{ "llm": { "conf": 0.99576414, "grade": "hostile", "model": "qwen/qwen3.8-27b", "outcome": "hostile", "interpretation": "Downloads and executes remote RAT" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.9974679, "rte": "az", "prob": 0.9974679 }, { "cls": 2, "raw": 0.9936778, "rte": "az/python_sdist", "prob": 0.9936778 } ], "prob": 0.9936778, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9936777949333191, "type": "python_sdist" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000006735324859619141, "type": "pkg_info" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00019182761025149375, "type": "python" } ], "version": "v18.18", "analyzed_at": "2026-09-04T23:17:06Z" }, "path": "async-http-tools-0.70.125.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZygS).8=0@(XID2vb0xMOunuVZj8y\u0026.fZe\u0026LEpf!$QsByxg\u0026)oFE+*CP+\u003eWvR$Dfj[.5Trg8c3$@+ezFuK%4BP7g=\u003e-S9^xTJV!i\u003e^CtL8%KY6Q!#vC6x*HyEwyw?ehpr#rydC4x^R(5Q-W\u003eEV*8[@POpP6#ep", "ln": 0 } ], "mol": "O₂(S₄Ca)H₅(Cm₈Db₂FOsPo₄)Md(Bk₂)", "sha": "e283068ab64c51103ff48cfff2d232543a9947acd670eaf94bdf6b466c8ff596", "path": "async-http-tools-0.70.125.tar.gz", "risk": 244, "size": 1932, "type": "python_sdist", "facts": { "metrics": { "file": { "size": 1932, "entropy": 7.8 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 1932, "peak_region_entropy": 7.7 }, "consistency": { "cloned_summary": 0, "name_typosquat": 0, "metadata_identity_mismatch": 0 } } }, "ident": { "name": { "value": "async-http-tools", "source": "python.name", "verified": false }, "urls": [ { "url": "https://github.com/guellemilb/coding-assessment", "kind": "homepage", "source": "python.homepage" } ], "trust": "unsigned", "version": { "value": "0.70.125", "source": "python.version", "verified": false }, "identifier": { "value": "async-http-tools", "source": "python.name", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/request/client::urllib-json-request-body", "conf": 0.9, "crit": 3, "desc": "urllib JSON request with body", "from": [ { "file": 7 } ], "uses": [ 18, 26, 36 ] }, { "id": "metadata/build/pip::packaging-setup-api-import", "conf": 0.95, "crit": 3, "desc": "Packaging setup API import or call", "from": [ { "file": 7 } ], "uses": [ 7 ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-string-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Python imports named module dynamically", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 7 } ] }, { "id": "objectives/supply-chain/hidden-payload/exec::pypi-setup-network-code-execution", "atk": "T1195.002", "conf": 0.99, "crit": 5, "desc": "PyPI setup hook executes network code", "from": [ { "off": 1267, "file": 7, "line": 30 } ], "uses": [ 38, 49 ] }, { "id": "micro-behaviors/communications/http/url/build::python-urllib-response-body-read", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python reads an urllib response body", "from": [ { "file": 7 } ] }, { "id": "metadata/build/pip::packaging-setuptools-import", "conf": 0.95, "crit": 3, "desc": "setuptools packaging import", "from": [ { "file": 7 } ] }, { "id": "metadata/build/package/recipe::python-install-hook", "conf": 0.9, "crit": 3, "desc": "Python package custom lifecycle hook", "from": [ { "off": 2723, "file": 7, "line": 68 } ], "uses": [ 20, 29 ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-symbol", "conf": 0.82, "crit": 3, "desc": "urllib.request.Request symbol", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/url/github::gist-githubusercontent-raw-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.92, "crit": 3, "desc": "GitHub Gist raw content URL", "from": [ { "file": 7 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-version-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package version", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/headers::authorization-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Defines an HTTP Authorization header mapping", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/thread::python-daemon-thread", "conf": 0.8, "crit": 3, "desc": "Creates a daemon thread in Python", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/directory/cwd::python-os-getcwd", "conf": 0.9, "crit": 3, "desc": "Calls Python os.getcwd", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request", "conf": 0.8, "crit": 3, "desc": "Imports Python urllib.request HTTP client", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::python-socket-gethostname", "atk": "T1082", "mbc": "E1082", "conf": 0.95, "crit": 3, "desc": "Calls Python socket.gethostname", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/read/file::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request-client-import", "conf": 0.82, "crit": 3, "desc": "Imports Python urllib.request through direct or from-import syntax", "from": [ { "file": 7 } ], "uses": [ 15 ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen", "conf": 0.7, "crit": 3, "desc": "Calls urllib.request.urlopen", "from": [ { "file": 7 } ] }, { "id": "metadata/build/package/recipe::setup-cmdclass-install", "conf": 0.9, "crit": 3, "desc": "setup() defines custom install command", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call-symbol", "conf": 0.85, "crit": 3, "desc": "Calls fully qualified urllib urlopen", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call", "conf": 0.82, "crit": 3, "desc": "Calls Python urllib urlopen", "from": [ { "file": 7 } ], "uses": [ 19, 21 ] }, { "id": "metadata/package/files/included::setup-py-basename", "conf": 0.95, "crit": 1, "desc": "Filename is setup.py", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/thread::python-thread-create", "conf": 0.65, "crit": 3, "desc": "Creates a thread in Python", "from": [ { "file": 7 } ] }, { "id": "objectives/credential-access/cloud/token/files::github-classic-pat", "atk": "T1552.001", "conf": 0.88, "crit": 3, "desc": "GitHub classic personal access token literal", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-object", "conf": 0.82, "crit": 3, "desc": "urllib Request object creation", "from": [ { "file": 7 } ], "uses": [ 9 ] }, { "id": "micro-behaviors/process/interpreter/python::exec-builtin", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Executes dynamic Python code with exec()", "from": [ { "file": 7 } ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-install-or-build-class", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "setup.py install or build class", "from": [ { "file": 7 } ] }, { "id": "metadata/build/package/recipe::setuptools-run-override", "conf": 0.8, "crit": 3, "desc": "Overrides run() method in install class", "from": [ { "file": 7 } ] }, { "id": "metadata/build/pip::root-setup-py", "conf": 0.98, "crit": 3, "desc": "Root Python setup.py packaging file", "from": [ { "file": 7 } ], "uses": [ 1, 51 ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "from": [ { "file": 7 } ], "uses": [ 26 ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call" }, { "id": "metadata/package/manifest/ecosystem::pkginfo-summary-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package summary", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package/recipe::setuptools-install-class", "conf": 0.9, "crit": 3, "desc": "Class inherits from setuptools.command.install", "from": [ { "file": 7 } ] }, { "id": "objectives/supply-chain/install-hook/dropper/setup::pypi-custom-install-network", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "PyPI custom install with network activity", "from": [ { "file": 7 } ], "uses": [ 23, 29, 31 ] }, { "id": "micro-behaviors/data/serialize/json::json-dumps-call", "conf": 0.9, "crit": 2, "desc": "Serializes data with Python json.dumps()", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 7 } ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-py-network-in-install", "atk": "T1195.002", "conf": 0.9, "crit": 4, "desc": "Network API used from setup install or build class", "from": [ { "file": 7 } ], "uses": [ 19, 28, 39 ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-py-or-cmdclass-marker", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "setup.py path marker", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "Python __import__ call" }, { "id": "metadata/package/manifest/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 1, "desc": "Declares Python Core Metadata version", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urlopen-response-body-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns response body read from urlopen" }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-word", "conf": 0.75, "crit": 3, "desc": "References Python urllib HTTP client", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 1, "desc": "Python JSON content type", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/interpreter/python::exec-variable", "atk": "T1059.006", "mbc": "E1059", "conf": 0.94, "crit": 3, "desc": "Python exec() executes a variable value", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/user/query::python-getpass-user", "atk": "T1033", "conf": 0.9, "crit": 3, "desc": "Reads the current user through Python getpass", "from": [ { "file": 7 } ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-name-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/object::python-username-variable-object-field", "conf": 0.92, "crit": 3, "desc": "Python object maps username variable", "from": [ { "file": 7 } ] }, { "id": "objectives/supply-chain/install-hook/setup::setup-code-execution", "atk": "T1195.002", "mbc": "E1059.006", "conf": 0.95, "crit": 5, "desc": "Code execution during package installation", "from": [ { "file": 7 } ], "uses": [ 27, 29 ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urlopen-response-body-read", "conf": 0.9, "crit": 3, "desc": "Reads urllib response body", "from": [ { "file": 7 } ] }, { "id": "metadata/build/pip::root-setup-py-path", "conf": 0.98, "crit": 1, "desc": "Shallow setup.py path candidate", "from": [ { "file": 7 } ] } ] }, { "ctx": [ { "b": "o\u003ewAPwmoN*eMMC6B7]MgiV{gggZV#^zdL:JvrlZiv\u003ezwoBz@*Nz/oDk3ry.UB7]MgiV{aeh.V\u003csgbPzqB.$#7A^oX*l34r?v\u003c1rwr8sYEy?WD#Bp7MSzdLqrvp%djazt\u003esAc15[fk20vxMW=pv@Diqxlv^4y?mD$y*]5cz!9N1xdWLkB7GAlzdNQb3pwSrB8#5cx\u003eqrCaw^8%xl4A$ze0)2awuiYxlvS}wGT2{ao", "ln": 0, "col": 1, "line": 1 }, { "b": "auzLapG6?cl2Z^-z*2Y5auzLao?wqboLF0FzGxv@qE%\u0026\u003cx(W^aeL{.mxM4=Hau?}Ae\u0026Kb9wPIv4x(Ffdz/dc]z/fVdzGEEfD2NsQaARgtBt4GtA+/i7CwW:QD2v5cx\u003e6gDv@bN{B7]l2wPwbCD2v5cx\u003e6gDwmY*(A+PGmx(v\u003e@m0SVUze0Gvay]58v@=p5BzkVheN[", "ln": 216, "col": 20, "line": 7 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 538, "entropy": 4.96 }, "binary": { "peak_region_bytes": 538, "peak_region_entropy": 4.96 } } }, "id": 1, "path": "async-http-tools-0.70.125.tar.gz!!async_http_tools-0.70.125/PKG-INFO", "pid": 0, "risk": 1, "sha": "1ace52442efc2365e08146a68dbdb89227ad79f08ad944d4124801c8a8dc402a", "size": 538, "traits": [ { "id": "metadata/package/manifest/author/identity::pypi-no-author-email", "conf": 0.7, "crit": 2, "desc": "PyPI metadata omits author email" }, { "id": "metadata/package/manifest/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 1, "desc": "Declares Python Core Metadata version", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-markdown-description", "conf": 0.9, "crit": 1, "desc": "Declares Markdown package description", "spans": [ [ 271, 0 ] ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-name-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package name", "spans": [ [ 22, 0 ] ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-summary-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package summary", "spans": [ [ 63, 0 ] ] }, { "id": "metadata/package/manifest/ecosystem::pkginfo-version-field", "conf": 0.9, "crit": 1, "desc": "Declares Python package version", "spans": [ [ 45, 0 ] ] }, { "id": "metadata/package/manifest/ecosystem::pypi-basic-metadata", "conf": 0.95, "crit": 2, "desc": "PyPI package declares name, version, summary", "uses": [ 1, 3, 4, 5 ], "spans": [ [ 22, 0 ] ] } ], "type": "pkg_info" }, { "ctx": [ { "b": "a%FjcvpK7YxjSh@wPIv4x(Ffdz/dfKa%Ewdze:AlBrCHyefG1VB1wCPBZ/rgz!0v1B1wCRA+]MavLhXjADL\u0026lBsXLRxMvV)wnb{]efG4GzdLmvA:-\u0026@z/2?}ze:AlBrCstz/d9GB8LM7wPPECxjVg7vrlF%w].*baAIaoB-qCvz!%Fqx(d*cA=-BBwPS6l3tar%z6i[hBAILAz/oDke[n*pzddr)e[]iAByx04azCXiz/P}xx(n0lvqG-!3s)ZWayx83z/fb[xM4:0c[dg:arR^HBAhT/3lQDlarR^HazCXiz/P}xyiarhefG7Qy\u00260/{e]\u003eJyB.bSoefG1Lv@2T$efFOpBz$VfA%:3jarR^HarR1larR^HarR^KatCF\u003e\u003e8c1%U8hwqH3#Wgm})6oBZ=E+B8#Fnavv{MYOM$rarR^HarR!uz/Z1yjS[/:v@2T$e[X:qxM4%lzEEx[c[bGCarR^HarR!HB7GwmjS[xGBz$VfB1R9pBAIUoAWSvzarR^HarR^HwmoN*auZ\u0026ZB8L}Gwoz:dB0#wVvSb!5b03\u0026YB8L}Gwoz:dB0#wVBA}?pb03]!x(EA[zGx]dy?$pDb5?sgb03]RB9RUkeOGlFA4MfIz!%FsefX+CB95P!xM4%lefYjTwPw$QB-RbmefXOFwfK6wuUj1*wNw!)dsASLarR^HarR^HA+fkkjS[(/y\u00260/{e]\u003eJyB.bSoe(Dn2B.bSoc\u003c?7tarR^HarR^HarR\u003ewBAzFyiXJc{Aa{}qx([3hvLheez7/{vAbP!Jxlv^4y?mD$y*]5cga^JTy*?Pxx(!urwPGHVfjO{qzdNQbB0rdxarR^HarR^HarR^HwmoN*j.d#yvj(bev@C)?c[cXOarR^HarR^HarR^HxK$Q.wPz\u0026PDKp(rarR^HarR^HarR^HarR\u003c]B-.qnA+P\u0026dBzkVhb03?\u003cBz\u003e@azxJO9A9\u003eNZe?O+Irz2j{ed9HxarR^HarR^HarR^HarR\u003c]v}f7?BrS:*b4kCfy?Wx/BzkVhflRkze[X)uxMW=pB#7T-B8L}ued9HxarR^HarR^HarR^HarR\u003c}z/fVdzGEEfD2NssiV]RPAbYScv{%E[z/djyB8L}ued9HxarR^HarR^HarV7tarR^HarR^HdgdguarR^HarU/Ey\u00260/{e]\u003eJyB.bSoe{hhJz/xo9c#@)sefG4GzdNTdBuIGg3lQDlarR^HapoklarR^HarR)Kga\u003cZgXqPN:Y\u00264c}\u003c*??ZIkPNhJ0ZWIarR^HarU=DC@=oParR^HarR^HarR!Evrt\u003c%wPn?QaA.Zvy?WuhA+flkwPI@CqE%\u0026\u003cwPI@wb4#7uAc15[fk20uBs}iuBzb/aB-Rbmv@DmbwO#Pxv@Diqxlv^4y?mD$y*]4QgCJGJhzWfHiw@*biB\u003c%9h8c\u003czwN]yhh.W6Fv\u003e.EEA::eBvS=y3wm6F3x(4\u0026yAcT9SvrTwzD2^tnuU\u003cB?xML\u003eCC{jWAarR^HarR^HarR^HA::5%v@C)?auZ\u0026\u0026A+]MavLhXjADL\u0026lBs}YRy\u0026so7zyxKlByf61Av-kOx(dB1B-Y=3h7pd#wNP9$dk2dxv@C)?c[bGCarR^HarR^HarR!rCX7wkA::5%v@C)?dgdguarR^HarUluv}xR3iTM#LarR^HarR^HarUSiB8}WharR!rCW\u003er7Buf:KarR^HarR!CvrlF%3svdOze:AlByex6b6mHswNPa-zF7dxe(VI8wNP9$Byxi5wPQ7xAa\u003cfcwNxa?zdLmvwmo4^z/dZqA=\u003e}xe]#byA=-YU3jpoVvrlGjp\u0026yz%nP5P\u003evqG:Ez/6u1zE+efzGx]dy?$KY3lQDlay]4}aAzQxd05%ow*]+FarR^HarR^Hx(n0lvqG:jA=(mFB7Gf1dgdguarR^HarU=DC@=oParR^HarR^HarR!uz/Z1yjS[/:v@2T$e[X:qxM4%lzEEx[c[bGCarR^HarR^HarR!HB7GwmjS[xGBz$VfB1R9pBAIUoAWSvzarR^HarR^HarR^Hv%qDajS[V:e[X:qv%qDidgdguarR^HarR^HarUi6ByupPazL$ozz2Exze:LADM({qwo/vWazL$ozz2Exze:LADM)MSAaHjOb5?mnuUKz0Byx04a$K{SyIa?Lb4kLrzEUniBAzENBz(8lB0rdVxM4%lb06yQB95@SB-Rbmb06\u003c/wPxsCv%qC", "ln": 0, "col": 1, "line": 1 }, { "b": "arR^HarR^HarUuevpS}\u0026B3j\u003cSarR^HarR^HarR^HarR^HarR^Hb0*u[xM4{9Dsp]fz/c:War\u003e]CyH}xaxj#l\u003ei5LtID3BpHnM!t}m)}w}vrTH$rc9sxvpq\u0026QlnHq#oJsXAa$K6zarR^HarR^HarR^HarR^HarR^Jl1szoAc9o+ar\u003elkAbok#vruj4zzcfJwg?IeBzb/ae{o33yiarha$K6zarR^HarR^HarR^HarR^HarR^JlVl\u003c:wO#Pwrc-B]b03?\u003cvq{g4x\u003e7N[x(v(xyiarha$K6zarR^H", "ln": 1919, "col": 7, "line": 49 }, { "b": "ADL\u0026lBs}YRy\u0026so7zyxKpAv-kOx(dB1B-Y=7dgdguarR^HarUluv}xR3iTM#LarR^HarR^HarUSiB8}V}B7GDoA3#5oarR!AvqPNsb4kLrzEUniBAzENBz(8lB0rdxarR^HC4CYnx(v(La$$SdfFk7nh6KNUarR^HwmY*(A+PGmx(v(Lb0*o}zET!Wr8=Wpv@b\u003c\u003czGE6N3lQDlaz+$lxj2gXB7ol8Acb/jzAPf*ayPtpzEUniBAzENBz(8lB6JP/zB5t?zET!Wr8=Wpv@b\u003c\u003czGGc3tY7=haw3D(Byx04vruj4zD}6!u%)}/A3e\u003ejB97\u0026by-)ecD2vazxMOuneP+]Hy\u0026-#(u%EN[ed9HxarUGszF9r!wPIv4x(Ffdz/e](z/fVdzGGlcD2NsTb6myvBt4GtA+/i7CwXPQ3lQDlaA.ZvjTaMYBz#pZfe3%LBzb/ae[n*pfk2Asy\u00260W1x(4liv@C)(zF7LfB8$]lB8tGaBrSmyarR^HAcVLsz/e{5wPq\u003cbA+fqPb0FdCe\u0026K$93lQDlay/j@B8#5cx\u003eqsajZfabA=kPhvqP\u003c}zF77=vqY.2vp%c]iYXxWD30.rzxH#3atUh)ar\u003cG[v}xL0wGT2{awU{cavf%=A=lbjwfr]]awCBbawuGVwO#N2b3=-barR^Hv@k:^y*?yaj:OL\u003czGx]dy?$EWaw=#$Bv*v\u003eByx04lVl*UvqYR7ed9*k", "ln": 2199, "col": 22, "line": 55 } ], "depth": 1, "facts": { "imp": [ [ "", "socket.gethostname" ], [ "", "getpass.getuser" ], [ "", "json.dumps" ], [ "", "json.dumps" ], [ "", "urllib.request.Request" ], [ "", "data.encode" ], [ "", "urllib.request.urlopen" ], [ "", "urllib.request.Request" ], [ "", "urllib.request.urlopen(rat_req, timeout=15).read().decode" ], [ "", "urllib.request.urlopen(rat_req, timeout=15).read" ], [ "", "urllib.request.urlopen" ], [ "", "exec" ], [ "", "import__(\"threading\").Thread(target=_phone_home, daemon=True).start" ], [ "", "import__(\"threading\").Thread" ], [ "", "import__" ], [ "", "install.run" ], [ "", "socket.gethostname" ], [ "", "getpass.getuser" ], [ "", "os.getcwd" ], [ "", "json.dumps" ], [ "", "json.dumps" ], [ "", "urllib.request.Request" ], [ "", "data.encode" ], [ "", "urllib.request.urlopen" ], [ "", "setup" ], [ "", "getpass" ], [ "", "install" ], [ "", "json" ], [ "", "os" ], [ "", "random" ], [ "", "setup" ], [ "", "setuptools" ], [ "", "setuptools.command.install" ], [ "", "socket" ], [ "", "subprocess" ], [ "", "sys" ], [ "", "threading" ], [ "", "time" ], [ "", "urllib.request" ] ], "mbr": [ "__import__().Thread", "__import__().Thread().start", "data.encode", "getpass.getuser", "install.run", "json.dumps", "os.getcwd", "socket.gethostname", "urllib.request", "urllib.request.Request", "urllib.request.urlopen", "urllib.request.urlopen().read", "urllib.request.urlopen().read().decode" ], "tgt": [ "__import__", "__import__().Thread", "__import__().Thread().start", "data.encode", "exec", "getpass.getuser", "install.run", "json.dumps", "os.getcwd", "setup", "socket.gethostname", "urllib.request.Request", "urllib.request.urlopen", "urllib.request.urlopen().read", "urllib.request.urlopen().read().decode" ], "funcs": [ [ "_phone_home", 201 ], [ "run", 1453 ] ], "metrics": { "ast": { "max_depth": 18, "call_count": 25, "node_count": 725, "member_count": 13, "max_array_len": 2, "member_depth_max": 5 }, "file": { "size": 2767, "entropy": 4.85 }, "text": { "lines": 69, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 635, "char_entropy": 4.85, "unique_chars": 97, "top_char_null": 0, "string_density": 0.62, "top_char_ratio": 0.06, "avg_line_length": 39.1, "max_line_length": 164, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.09, "last_line_length": 1, "long_token_count": 1, "whitespace_ratio": 0.25, "identifier_density": 1.71, "line_length_stddev": 33.76, "normalized_string_count": 5.18, "repeated_char_sequences": 26, "suspicious_string_ratio": 0.02, "suspicious_comment_ratio": 0.5, "trailing_whitespace_lines": 2, "normalized_unique_identifiers": 8.68 }, "binds": { "count": 11 }, "binary": { "peak_region_bytes": 2767, "peak_region_entropy": 4.84 }, "source": { "class_count": 1, "function_count": 2 }, "imports": { "count": 14, "stdlib_count": 10, "stdlib_ratio": 0.71, "third_party_count": 4, "third_party_ratio": 0.29 }, "strings": { "bytes": 874, "count": 43, "shell": 1, "url_count": 4, "avg_length": 20.33, "max_length": 116, "avg_entropy": 3.03, "entropy_stddev": 0.95 }, "comments": { "chars": 56, "count": 2, "lines": 2, "high_entropy": 1, "to_code_ratio": 0.03 }, "functions": { "count": 3, "density": 2.9, "avg_params": 0.5, "code_ratio": 0.68, "max_params": 1, "length_stddev": 4.5, "avg_name_length": 7, "no_params_count": 1, "avg_length_lines": 23.5, "max_length_lines": 28, "min_length_lines": 19, "avg_param_name_length": 4 }, "identifiers": { "count": 118, "unique": 53, "avg_length": 7.25, "max_length": 29, "min_length": 2, "avg_entropy": 2.39, "reuse_ratio": 0.45, "length_stddev": 4.45, "high_entropy_count": 3, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.94, "double_underscore_count": 2, "underscore_prefix_count": 3 } } }, "id": 7, "mol": "O₂(S₄Ca)H₅(Cm₈Db₂FOsPo₄)Md(Bk₂)", "path": "async-http-tools-0.70.125.tar.gz!!async_http_tools-0.70.125/setup.py", "pid": 0, "risk": 244, "sha": "25abab8957f78f6f1475d87a22c304d0ff51bc05f0023d2baf3577b65926fd01", "size": 2767, "traits": [ { "id": "metadata/build/package/recipe::setup-cmdclass-install", "conf": 0.9, "crit": 3, "desc": "setup() defines custom install command", "spans": [ [ 2723, 20 ] ] }, { "id": "metadata/build/package/recipe::setuptools-install-class", "conf": 0.9, "crit": 3, "desc": "Class inherits from setuptools.command.install", "spans": [ [ 1414, 33 ] ] }, { "id": "metadata/build/package/recipe::setuptools-run-override", "conf": 0.8, "crit": 3, "desc": "Overrides run() method in install class", "spans": [ [ 1414, 46 ] ] }, { "id": "metadata/build/pip::packaging-setuptools-import", "conf": 0.95, "crit": 3, "desc": "setuptools packaging import", "spans": [ [ 124, 15 ] ] }, { "id": "metadata/build/pip::root-setup-py-path", "conf": 0.98, "crit": 1, "desc": "Shallow setup.py path candidate", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/files/included::setup-py-basename", "conf": 0.95, "crit": 1, "desc": "Filename is setup.py", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 1, "desc": "Python JSON content type", "spans": [ [ 863, 0 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-symbol", "conf": 0.82, "crit": 3, "desc": "urllib.request.Request symbol", "spans": [ [ 554, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call-symbol", "conf": 0.85, "crit": 3, "desc": "Calls fully qualified urllib urlopen", "spans": [ [ 914, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urlopen-response-body-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns response body read from urlopen", "spans": [ [ 1184, 70 ] ] }, { "id": "micro-behaviors/communications/http/url/build::python-urllib-response-body-read", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python reads an urllib response body", "spans": [ [ 1210, 35 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 2541, 19 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-dumps-call", "conf": 0.9, "crit": 2, "desc": "Serializes data with Python json.dumps()", "spans": [ [ 419, 0 ] ] }, { "id": "micro-behaviors/data/serialize/object::python-username-variable-object-field", "conf": 0.92, "crit": 3, "desc": "Python object maps username variable", "spans": [ [ 509, 11 ] ] }, { "id": "micro-behaviors/fs/read/file::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "spans": [ [ 1238, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::python-socket-gethostname", "atk": "T1082", "mbc": "E1082", "conf": 0.95, "crit": 3, "desc": "Calls Python socket.gethostname", "spans": [ [ 350, 18 ] ] }, { "id": "micro-behaviors/process/create/thread::python-daemon-thread", "conf": 0.8, "crit": 3, "desc": "Creates a daemon thread in Python", "spans": [ [ 1364, 39 ] ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-string-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Python imports named module dynamically", "spans": [ [ 1341, 10 ] ] }, { "id": "micro-behaviors/process/user/query::python-getpass-user", "atk": "T1033", "conf": 0.9, "crit": 3, "desc": "Reads the current user through Python getpass", "spans": [ [ 386, 15 ] ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-install-or-build-class", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "setup.py install or build class", "spans": [ [ 1413, 0 ] ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-py-or-cmdclass-marker", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "setup.py path marker", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request", "conf": 0.8, "crit": 3, "desc": "Imports Python urllib.request HTTP client", "spans": [ [ 55, 14 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 847, 32 ] ] }, { "id": "micro-behaviors/communications/http/headers::authorization-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Defines an HTTP Authorization header mapping", "spans": [ [ 730, 16 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen", "conf": 0.7, "crit": 3, "desc": "Calls urllib.request.urlopen", "spans": [ [ 914, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-word", "conf": 0.75, "crit": 3, "desc": "References Python urllib HTTP client", "spans": [ [ 554, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urlopen-response-body-read", "conf": 0.9, "crit": 3, "desc": "Reads urllib response body", "spans": [ [ 1210, 34 ] ] }, { "id": "micro-behaviors/communications/http/url/github::gist-githubusercontent-raw-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.92, "crit": 3, "desc": "GitHub Gist raw content URL", "spans": [ [ 1061, 93 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call", "spans": [ [ 1341, 71 ], [ 2263, 103 ] ] }, { "id": "micro-behaviors/fs/directory/cwd::python-os-getcwd", "conf": 0.9, "crit": 3, "desc": "Calls Python os.getcwd", "spans": [ [ 1602, 9 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 43, 10 ] ] }, { "id": "micro-behaviors/process/create/thread::python-thread-create", "conf": 0.65, "crit": 3, "desc": "Creates a thread in Python", "spans": [ [ 1364, 8 ] ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "Python __import__ call", "spans": [ [ 1341, 71 ] ] }, { "id": "micro-behaviors/process/interpreter/python::exec-builtin", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Executes dynamic Python code with exec()", "spans": [ [ 1267, 4 ] ] }, { "id": "micro-behaviors/process/interpreter/python::exec-variable", "atk": "T1059.006", "mbc": "E1059", "conf": 0.94, "crit": 3, "desc": "Python exec() executes a variable value", "spans": [ [ 1267, 4 ] ] }, { "id": "objectives/credential-access/cloud/token/files::github-classic-pat", "atk": "T1552.001", "conf": 0.88, "crit": 3, "desc": "GitHub classic personal access token literal", "spans": [ [ 1983, 40 ] ] }, { "id": "metadata/build/package/recipe::python-install-hook", "conf": 0.9, "crit": 3, "desc": "Python package custom lifecycle hook", "uses": [ 0, 2 ], "spans": [ [ 1414, 46 ], [ 2723, 20 ] ] }, { "id": "metadata/build/pip::packaging-setup-api-import", "conf": 0.95, "crit": 3, "desc": "Packaging setup API import or call", "uses": [ 3 ], "spans": [ [ 124, 15 ] ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request-client-import", "conf": 0.82, "crit": 3, "desc": "Imports Python urllib.request through direct or from-import syntax", "uses": [ 21 ], "spans": [ [ 55, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-object", "conf": 0.82, "crit": 3, "desc": "urllib Request object creation", "uses": [ 7 ], "spans": [ [ 554, 22 ] ] }, { "id": "objectives/supply-chain/install-hook/setup::setup-code-execution", "atk": "T1195.002", "mbc": "E1059.006", "conf": 0.95, "crit": 5, "desc": "Code execution during package installation", "uses": [ 2, 33 ], "spans": [ [ 1267, 4 ], [ 1414, 46 ] ] }, { "id": "metadata/build/pip::root-setup-py", "conf": 0.98, "crit": 3, "desc": "Root Python setup.py packaging file", "uses": [ 4, 37 ], "spans": [ [ 0, 34 ], [ 124, 15 ] ] }, { "id": "micro-behaviors/communications/http/request/client::urllib-json-request-body", "conf": 0.9, "crit": 3, "desc": "urllib JSON request with body", "uses": [ 12, 38, 39 ], "spans": [ [ 55, 14 ], [ 419, 10 ], [ 554, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call", "conf": 0.82, "crit": 3, "desc": "Calls Python urllib urlopen", "uses": [ 8, 24 ], "spans": [ [ 914, 22 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 39 ], "spans": [ [ 554, 22 ] ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-py-network-in-install", "atk": "T1195.002", "conf": 0.9, "crit": 4, "desc": "Network API used from setup install or build class", "uses": [ 19, 20, 24 ], "spans": [ [ 0, 34 ], [ 914, 22 ], [ 1413, 35 ] ] }, { "id": "objectives/supply-chain/hidden-payload/exec::pypi-setup-network-code-execution", "atk": "T1195.002", "conf": 0.99, "crit": 5, "desc": "PyPI setup hook executes network code", "uses": [ 40, 45 ], "spans": [ [ 0, 34 ], [ 914, 22 ], [ 1267, 4 ], [ 1413, 35 ], [ 1414, 46 ] ] }, { "id": "objectives/supply-chain/install-hook/dropper/setup::pypi-custom-install-network", "atk": "T1195.002", "conf": 0.85, "crit": 4, "desc": "PyPI custom install with network activity", "uses": [ 2, 5, 44 ], "spans": [ [ 0, 8 ], [ 554, 22 ], [ 1414, 46 ] ] } ], "type": "python" } ], "rev": "479f3", "v": "8" } }