{ "llm": { "conf": 0.9998736, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 0, "prob": 0.99981135, "class": "hostile" }, "outcome": "hostile", "interpretation": "Exfiltrates data via webhook.site" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 0, "raw": 0.99848884, "rte": "az", "prob": 0.99848884 }, { "cls": 2, "raw": 0.99981135, "rte": "az/npm", "prob": 0.99981135 } ], "prob": 0.99981135, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9998113512992859, "type": "npm" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00010137756908079609, "type": "javascript" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00005246202272246592, "type": "package.json" } ], "version": "v18.18", "analyzed_at": "2026-09-07T02:56:42Z" }, "path": "sfly-services-4.1.4.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000@}T?zbn}R5A-P.IEzdUP#M/tNNfAs6s!y#bP#I8rshQeU[#+oYSO}rk\u003ck0\u003cYHz:R\u003eSP#Xa+iyD\u003eR39sO6G:I.A(es6CY\u003cN?o1#NMZ%LnNoZ6Eta%c-0n1ZkY8C[\u003c].?Sn6WfeM@+U#nst4G/XOq[qmBJ!gu.HNsh+S]=X=Yq-k%)G\u003cj2\u00267E?T^tO\u0026^O*eRH9XJpOGdNlYk6R\u003e2%r/awAsmijkfRl^{31Z-OoCQzv{Xxr@enC.\u0026)PsM\u0026V]e[GeX{bB#/.2CIfcl3+:[vg1FLlL#M@G\u0026A6+jUP:Mj5uwZQ9+MUNbcps\u003cR)L2?!U#h!q-tMG9q+(MCm\u003c=^taY\u003eBt$@[BecMl!Ns9\u003ct1Om[H\u0026:A7x", "ln": 0 } ], "mol": "O₃(SCEu)H₂(CmPo₃)Md₃(InPa)", "sha": "ccc51de49e0c2506a59cfa47a8f192d5a913122d8dd45c81b6189b03463503a1", "path": "sfly-services-4.1.4.tgz", "risk": 124, "size": 1033, "type": "npm", "facts": { "metrics": { "file": { "size": 1033, "entropy": 7.83 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 7.83 } } }, "ident": { "name": { "value": "sfly-services", "source": "npm.name", "verified": false }, "trust": "unsigned", "version": { "value": "4.1.4", "source": "npm.version", "verified": false }, "identifier": { "value": "sfly-services", "source": "npm.name", "verified": false } }, "traits": [ { "id": "micro-behaviors/process/create/shell/bridge::child-process-exec-destructure", "atk": "T1059", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Destructures exec from Node.js child_process", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook", "from": [ { "file": 3 } ] }, { "id": "objectives/exfiltration/oob/endpoint::web-content-oob-service-reference", "conf": 0.9, "crit": 3, "desc": "OOB service URL in web content", "from": [ { "file": 2 } ] }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook" }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable", "atk": "T1059.007", "mbc": "C0017", "conf": 0.94, "crit": 3, "desc": "Node child_process exec receives a command-named variable", "from": [ { "file": 2 } ], "uses": [ 10, 12 ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 2 } ], "uses": [ 14, 22 ] }, { "id": "metadata/file/profile/language::lang-arabic-script", "conf": 0.8, "crit": 3, "desc": "Contains Arabic-script text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/curl::curl-post-flag", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "curl explicitly sends an HTTP POST request", "from": [ { "file": 2 } ] }, { "id": "objectives/exfiltration/oob/endpoint::oob-endpoint-any", "conf": 0.9, "crit": 3, "desc": "Any OOB callback endpoint", "from": [ { "file": 2 } ], "uses": [ 2 ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "micro-behaviors/process/create/shell/local::node-exec-child-process-binding", "conf": 0.94, "crit": 1, "desc": "Binds Node child_process exec", "from": [ { "file": 2 } ], "uses": [ 18 ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec", "atk": "T1059.007", "mbc": "C0017", "conf": 0.95, "crit": 3, "desc": "Executes a command through Node.js child_process exec", "from": [ { "file": 2 } ], "uses": [ 0, 15 ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable-call", "conf": 0.9, "crit": 1, "desc": "Calls exec with a command-named variable", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point" }, { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec-call", "conf": 1.0, "crit": 1, "desc": "Calls a function named exec", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook" }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-reference", "conf": 0.85, "crit": 3, "desc": "webhook.site service reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-require-destructure-binding", "conf": 0.94, "crit": 1, "desc": "Destructures Node exec from require", "from": [ { "file": 2 } ] }, { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install" }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::preinstall-runs-node-local-script", "atk": "T1195.002", "conf": 0.97, "crit": 3, "desc": "preinstall hook runs a local Node.js script" }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::oob-service", "atk": "T1567", "conf": 0.85, "crit": 3, "desc": "Out-of-band interaction service reference", "from": [ { "file": 2 } ], "uses": [ 8 ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::preinstall-local-script-oob", "atk": "T1195.002", "mbc": "E1041", "conf": 0.96, "crit": 5, "desc": "preinstall runs local JS contacting OOB callback", "from": [ { "file": 2 }, { "off": 207, "file": 3, "line": 8 } ], "uses": [ 8, 21 ], "spans": [ [ 0, 41 ] ] } ] }, { "ctx": [ { "b": "v@DmaBrC]MwQ4=@aBLv}aAz4kB.L(cc)@Irx(4r!Ab](bwPI]udlv\u003ezfe1B\u003eaT4#XS[s91Gv)vI/[FalaLrExH9kf8/S:2aaLzL6H-\u003euF/[w4eaxqrkaLrQBGXiY+T\u003ewP:TSVn]/[w1X/R^xfaLrTCGchrXaQRZ$zGx[xk#Z/HlRx\u003cCuR0%\u003er8b.NmiB-ob6NQcxM4*8e]$-GwG\u003chyv@DmaBrA\u003eGr6-(Amn^F?k#Zw$jS\u003e}4gg-g1h-1(NeI/j{iw06yhEOf$hEOD{fG9t$iwSAGwmGdYb0c]2fcF]B/T6kg/SJ(g/[F7UaLrQBGXp\u003e#rz(Hk/R^zQ/S:4^aLzO6W+edyS[AdI/[4?laLsfRGXilRGcn*A/[w1:/R^x2/[6Lrfe1E2R}D:QQUgvNU]}X%/[w1Z/[{{8V!pk*SmXl8T0369/[HT4UI1PZIRiU9/-", "ln": 0, "col": 1, "line": 1 }, { "b": "mJ+R#k#H6vau.\u003eJjV$}\u003ejT8@{arR^HarR^HwN/y(ar\u003e2ut{96Svrb\u003c\u003ex(mMaw]zYjBzbkdzE){6B-8qjAXqADaAI4kx(FeDe?Otf3lQDlarR^HapoklarR^HarR)K/R^xd/S9Pb/SS$Zazbt9wfxMU/[w1R/SA/baLslTH9kcD/[w4j/[w4faLrQBGXq7iT\u003eo\u0026fUl(x{arR^HarUogzE:\u003eyat4FtzdK?lzE){6B-8qjAXqADa%nT8fjXTqfk+]Gy=.$harR^HarR^HwN/y(ar\u003e6dtY8X/jV$}\u003ejV%]SnLRMBaw+%ipEVE9ml%*snfyw[pdXwPmmnmYjV$}\u003ejV$}Li%)8MarS9QgcN3tasNT8arR^HboUTl/S\u003c8n/[pH3Gv$]2/R^zQ/R)FX/R^zS/R^x4aLzt0IxHMX/[w1Raw+\u003cjr3o\u003eI/R^x7/SLS8arR!pB-IpveM:b(pG7jnb4#7uAc15[fc\u003e)gr8=dJogq-=nkAe-pc?PyEi:e9r8=dJogq-=p^F5KEiG!s3lQDlat3bbb13o^By/uieMv1mwJy@QwQ5qIAbn@%zxZid3lQDlat2fQvrt{fvRGZ*A^n=KbT:{$k{vBR3lQDlat4TSePh:+wmY{qzGP=i3sC}53nj4P/S9RV/[4?l/SVHJR}D:QQUgvNU)LO[C{4CvarR^HwQ4=@c$vgjzddr)asPwVEir3dByO#bc$K?IDKp(rarSr\u003caLrZDTK%D7HUmt6/RvbSaLrEwUgQkoR}vWIEf]", "ln": 510, "col": 34, "line": 11 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "ATTACKER_HOSTNAME" ], [ "", "ATTACKER_PATH" ], [ "", "command" ], [ "", "exec" ], [ "", "child_process" ] ], "tgt": [ "exec", "require" ], "metrics": { "ast": { "max_depth": 6, "call_count": 2, "node_count": 93 }, "file": { "size": 1116, "entropy": 5.46 }, "text": { "lines": 32, "top_char": 216, "max_ws_run": 1, "digit_ratio": 0.07, "space_count": 195, "char_entropy": 5.46, "unique_chars": 107, "top_char_null": 0, "string_density": 0.13, "top_char_ratio": 0.1, "avg_line_length": 33.87, "max_line_length": 138, "non_ascii_ratio": 0.33, "empty_line_ratio": 0.19, "last_line_length": 1, "whitespace_ratio": 0.2, "identifier_density": 0.28, "line_length_stddev": 31.65, "normalized_string_count": 0.71, "suspicious_string_ratio": 0.25, "trailing_whitespace_lines": 1, "suspicious_identifier_ratio": 0.17, "normalized_unique_identifiers": 1.2 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.47 }, "imports": { "count": 1, "stdlib_count": 1, "stdlib_ratio": 1 }, "strings": { "bytes": 674, "count": 4, "shell": 1, "avg_length": 168.5, "max_length": 612, "path_count": 1, "avg_entropy": 3.9, "domain_count": 1, "entropy_stddev": 0.77, "high_entropy_count": 1 }, "comments": { "chars": 264, "count": 5, "lines": 5, "to_code_ratio": 0.19 }, "identifiers": { "count": 9, "unique": 6, "avg_length": 8.17, "max_length": 17, "min_length": 1, "avg_entropy": 2.11, "reuse_ratio": 0.67, "length_stddev": 5.37, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.17, "all_lowercase_ratio": 0.67, "all_uppercase_ratio": 0.33 } } }, "id": 2, "mol": "O₂(CEu)H₂(CmPo₂)Md₂(In)", "path": "sfly-services-4.1.4.tgz!!package/exploit.js", "pid": 0, "risk": 6, "sha": "5247fb44de7c41961b40786d7e4121c2c3990eeec8e853d9f832e05ba317a2be", "size": 1116, "traits": [ { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "spans": [ [ 17, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-exec-destructure", "atk": "T1059", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Destructures exec from Node.js child_process", "spans": [ [ 6, 33 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec-call", "conf": 1.0, "crit": 1, "desc": "Calls a function named exec", "spans": [ [ 1050, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable-call", "conf": 0.9, "crit": 1, "desc": "Calls exec with a command-named variable", "spans": [ [ 1049, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-require-destructure-binding", "conf": 0.94, "crit": 1, "desc": "Destructures Node exec from require", "spans": [ [ 6, 0 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::web-content-oob-service-reference", "conf": 0.9, "crit": 3, "desc": "OOB service URL in web content", "spans": [ [ 153, 12 ] ] }, { "id": "metadata/file/profile/language::lang-arabic-script", "conf": 0.8, "crit": 3, "desc": "Contains Arabic-script text", "spans": [ [ 51, 8 ] ] }, { "id": "micro-behaviors/communications/http/curl::curl-post-flag", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "curl explicitly sends an HTTP POST request", "spans": [ [ 865, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "spans": [ [ 6, 33 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::webhook-site-reference", "conf": 0.85, "crit": 3, "desc": "webhook.site service reference", "spans": [ [ 153, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec", "atk": "T1059.007", "mbc": "C0017", "conf": 0.95, "crit": 3, "desc": "Executes a command through Node.js child_process exec", "uses": [ 1, 2 ], "spans": [ [ 6, 33 ], [ 1050, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-child-process-binding", "conf": 0.94, "crit": 1, "desc": "Binds Node child_process exec", "uses": [ 4 ], "spans": [ [ 6, 0 ] ] }, { "id": "objectives/exfiltration/oob/endpoint::oob-endpoint-any", "conf": 0.9, "crit": 3, "desc": "Any OOB callback endpoint", "uses": [ 5 ], "spans": [ [ 153, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable", "atk": "T1059.007", "mbc": "C0017", "conf": 0.94, "crit": 3, "desc": "Node child_process exec receives a command-named variable", "uses": [ 3, 11 ], "spans": [ [ 6, 33 ], [ 1049, 13 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "uses": [ 0, 8 ], "spans": [ [ 6, 33 ], [ 17, 7 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::oob-service", "atk": "T1567", "conf": 0.85, "crit": 3, "desc": "Out-of-band interaction service reference", "uses": [ 12 ], "spans": [ [ 153, 12 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb6dvjC}B8GA=#ebwPG4D3lQDnC4CYnx(v(kiV]R6e?[$na$K6zar\u003eucB7ol8Acb/jzx.a:b1VV]wPzV%y-)!gA=#ebwPF#kvpK7YxjSh$z/M$ww]8-Ba$K6zar\u003eVhx(kaQar\u003eJqwmZ0ryi7NI3lQDnB7ol8AccdBiV@+RarR^Hb6myqBrS:*b4Um$zY\u0026pemriA!AYLsXzY\u003cdkB95KCAaJJ[w[+*!tP$pqclM(Ax(\u003eELa$K6zarR^JAb]J7zGx]dy?$pRar\u003eYwwmV({CYmFqx(\u003e$xB0p@laBL^FarR\u003ezwQeGrA+6kniV}SJB7Plla$K\u0026XB7Gxnx\u003e7Z}b3=-barR\u003epB-.qnAW0K!a%FMBarR\u003eAx\u003e7Z(B7DKRar\u003cxQlM#\u003e=3i", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 317, "entropy": 4.51 }, "binary": { "peak_region_bytes": 317, "peak_region_entropy": 4.51 } } }, "id": 3, "mol": "O(S)H(Po)Md(Pa)", "path": "sfly-services-4.1.4.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "index.js", "off": 118, "kind": "local" } ], "risk": 5, "sha": "fcd2ba4a3b728983ed5d57e1aea063d95830602b48d3ffe9d555cd7c24f89f0b", "size": 317, "traits": [ { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field", "spans": [ [ 0, 21 ] ] }, { "id": "supply-chain/install-hook/preinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'preinstall' hook that runs during install", "spans": [ [ 207, 15 ] ] }, { "id": "metadata/package/manifest/entrypoint::pkg-main-field", "conf": 0.6, "crit": 2, "desc": "package.json declares a main entry point", "spans": [ [ 109, 0 ] ] }, { "id": "metadata/package/scripts/lifecycle::has-preinstall-script", "conf": 0.95, "crit": 3, "desc": "Manifest declares npm preinstall lifecycle hook", "spans": [ [ 207, 15 ] ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter", "spans": [ [ 131, 15 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has preinstall script hook", "spans": [ [ 207, 15 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::has-preinstall-raw", "conf": 0.88, "crit": 3, "desc": "Raw content contains preinstall hook", "spans": [ [ 207, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/lifecycle::preinstall-runs-node-local-script", "atk": "T1195.002", "conf": 0.97, "crit": 3, "desc": "preinstall hook runs a local Node.js script", "spans": [ [ 207, 15 ] ] } ], "type": "package.json" } ], "rev": "479f3", "v": "8" } }