{
  "ml": {
    "v": "7",
    "eng": "2.3.0-beta.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.040896595,
        "rte": "az",
        "prob": 0.040896595
      },
      {
        "cls": 0,
        "raw": 0.00040507317,
        "rte": "az/tar",
        "prob": 0.00040507317
      }
    ],
    "prob": 0.040896595,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.040896594524383545,
        "type": "tar.gz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.002643972635269165,
        "type": "shell"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "src_info"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-10T18:46:07Z"
  },
  "path": "riscv64-gnu-toolchain-elf-bin-2026.07.11-1.src.tar.gz",
  "raw": {
    "fetched": [
      {
        "kind": "dependency",
        "cached": false,
        "locator": "https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2026.07.10/riscv64-elf-ubuntu-24.04-gcc.tar.xz",
        "outcome": {
          "failed": "response too large"
        },
        "fetched_at": 1783709167,
        "resolved_url": "https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2026.07.10/riscv64-elf-ubuntu-24.04-gcc.tar.xz",
        "source_offset": 296,
        "source_sha256": "de0cd6fa82eef37095e2400972fb00ff81a59ca6ae3483f9994ee6bbe456bf6f"
      }
    ],
    "files": [
      {
        "id": 0,
        "mol": "H₂(CmPo₂)",
        "sha": "e1599c653c0c0a80cd32aed18b692b0a8952dc04b655cac1f3f57a56c2bdfa11",
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/riscv64-gnu-toolchain-elf-bin/riscv64-gnu-toolchain-elf-bin-2026.07.10-1.src.tar.gz",
        "risk": 2,
        "size": 1195,
        "type": "tar.gz",
        "facts": {
          "metrics": {
            "file": {
              "size": 1195.0,
              "entropy": 7.8,
              "size_bytes": 1195.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 7.8,
              "peak_region_bytes": 1024.0,
              "peak_region_entropy": 7.76
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-c-exec",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "shell execution with -c flag",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/build::clang-invocation",
            "atk": "T1027.004",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Clang compiler invocation",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/external/github::github-release-download",
            "atk": "T1105",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "GitHub releases download URL",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boPY?x(n33x(mH5iV{}by*{%@BrB7/y*[=kauTpJy*}D#x(4l\u0026A=:MVzddc{e[n*pj]",
            "n": [
              {
                "c": 3,
                "d": "Recognized OS-specific execution marker",
                "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker",
                "o": 0,
                "z": 8,
                "cf": 0.800000011920929
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "Abf97vqPNsA+PP8B#zfexkR\u0026zBz(8lv}Yp+zy]Bow?vFazu",
            "ln": 2,
            "addr": 54
          },
          {
            "b": "Abf9fwPx{?fFUKsfGgQsfA",
            "ln": 3,
            "addr": 92
          },
          {
            "b": "Abf8%wPIuAb1CydaARKuy?4c!x(k59z/M$vx(^^chz=KBoHZMQx(mA%B.2i7xcoYilOoL",
            "ln": 5,
            "addr": 119
          },
          {
            "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z",
            "ln": 6,
            "addr": 175
          },
          {
            "b": "B-IpYb4#7uAc15[fk20vxMW=pv@DiqA+PP8B$Eixy\u00260J?flg=Fv%fCpzGNKMz/oD4xKLQ)a]",
            "n": [
              {
                "c": 2,
                "d": "HTTPS protocol prefix",
                "i": "micro-behaviors/communications/http/message::https-prefix",
                "o": 196,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 7,
            "addr": 191
          },
          {
            "b": "y?Wx\u003czGxwLc)}IYoFN$A",
            "ln": 8,
            "addr": 249
          },
          {
            "b": "Ab](ux\u003eg^@jTZ",
            "ln": 9,
            "addr": 266
          },
          {
            "b": "z/x/jz/fRVc)rUNA+PFw",
            "ln": 16,
            "addr": 361
          },
          {
            "b": "B8Mhwv}v!K",
            "ln": 17,
            "addr": 378
          },
          {
            "b": "arR\u003eGx(^^chz^0#zGNKMz/oD4xKLQ)eOe:geN\u0026BieIY1nhzcWxe?]4iA+PP8B#zfewO+%gBZ/GhBAGe\u003cg+HEseOwN6e{7Jxe{IX6i+SRSAc15[fk20vxMW=pv@DiqA+PP8B$Eixy\u00260J?flg=Fv%fCpzGNKMz/oD4xKLQ)flgSuwNPT\u003eB1.6xCw.knvpR2DfFUKsfGgQsfFvDXB7owKg+AoPw?wdmB-8qzeIYdnfF\u003ev]v}dckvr9#BDlJ",
            "n": [
              {
                "c": 3,
                "d": "GitHub releases download URL",
                "i": "micro-behaviors/communications/url/external/github::github-release-download",
                "o": 476,
                "z": 62,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 18,
            "addr": 387
          },
          {
            "b": "df",
            "ln": 19,
            "addr": 586
          },
          {
            "b": "B7!#tf/0/)zf4\u0026*",
            "ln": 20,
            "addr": 588
          },
          {
            "b": "arUikzE\u0026",
            "ln": 43,
            "addr": 1521
          },
          {
            "b": "",
            "ln": 44,
            "addr": 1528
          },
          {
            "b": "arR)Kl2pQXaAhvtC4\u003eF#aAR4jxjVfcADLY2A=(tqwPP5pzY\u003c1twP?T5BrC7izF13jx(mMav@bN\u003ex8",
            "n": [
              {
                "c": 3,
                "d": "Shell command execution indicators",
                "i": "micro-behaviors/process/create/shell/spawn::shell-execution-indicators",
                "o": 1585,
                "z": 10,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 45,
            "addr": 1529
          },
          {
            "b": "arUGrat4TSA+PP8B#zfeB-7#jz*c7JwO+%3a%.IOyIdf(A^Yb+B-RNRA+PP8B#zfeB-7#jz*c7JB-7#jz*c7JwO+@",
            "ln": 46,
            "addr": 1591
          },
          {
            "b": "arUGrat4TSA+PP8B#zfeB-7#jz*c7JwO+%3a%.IOyIdf(A^Yb+B-RNRy?WuixjCB8A+PP8B#zfeB-7#jz*c7JB-7#jz*c7JwO+@",
            "ln": 47,
            "addr": 1663
          },
          {
            "b": "arR^HePb0lwGV2cB7owKg+A\u0026/yI[6mzy]Bow/$s",
            "ln": 50,
            "addr": 1770
          },
          {
            "b": "arR^HeP=nSwGUIatM",
            "ln": 51,
            "addr": 1802
          },
          {
            "b": "arR^HeOffrv\u003c0Blx(kOBxDO)pasy#yat4TSA+PP8B#zfeB-7#jz*c7JwO+%3a%XNEx(X91zdK?lbRQz\u003ea$)$JB7owKg+A\u0026/yI[6mzy{0GyI[6mzy]Bow*XZFEiq=R",
            "n": [
              {
                "c": 3,
                "d": "Shell command execution capability",
                "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
                "o": 1831,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 52,
            "addr": 1816
          },
          {
            "b": "",
            "ln": 53,
            "addr": 1917
          },
          {
            "b": "arR)Kq/)4]z#",
            "ln": 54,
            "addr": 1918
          },
          {
            "b": "arR^HeP=nSwGUOctM",
            "ln": 59,
            "addr": 2109
          },
          {
            "b": "arR^HeOffrv\u003c0Blx(kOBxDO)pasy(nazbt7wGSMRzF}aFvqYQ+z*ixGbRQz+D)06xwPe+zAyy#]mncf6dKX\u003eMwN/\u003e8vpB4:D#\u0026$fA+e=7z^)D)v@%dzj0nSUwO@SiBAh8mar\u00266+b0c]Vx^U3IEiq=R",
            "ln": 60,
            "addr": 2123
          },
          {
            "b": "Ee",
            "n": [
              {
                "c": 2,
                "d": "shell code embedded in string",
                "i": "metadata/lang/embedded::shell",
                "o": 4290,
                "z": 91,
                "cf": 1.0
              }
            ],
            "ln": 61,
            "addr": 2244
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "install"
            ],
            [
              "",
              "install"
            ],
            [
              "",
              "cp"
            ],
            [
              "",
              "cp"
            ],
            [
              "",
              "test"
            ],
            [
              "",
              "test"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "basename"
            ],
            [
              "",
              "basename"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "ln"
            ],
            [
              "",
              "find"
            ],
            [
              "",
              "find"
            ],
            [
              "",
              "find"
            ],
            [
              "",
              "find"
            ]
          ],
          "tgt": [
            "basename",
            "cp",
            "find",
            "install",
            "ln",
            "test"
          ],
          "metrics": {
            "ast": {
              "max_depth": 11.0,
              "bind_count": 17.0,
              "call_count": 11.0,
              "node_count": 369.0,
              "identifier_count": 57.0,
              "string_literal_count": 28.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 2245.0,
              "entropy": 5.22,
              "size_bytes": 2245.0
            },
            "text": {
              "digit_ratio": 0.11,
              "space_count": 190.0,
              "total_lines": 61.0,
              "char_entropy": 5.22,
              "unique_chars": 74.0,
              "string_density": 0.46,
              "avg_line_length": 35.82,
              "max_line_length": 198.0,
              "empty_line_ratio": 0.1,
              "last_line_length": 1.0,
              "long_token_count": 2.0,
              "whitespace_ratio": 0.11,
              "most_common_ratio": 0.06,
              "identifier_density": 1.8,
              "line_length_stddev": 39.51,
              "encoded_string_ratio": 0.04,
              "normalized_string_count": 3.59,
              "suspicious_string_ratio": 0.07,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 110.0,
              "suspicious_identifier_ratio": 0.04,
              "normalized_unique_identifiers": 9.61
            },
            "binds": {
              "count": 17.0
            },
            "calls": {
              "count": 11.0
            },
            "binary": {
              "overall_entropy": 5.22,
              "peak_region_bytes": 1024.0,
              "peak_region_entropy": 5.38
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 28.0,
              "url_count": 1.0,
              "avg_length": 28.57,
              "max_length": 194.0,
              "avg_entropy": 3.35,
              "hex_strings": 1.0,
              "total_bytes": 800.0,
              "entropy_stddev": 0.7,
              "shell_command_strings": 2.0
            },
            "comments": {
              "chars": 170.0,
              "lines": 6.0,
              "total": 6.0,
              "to_code_ratio": 0.11
            },
            "functions": {
              "count": 1.0,
              "avg_params": 15.0,
              "max_params": 15.0,
              "avg_name_length": 7.0,
              "avg_length_lines": 38.0,
              "max_length_lines": 38.0,
              "min_length_lines": 38.0,
              "many_params_count": 1.0,
              "avg_param_name_length": 34.53,
              "density_per_100_lines": 1.64,
              "code_in_functions_ratio": 0.62
            },
            "identifiers": {
              "count": 57.0,
              "total": 110.0,
              "avg_length": 13.44,
              "max_length": 62.0,
              "min_length": 1.0,
              "avg_entropy": 2.53,
              "reuse_ratio": 0.52,
              "unique_count": 57.0,
              "length_stddev": 14.93,
              "has_digit_ratio": 0.3,
              "sequential_names": 2.0,
              "single_char_count": 4.0,
              "single_char_ratio": 0.07,
              "high_entropy_count": 14.0,
              "high_entropy_ratio": 0.25,
              "all_lowercase_ratio": 0.44,
              "numeric_suffix_count": 1.0
            }
          }
        },
        "id": 1,
        "mol": "H₂(CmPo₂)",
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/riscv64-gnu-toolchain-elf-bin/riscv64-gnu-toolchain-elf-bin-2026.07.10-1.src.tar.gz!!riscv64-gnu-toolchain-elf-bin/PKGBUILD",
        "pid": 0,
        "risk": 2,
        "sha": "b2e128f25c1dbe3d808399dacebe959a165387ee26b9ef6cb128c25e319f2ff9",
        "size": 2245,
        "traits": [
          {
            "id": "micro-behaviors/communications/url/external/github::github-release-download",
            "atk": "T1105",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "GitHub releases download URL",
            "spans": [
              [
                476,
                62
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-c-exec",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "shell execution with -c flag",
            "spans": [
              [
                1831,
                5
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/build::clang-invocation",
            "atk": "T1027.004",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Clang compiler invocation",
            "spans": [
              [
                1585,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "spans": [
              [
                1585,
                10
              ],
              [
                1831,
                5
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 675.0,
              "entropy": 5.21,
              "size_bytes": 675.0
            },
            "binary": {
              "overall_entropy": 5.21,
              "peak_region_bytes": 675.0,
              "peak_region_entropy": 5.21
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/riscv64-gnu-toolchain-elf-bin/riscv64-gnu-toolchain-elf-bin-2026.07.10-1.src.tar.gz!!riscv64-gnu-toolchain-elf-bin/.SRCINFO",
        "pid": 0,
        "refs": [
          {
            "to": "https://github.com/riscv-collab/riscv-gnu-toolchain/releases/download/2026.07.10/riscv64-elf-ubuntu-24.04-gcc.tar.xz",
            "off": 296,
            "kind": "dependency"
          }
        ],
        "sha": "de0cd6fa82eef37095e2400972fb00ff81a59ca6ae3483f9994ee6bbe456bf6f",
        "size": 675,
        "type": "src_info"
      }
    ],
    "rev": "b8372",
    "v": "8"
  }
}