{ "llm": { "conf": 0.01679286, "grade": "benign", "model": "Qwen/Qwen3.8-27B", "outcome": "benign", "interpretation": "Legitimate MJML Rails gem" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.025063971, "rte": "az", "prob": 0.025063971 }, { "cls": 0, "raw": 0.005896648, "rte": "az/gem", "prob": 0.005896648 } ], "prob": 0.025063971, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.025063971057534218, "type": "gem" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000026305517167202197, "type": "tar.gz" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001523892115073977, "type": "ruby" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00001547733882034663, "type": "ruby" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000012745459571306128, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-02T18:01:11Z" }, "path": "mjml-rails-4.4.0.gem", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "zdN/$wmoN*e[YFg00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fFCgmg=d2?fFCgmfFCfXfFCgmfA", "ln": 0 } ], "mol": "O(C)H₂(CmPo)", "sha": "ce1ec17990fa923fb54ec6f6182d897d2c3e718f82c051864b2aa719c93680cd", "path": "mjml-rails-4.4.0.gem", "risk": 4, "size": 16384, "type": "gem", "facts": { "metrics": { "gem": { "dependency_count": 0, "runtime_dependency_count": 0, "development_dependency_count": 0 }, "file": { "size": 16384, "entropy": 6.59 }, "binary": { "peak_region_bytes": 9216, "peak_region_entropy": 7.82 }, "archive": { "file_count": 6, "member_count": 6, "script_count": 0, "directory_count": 0, "executable_count": 0, "hidden_file_count": 0, "uncompressed_size": 11352, "max_filename_length": 21, "rtlo_filename_count": 0, "format.regular_count": 6, "nested_archive_count": 3, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "timing.mtime_unique_count": 2, "misplaced_executable_count": 0, "timing.mtime_spread_seconds": 1, "security.world_writable_count": 0 } } }, "ident": { "name": { "value": "mjml-rails", "source": "gem.name", "verified": false }, "urls": [ { "url": "https://github.com/sighmon/mjml-rails", "kind": "homepage", "source": "gem.homepage" } ], "trust": "unsigned", "authors": [ { "name": "Simon Loffler", "role": "author", "source": "gem.authors" }, { "name": "Steven Pickles", "role": "author", "source": "gem.authors" } ], "version": { "value": "4.4.0", "source": "gem.version", "verified": false } }, "traits": [ { "id": "objectives/command-and-control/reverse-shell/dup::open3-popen", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Open3 popen call" }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference" }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 1, "desc": "File path or name indicates test code" }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal" }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "micro-behaviors/process/create/shell/lang::ruby-popen", "conf": 0.92, "crit": 3, "desc": "popen pipes to/from command" }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory" }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 1 }, { "file": 3 }, { "file": 12 }, { "file": 13 }, { "file": 14 }, { "file": 15 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 8075, "entropy": 7.97 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 8075, "peak_region_entropy": 7.82 } } }, "id": 1, "mol": "O(C)H₂(CmPo)", "path": "mjml-rails-4.4.0.gem!!data.tar.gz", "pid": 0, "risk": 4, "sha": "44f3771373b38d7ba49ebee9ae6e503a4f094f2c7ab96bb0be88e6b3326ee38d", "size": 8075, "traits": [ { "id": "objectives/command-and-control/reverse-shell/dup::open3-popen", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Open3 popen call" }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path" }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory" }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 3 }, { "file": 12 }, { "file": 13 }, { "file": 14 }, { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal" }, { "id": "micro-behaviors/process/create/shell/lang::ruby-popen", "conf": 0.92, "crit": 3, "desc": "popen pipes to/from command" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 1, "desc": "File path or name indicates test code" }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference" } ], "type": "tar.gz" }, { "ctx": [ { "b": "A+flkx(W=cb64aay\u0026.mMwPz\u003caz/c:aA+flkx(W=cb4j#6x(v(@C4\u003eJia{@v4ADL#owGSg9v@#B6zEmN3wP]!HwO(y5vru683uxY$B.L(car\u003eVqzep\u003exyhE^ewO?", "ln": 0, "col": 1, "line": 1 }, { "b": "a{]CnkTog3zerM*x(mv1D0+c6A=k#9B98CpzF77Par\u003cf\u003eB.\u003ePacV*Fyx(mD7Bzbkdo?FbNar#kcyhE=tze9{7uT^.!vrcT2C4CYnx(v(@B9hCvz/P@hwpkOfx(mv1C}HY(xKM6}aBd)FaAzQxas57EAbu.izGx]dy?$khyhE=Ka{]CnkTn^\u0026vrDWaw{CHZaARTDwEoL5kTog2zFrZdauZ\u0026VvqH0@3lQDRkZ3NLx\u003egT]x(v(@y?m^3y-\u003e\u003e-b6dWmBrR50arUiaw/#eay?tqfxK$W?uV{13B7]Mgc$l[ddgdguarTlKe]U-FwO@]2vRGZhasw-)C4CYnx(v(pt}3[yaBE)wD)0cwe]\u003eJiwg?Olv@co#wJ}N!ze9{7eN@ZtwJy}UDRFl(y+xNtzerM*x(mv1D0+-aA=U@kzEmEcAbY-oBy/0ha$jT.3lQEiwPIv7wEoL5arUo8y\u0026:d{arUlkwc@U^ay]4}aAIagw?ERdB7ociwPzc{yhE=]vRGY!arR^HboPu!wN/G#w]zYjvixi0z^)c\u003eazC.mByx04aA7\u003cmo?FbNayY55vrcS2arR^Hze9{7uT^.!auZ?{ze9{7cKH$sarUYoBAIRwaz\u003e\u003egy*QT=zxJU9ay/7@v@2B{wPz\u003caz/c$uyhE+", "ln": 438, "col": 40, "line": 14 }, { "b": "Acb/jzEEu7B7F\u003c1zE:(hz/{8gwGU@2A:-/@By/FnBz\u0026psvqxA%x(\u003eFwz/PRoCwhejaw#SZy\u0026ZZ.jS(Tz3lQDlar@0}wOkZ{zFs03aA}KwxDQhYx(4\u0026khxW9Mze:r1By=OdvqYQ(wPz\u0026mxjVfcBzbkdB8Mhwv}u^3w/#hewGV8aze:r1By=O6B0bNr", "ln": 1701, "col": 8, "line": 59 }, { "b": "vrcDjCwhejauTHQzeqxUA=k(raAR483lQDlarR^Kaw3e/Cv.[fwPP5dwPzu8vqYP#By/rdy*?A%aAIEzA:@V6wn=42zyoJGB97\u0026hBrC^wBz8!nzE\u003c@8BrCBivqZb[arR^HarR)KBzb98aA}xtvrb{4A+fc0wPzH5xcqe4A==27y-)R7zdNl2vpJ!=A+5)4xcqqmaz+R4vpKN9zEEx@zF784z/f-fzGGPhzxHuDvrcE7vqH0cwO#3)zF78ox([2hcOxmJ", "ln": 2170, "col": 79, "line": 70 }, { "b": "xK#67Bz(aIy?m^3y-)L5D2E?Efly=xAbn%8wGUYdaAz4hwmY^)wc%C4arR^HbmkLoarR^HboQhAt{7ZwxMOunB2\u003e%cxk8E3BZ=$kz/4dAyhE^3z.C%xzep\u003emy\u0026r=ozddHcwPxCmz^$CkB.Lw$e]tbzze9{73lQDlarR!vw/$P4ze:i9wN]d?z/{8gwGTc+atk\u0026]yhE=ne?nwnj$*QSarR^HarR^Hb28/?y=TQKyhE^ewO(y5vru6kBz\u003eJ1BzU?xvR6g^zAx6", "ln": 2503, "col": 26, "line": 74 } ], "depth": 2, "facts": { "imp": [ [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "mattr_accessor" ], [ "", "mjml_binary_version_supported" ], [ "", "popen" ], [ "", "include?" ], [ "", "read" ], [ "", "mjml_binary_version_supported" ], [ "", "check_version" ], [ "", "bin_path_from" ], [ "", "bin_path_from" ], [ "", "puts" ], [ "", "mjml_binary_error_string" ], [ "", "join" ], [ "", "check_version" ], [ "", "puts" ], [ "", "mjml_binary_error_string" ], [ "", "popen3" ], [ "", "chomp" ], [ "", "read" ], [ "", "registered_template_handler" ], [ "", "template_language" ], [ "", "call" ], [ "", "call" ], [ "", "block_given?" ], [ "", "attr_writer" ], [ "", "tap" ], [ "", "new" ], [ "", "progname" ], [ "", "name" ], [ "", "action_view" ], [ "", "action_view/template" ], [ "", "mjml/mjmltemplate" ], [ "", "mjml/railtie" ], [ "", "open3" ], [ "", "rails/version" ], [ "", "rubygems" ] ], "mbr": [ "File.join", "IO.popen", "Logger.new", "Logger.new.tap", "Mjml.mjml_binary_error_string", "Mjml.mjml_binary_version_supported", "Mjml.template_language", "Open3.popen3", "io.read", "io.read.include?", "log.progname", "stdout.read", "stdout.read.chomp", "template_handler.call" ], "tgt": [ "attr_writer", "bin_path_from", "block_given?", "call", "check_version", "chomp", "include?", "join", "mattr_accessor", "mjml_binary_error_string", "mjml_binary_version_supported", "name", "new", "popen", "popen3", "progname", "puts", "read", "registered_template_handler", "require", "tap", "template_language" ], "funcs": [ [ "check_version", 648 ], [ "discover_mjml_bin", 815 ], [ "bin_path_from", 1320 ], [ "template_handler", 1562 ], [ "call", 1879 ], [ "setup", 2810 ], [ "logger", 2908 ] ], "metrics": { "ast": { "op.ge": 1, "op.lor": 1, "max_depth": 13, "op.concat": 19, "call_count": 35, "node_count": 513, "member_count": 14, "max_array_len": 2, "op_density.ge": 0, "op_density.lor": 0, "member_depth_max": 3, "op_density.concat": 0.04 }, "file": { "size": 3031, "entropy": 4.8 }, "text": { "lines": 98, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0, "space_count": 541, "char_entropy": 4.8, "unique_chars": 74, "top_char_null": 0, "string_density": 0.18, "top_char_ratio": 0.08, "avg_line_length": 29.93, "max_line_length": 158, "empty_line_ratio": 0.15, "last_line_length": 3, "whitespace_ratio": 0.21, "identifier_density": 1.06, "line_length_stddev": 32.08, "normalized_string_count": 1.82, "repeated_char_sequences": 2, "suspicious_comment_ratio": 0.08, "normalized_unique_identifiers": 9.07 }, "binds": { "count": 15 }, "binary": { "peak_region_bytes": 3031, "peak_region_entropy": 4.87 }, "source": { "class_count": 2, "function_count": 7 }, "imports": { "count": 7, "third_party_count": 7, "third_party_ratio": 1 }, "strings": { "bytes": 354, "count": 18, "avg_length": 19.67, "max_length": 102, "avg_entropy": 2.86, "entropy_stddev": 1.09 }, "comments": { "chars": 759, "count": 13, "empty": 1, "lines": 12, "high_entropy": 1, "to_code_ratio": 0.14, "url_in_comments": 1 }, "functions": { "count": 9 }, "identifiers": { "count": 104, "unique": 60, "avg_length": 9.8, "max_length": 31, "min_length": 1, "avg_entropy": 2.58, "reuse_ratio": 0.58, "length_stddev": 7.33, "has_digit_ratio": 0.03, "single_char_count": 1, "single_char_ratio": 0.02, "high_entropy_count": 10, "high_entropy_ratio": 0.17, "all_lowercase_ratio": 0.57, "all_uppercase_ratio": 0.1, "numeric_suffix_count": 2, "underscore_prefix_count": 1 } } }, "id": 2, "mol": "H₂(CmPo)", "path": "mjml-rails-4.4.0.gem!!data.tar.gz!!lib/mjml.rb", "risk": 2, "sha": "cdffdf13a8579f6465cdaf79fd4423f306dfec2ddf5015a2ab6b827303cb9db6", "size": 3031, "traits": [ { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "micro-behaviors/process/create/shell/lang::ruby-popen", "conf": 0.92, "crit": 3, "desc": "popen pipes to/from command", "spans": [ [ 680, 5 ] ] } ], "type": "ruby" }, { "ctx": [ { "b": "A+flkx(W=ccV\u0026{vByeY)y\u0026A%acKHh\u003ewPIv4x\u003c$S@o\u003e[JYiYZ8CA=U/jay]x$arUGiBsog:zG6-udiJ%WzeS{1c)@.DAclmIdiK3CarUGiBsog?vrcB2AW-bTawDP/y=TQNvrcB2AXqlvCpme", "ln": 0, "col": 1, "line": 1 }, { "b": "arUlkwc@U^arR!qwPIv4x\u003c$S@cU3O5aAz44wftt)vrDWaw{C{Ize0)4w{C{IvqYP#C42i3wmoN]z/e]#wP?T3ay/tcw[+[0cM(@r3lQDlarR!vBrz@NB7DF8wObv[y\u0026\u003c.vx\u003ewG9zY\u0026LdzF0P}azC)tB7GCvay]x$arR^HarR^HwQ5f9v@%a[yhE+", "ln": 991, "col": 3, "line": 39 }, { "b": "3lQDlarR!ywPPsYwPz*fAW-bTaszkzwO=f9wPz*fAWI#T3lQDlarR!ywPPsYB97@7A=JPKDMWfzv@0FuB97@7A=JJUaz2F6kro{0vqH0@efF$AvpRzwwPz*fAW-bV3jm)#arR^HvR6d\u0026A+cwuawV@/zzJ[^BAI5lc#:9zwO%p+ax@.$y+cYDx(2syB97@7A=JYNzFr])diK3C3lQDlarR!vBrz@Kvqf^]B0b4sv}xR3x(v(pay]x$arR^HarR^HeJ$q7aAg+fB7GwAA=(mxa$[4PA4+{yAclnfw[=6)e]tuuy:70Ie]t-LByf5%x(^\u0026lo\u003e[JYiYZ8CA=U/jiYZ8CA=U!XA=M8sefFIAA=k$E3lQDlarR!rzE:7%arR!rzE:7%az2C33t19=3i", "ln": 1709, "col": 47, "line": 63 } ], "depth": 2, "facts": { "imp": [ [ "", "require" ], [ "", "describe" ], [ "", "let" ], [ "", "mock" ], [ "", "let" ], [ "", "new" ], [ "", "describe" ], [ "", "describe" ], [ "", "let" ], [ "", "new" ], [ "", "let" ], [ "", "new" ], [ "", "before" ], [ "", "raises" ], [ "", "stubs" ], [ "", "describe" ], [ "", "before" ], [ "", "setup" ], [ "", "raise_render_exception" ], [ "", "it" ], [ "", "must_raise" ], [ "", "render" ], [ "", "message" ], [ "", "describe" ], [ "", "before" ], [ "", "setup" ], [ "", "raise_render_exception" ], [ "", "it" ], [ "", "must_equal" ], [ "", "render" ], [ "", "describe" ], [ "", "it" ], [ "", "must_equal" ], [ "", "expect" ], [ "", "beautify" ], [ "", "must_equal" ], [ "", "expect" ], [ "", "minify" ], [ "", "must_equal" ], [ "", "expect" ], [ "", "validation_level" ], [ "", "it" ], [ "", "setup" ], [ "", "beautify" ], [ "", "minify" ], [ "", "validation_level" ], [ "", "must_equal" ], [ "", "expect" ], [ "", "beautify" ], [ "", "must_equal" ], [ "", "expect" ], [ "", "minify" ], [ "", "must_equal" ], [ "", "expect" ], [ "", "validation_level" ], [ "", "describe" ], [ "", "describe" ], [ "", "let" ], [ "", "let" ], [ "", "mock" ], [ "", "before" ], [ "", "stubs" ], [ "", "it" ], [ "", "must_raise" ], [ "", "run" ], [ "", "test_helper" ] ], "mbr": [ "Class.new", "Mjml.beautify", "Mjml.minify", "Mjml.setup", "Mjml.validation_level", "Open3.stubs", "config.beautify", "config.minify", "config.raise_render_exception", "config.validation_level", "custom_error_class.new", "error.message", "parser.render", "parser.render.must_equal", "parser.run", "parser.stubs", "parser.stubs.raises" ], "tgt": [ "beautify", "before", "describe", "expect", "it", "let", "message", "minify", "mock", "must_equal", "must_raise", "new", "raise_render_exception", "raises", "render", "require", "run", "setup", "stubs", "validation_level" ], "metrics": { "ast": { "max_depth": 21, "op.concat": 33, "call_count": 65, "node_count": 574, "member_count": 17, "max_array_len": 4, "member_depth_max": 3, "op_density.concat": 0.06 }, "file": { "size": 2026, "entropy": 4.37 }, "text": { "lines": 74, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0, "space_count": 518, "char_entropy": 4.37, "unique_chars": 53, "top_char_null": 0, "string_density": 0.3, "top_char_ratio": 0.09, "avg_line_length": 26.38, "max_line_length": 92, "empty_line_ratio": 0.18, "last_line_length": 3, "whitespace_ratio": 0.29, "identifier_density": 1.41, "line_length_stddev": 22.65, "normalized_string_count": 2.56, "repeated_char_sequences": 11, "normalized_unique_identifiers": 5.15 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 2026, "peak_region_entropy": 4.52 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 380, "count": 22, "avg_length": 17.27, "max_length": 55, "path_count": 1, "avg_entropy": 3.04, "empty_count": 1, "entropy_stddev": 0.68 }, "identifiers": { "count": 104, "unique": 32, "avg_length": 7.25, "max_length": 22, "min_length": 2, "avg_entropy": 2.31, "reuse_ratio": 0.31, "length_stddev": 4.38, "has_digit_ratio": 0.03, "all_lowercase_ratio": 0.81, "numeric_suffix_count": 1 } } }, "id": 3, "mol": "O(C)", "path": "mjml-rails-4.4.0.gem!!data.tar.gz!!test/parser_test.rb", "risk": 2, "sha": "befa0613b7f423c2c4635bffe6d34b87ca28497872eb71a427a7add032245bba", "size": 2026, "traits": [ { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 1929, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference" }, { "id": "objectives/command-and-control/reverse-shell/dup::open3-popen", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Open3 popen call" }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 1, "desc": "File path or name indicates test code", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "spans": [ [ 0, 0 ] ] } ], "type": "ruby" }, { "ctx": [ { "b": "DM)3hz/ZhBBy/qkiWeiFz6yIPzEEx[b03]+yhE=sA:-V#B0rdVC4CYnx(v(kiWcykg+HEaefY4QvR/+1xK$ZYvrrXOf/p{Fiw@\u0026RgDv0gvp%dUwmo+8b04Fng+{QayY", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 848, "entropy": 4.76 }, "binary": { "peak_region_bytes": 848, "peak_region_entropy": 4.76 }, "registry": { "age_days": 2342, "published_at": 1585968839, "is_deprecated": 0, "downloads_total": 10070903, "downloads_recent": 161349 } } }, "id": 18, "path": "mjml-rails@4.4.0.registry.json", "pid": 0, "rel": "registry", "role": "sidecar", "sha": "7c8dc2a1b798db4552322e6107c5e4c6d19de7bbd37e9362380a0ea272eebb16", "size": 848, "traits": [ { "id": "metadata/registry::widely-installed", "conf": 1.0, "crit": 1, "desc": "Large registry install base (10k+ downloads)", "spans": [ [ 0, 0 ] ] } ], "type": "registry" } ], "rev": "479f3", "v": "8" } }