel-v0.28.6-build20260706.zip!!github.com/rancher/image-build-flannel@v0.28.6-build20260706/README.md",
        "size": 27,
        "type": "markdown",
        "depth": 1
      },
      {
        "id": 11,
        "sha": "926c5fb89aecf87ee46e582abbf3a90181da9100de427f6820a4515bc019064e",
        "path": "github.com_rancher_image-build-flannel@v0.28.6-build20260706.registry.json",
        "size": 829,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 5,
    "v": "8"
  }
}