{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000014086564, "rte": "az", "prob": 0.000014086564 }, { "cls": 0, "raw": 0.00035919747, "rte": "az/tar", "prob": 0.00035919747 } ], "prob": 0.000014086564, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000014086564078752417, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010848045349121094, "type": "src_info" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000010361273780290503, "type": "shell" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000010033448234025855, "type": "registry" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000010033448234025855, "type": "registry" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000010033448234025855, "type": "registry" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000010033448234025855, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-14T11:13:55Z" }, "path": "firefox-nightly-bin-158.0a1.20260913.212439-1.src.tar.gz", "raw": { "fetched": [ { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/gtk3", "outcome": "unresolved", "fetched_at": 0, "source_offset": 321, "source_sha256": "611e14f7b4eb6cbc68364aca1f1ee68050f5497c721f43f585c7489b4c0e1497" }, { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/nss", "outcome": "unresolved", "fetched_at": 0, "source_offset": 354, "source_sha256": "611e14f7b4eb6cbc68364aca1f1ee68050f5497c721f43f585c7489b4c0e1497" }, { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/mime-types", "outcome": "unresolved", "fetched_at": 0, "source_offset": 369, "source_sha256": "611e14f7b4eb6cbc68364aca1f1ee68050f5497c721f43f585c7489b4c0e1497" }, { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/python", "outcome": "unresolved", "fetched_at": 0, "source_offset": 391, "source_sha256": "611e14f7b4eb6cbc68364aca1f1ee68050f5497c721f43f585c7489b4c0e1497" } ], "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zN\u003e(Vi-WME1gDUJNg-hpLa3x7O1er\u003ci3^1rnkjU!8uJS+ngP4i0G\u0026\u003c@)@9T]=*6a^H945e4sD-XAJ1/n[\u003cyZY=]?rbGt^U#Jt}{+GOI?F+1y5QRaLa=O2P", "ln": 0 } ], "mol": "H(Po)", "sha": "dfc15fcb2e0183f9a69d8a2e9d6f341eddb753f130566bc1044b8525e6095388", "path": "firefox-nightly-bin-158.0a1.20260913.212439-1.src.tar.gz", "risk": 1, "size": 7388, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 7388, "entropy": 7.97 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 7168, "peak_region_entropy": 7.8 } } }, "ident": { "name": { "value": "firefox-nightly-bin", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "158.0a1.20260913.212439-1.src", "source": "file.basename", "verified": false } }, "traits": [ { "id": "micro-behaviors/process/create/shell/pipeline::base64-curl-pipeline-four-pipes", "conf": 0.8, "crit": 3, "desc": "base64/curl pipeline with four or more pipes", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::cat-grep-pipeline-four-pipes", "conf": 0.8, "crit": 3, "desc": "cat/grep pipeline with four or more pipes", "from": [ { "file": 4 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 2490, "entropy": 5.36 }, "binary": { "peak_region_bytes": 2490, "peak_region_entropy": 5.16 }, "references": { "declared_count": 4, "unresolved_count": 4, "security_hold_count": 0, "unresolved_extension_count": 0 } } }, "id": 1, "path": "firefox-nightly-bin-158.0a1.20260913.212439-1.src.tar.gz!!firefox-nightly-bin/.SRCINFO", "pid": 0, "refs": [ { "to": "pkg:alpm/arch/dbus-glib", "off": 300, "kind": "dependency" }, { "to": "pkg:alpm/arch/gtk3", "off": 321, "kind": "dependency" }, { "to": "pkg:alpm/arch/libxt", "off": 337, "kind": "dependency" }, { "to": "pkg:alpm/arch/nss", "off": 354, "kind": "dependency" }, { "to": "pkg:alpm/arch/mime-types", "off": 369, "kind": "dependency" }, { "to": "pkg:alpm/arch/python", "off": 391, "kind": "dependency" } ], "sha": "611e14f7b4eb6cbc68364aca1f1ee68050f5497c721f43f585c7489b4c0e1497", "size": 2490, "type": "src_info" }, { "ctx": [ { "b": "BAzFyiXJc#Bz@\u003cHz*Dbly*!@mA+v4ABZ^1ox(W=%z*i{Mx\u003eIa3y\u003cuv{y*?i]j.nH.rz%liC4CYnx(v(LbQ^eBA+(\u003czDTy]oy\u003c^%Mvru74Bs?uFDtdhivj+#2zGG]cy+D]Uazk.aA3ctIDTyO$zFawIy?W^fCRae1hEwv0e[nNav@3ddzf3)zD)0Gwwfr7qfj3mXk4XIHwOb\u003e9eIw+saAGhve*Je7dLAC0aBCqMz/P}xeP8XUaAR4ay-\u003erEatCqLuT!d(y?c)!wm6v=CrEb}c$vyuy-\u003erJar\u00267TuT^C+wNxO2y\u003c^%Mvru74Bs?uFDtdhivj+#2zGG]cy+E5XuV6p?wQMcQDTy@cA=U@kzHBb.DTyO$zFawIy?W^fCR7g/lQsQqnpra2xK$W?B9htva%qmQxl4N5asw^XvrcE7vqEMkvr9.rD(#{wBrAeCcM\u003c=VeOl*ZD)06xwPe+zmiBg2asyw$i+h@qx((ywu3!p.Ej3d+aAIEwBrC@NByw)1at4E=diYafwN/K+A+cvBk{fJzB.LV5uUK3TuT!d(y?c)!wizsFarR^Htx%^*A:p*LbZS)cB.LV5uUK4TA::eMfGI4sa{]CnarT)9z/fVgt%fwSDTyl8x(4r!x\u003egN\u003evrT:?iX(ac3lQDlax@w+D0JMSbZS)cB.LV5uUK4TA::eMhAAQwa{]CnarT)4z/{8ajT8d#uT!d(y?c)!wm6v=CrdYAgjptNarR^HtwX7(t%fwSDTyl8x(4r!x\u003egN\u003evrT:!fGH$qa{]CnarT)fwN/1ea%.IxvS=y3wm64YuVGO0iX-xJgjptNarR^Htv.e:wNdCybZS)cB.LV5uUK4TA::eMfGIgwa{]CnarT)gx(dA!jT8d#uT!d(y?c)!wm6v=CrdYAhHM+RdgfA\u003eB.LV5uUK4TwmoN\u003ejTtwYvS=y3wm64Ytv.e:wNfY\u003euT!d(y?c)!wm6B)zdL\u003cQDTyl8x(4r!x\u003egB\u0026x(dA!Ef%}exlE\u003cbjTqB{A+PAkw/@ozB1O+We*UM.as8qvC4CYnx(v)qas8qvvS=y3wm64YuU0O!wQLWDDTyl8x(4r!x\u003egN)x(dBfdgfS@xM21qC4CYnx(v(LbZS)wwPz\u003caz/f$E3t0ZXzY*lyyId*4AY\u003eW{Abf9fwPAhy3jp\u0026=wfrErar\u003e\u003eWAbf9fwPx{^dKlV^yId*4AY\u003eW{Abf9fwPAhLa%oYPm/", "ln": 6, "col": 7, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "curl" ], [ "", "grep" ], [ "", "sed" ], [ "", "sort" ], [ "", "tail" ], [ "", "curl" ], [ "", "grep" ], [ "", "cut" ], [ "", "grep" ], [ "", "sort" ], [ "", "tail" ], [ "", "printf" ], [ "", "echo" ], [ "", "echo" ], [ "", "sed" ], [ "", "sed" ], [ "", "sed" ], [ "", "sed" ], [ "", "cat" ], [ "", "updpkgsums" ] ], "tgt": [ "cat", "curl", "cut", "echo", "grep", "printf", "sed", "sort", "tail", "updpkgsums" ], "metrics": { "ast": { "max_depth": 8, "call_count": 20, "node_count": 403, "max_array_len": 8 }, "file": { "size": 1176, "entropy": 5.36 }, "text": { "lines": 27, "top_char": 95, "max_ws_run": 1, "digit_ratio": 0.04, "space_count": 88, "char_entropy": 5.36, "unique_chars": 68, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.67, "top_char_ratio": 0.06, "avg_line_length": 42.56, "max_line_length": 206, "empty_line_ratio": 0.04, "last_line_length": 10, "whitespace_ratio": 0.1, "identifier_density": 4.85, "line_length_stddev": 42.84, "normalized_string_count": 3.46, "suspicious_string_ratio": 0.06, "normalized_unique_identifiers": 9.88 }, "binds": { "count": 8 }, "binary": { "peak_region_bytes": 1176, "peak_region_entropy": 5.32 }, "strings": { "bytes": 608, "count": 18, "shell": 1, "avg_length": 33.78, "max_length": 190, "avg_entropy": 3.75, "entropy_stddev": 0.64, "high_entropy_count": 1 }, "identifiers": { "count": 131, "unique": 47, "avg_length": 5.79, "max_length": 43, "min_length": 1, "avg_entropy": 1.85, "reuse_ratio": 0.36, "length_stddev": 6.94, "has_digit_ratio": 0.09, "single_char_count": 5, "single_char_ratio": 0.11, "high_entropy_count": 2, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.6, "all_uppercase_ratio": 0.04, "numeric_suffix_count": 2, "underscore_prefix_count": 9 } } }, "id": 4, "mol": "H₄(Cm₃DbOs₂Po)", "path": "firefox-nightly-bin-158.0a1.20260913.212439-1.src.tar.gz!!firefox-nightly-bin/get_latest_version.sh", "pid": 0, "risk": 4, "sha": "05a96952b4df382c0d0a29d9d49824716ece45f28ca3eeeeb92e8adc77d4b0f1", "size": 1176, "traits": [ { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension" }, { "id": "metadata/file/string/identity::multi-architecture-name-set--other", "conf": 0.9, "crit": 1, "desc": "x86, ARC, or MPSL architecture reference", "spans": [ [ 132, 0 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::curl-command-call", "atk": "T1105", "conf": 0.96, "crit": 3, "desc": "Shell invokes the curl command", "spans": [ [ 72, 4 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::source-curl-output-option", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl output file source", "spans": [ [ 227, 189 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::subshell-curl", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl invoked inside command substitution", "spans": [ [ 70, 6 ] ] }, { "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl or wget references shell variable", "spans": [ [ 71, 13 ], [ 226, 90 ] ] }, { "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format", "conf": 0.9, "crit": 3, "desc": "Code formats a zero-padded integer", "spans": [ [ 479, 3 ], [ 683, 3 ], [ 717, 3 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-amd64", "conf": 0.94, "crit": 3, "desc": "x86 or AMD64 architecture reference", "spans": [ [ 132, 6 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--x86-or-mips", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 1, "desc": "Shell x86 or MIPS architecture selector", "spans": [ [ 131, 0 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.7, "crit": 2, "desc": "curl command includes URL or option", "spans": [ [ 226, 0 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-text", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "curl text contains silent or fail flags", "spans": [ [ 227, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::base64-curl-pipeline-four-pipes", "conf": 0.8, "crit": 3, "desc": "base64/curl pipeline with four or more pipes", "spans": [ [ 72, 127 ], [ 227, 172 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::cat-grep-pipeline-four-pipes", "conf": 0.8, "crit": 3, "desc": "cat/grep pipeline with four or more pipes", "spans": [ [ 330, 76 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl", "atk": "T1105", "conf": 0.66, "crit": 3, "desc": "Download via curl", "uses": [ 9 ], "spans": [ [ 226, 8 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent", "atk": "T1105", "conf": 0.92, "crit": 3, "desc": "curl command uses silent or fail flags", "uses": [ 2, 10 ], "spans": [ [ 72, 4 ], [ 227, 7 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 3, "desc": "Shell lists architecture selector names", "uses": [ 8 ], "spans": [ [ 131, 7 ] ] } ], "type": "shell" }, { "depth": 2, "facts": { "metrics": { "file": { "size": 847, "entropy": 4.77 }, "binary": { "peak_region_bytes": 847, "peak_region_entropy": 4.77 }, "registry": { "age_days": 538, "maintainers": 1, "published_at": 1742829768, "is_deprecated": 0 } } }, "id": 6, "path": "dbus-glib@0.114-1.registry.json", "pid": 1, "rel": "registry", "role": "sidecar", "sha": "6679a8af5943bf04b7750d91659dfb9b7a4d1e4b5e55b38f5cdd5a5cc3b2e3df", "size": 847, "type": "registry" }, { "depth": 2, "facts": { "metrics": { "file": { "size": 809, "entropy": 4.61 }, "binary": { "peak_region_bytes": 809, "peak_region_entropy": 4.61 }, "registry": { "age_days": 665, "maintainers": 1, "published_at": 1731863889, "is_deprecated": 0 } } }, "id": 7, "path": "libxt@1.3.1-1.registry.json", "pid": 1, "rel": "registry", "role": "sidecar", "sha": "de173c037274cdc902d3426c8714b19d68fa53666034bd2c4aa5fa746847319a", "size": 809, "type": "registry" }, { "ctx": [ { "b": "DM)3hz/ZhBBy/qkiWe0Mv}W5qb5Q?awG\u003ceVzGx\u003eyefYmGA=U@kzx.a=gCgyqiv#%fefY4QvR/+1xK$ZYvrrXOf/I6Lf/I6Ff/7v8vp%dUwmo+8b04Fgb5yXfwPI%2C4CYnx(v(ki=o7Ry+c=sB-.qnAW0K*xK$^$x\u003eFRvb6mKvy?j!KzGP=iefXRoB7ol8", "ln": 0, "col": 1, "line": 1 } ], "depth": 2, "facts": { "metrics": { "file": { "size": 823, "entropy": 4.64 }, "binary": { "peak_region_bytes": 823, "peak_region_entropy": 4.64 }, "registry": { "age_days": 2, "maintainers": 1, "published_at": 1789178313, "is_deprecated": 0 } } }, "id": 8, "mol": "Md(Re)", "path": "nss@3.129-1.registry.json", "pid": 1, "rel": "registry", "risk": 1, "role": "sidecar", "sha": "2e22b13db0066117977ba3f7e2559d71d3338f7119e4c390b910a8fe92ce7d5b", "size": 823, "traits": [ { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Release published within seven days", "spans": [ [ 0, 24 ] ] } ], "type": "registry" }, { "id": 9, "sha": "23048619b16645abb52310127630043225f40cc0d19a33ba5f7bb6d3cb516f46", "path": "firefox-nightly-bin@158.0a1.20260913.212439-1.registry.json", "size": 910, "type": "registry", "depth": 1 } ], "omitted_files": 1, "v": "8" } }