{ "llm": { "conf": 0.99919426, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 20000, "prob": 0.9987974, "class": "benign" }, "outcome": "suspicious", "interpretation": "Obfuscated credential stealer" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": 279, "conf": 80, "mods": [ { "cls": 0, "raw": 0.9987974, "rte": "az", "prob": 0.9987974 }, { "cls": 0, "raw": 0.99112695, "rte": "az/npm", "prob": 0.99112695 } ], "prob": 0.99919426, "files": [ { "id": 0, "lvl": 279, "conf": 80, "prob": 0.9991942644119263, "type": "npm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0037041206378489733, "type": "javascript" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00004315376281738281, "type": "package.json" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000014662742614746094, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-29T15:49:32Z" }, "path": "dotenv-precheck-1.0.0.tgz", "raw": { "files": [ { "id": 0, "mol": "O₄(As₄EuS₃Xe)H₆(Cm₃CrDb₉FOsPo)Md₃(In₂Pa₃)Th", "sha": "d080c79d0c8da50b03ab4cd5c28e10f0da4e2940deb2ffff88dccfa0b67f1b19", "path": "dotenv-precheck-1.0.0.tgz", "risk": 98, "size": 16597, "type": "npm", "facts": { "metrics": { "file": { "size": 16597, "entropy": 7.97 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 16384, "peak_region_entropy": 7.82 } } }, "ident": { "name": { "value": "dotenv-precheck", "source": "npm.name", "verified": false }, "trust": "unsigned", "version": { "value": "1.0.0", "source": "npm.version", "verified": false }, "identifier": { "value": "dotenv-precheck", "source": "npm.name", "verified": false } }, "traits": [ { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-variable-names", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Hex-prefixed variable names (_0x pattern)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "from": [ { "file": 1 } ] }, { "id": "supply-chain/install-hook/postinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'postinstall' hook that runs during install" }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/post::post-form", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP form submission encoding", "from": [ { "off": 36965, "file": 1, "line": 1 } ], "uses": [ 21 ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-mnemonic-token", "atk": "T1041", "conf": 0.9, "crit": 1, "desc": "Node MNEMONIC token", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::obfuscated-base64-codec", "atk": "T1027.002", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Obfuscated JavaScript embeds a Base64 alphabet", "from": [ { "off": 597, "file": 1, "line": 1 } ], "uses": [ 37, 63 ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-function-derived-computed-call", "conf": 0.9, "crit": 3, "desc": "Calls computed member from function result", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::host-user-field-pair", "conf": 0.9, "crit": 3, "desc": "JSON-like host and user identity fields", "from": [ { "off": 22812, "file": 1, "line": 1 } ], "uses": [ 46, 48 ] }, { "id": "metadata/import/npm/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-member-variable-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns through a computed JavaScript member", "from": [ { "file": 1 } ] }, { "id": "metadata/package/scripts/lifecycle::versioned-install-hook-without-source-repository", "conf": 0.9, "crit": 3, "desc": "Versioned install-hook package lacks declared source repository", "from": [ { "file": 2 } ], "uses": [ 61, 66 ] }, { "id": "objectives/supply-chain/install-hook/scripts/declaration::has-postinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has postinstall script hook" }, { "id": "micro-behaviors/communications/http/request/computed::js-fetch-computed-helper-argument", "conf": 0.93, "crit": 3, "desc": "Fetch API passed to computed helper" }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-name-mangling-with-string-table-rotation", "atk": "T1027.002", "mbc": "B0032", "conf": 0.94, "crit": 3, "desc": "Hex-named string-table decoder", "from": [ { "off": 20365, "file": 1, "line": 1 } ], "uses": [ 47, 62 ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "objectives/supply-chain/install-hook/package/manifest::postinstall-runs-node-script", "conf": 0.92, "crit": 3, "desc": "Postinstall targets local Node.js file" }, { "id": "micro-behaviors/data/source/property/computed::js-nested-concat-this-call", "conf": 0.94, "crit": 3, "desc": "Nested this-concat calls a computed member", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/form::formdata-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Constructs browser FormData", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-near-zero-whitespace", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JavaScript near-zero whitespace", "from": [ { "file": 1 } ] }, { "id": "metadata/import/npm/fs::fs", "conf": 0.95, "crit": 3, "desc": "imports fs", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::lower-first-base64-alphabet", "conf": 0.9, "crit": 3, "desc": "JavaScript embeds a lower-first Base64 alphabet", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning/sentinel::npm-version-exactly-1-0-0", "atk": "T1195.002", "conf": 0.6, "crit": 3, "desc": "npm package version is exactly 1.0.0" }, { "id": "supply-chain/new-package-with-hooks", "conf": 0.6, "crit": 3, "desc": "Version 1.0.0 package with install hooks (common malware pattern)" }, { "id": "objectives/supply-chain/install-hook/scripts/declaration::postinstall-hook-declaration", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Package declares a postinstall hook" }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "file": 1 } ], "uses": [ 57 ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-seed-phrase-token", "atk": "T1041", "conf": 0.9, "crit": 3, "desc": "Node SEED_PHRASE token", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::versioned-install-hook-without-source-repository", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Versioned install-hook package lacks a declared source repository", "from": [ { "file": 2 } ], "uses": [ 61, 66 ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::javascript-obfuscator-string-array-runtime", "atk": "T1027.002", "mbc": "B0032", "conf": 0.96, "crit": 4, "desc": "JavaScript Obfuscator rotates and decodes a string array at runtime", "from": [ { "off": 458, "file": 1, "line": 1 } ], "uses": [ 35, 53 ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::js-secret-key-name", "atk": "T1027.013", "mbc": "B0032", "conf": 0.75, "crit": 3, "desc": "Secret key identifier", "from": [ { "file": 1 } ] }, { "id": "metadata/package/entrypoint::main-root-javascript-entry", "conf": 0.9, "crit": 2, "desc": "Root JavaScript main entrypoint" }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-mangled-bracket-rotation", "atk": "T1027.002", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Mangled array self-rotates via bracket access", "from": [ { "file": 1 } ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "micro-behaviors/data/decode/base64::base64-alphabet", "conf": 0.9, "crit": 3, "desc": "JavaScript embeds a Base64 alphabet", "from": [ { "off": 23180, "file": 1, "line": 1 } ], "uses": [ 25 ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-date-method-call", "conf": 0.82, "crit": 3, "desc": "Calls a Date method through bracket notation", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Exactly one line exceeds 1000 chars", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "from": [ { "file": 1 } ] }, { "id": "third_party/SigBase/SUSP/Obfuscated/JS/Obfuscatorio", "conf": 0.9, "crit": 3, "desc": "Detects JS obfuscation done by the js obfuscator (often malicious)" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors" }, { "id": "metadata/package/files/included::npm-publish-root-manifest", "conf": 0.95, "crit": 2, "desc": "Manifest sits at npm publish root", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::push-shift-bracket-pattern", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Bracket-notation push/shift self-rotation", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::host-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like host identity field", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/import-chain::scripts-postinstall-executor-node", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "postinstall invokes node" }, { "id": "micro-behaviors/fs/build-artifacts::compiled-artifact-cleanup", "conf": 1.0, "crit": 3, "desc": "Deletes only compiled/cache build artifacts", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/interpreter/script/npm::npm-postinstall-script", "conf": 1.0, "crit": 3, "desc": "Declares an npm postinstall lifecycle hook" }, { "id": "micro-behaviors/data/serialize/schema-object::content-object-field", "conf": 0.8, "crit": 3, "desc": "JSON content object field", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-mangled-parseint-rotation-guard", "atk": "T1027.002", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Mangled parseInt checksum drives rotation loop", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/wallet/keywords::seed-phrase-word", "conf": 0.5, "crit": 3, "desc": "seedPhrase credential field reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/module/require::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "from": [ { "file": 1 } ], "uses": [ 69, 76 ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::postinstall-hook-key", "conf": 0.85, "crit": 3, "desc": "Declares a package postinstall hook" }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/time/query::js-triple-new-date", "conf": 0.4, "crit": 3, "desc": "3+ new Date() calls", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster", "conf": 0.86, "crit": 3, "desc": "Dense computed-property call cluster (3+)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning/scheme::mature-version", "conf": 0.7, "crit": 2, "desc": "Major version is 1 or higher" }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-name-mangling", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Hex-prefixed identifier names (obfuscation)", "from": [ { "off": 578, "file": 1, "line": 1 } ], "uses": [ 0, 67 ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::any-name-mangling", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Obfuscator-style name mangling", "from": [ { "off": 20365, "file": 1, "line": 1 } ], "uses": [ 62 ] }, { "id": "metadata/file/encoded::large-base64-like-literal", "conf": 0.8, "crit": 3, "desc": "Large Base64-like string literal", "from": [ { "file": 1 } ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-dev-secret-regex-list", "atk": "T1041", "conf": 0.94, "crit": 4, "desc": "Node developer secret regex list", "from": [ { "off": 26445, "file": 1, "line": 1 } ], "uses": [ 6, 30, 77, 79 ] }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 1, "desc": "Package has install hooks", "from": [ { "file": 2 } ], "uses": [ 14 ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-function-names", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Hex-prefixed function names (_0x pattern)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json", "from": [ { "file": 2 } ] }, { "id": "metadata/import/builtin::require-fs", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js fs module", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/wallet/keywords::private-key-word", "conf": 0.5, "crit": 3, "desc": "privateKey credential field reference", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Last line is over 1000 chars", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0xff hex byte token", "from": [ { "file": 1 } ] }, { "id": "metadata/file/naming::numeric-suffix-identifiers", "conf": 0.75, "crit": 3, "desc": "At least 100 numeric-suffixed identifier names", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::version-1-0-0-with-hooks", "conf": 0.75, "crit": 3, "desc": "Version 1.0.0 with install hooks", "from": [ { "file": 2 } ], "uses": [ 26, 66 ] }, { "id": "micro-behaviors/data/source/syntax/array::shift-string-literal", "conf": 0.6, "crit": 3, "desc": "String literal names the shift method", "from": [ { "file": 1 } ] }, { "id": "metadata/import/builtin::require-os", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js os module", "from": [ { "file": 1 } ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-wallet-key-token", "atk": "T1041", "conf": 0.9, "crit": 3, "desc": "Node WALLET_KEY token", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-decoder-call-prefix", "conf": 0.9, "crit": 3, "desc": "Computed call uses a decoder function", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/asymmetric/key::private-key-identifier", "conf": 0.75, "crit": 3, "desc": "Private-key identifier", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/archive-member::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" } ] }, { "ctx": [ { "b": "v@DmaBrB{ACR-!!h.XY7uODZYwhM55c$WQtv@#B6zyw\u003cCCX7qygDvxBuODZVv(u23wHR$oz/fSrayu*Eh8c\u003c#v(VXVfNbA+h83N*fNbudi59czjZP)/wNNLOix5unj9LvLy?k1raZnk3DVTpNDT*#iB95KifNbP!wh=zbjUpRYA=U!-zGEplfNbDfgg\u003e2Rc[])2vk]X+fedS9d\u003eLZGA=U!-zGEplfNbDfgg\u003e2Rc[])2hzuNefedSad@X{qB7E{XBspGICR}ihw[9?HfNbrbwHP5YfNbx7ePtcsB7E{XBspGICR}ihw[9?HfNbrhh7o$cfNbA7c[PyDA=U!-zGEplfNbDfgg\u003e2Rc[])2hFax!fedSddjV#?vrcB2nP5R#uODZZf/0uJivDOaf/y*pdk9x1hy\u0026-PA=U!-zGEplfNbDfgg\u003e2Rc[])2iB%S*fedSfd\u003eLZGA=U!-zGEplfNbDfgg\u003e2Rc[])2fF+dbfedSgdKYmAA=U!-zGEplfNbDfgg\u003e2Rc[])2gb*ThfedShdlzlQc%[VMiBVIThAr]-jZP)/f\u003ei9}iB%TGA+eV{j7SkHwGUtlCRR3lf!\u003eE*cVBiHxEv7luODZWgb}0ygG#kFxLz72cTwbHdlz@/vru0)c%[VMg?6(Hg+Zw9uODZWgb}0ygG#kCB-Rjzt{%5lCRR3lf!\u003eE*cV-%nw]]zac[cPbEslI(uODZZi5-YCfNbA.hdOG(dlzc:zEW^5z/cX8fNbDmh-i0jDT*#iB95KifNbxdw))CMjZfp1xe@}qCxcIEm\u003c/\u0026ny+/:al$4C]cU)iZpI-Q3p?%ibqFQtLod8nrlOZV3Dt$q-cUWm6pEv\u0026*t6+Bghyy46DuR+jl3k1iegkl\u0026zCiw\u003eA+dM)zzsF4C2Z}scOcSjgdT@Mn{8)pegi=dw(*uhcU#HNt0:#3cOcS\u003eo?XLMCY3r6CxddXvj9PNmp!FQDqc7vegkZ/vPL)fod8nrBwcZ!zfmM\u003eC6DX#A+e/:BwcmaAb^lRcQPTHw\u003cH3qcOcS\u003eCqRc#giMuqw{N0nphIvfcQPX0q:CUFcOcShCY47UCXP]$gJDI-pd(@=cQRJUolbklod8nrl1\u003eo)lUHr{y/@.BegkZ0ybFv(A-KLscQ?PYBWO\u003eZcOcS*w\u003ek-^wO0kucU#H$s3*CmrEep\u0026fEFz0y+!yLl$QQzDs{?zDu:oOegkM@l@MAdAvip+D3s0]lqqG3lp\u003eSSC$*$hl3NAcx\u003eI3Hlt7BhD3s17m0JYwD3s17l}}!]D3s1bDuRk2x\u003eI3HlOZV8C$zEoC$@lhlRRe+l$oW%C$@lilRRL\u003cD3s0TlO-^OD3sc#Du:shx\u003eI3IC}@5^DuRk2x\u003eI3IC}}xmlqzI\u003cD3sc#m0JPyx\u003eI3Il1-\u003e+l}}!]D3sd5DsHzPC}}xmlO\u0026:VD0aPEC@64!l3Ncrx\u003eI3IlRPNAlS)\u003e?C@6CgD3scWl3Cs?x\u003eI3Il$XI.x\u003eI3Il$*selO\u0026NHD3scWm0Alwx\u003eI3JD3A^Lx\u003eI3JDsHzPDs}m{C@6CgD3sp4lRR-c", "ln": 0, "col": 1, "line": 1 }, { "b": "cQHJ/gBDD\u0026uODZZi5-YTw{503BzkVhc[fH-wPS6nzxJpuCR.6^vko-5ElhEXBAIRwayu*Eh8)JLc[dlav@DmaBrB{ACR.6kv\u003eYV3c$WQtv@#B6zyu@Xy?mYhuODZXvko=2vlC+Stu%shwPS6nzxJLlzEW^5z/c$gfNbucvQ.2Kemg8QhdX^Uh-Sslv@DmaBrB{ACRH{kgbSG6uODZXvko=2vlXvDzEW^5z/c%LDT*#iB95KifNbr:g=v3CjZP)/g?nD$j85pPuODZZwJsoWivPq+z/fSrayu*EgH:]MgH\u0026NPfNbD^iB\u003e6etvf7ef\u003eJm2fG7skCRI0=dp1uefNbucvQ.2KemANiB.$YcBAn()A+funA=91bfNbD^iB\u003e6ej-kyUy+e{ECR-/uh8w-7Esjd*B-7Yhx(v(qdslF8A+funA=91bfNbxZgb?d2jT13nemg8Qf!\u003eWzhdnN{jaeIadj!*WCSfexh-JSSuODZXf/JO@gamlTx(+?qB-7Yhx(v(qdskMyzGx[xuODZWf\u003er1FhA+z3CR\u0026}*fF3M+CR}GtwN)UYDNAn]p\u0026PwXi+AILv@#B6zyw\u003cCCRI0+vQ}kBuODZYiBMITgBWV\u003ewPS6nzxJpuCRI0+vQ}kqjW0daCR?A?w\u0026qCbEjM:iBYg\u003eNcPUP*CRR0:f\u003e93?fNbrdg+0\u0026mx\u003ew=2fNbDnhF3zRtvf7egbiq]vM2R*CRIi/dp1uefNbJ!vMcn6tvf7egbiq]vM2R*CRIf?dp1tJtvf7egbiq]vM2R*CRH%cdp1tJtvf7egbiq]vM2R*CRIfkdp1tHtZd@hcN*O#fNbr3dro0wB-IvYA+funA=91bfNbJ!vMcn6tvf7egbiq]vM2R*CRH%cdp1tJtvf7egbiq]vM2R*CRI6jdp1uefNbDnhF3zRtvf7egbiq]vM2R*CRI9ldp1xbuODZWf\u003er1FhyHn7f!$Bit{}dauODZWf\u003er1FhyHn7f\u003c#{*t{%5lCSfexh-JSytvf7egbiq]vM2R*CRI6jdp1uefNbDnhF3zRtvf7egbiq]vM2R*CRI9ldp1w:Ejml+fNbJ!vMcn6c[dk/z/fSrayu*EhdQkLf/7$kwPq\u003cbA+cTDw]/sGemg8QgbHZyhdX{\u003ewPq\u003cbA+cUafNbx.hA9s0c[])2hdm{.emg8Qg=w=5fF+\u003ejwPq\u003cbA+cTDz/WoPemg8QgH:{9ggrs^wPq\u003cbA+cUafNbx.hA9s0c[])2g=u^iemg8QhdFKNwN^\u003e\u0026B.kk%A:8)8CR-!!h.XX?fNbrhgauGSuODZXvM3e0vKJ{Pf/0n*emg8QgH-m3fK=B:CRH{fdjFFdfNbx.hA9s0c[])2gb7d.c%[VMgH-m3fK=B:CRIijdjEt{wPP54fNbD^gC\u0026V4jWKp6w[u0!uODZXvM3e0vKJ{Pf/H\u003cpt{%5lCR-!!h.XX?fNbrdw*]or", "ln": 20301, "col": 20302, "line": 1 }, { "b": "h.XX?fNbregauGSfi\u0026MGfdyajfNbx.hA9s0c[])2ia:QBc{?\u0026\u003cy?m3)dj!*WCR?o/ixn/SzE[2mo\u003c}#?uOD.mv(2(HgfX9tCR-!!h.XX?fNbrdvjtFgc%[VMf\u003es-NwO0A1fNbr-iaL3WdlP\u003e0uODZVwmvMgwH}gxCRJ+?wi1gadjD/PfNbraiaL0iuODZWg+*\u003cBwM@H}CR-!!h.XX?fNbrbi4nbYuODZYhEOQ1gH1iuCR-!!h.XX?fNbrdgauGSdj!*WCR-!!h.XX?fNbreivMysBAhUNx\u003ew=2fNbD=whb!{tvf7egH-m3fK=B:CRI6^dp1uefNbraiaK#$dr6rCv}x.5tvf7egH-m3fK=B:CRH).dp1tQCRyNduODZZwmNzHgH1iuCR-!!h.XX?fNbrcivOkZuODZVfGrP5ek{Uhx(mMil$7gGtvf7egH-m3fK=B:CRI0edp1tJdjEubv{%E?xNteqz/fSrayu*EgbAxHgbq0DCRQ:5CR?9ddLM97fFC4+fNbDjwJsrXjUHX\u003ewmYa+z!a0bwPJl7e[X)uD#-!dD1gV4D#@}pAc#e7v}YC3uTE+$v{@\u003eXwNw!(Cwg@9z*cnICwg@oCYOmqbYWEaD1gV4tRoG1zHuzzz!B90z6iC8y?mWnuuxQ@xjVfgD%Q5gw[=c}wPz:gx(n2rD%Q5gv{%y\u003czZoZptRp5tB98LzbZ-{6e?OV4ut\u003c$dbZ-{cB.LV5bZ-{ex(!wwD%QD7eN\u0026\u003cpy?a/sur/aaB7oc0wH5{yemg8Qf\u003e1PIwhMIOuODZWg+*\u003cBwM@H}CR-!!h.XX?fNbrbi4nbYuODZYhEOQ1gH1iuCR-!!h.XX?fNbrdgauGSdj!*WCR-!!h.XX?fNbrcwHP5VuODZWgY", "ln": 21643, "col": 21644, "line": 1 }, { "b": "dp1tJemg8QgH-m3fK=B:CRI9kdj!*WCR-!!h.XX?fNbrbh7o$Wemg8Qh8c{xfGzpycV\u003c6twPI%4zeZ\u003c-zE[2ml$7gGc[ewcfNbx.hA9s0c[])2i5-o(c[cX{xM4%lcPUP*CR?r!iwrl[uODZXvM3e0vKJ{Pf!^2+t{}cMcV%GwAWJ[PfNbAjvl31$tvf7egH-m3fK=B:CRI6!dp1tJtvf7egH-m3fK=B:CRH)-dp1FLwO#VXx(4v4cPUEqegk1DC2I%-wl9bVB0\u003c1Mt}vvxA+PY9By!9RD2\u003et]tu@^cB7F][p?T(TB7Gzui:k)rj7-RMv@#B6zxJpuCR\u0026}*fEQoZCRIc*wJsiJuODZYhzE3Ev\u003c#+ifNbrhwO0(hjZP)/f/JVPiBTM]CRH)bj7AhDB95KifNbA+vk8jIjZP)/h8)JLc[dk]wPP54fNbxig=F]MjZP)/g?p2GwhWU0fNbrhwO0(ht@#+jc%[VMg?nD$tpic:mnVM@cTw\u003e#j-$TMwObT]wN)lpC42zluOD.ow\u0026RLQf*fb\u003ezEW^5z/c$gfNbuffGrJLdskMyzGx[xuODZYwIvNGh9Ar}vQ\u0026}Ww[L^\u003eyhmT5zF%GlA=VtBC6wgRDo\u003c\u003e+l}6Nnnj=ADoIFnTp/ga?r8($2sxO/Yf!$Kwh8WxMiv=:CcP=cQBrB{ACRRfkgCZ)KcNQDLfNbukfFUQBjTRQduODZWh8nYLi6yR5CRRfkgCZ)suOD.ow\u0026RLQf!uV=CR%4(wIMbac){w)w{503BzkVhc[fH-wPS6nzxHSTfGTXitpjc5wmZ0Yw*Z\u003ejcTp)Ivj9GEjV$wJCRIo(z/NmxwPP54fNbAew[A=bjURamemg8QgCAxJfK#.wfNbDiw?V53emg8Qg=e-LvkQh4CRzi^fNbDiw?V53jZP)/gbHWAvQ@W\u003cv}Yp\u003el3aFWc%[VMg=e-LvkPL=dlz$", "ln": 22717, "col": 22718, "line": 1 }, { "b": "gC{WCuODZZwJjlRhgf^UfNbugggT(Otpi]]vra.NwmX5GcTwccfNbAhwmw$8d\u003e(iRdj)k#viE=%fNbooq/)4]zF9f3w].*blUG[GlVlHDcTwbOCXgLmuODZXfLa=GwiJg9eIIA8dQK(Og+\u0026POf\u003e8E-CS401i:TN=g+\u0026POf\u003e9f$CRyN[uODZZg?FA#i6yR5CR\u0026$=vLP/BcUWEewQ40.cTwccfNbDiw?V53dlz@\u0026z/NmxwPP54fNbrYwIM21jURamemg8Qf\u003eaSIw[j5ifNbuhgCZ*Atpjk#zFa68cTw/vfNbrYwIM21jyo^!f\u003eaSIw[i#gfNbrYwIM21d\u003er5}uODZWiwriFh7H*qb{$h\u003ecONk4d{\u003c#PgbZ{AgC@w:v}Yp\u003elVlHDl3aFWc%[VMf\u003eaYHgb*T^cV\u003co9BAh8kxd3$kfNbradjFEGB8kM2wHy+ieIIA8dlz@#wPS6nzxJF3v@C)?rz(yQz/6DizE)Zcc%[VMgc43zi5JcDElg^\u0026CR\u0026}*fK2]0w\u003eVuEy:SHKuOD.ow\u0026RLQf!uV=CR\u0026}*fK2]Jl%1h7q72TjDWNCLfNbA+h85kZo(JJ#m@{4-jS$$Mt%0EAz/fSrayu*Eh8)JLiat3TfNbA+vk8jItqgpQt@#yECR\u0026}*fK2]3BA7?Up:YJ(jW0daCR}Dth8]4(cmAjPCR\u0026}*fK2]Jl%1h7q72TjDWNCLfNbA+h85kZp\u0026{X/lR]dojZP)/h8)JLiasr#v@DmaBrB{ACR\u0026}*fFWi5uODZYwhM5BcWFfZy/BmVu0yU\u0026CRIc*wJsj9j85pPuODZYwhM4@wJ-gtB-7-3w[=c]wgq\u003enz/fSrayu*EvQRhIf*fb\u003ezEW^5z/c$gfNbrdiwAlFdsleIx(^GaAB}:rCwX^ljZP)/f/7*Af/Q.axLzJ(cR!O-ltyr:t%hyCCRH:6CRyW5CRAzOBzbxftpixHx\u003eqv5cTw(EB-7Yhx(v(qdsl8DBAIRwcViHtq/(C\u0026wHxM/eoCMtB6y1ZxK$gNrWRfocTp)Nv{Bmqh^yO.vQadkfKe\u0026Tvo!4mv{Bmli9ZX=v{BmliA#", "ln": 23567, "col": 23568, "line": 1 }, { "b": "CRRi.CSfbqCRR3VCR%2pCR-/lCR-@pCRQ%TCRSYjCSfdXjafg$fNd5nh.^3\u003ecVB9ABz(nDAaHz5tph{Qp\u0026]A9cTw(EB-7Yhx(v(qdskMyzGx[xuODZWgDvm4vlFHtCox^{xgm5:d0fcpB6y1ZxK$gNrWRf6Bzbxftpjidog%w1cTweLuODZYwhW)KgD/80CRR5", "ln": 24491, "col": 24492, "line": 1 }, { "b": "BzkVhc%[VMhdHbMh8=$hx\u003ew+plt{^UwNPE8EQs^NhdHbMh8=%kA+funA=91bfNbD+v(c54j91[OB-IvxBzbxftpii^AE7G4cTwcxxLzJ(cVJ-?p\u003cl!8t}4\u003c-emg8QvQRhIf\u003cu2AA=l5rBA}?pcTx}7pJpx2qe)%?j.w?Ov@#B6zyw\u003cCCR?ukvk/$\u003eDUdhpc#rEpayu*EgDe+%v(MR9CRyWQfNbrcf!)fGj-\u003evKB6y1!z^2Fxy:SH)cV0vixlm/mt@#yECR.o/fK)78uODZVgbgH[wijcLCR.o/fK)6)d\u003eb*!xLzJ(cR!O-ltyr:u0wW}B-Rjzt{@AQBza(aA=l8rwg7Uho\u003c@cStpjD1zE^W5cTwbHdjD/PfNbrcf!)fGj-\u003evKB6y1!z^2Fxy:SH)cV0vixlm/mt%0EPwPS6nzxJpuCR?ukvk/$\u003cBzbxftpif:t0=$ucTx}gCRAzLjaeUdcNQARB-7Yhx(v\u003e", "ln": 24804, "col": 24805, "line": 1 }, { "b": "CR.lmh!cnVuODZYwhM5BcRXhDs-Fm9t{%5lCR.lmh!cnBemg8Qg?nD$tpj.+s8p\u0026kcTx}-fNbrhwO0(ht%hKGCR.lmh!cnTEpWkowGUtlCR.lmh!cnVuODZYwhM4@wJK{zBAIRwayu*EgD46Gv{}DEw{503BzkVhayu*EiBK)QfK#OsfNbx:gbZ\u003cwdskMyzGx[xuODZZv(DhPfG\u0026+%CR-!!h.XX(uODZVialxdix.ZpvOyMJB0\u003c1XB-7Yhx(v(quODZYv}xaUwgR7wCX5^wvR4nyDVAXtB-IvxuODZYv}xaUwiA7suOD.ohEQ6af/%!mcStk9z/^u/w{4$", "ln": 25267, "col": 25268, "line": 1 }, { "b": "fEOS1f/Z{pElhmRBrB{ACR}Dvw?#CeBAhUNuODZZi5$ObixZ.6CR%2xf!\u003eE*uODZZv(DhPfEOS1f/H)qt{%5lCR-\u003e=hzD{njagQEByP0hA+funA=91qB.\u003e\u003eQEq9pwuODZVialxdiA]\u0026ACR@$\u0026gI5l*fNbrcf!3xRuODZZi5$ObiA]\u0026ACR@$\u0026gI5l*fNbrfw*}1pfNbo2E0/oPCR}Dvw?#CKuODZZv(DhPfEOS1f/rL(t%qQHCRR6:v\u003e]!*A+funA=91qB.\u003e\u003eQx\u003ew=2fNbrivp-}etl", "ln": 25700, "col": 25701, "line": 1 }, { "b": "wItI^CRH%cdp1uefNbrivp-}etvf7ehdFN3wItI^CRH%=dp1w:EpEhkB95KifNbAehE*hKjUHa\u0026krqt6uRJ*+r7fX(q:\u003cbyuQX0\u0026D}lUjo*IYSmn^F\u003emmxQ(q:\u003cbyuR\u003co\u003ek#Qj1o?[bKpFKFGD@9ZjrZxXNuRr*\u003cD@9ZjrZxXNuSfxZm0@64oIv(OuRr*\u003cD@\u0026QcoHR]/q:\u003cbyD@AE3qBKL(ogq#jtr%\u0026AfFbp(t}f92dM}3TdKV]1di{MVx(bzdfNbrgix7IdjUHbCay61]dKXH!eM%?WiBu5wc{G:=moL1pmmf%wrd4UvogqQ6p^F2Us5hZZD@9acq*.IjmmqI$pdm(MpdW*2s3YINmo1U4qBJ#xpe\u003c!JoETgieM%?WiBu5wdo^{1Bx{vVtoEf)t}dlPd\u003e8.%xkG.xB-7Yhx(v(iuODZXgbSP2vKLOqCRR6gf!\u003eHouODZZfGp^$fE.uUz/fSrayu*Eg?nHNf/Im5fNbx.hA9s0emg8Qgg:(Fw\u0026I@2cQ.YsvmR+bw{503BzkVhc%[VMg?5gFh!jEDfNbuji503#emg8Qf!$Qywh2DVA+funA=91bfNbA-f\u003e01Kc%[VMgb]", "ln": 26328, "col": 26329, "line": 1 }, { "b": "wN/ddiass1k6{^TzGx[xuODZVgg\u003e9fh:7I4CR\u0026}*fGS#Xc)q}KCR}ijf!+Q(uODZVgg\u003e9fhZ*w8f/gQlu0yU\u0026CRH%=wO9\u003eHfNbrdh7q/VuODZZh-LwWvM=[ZfNbDliaVVgtvf7ef/0uLw\u0026za(CRIfqdp281jZP)/h840Awh2tSuODZZh-LwWvQ0g[CRH%=wD", "ln": 27026, "col": 27027, "line": 1 }, { "b": "B.8{YuOD.ov{}tRvQ0g[CRH%=wO9\u003eHfNbrih7q/VdsATbElg^\u0026CR?ckv}4h$uODZYwhW)KhZ*w8f/y^ot%f(^fGTF(x(4uec%[VMh8Wj3h8vy5fNbAehE*hKtvf7eg?nHNf/HHmCRH%.dp1uefNbuegbgHudjDA6j-kyUy:\u0026ZBCRS\u0026sfLipGuODZYwhW)KhZ*w8f/JU)t{%5lCRRl*h!uzGuODZZhzO\u00263gG#LTf\u003cMtqfNbDkgg-s0tqgpSt}4\u003cxfNbrgix7Idtvf7eg?nHNf/HHmCRI9idp27\u003cCRzj6xLzo]c%[VMgg:(Fw\u0026K14fNbA+hEXy1c[])2vl2=xc%[VMh8Wj3h8vy5fNbrgix7Idtvf7eg?nHNf/HHmCRH%.dp1uefNbuegbgHudj/vVy?$KHuODZWwNNo8i9P-zCR\u0026}?vLG!\u0026fNbrhvKUOhuODZWiaB)UvjU+tCR}xmwI(nFfNbrTemg8Qh8Wj3h8wC\u003cCRSLNjagZ-zEW^5z/cX8fNbrbf!\u003eU1c%[VMh85C#hd!yDfNbx+hdFQ8dskMyzGx[xuODZ.vkhsNfG\u0026+%CR-!!h.XX(uODZZvLGU[f*f\u003ehq/E20pa58ffNbG:f\u003eAv0c[])2vkxuXemg8QgCJx0f/Im5fNbDevk{bRtvf7ehEOsKiwq\u003cnCRH{kdp1tPtW/yitl", "ln": 27328, "col": 27329, "line": 1 }, { "b": "uODZZf/gQsiA]\u0026ACS5$+wJqB)fNbrigBVQluODZ.vkhsNfEOS1f/-?{t{$4Ew[=6)cPUP*CR-[*v(My#cV\u003cSMwHxJCfNbG:f\u003eAv0c[])2h-SrrcW5{mB.8{YuODZXf\u003eif$h^m$XfKo8Qj7AhDB95KifNbDmf/p)CjZP)/h85C#hd*61fNbG:f\u003eAv0c[])2f/ZW*c[!?mtqY5Eu0x3niybk/n?A!meM#NmyI+UHu3!B.ehYegtW/unj85p", "ln": 27901, "col": 27902, "line": 1 }, { "b": "fEOS1f\u003e00\u0026t{}yKfF1]5v(L]=dlz@/z/fSrayu*Ef/p:wf!$)@fNd7UfNdgXfNbrcehhr6h7QCaf/SD2w{503BzkVhayu*EgDn(Nwml([fNbx:hE*kJdskMyzGx[xuODZZw\u00260{Qv)afMCR-!!h.XX(uOD.lgbSPLj:OLTq:+RDcPU\u003cZzEW^5z/c$gfNbD!gb7ZCemg8QgDvlEvQ{{mA+funA=91bfNbD!gb7ZCjV$@nfNbxlgC-GJjaeUcs8h+ImKHleB-7W", "ln": 28450, "col": 28451, "line": 1 }, { "b": "cPU\u003cZzEW^5z/c$gfNbDeh8c%Cemg8Qh8eSJh8uXdA+funA=91bfNbDeh8c%CeNHhRh8eSJh8vsxegi+@ph\u003c\u003e]i+AILv@#B6zyw\u003cCCRRi!w\u0026RQ$uODZVv(chTgavM\u003cwPS6nzxJpuCRRi!w\u0026RReuODZVv(cg", "ln": 28789, "col": 28790, "line": 1 }, { "b": "CRI6ndp1uefNbxkgHT\u0026NdlP*SuODZVh8!#5wM@H}CR%7?v(E)CfNbrfi4nbYfNbo5uODZXf/AM0wgoP*w{503BzkVhayu*EggK-Dh83B=fNbxfg=n(1emg8QhdXNNv\u003e/AVv@DmaBrB{ACR\u003c2vgbiu6uODZXvM3e0vK$\u003euCRJ.*h!B*dDNADBv}GZdi+AILv@#B6zyw\u003cCCR-}/h.WixuODZVh83%ywHR$DwPS6nzxJpuCR-}/h.WiNuODZVh83%ywJLq\u003ecUdk", "ln": 30314, "col": 30315, "line": 1 }, { "b": "CR?l!ixgRluODZZwmNzHgH1iuCR-}(iaj={fNbrbgauGSuODZWi5Un4fF4L#CwhejmRMWIrc-B]B0\u003c0(aZnl2dlz@/vru0)DVAXtB-IvYEp1WMh90POgg\u00263!j7-zKc$vgkB95KifNbD-w\u0026qz3aA7\u003cmuODZYg?eK9w*@7pz/fSrayu*Egb7BxvkQhPfNbuff/p?1tl", "ln": 32360, "col": 32361, "line": 1 }, { "b": "fNbA^hF3AfdpWplBzkSnwJKlMCR@[!w[A?Hd\u003eAtWtRoP9B$W6bfNbx=ixgCbc[])2hEXavc%[VMhdp8PgbJixfNbx=ixgCbc[])2h83E+djcxGfNbDfg+*WAtvf7egIeTbvk]U?CRH)jdp3d+fNbx=ixgCbc[])2iC6ZCd0)sNx(4udi:TN=gb7BxvkPO-v@DmbwO#Pqi:TN=g?FTSwmO[KfNbx=ixgCbc[])2vk/Svc[])1ehhr6gDmuyEjlZOfNbAdwhc23tvf7egIeTbvk]U?CRI3edp1uefNbxehdOQOemg8Qg?FTSwmNk#fNbubf/SP0dj!*WCR?9+f/I0{uODZXw\u0026R?Vi4cF9f/gNkt(", "ln": 32826, "col": 32827, "line": 1 }, { "b": "gBK@4f/g*rt{%5lCR-[=g?eJ%uODZVix7w4vK%iTfEY8idj!*WCR}ijf!+Q(uODZXvM3e0vKJ{Pf/rC\u0026t%hKGCR@[!w[A?IuODZZf/gQsiA]\u0026ACR-!!h.XX?fNbrhhZ@2}uODZZix5(Lw?mpyCR}ijf!+Q(uODZXvM3e0vKJ{Pf/9q*t%i7pCoxpZBy=\u003cHtvf7egH-m3fK=B:CRIfpdp1tJj7ihQzET/3B-7Yhx(v(iuODZZv\u003e?NMi4eb/CR}f!v(m:EuOD.pvk6O@h7r(Zz/fSrayu*EgbR6Eg=dv5fNbx.hu", "ln": 33416, "col": 33417, "line": 1 }, { "b": "w?#h7EjM:DBXcascPUP*CRRcpgbH*ofNbreh7p77m}(NCpBwhgfNbugiwJAFc[])2iBKv+j91[OB-IvxuODZZf/9u0h^oSyCRRcpgbH*ofNbrchyR]Ww[u6]xE)HACR}iiwh=CKuODZWh90AGg:\u003e55f!\u003eQot{%5lCR}iiwh=CKuODZWh90AGg:\u003e55f/.cvt{%5lCR}iiwh=CKuODZWh90AGg:\u003e55f/.cvt{%5lCR}iiwh=CKuODZWh90AGg:\u003e55f/.cvt{%5lCR}iiwh=CKuODZWh90AGg:\u003e55f/.cvt{%5lCR}iiwh=CKuODZWh90AGg:\u003e55f!\u003eEkt}xtpCR\u0026}!hzv6semg8QgbR6Eg=cQmCRI0gdjD!", "ln": 33888, "col": 33889, "line": 1 }, { "b": "cPU\u003cZzEW^5z/c$gfNbxZwJjlPemg8Qf\u003eK#Ow[AGsA+funA=91bfNbxZwJjlPeNHhRf\u003eK#Ow[BbMegjn8B9qsDi+AILv@#B6zyw\u003cCCR\u003c1)w?^:CuOD.khE!BMh7r()wPS6nzxJpuCR\u003c1)w?^:yuOD.khE!A", "ln": 34601, "col": 34602, "line": 1 }, { "b": "uODZYhzNg0h.ek?CR%4)wN^UXEsjh0A^r1Cw*!*ffNbD^gC\u0026V4dskMyzGx[xuODZVw))IMfG\u0026\u0026*vqf*auODZXgD3{@w)nQ@CRI6ohAiMxfNbrghZ@2Xw[u6]xE)HACR.clfK!S#uODZVh90MOh7ge6f/SU(t{%5lCR.clfK!S#uODZVh90MOh7ge6f/SU(t{%5lCR.clfK!S#uODZVh90MOh7ge6f/R0st}onoCR\u0026}!hzv6vuODZXgD3{@w)nQ@CRI6ohAiMxfNbrgvjtFhd{\u003c#PhdFKNwN^n#fNbxfhzwPLtvf7ef/p%Hi5J9rCRH)gdp1wKemg8Qh8Ej1fL9yQCvticayu*Ef\u003eK\u0026Jg+-cvfNbrfiw@?", "ln": 35603, "col": 35604, "line": 1 }, { "b": "fNbDfg+*WAtvf7ef/p%Hi5J9rCRI6ldp3d+fNbrfiw@\u0026Oc[])2hd!pydsATbv@DmaBrB{ACR.f!f\u003eA75zE[2mmSir:l$7gCc[dk+fNbxgwhdTItvf7ef/p%Hi5J9rCRIildp1uefNbxfhzwPLtvf7ef/p%Hi5J9rCRI3mdp1GifNbD^gC\u0026V4dj!*WCR.f!f\u003eA7zuODZVh90MOh7ge6f/.0rt{%5lCR.clfK!S#uODZVh90MOh7ge6f!+Knt}x(8Ck", "ln": 36901, "col": 36902, "line": 1 }, { "b": "c[])2i5@A[d\u003c([@ejr]*wM@H}CRI6ohAiMxfNbrdf!3xRdjD/PfNbrfiw@\u0026Oc[])2gH.^Zdj![Kvqf*auODZXgD3{@w)nQ@CRI6ohAiMxfNbrcvjtFgw[u6]xE)HACR.clfK!S#uODZVh90MOh7ge6f/7Hjt{%5lCR.clfK!S#uODZVh90MOh7ge6f/z0ut{%5lCR.clfK!S#uODZVh90MOh7ge6f/SU(t{%5lCR.clfK!S#uODZVh90MOh7ge6f!+Elt{%5lCRI6ohAiMxfNbreh7p7-fNbA+gD3{Cdj!*WCR.clfK!S#uODZVh90MOh7ge6f/AC?t}4sifNbD+hEZlcdj!*WCRI6ohAiMxfNbrdi4lpcDNAVwBzbP6cPUP*CRI6ohAiMxfNbrhwgo5SvSb!5cPUP*CR.f!f\u003eA7/dlz@/vru0)c%[VMgIev4v(bSYEsiK)djEs", "ln": 37298, "col": 37299, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "_0xea8397" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "parseInt" ], [ "", "_0x512fc9" ], [ "", "_0x228113.push" ], [ "", "_0x228113.shift" ], [ "", "_0x228113.push" ], [ "", "_0x228113.shift" ], [ "", "_0x5875" ], [ "", "_0x1f4606" ], [ "", "_0x317c02" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x21d1b6" ], [ "", "_0x7db784" ], [ "", "require" ], [ "", "require" ], [ "", "_0x3b670b" ], [ "", "require" ], [ "", "require" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "Map" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "String" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "_0x3b670b" ], [ "", "Date" ], [ "", "_0x5875" ], [ "", "_0x2408bd.charAt" ], [ "", "_0x252dc8.charCodeAt" ], [ "", "String.fromCharCode" ], [ "", "_0x4e0b25.indexOf" ], [ "", "_0x263335.charCodeAt.toString" ], [ "", "_0x263335.charCodeAt" ], [ "", "decodeURIComponent" ], [ "", "RegExp" ], [ "", "_0x2393da.test" ], [ "", "Boolean" ], [ "", "Math.round" ], [ "", "Math.random" ], [ "", "_0x470a73" ], [ "", "_0xba711.GjPtML" ], [ "", "_0xba711" ], [ "", "_0x4d50.MfLYql" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x5c73e0" ], [ "", "_0x4b1a7d" ], [ "", "_0x59b3d6" ], [ "", "_0x12fef7" ], [ "", "_0x12fef7" ], [ "", "_0x12fef7" ], [ "", "_0x12fef7" ], [ "", "_0x12fef7" ], [ "", "_0x12fef7" ], [ "", "_0x12fef7" ], [ "", "_0x12fef7" ], [ "", "_0x4d6b17" ], [ "", "_0x4d6b17" ], [ "", "_0x4d6b17" ], [ "", "_0x4d6b17" ], [ "", "_0x4d6b17" ], [ "", "_0x4d6b17" ], [ "", "_0x4d6b17" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x6a1e90" ], [ "", "_0x4d8363" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x5f3c7c" ], [ "", "_0x3775ea" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x4fa21e" ], [ "", "_0x8bb1e2" ], [ "", "_0x3a3828" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3e14c9" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x3f98a8" ], [ "", "_0x2ca050" ], [ "", "_0x39ea85" ], [ "", "_0x4a7df3" ], [ "", "_0x4a7df3" ], [ "", "Date" ], [ "", "_0x32c4c1" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x259244" ], [ "", "_0x444244" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x4f9f1b" ], [ "", "_0x2c7b64" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x5b50c3" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "_0x159685" ], [ "", "FormData" ], [ "", "Blob" ], [ "", "fs" ], [ "", "os" ] ], "mbr": [ "Math.random", "Math.round", "String.fromCharCode", "_0x228113.push", "_0x228113.shift", "_0x2393da.test", "_0x2408bd.charAt", "_0x252dc8.charCodeAt", "_0x263335.charCodeAt", "_0x263335.charCodeAt.toString", "_0x263335.length", "_0x4d50.MfLYql", "_0x4d50.MpEQGs", "_0x4d50.PtqdCP", "_0x4d50.zDWlTQ", "_0x4e0b25.indexOf", "_0x5aaac3.id", "_0xba711.GjPtML", "_0xba711.prototype", "_0xba711.prototype.GjPtML", "_0xba711.prototype.OqqzQq", "_0xba711.prototype.mKipkp" ], "tgt": [ "Blob", "Boolean", "Date", "FormData", "Map", "Math.random", "Math.round", "RegExp", "String", "String.fromCharCode", "_0x12fef7", "_0x159685", "_0x1f4606", "_0x21d1b6", "_0x228113.push", "_0x228113.shift", "_0x2393da.test", "_0x2408bd.charAt", "_0x252dc8.charCodeAt", "_0x259244", "_0x263335.charCodeAt", "_0x263335.charCodeAt.toString", "_0x2c7b64", "_0x2ca050", "_0x317c02", "_0x32c4c1", "_0x3775ea", "_0x39ea85", "_0x3a3828", "_0x3b670b", "_0x3e14c9", "_0x3f98a8", "_0x444244", "_0x470a73", "_0x4a7df3", "_0x4b1a7d", "_0x4d50.MfLYql", "_0x4d6b17", "_0x4d8363", "_0x4e0b25.indexOf", "_0x4f9f1b", "_0x4fa21e", "_0x512fc9", "_0x5875", "_0x59b3d6", "_0x5b50c3", "_0x5c73e0", "_0x5f3c7c", "_0x6a1e90", "_0x7db784", "_0x8bb1e2", "_0xba711", "_0xba711.GjPtML", "_0xea8397", "decodeURIComponent", "parseInt", "require" ], "funcs": [ [ "anonymous", 25 ], [ "_0x5875", 578 ], [ "anonymous", 20317 ], [ "anonymous", 20382 ], [ "anonymous", 20419 ], [ "anonymous", 20475 ], [ "anonymous", 20624 ], [ "anonymous", 20700 ], [ "anonymous", 20754 ], [ "anonymous", 21735 ], [ "_0x4d50", 22970 ], [ "anonymous", 23143 ], [ "anonymous", 23321 ], [ "anonymous", 24237 ], [ "anonymous", 24326 ], [ "anonymous", 24562 ], [ "anonymous", 24800 ], [ "anonymous", 24933 ], [ "anonymous", 25179 ], [ "_0x9a8a0d", 25387 ], [ "anonymous", 25462 ], [ "anonymous", 25531 ], [ "anonymous", 25625 ], [ "_0x325d6b", 26659 ], [ "anonymous", 26744 ], [ "anonymous", 26832 ], [ "anonymous", 26901 ], [ "anonymous", 27012 ], [ "_0x578eeb", 27110 ], [ "_0x11118f", 27722 ], [ "_0x38cbda", 28514 ], [ "anonymous", 28588 ], [ "anonymous", 28657 ], [ "anonymous", 28724 ], [ "anonymous", 28791 ], [ "anonymous", 28858 ], [ "anonymous", 28925 ], [ "anonymous", 29013 ], [ "anonymous", 29105 ], [ "_0x2ca050", 30378 ], [ "anonymous", 30463 ], [ "anonymous", 30530 ], [ "anonymous", 30598 ], [ "anonymous", 30666 ], [ "anonymous", 30733 ], [ "_0x4d9612", 31746 ], [ "_0x3e14c9", 31986 ], [ "anonymous", 32071 ], [ "anonymous", 32138 ], [ "anonymous", 32206 ], [ "_0x197a2b", 33218 ], [ "anonymous", 33275 ], [ "_0x5c1f58", 33589 ], [ "anonymous", 33680 ], [ "anonymous", 33768 ], [ "anonymous", 33835 ], [ "anonymous", 34338 ], [ "anonymous", 34393 ], [ "anonymous", 34461 ], [ "anonymous", 34603 ], [ "anonymous", 34670 ], [ "anonymous", 34738 ], [ "anonymous", 34851 ], [ "anonymous", 34918 ], [ "anonymous", 34985 ], [ "anonymous", 35252 ], [ "anonymous", 35344 ], [ "anonymous", 35432 ], [ "anonymous", 35499 ], [ "anonymous", 35566 ] ], "metrics": { "ast": { "op.eq": 15, "op.ge": 3, "op.gt": 3, "op.le": 1, "op.lt": 5, "op.ne": 6, "op.add": 41, "op.div": 10, "op.lor": 2, "op.mod": 2, "op.mul": 7, "op.shr": 1, "op.sub": 15, "op.band": 2, "op.bnot": 2, "op.land": 11, "op.lnot": 17, "max_depth": 37, "call_count": 500, "node_count": 8667, "member_count": 22, "max_array_len": 170, "op_density.eq": 0, "op_density.ge": 0, "op_density.gt": 0, "op_density.le": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.mod": 0, "op_density.mul": 0, "op_density.shr": 0, "op_density.sub": 0, "sequence_count": 11, "op_density.band": 0, "op_density.bnot": 0, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 16, "member_depth_max": 3, "max_numeric_array": 5, "infinite_loop_count": 1, "const_return_function_count": 4, "const_return_function_ratio": 0.06, "string_return_function_count": 1, "string_return_function_ratio": 0.01 }, "file": { "size": 37665, "entropy": 5.88 }, "text": { "lines": 1, "top_char": 48, "max_ws_run": 1, "digit_ratio": 0.27, "space_count": 169, "char_entropy": 5.88, "unique_chars": 91, "top_char_null": 0, "escape_density": 0.1, "lines_over_200": 1, "lines_over_500": 1, "string_density": 343, "top_char_ratio": 0.06, "avg_line_length": 37665, "lines_over_1000": 1, "max_line_length": 37665, "hex_escape_count": 38, "last_line_length": 37665, "long_token_count": 54, "whitespace_ratio": 0, "identifier_density": 1056, "encoded_string_ratio": 0.03, "normalized_string_count": 343 }, "binds": { "count": 122 }, "binary": { "peak_region_bytes": 12288, "peak_region_entropy": 5.72 }, "source": { "function_count": 9 }, "imports": { "count": 2, "stdlib_count": 2, "stdlib_ratio": 1 }, "strings": { "bytes": 20159, "count": 343, "very_long": 1, "avg_length": 58.77, "max_length": 17487, "avg_entropy": 2.59, "empty_count": 6, "entropy_stddev": 0.78, "base64_candidates": 12, "high_entropy_count": 3 }, "functions": { "count": 9, "nested": 16, "density": 7000, "anonymous": 61, "avg_params": 1.63, "code_ratio": 70, "max_params": 3, "one_liners": 70, "avg_name_length": 8.56, "no_params_count": 14, "avg_length_lines": 1, "max_length_lines": 1, "min_length_lines": 1, "avg_nesting_depth": 0.86, "max_nesting_depth": 2, "numeric_suffix_names": 1, "avg_param_name_length": 9 }, "identifiers": { "count": 1056, "unique": 253, "avg_length": 8.82, "max_length": 18, "min_length": 3, "avg_entropy": 2.86, "reuse_ratio": 0.24, "length_stddev": 1.05, "has_digit_ratio": 0.94, "all_lowercase_ratio": 0.02, "all_uppercase_ratio": 0, "numeric_suffix_count": 164, "underscore_prefix_count": 237 } } }, "id": 1, "mol": "O₂(As₄Eu)H₅(Cm₃CrDb₉FOs)Md₂(In₂)Th", "path": "dotenv-precheck-1.0.0.tgz!!package/index.js", "pid": 0, "risk": 90, "sha": "1af2d92d8f6bdcbe104f1072e6047fdfb6cd588b591fe3a012ffc34359e660e7", "size": 37665, "traits": [ { "id": "metadata/import/npm/fs::fs", "conf": 0.95, "crit": 3, "desc": "imports fs", "spans": [ [ 21180, 2 ] ] }, { "id": "metadata/import/npm/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 21240, 2 ] ] }, { "id": "metadata/file/encoded::large-base64-like-literal", "conf": 0.8, "crit": 3, "desc": "Large Base64-like string literal", "spans": [ [ 956, 128 ] ] }, { "id": "metadata/import/builtin::require-fs", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js fs module", "spans": [ [ 21172, 0 ] ] }, { "id": "metadata/import/builtin::require-os", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js os module", "spans": [ [ 21232, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 0, 0 ], [ 23372, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 0, 0 ], [ 20695, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/computed::js-fetch-computed-helper-argument", "conf": 0.93, "crit": 3, "desc": "Fetch API passed to computed helper", "spans": [ [ 33952, 103 ], [ 35667, 103 ], [ 37362, 103 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/key::private-key-identifier", "conf": 0.75, "crit": 3, "desc": "Private-key identifier", "spans": [ [ 0, 11 ], [ 26445, 11 ] ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-function-derived-computed-call", "conf": 0.9, "crit": 3, "desc": "Calls computed member from function result", "spans": [ [ 20549, 19 ], [ 20853, 19 ], [ 20881, 19 ], [ 20901, 19 ], [ 20921, 19 ], [ 20997, 19 ], [ 21064, 19 ], [ 21298, 19 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors", "spans": [ [ 22020, 2 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression", "spans": [ [ 0, 4 ], [ 37659, 4 ] ] }, { "id": "micro-behaviors/data/decode/base64::lower-first-base64-alphabet", "conf": 0.9, "crit": 3, "desc": "JavaScript embeds a lower-first Base64 alphabet", "spans": [ [ 23180, 65 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "spans": [ [ 0, 7 ], [ 27965, 7 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::content-object-field", "conf": 0.8, "crit": 3, "desc": "JSON content object field", "spans": [ [ 0, 10 ], [ 32977, 10 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::host-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like host identity field", "spans": [ [ 0, 7 ], [ 22812, 7 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "spans": [ [ 0, 7 ], [ 22849, 7 ] ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster", "conf": 0.86, "crit": 3, "desc": "Dense computed-property call cluster (3+)", "spans": [ [ 458, 18 ], [ 476, 19 ], [ 20540, 28 ], [ 20844, 28 ], [ 20872, 28 ], [ 20968, 28 ], [ 21292, 25 ], [ 21707, 28 ] ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-decoder-call-prefix", "conf": 0.9, "crit": 3, "desc": "Computed call uses a decoder function", "spans": [ [ 20540, 28 ], [ 20844, 28 ], [ 20872, 28 ], [ 20968, 28 ], [ 21292, 25 ], [ 21707, 28 ], [ 21791, 28 ], [ 21819, 28 ] ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-member-variable-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns through a computed JavaScript member", "spans": [ [ 0, 11 ], [ 23981, 11 ], [ 24138, 11 ], [ 24270, 11 ], [ 25331, 11 ], [ 33480, 11 ], [ 33518, 11 ] ] }, { "id": "micro-behaviors/data/source/property/computed::js-nested-concat-this-call", "conf": 0.94, "crit": 3, "desc": "Nested this-concat calls a computed member", "spans": [ [ 0, 20 ], [ 24868, 20 ] ] }, { "id": "micro-behaviors/data/source/syntax/array::shift-string-literal", "conf": 0.6, "crit": 3, "desc": "String literal names the shift method", "spans": [ [ 487, 5 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "spans": [ [ 23856, 29 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 0, 8 ], [ 23892, 8 ] ] }, { "id": "micro-behaviors/fs/build-artifacts::compiled-artifact-cleanup", "conf": 1.0, "crit": 3, "desc": "Deletes only compiled/cache build artifacts", "spans": [ [ 0, 11 ], [ 22103, 11 ] ] }, { "id": "micro-behaviors/time/query::js-triple-new-date", "conf": 0.4, "crit": 3, "desc": "3+ new Date() calls", "spans": [ [ 0, 9 ], [ 22781, 9 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0xff hex byte token", "spans": [ [ 0, 4 ], [ 23654, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-mangled-bracket-rotation", "atk": "T1027.002", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Mangled array self-rotates via bracket access", "spans": [ [ 0, 34 ], [ 458, 34 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-mangled-parseint-rotation-guard", "atk": "T1027.002", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Mangled parseInt checksum drives rotation loop", "spans": [ [ 0, 41 ], [ 101, 41 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "spans": [ [ 0, 10 ], [ 26493, 10 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::js-secret-key-name", "atk": "T1027.013", "mbc": "B0032", "conf": 0.75, "crit": 3, "desc": "Secret key identifier", "spans": [ [ 0, 10 ], [ 26493, 10 ] ] }, { "id": "objectives/credential-access/wallet/keywords::private-key-word", "conf": 0.5, "crit": 3, "desc": "privateKey credential field reference", "spans": [ [ 22936, 11 ] ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-mnemonic-token", "atk": "T1041", "conf": 0.9, "crit": 1, "desc": "Node MNEMONIC token", "spans": [ [ 0, 0 ], [ 26436, 0 ] ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-seed-phrase-token", "atk": "T1041", "conf": 0.9, "crit": 3, "desc": "Node SEED_PHRASE token", "spans": [ [ 0, 11 ], [ 26424, 11 ] ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-wallet-key-token", "atk": "T1041", "conf": 0.9, "crit": 3, "desc": "Node WALLET_KEY token", "spans": [ [ 0, 10 ], [ 26470, 10 ] ] }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "spans": [ [ 0, 37665 ] ] }, { "id": "metadata/file/naming::numeric-suffix-identifiers", "conf": 0.75, "crit": 3, "desc": "At least 100 numeric-suffixed identifier names" }, { "id": "micro-behaviors/communications/http/form::formdata-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Constructs browser FormData", "spans": [ [ 0, 13 ], [ 36965, 13 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "spans": [ [ 0, 19 ], [ 25778, 19 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "spans": [ [ 0, 18 ], [ 37641, 18 ] ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "spans": [ [ 23631, 19 ] ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-date-method-call", "conf": 0.82, "crit": 3, "desc": "Calls a Date method through bracket notation", "spans": [ [ 0, 23 ], [ 21987, 23 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-near-zero-whitespace", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JavaScript near-zero whitespace" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Last line is over 1000 chars" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Exactly one line exceeds 1000 chars" }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-function-names", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Hex-prefixed function names (_0x pattern)", "spans": [ [ 0, 17 ], [ 578, 17 ], [ 22970, 17 ], [ 25387, 19 ], [ 26659, 19 ], [ 27722, 19 ], [ 28514, 19 ], [ 30378, 19 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-variable-names", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Hex-prefixed variable names (_0x pattern)", "spans": [ [ 0, 16 ], [ 55, 16 ], [ 117, 16 ], [ 597, 16 ], [ 20365, 16 ], [ 20393, 14 ], [ 20449, 16 ], [ 20486, 16 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::push-shift-bracket-pattern", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Bracket-notation push/shift self-rotation", "spans": [ [ 0, 39 ], [ 458, 39 ] ] }, { "id": "objectives/credential-access/wallet/keywords::seed-phrase-word", "conf": 0.5, "crit": 3, "desc": "seedPhrase credential field reference", "spans": [ [ 0, 128 ], [ 22953, 10 ] ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "uses": [ 35 ], "spans": [ [ 0, 37665 ] ] }, { "id": "micro-behaviors/data/decode/base64::base64-alphabet", "conf": 0.9, "crit": 3, "desc": "JavaScript embeds a Base64 alphabet", "uses": [ 12 ], "spans": [ [ 23180, 65 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::host-user-field-pair", "conf": 0.9, "crit": 3, "desc": "JSON-like host and user identity fields", "uses": [ 15, 16 ], "spans": [ [ 0, 7 ] ] }, { "id": "micro-behaviors/os/module/require::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "uses": [ 3, 4 ], "spans": [ [ 21232, 7 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::javascript-obfuscator-string-array-runtime", "atk": "T1027.002", "mbc": "B0032", "conf": 0.96, "crit": 4, "desc": "JavaScript Obfuscator rotates and decodes a string array at runtime", "uses": [ 27, 28 ], "spans": [ [ 0, 34 ], [ 101, 41 ], [ 458, 34 ] ] }, { "id": "objectives/exfiltration/stealer/credential/multi-source::node-dev-secret-regex-list", "atk": "T1041", "conf": 0.94, "crit": 4, "desc": "Node developer secret regex list", "uses": [ 8, 32, 33, 34 ], "spans": [ [ 0, 8 ] ] }, { "id": "micro-behaviors/communications/http/post::post-form", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP form submission encoding", "uses": [ 37 ], "spans": [ [ 0, 13 ], [ 36965, 13 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-name-mangling", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Hex-prefixed identifier names (obfuscation)", "uses": [ 45, 46 ], "spans": [ [ 0, 16 ], [ 55, 16 ], [ 117, 16 ], [ 578, 17 ], [ 597, 16 ], [ 20365, 16 ], [ 20393, 14 ], [ 20449, 16 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::any-name-mangling", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Obfuscator-style name mangling", "uses": [ 56 ], "spans": [ [ 0, 16 ], [ 55, 16 ], [ 117, 16 ], [ 578, 17 ], [ 597, 16 ], [ 20365, 16 ], [ 20393, 14 ], [ 20449, 16 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-name-mangling-with-string-table-rotation", "atk": "T1027.002", "mbc": "B0032", "conf": 0.94, "crit": 3, "desc": "Hex-named string-table decoder", "uses": [ 47, 56 ], "spans": [ [ 0, 16 ], [ 55, 16 ], [ 117, 16 ], [ 458, 39 ], [ 578, 17 ], [ 597, 16 ], [ 20365, 16 ], [ 20393, 14 ] ] }, { "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::obfuscated-base64-codec", "atk": "T1027.002", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Obfuscated JavaScript embeds a Base64 alphabet", "uses": [ 50, 57 ], "spans": [ [ 0, 16 ], [ 55, 16 ], [ 117, 16 ], [ 578, 17 ], [ 597, 16 ], [ 20365, 16 ], [ 20393, 14 ], [ 20449, 16 ] ] }, { "id": "third_party/SigBase/SUSP/Obfuscated/JS/Obfuscatorio", "conf": 0.9, "crit": 3, "desc": "Detects JS obfuscation done by the js obfuscator (often malicious)", "spans": [ [ 101, 11 ], [ 134, 11 ], [ 197, 11 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rb5Q?awG\u003ceTb4LRlwO#VyAb]J1xK$W?a$K6zar\u003e#uA=U@kzx.a:a#7Y7e?!F23lQDnwmY*(A+PGmx(v(kiV]RAB-8mywn=N3zGWdwA+e\u003c0x\u003eIa3ay/7@v@3cdvrrSazGx]dy?$kox(dA9ed9Hxb5H+5zx.a:b57}9wQ2?xB0rdxarR\u003eHv@=p5BAnS!aBsCrarR^JAbP/tx(n0lvqG:7iV]R:z!9A4x(mD)CRi-La{]CnEjLZFar\u003ePjD3sgEwoe}Qax]f}arR^Jwn=N3zGWiP3lQDlar\u003exmB%nEAarR^Hb5?Nlw]8f]xMLBH3lQDlar\u003exmC4\u003e#nzF-%5BrR5maycJ9arR\u003eAx\u003e7Z(B7DKRar\u003cJKr3zV$3i", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 297, "entropy": 4.43 }, "binary": { "peak_region_bytes": 297, "peak_region_entropy": 4.43 } } }, "id": 2, "ident": { "name": { "value": "dotenv-precheck", "source": "npm.name", "verified": false }, "trust": "unsigned", "version": { "value": "1.0.0", "source": "npm.version", "verified": false }, "identifier": { "value": "dotenv-precheck", "source": "npm.name", "verified": false } }, "mol": "O₂(S₃Xe)H(Po)Md(Pa₂)", "path": "dotenv-precheck-1.0.0.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "index.js", "off": 129, "file": 1, "kind": "local" } ], "risk": 8, "sha": "00cb566f2d24458eb5210b8d61f12a998ce490c13d186e70740a6be6923bda32", "size": 297, "traits": [ { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field", "spans": [ [ 0, 21 ] ] }, { "id": "supply-chain/new-package-with-hooks", "conf": 0.6, "crit": 3, "desc": "Version 1.0.0 package with install hooks (common malware pattern)", "spans": [ [ 33, 32 ] ] }, { "id": "supply-chain/install-hook/postinstall", "conf": 0.8, "crit": 3, "desc": "Package has 'postinstall' hook that runs during install", "spans": [ [ 159, 13 ] ] }, { "id": "metadata/package/entrypoint::main-root-javascript-entry", "conf": 0.9, "crit": 2, "desc": "Root JavaScript main entrypoint", "spans": [ [ 120, 0 ] ] }, { "id": "metadata/package/files/included::npm-publish-root-manifest", "conf": 0.95, "crit": 2, "desc": "Manifest sits at npm publish root" }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json" }, { "id": "metadata/package/versioning/sentinel::npm-version-exactly-1-0-0", "atk": "T1195.002", "conf": 0.6, "crit": 3, "desc": "npm package version is exactly 1.0.0", "spans": [ [ 33, 5 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/import-chain::scripts-postinstall-executor-node", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "postinstall invokes node", "spans": [ [ 159, 13 ] ] }, { "id": "metadata/package/versioning/scheme::mature-version", "conf": 0.7, "crit": 2, "desc": "Major version is 1 or higher", "spans": [ [ 33, 0 ] ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter", "spans": [ [ 142, 13 ] ] }, { "id": "objectives/execution/interpreter/script/npm::npm-postinstall-script", "conf": 1.0, "crit": 3, "desc": "Declares an npm postinstall lifecycle hook", "spans": [ [ 159, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::postinstall-hook-key", "conf": 0.85, "crit": 3, "desc": "Declares a package postinstall hook", "spans": [ [ 159, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::postinstall-runs-node-script", "conf": 0.92, "crit": 3, "desc": "Postinstall targets local Node.js file", "spans": [ [ 159, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/declaration::has-postinstall", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Has postinstall script hook", "spans": [ [ 159, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/scripts/declaration::postinstall-hook-declaration", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Package declares a postinstall hook", "spans": [ [ 159, 13 ] ] }, { "id": "metadata/package/scripts/lifecycle::install-hooks", "conf": 1.0, "crit": 1, "desc": "Package has install hooks", "uses": [ 13 ], "spans": [ [ 159, 0 ] ] }, { "id": "metadata/package/scripts/lifecycle::versioned-install-hook-without-source-repository", "conf": 0.9, "crit": 3, "desc": "Versioned install-hook package lacks declared source repository", "uses": [ 8, 15 ], "spans": [ [ 33, 5 ], [ 159, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::version-1-0-0-with-hooks", "conf": 0.75, "crit": 3, "desc": "Version 1.0.0 with install hooks", "uses": [ 6, 15 ], "spans": [ [ 33, 5 ], [ 159, 13 ] ] }, { "id": "objectives/supply-chain/install-hook/package/manifest::versioned-install-hook-without-source-repository", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Versioned install-hook package lacks a declared source repository", "uses": [ 8, 15 ], "spans": [ [ 33, 5 ], [ 159, 13 ] ] } ], "type": "package.json" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 794, "entropy": 4.7 }, "binary": { "peak_region_bytes": 794, "peak_region_entropy": 4.7 }, "registry": { "age_days": 0, "file_count": 2, "maintainers": 1, "published_at": 1790690384, "releases_24h": 3, "releases_48h": 3, "is_deprecated": 0, "release_count": 3, "security_hold": 0, "unpacked_size": 37962, "version_removed": 0, "package_age_days": 0, "first_published_at": 1790690384, "has_install_script": 0, "publisher_in_maintainers": 1 } } }, "id": 3, "mol": "Md(Re)", "path": "dotenv-precheck@1.0.0.registry.json", "pid": 0, "rel": "registry", "risk": 1, "role": "sidecar", "sha": "fce6d222837cf8c6f292cfdad1ad1f2d04f00c9b078a55276e835bcfae7f30cb", "size": 794, "traits": [ { "id": "metadata/registry::brand-new-package", "conf": 1.0, "crit": 3, "desc": "Package first published within seven days" }, { "id": "metadata/registry::few-releases", "conf": 1.0, "crit": 3, "desc": "Three or fewer releases" }, { "id": "metadata/registry::publish-burst-24h", "conf": 1.0, "crit": 3, "desc": "Three releases published within 24 hours" }, { "id": "metadata/registry::publish-burst-48h", "conf": 1.0, "crit": 3, "desc": "Three releases published within 48 hours" }, { "id": "metadata/registry::recent-package", "conf": 1.0, "crit": 3, "desc": "Package under two months old" }, { "id": "metadata/registry::single-maintainer", "conf": 1.0, "crit": 3, "desc": "Registry package lists one maintainer" }, { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Release published within seven days" }, { "id": "metadata/registry::new-package-publish-burst", "conf": 0.6, "crit": 3, "desc": "Brand-new package with publish burst", "uses": [ 0, 2 ] } ], "type": "registry" } ], "rev": "c1ea9", "v": "8" } }