{ "ml": { "v": "7", "eng": "2.2.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.05761084, "rte": "az", "prob": 0.05761084 } ], "prob": 0.05761084, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.05761083960533142, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.009726841934025288, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00985120702534914, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000010738770470197778, "type": "kotlin" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00001286466886085691, "type": "kotlin" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000010579824447631836, "type": "kotlin" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000011156002983625513, "type": "kotlin" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000010967254638671875, "type": "kotlin" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000011960665688093286, "type": "kotlin" } ], "version": "v18.18", "analyzed_at": "2026-06-29T00:46:24Z" }, "path": "tex-forest-2.1.5.tgz", "raw": { "files": [ { "id": 0, "mol": "O(Er)H(Po₂)", "sha": "e3de53bce69300f445490b22a244d7365230ca23bcf3da10c7cd40367dca8f6d", "path": "tex-forest-2.1.5.tgz", "risk": 4, "size": 59328, "type": "xz", "facts": { "metrics": { "file": { "size": 59328.0, "entropy": 8.0, "size_bytes": 59328.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 59328.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with" }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path" }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)" }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 1 }, { "file": 2 } ], "spans": [ [ 0, 34 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] } ] }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 9, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "2{QM\u003cwO(vewGV5cwO=g7azbUjz6gGyByM$BxK#0@B1N", "ln": 108, "addr": 2025 }, { "b": "2{P", "ln": 109, "addr": 2060 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2080, "z": 5, "cf": 0.5 } ], "ln": 110, "addr": 2063 }, { "b": "2)\u0026jqd]O#coIuNbmnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ee", "ln": 111, "addr": 2089 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 112, "addr": 2127 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 7.0, "bind_count": 55.0, "call_count": 33.0, "node_count": 782.0, "identifier_count": 82.0, "string_literal_count": 53.0 }, "file": { "size": 3268.0, "entropy": 5.79, "size_bytes": 3268.0 }, "text": { "tab_count": 74.0, "digit_ratio": 0.04, "space_count": 216.0, "total_lines": 160.0, "char_entropy": 5.79, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.33, "avg_line_length": 19.43, "max_line_length": 71.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.05, "identifier_density": 1.27, "line_length_stddev": 16.79, "normalized_string_count": 4.19, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.47 }, "binds": { "count": 55.0 }, "calls": { "count": 33.0, "dynamic_target_count": 15.0 }, "binary": { "overall_entropy": 5.79, "peak_region_bytes": 3268.0, "peak_region_entropy": 5.79 }, "strings": { "total": 53.0, "avg_length": 10.7, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.85, "empty_count": 2.0, "total_bytes": 567.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 696.0, "lines": 17.0, "total": 39.0, "to_code_ratio": 0.12, "empty_comments": 22.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 82.0, "total": 203.0, "avg_length": 6.88, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.25, "reuse_ratio": 0.41, "unique_count": 84.0, "length_stddev": 5.18, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.04, "all_uppercase_ratio": 0.7, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 1, "mol": "O(Er)H(Po₂)", "path": "tex-forest-2.1.5.tgz!!+DEINSTALL", "risk": 4, "sha": "eed7b5220261ff75c702959c7b59bc2e65250151ff174ad0a289b751245b6b11", "size": 3268, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 9, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "2{QM\u003cwOkZ#By/FnB7/c3y\u0026Z.kzxHPzByM$BxK#0@B1N", "ln": 142, "addr": 2924 }, { "b": "2{P", "ln": 143, "addr": 2959 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2979, "z": 5, "cf": 0.5 } ], "ln": 144, "addr": 2962 }, { "b": "2)\u0026jqd]O#coIuM{l{@dyDR^v9uRJ%*k$11rl0)2KqHF", "ln": 145, "addr": 2988 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 146, "addr": 3023 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "{SH}" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "exit" ], [ "", "exit" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+PERMS" ], [ "", "./+PERMS" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${SH}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+PERMS", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 9.0, "bind_count": 55.0, "call_count": 43.0, "node_count": 882.0, "identifier_count": 84.0, "string_literal_count": 53.0 }, "file": { "size": 3621.0, "entropy": 5.73, "size_bytes": 3621.0 }, "text": { "tab_count": 96.0, "digit_ratio": 0.04, "space_count": 283.0, "total_lines": 177.0, "char_entropy": 5.73, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.3, "avg_line_length": 19.46, "max_line_length": 73.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.04, "identifier_density": 1.36, "line_length_stddev": 16.64, "normalized_string_count": 3.98, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.65 }, "binds": { "count": 55.0 }, "calls": { "count": 43.0, "dynamic_target_count": 19.0 }, "binary": { "overall_entropy": 5.73, "peak_region_bytes": 3621.0, "peak_region_entropy": 5.71 }, "strings": { "total": 53.0, "avg_length": 10.7, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.85, "empty_count": 2.0, "total_bytes": 567.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 762.0, "lines": 18.0, "total": 42.0, "to_code_ratio": 0.11, "empty_comments": 24.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 84.0, "total": 241.0, "avg_length": 6.68, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.24, "reuse_ratio": 0.36, "unique_count": 87.0, "length_stddev": 4.98, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.03, "all_uppercase_ratio": 0.68, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "O(Er)H(Po₂)", "path": "tex-forest-2.1.5.tgz!!+INSTALL", "risk": 4, "sha": "5796bd43e9e8025c4dde10a52e565c175744cebdf994713a1c706c1e0809491b", "size": 3621, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "b{:WPvrlutDtdLhzF%Yjv)BWHwPI@Cvrcl%B1RJF", "ln": 8, "addr": 233 }, { "b": "b{-", "ln": 9, "addr": 266 }, { "b": "b{:WkxLzJgCw?Iqaz\u003eLjayX[8wncabA+P09By!#9vqYQez/M$qz!9M]x\u003ep/$B-7-3AV/EqwD", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 272, "z": 4, "cf": 0.800000011920929 } ], "ln": 10, "addr": 269 }, { "b": "b{:Wzz/f91BzkVhB0bykaARpdawuiywMQ6KA=kY7v@@?\u0026BZ/f3v\u003c1DVv}xL0wH[%nx([31AV/KpA=U@kzxHU^gx", "n": [ { "c": 1, "d": "Project/workspace target word", "i": "objectives/impact/destroy/keywords::target-project", "o": 354, "z": 7, "cf": 0.8600000143051147 } ], "ln": 11, "addr": 327 }, { "b": "b{:WLw/#hex(+zkx\u003e7Z(B7DFjAV==sBrC\u003cEB-FQyAcb/jzyDYpzH0vvvru73aA?spB7]Mge=", "ln": 12, "addr": 397 }, { "b": "b{:WkxK@r5vru74BrC:rA=U@kzxJ\u003efaARphB0bpkv}xL0wGUYdazCY", "ln": 13, "addr": 455 }, { "b": "b{:V", "ln": 21, "addr": 719 }, { "b": "b{:WkxLzJgw[=6)azC)tvixI$A=-Bxw/#53v@2H=wGUw)z/PAgBseW-mSiq\u0026Bzbkdy?W%jaA7\u003cmw[=6)A@", "ln": 22, "addr": 723 }, { "b": "b{:Wzz/fSrx([Gtx(mMaBzbkdAa9l(vp%c]B7F]9zddc@aAIEzA:@V6w[=6)aA7\u003cmBzbkdAa9l(vp%d5", "n": [ { "c": 1, "d": "Source/test target word", "i": "objectives/impact/destroy/keywords::target-source-test", "o": 826, "z": 11, "cf": 0.8799999952316284 } ], "ln": 23, "addr": 789 }, { "b": "b{:Www]zZ3B963BBA/e:aA8oyBzbkdwmY^}C4Chbu$Ks$wPI@CB98WPe=", "ln": 24, "addr": 854 }, { "b": "", "ln": 25, "addr": 900 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 2.0, "call_count": 0.0, "node_count": 4.0 }, "file": { "size": 10205.0, "entropy": 4.84, "size_bytes": 10205.0 }, "text": { "digit_ratio": 0.04, "space_count": 1630.0, "total_lines": 271.0, "char_entropy": 4.84, "unique_chars": 75.0, "avg_line_length": 36.66, "max_line_length": 163.0, "empty_line_ratio": 0.01, "last_line_length": 53.0, "long_token_count": 3.0, "whitespace_ratio": 0.19, "most_common_ratio": 0.09, "line_length_stddev": 30.97, "repeated_char_sequences": 16.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 25.0, "trailing_whitespace_lines": 4.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 4.84, "peak_region_bytes": 9181.0, "peak_region_entropy": 4.89 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.source_as_unknown": 1.0 } } }, "id": 3, "path": "tex-forest-2.1.5.tgz!!share/texmf-dist/tex/latex/forest/forest-compat.sty", "risk": 1, "sha": "39390595e0b9a3c8b06fc7782a7a530072946e508ef61b5e62234fb83194f506", "size": 10205, "traits": [ { "id": "objectives/impact/destroy/keywords::target-project", "conf": 0.8600000143051147, "crit": 1, "desc": "Project/workspace target word", "spans": [ [ 354, 7 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 272, 4 ] ] }, { "id": "objectives/impact/destroy/keywords::target-source-test", "conf": 0.8799999952316284, "crit": 1, "desc": "Source/test target word", "spans": [ [ 826, 11 ] ] } ], "type": "kotlin" }, { "ctx": [ { "b": "b{-", "ln": 1, "addr": 0 }, { "b": "b{:WkxLzJgx(+zex(4u6u$Ks$wPI@CB98WPec", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 6, "z": 4, "cf": 0.800000011920929 } ], "ln": 2, "addr": 3 }, { "b": "b{:WDwO#71vru6\u003eaA}KwxDRzgwGUJ4v@(:jx(ChqBzkM9BA]F", "ln": 3, "addr": 33 }, { "b": "b{-", "ln": 4, "addr": 73 }, { "b": "b{:WkxK@r8A+Pf2zEEu7B8Mhwv}u={x(4v4aA}yqwJx", "n": [ { "c": 1, "d": "Source/test target word", "i": "objectives/impact/destroy/keywords::target-source-test", "o": 92, "z": 12, "cf": 0.8799999952316284 } ], "ln": 5, "addr": 76 }, { "b": "b{-", "ln": 6, "addr": 111 }, { "b": "b{:WCz/PAgBs}9CCPV", "ln": 7, "addr": 114 }, { "b": "b{-", "ln": 14, "addr": 341 }, { "b": "b{:WkxLzJgCw?Iqaz\u003eLjayX[8wncabA+P09By!#9vqYQez/M$qz!9M]x\u003ep/$B-7-3AV/EqwD", "ln": 15, "addr": 344 }, { "b": "b{:Wzz/f91BzkVhB0bykaARpdawuiywMQ6KA=kY7v@@?\u0026BZ/f3v\u003c1DVv}xL0wH[%nx([31AV/KpA=U@kzxHU^gx", "n": [ { "c": 1, "d": "Project/workspace target word", "i": "objectives/impact/destroy/keywords::target-project", "o": 429, "z": 7, "cf": 0.8600000143051147 } ], "ln": 16, "addr": 402 }, { "b": "b{:WLw/#hex(+zkx\u003e7Z(B7DFjAV==sBrC\u003cEB-FQyAcb/jzyDYpzH0vvvru73aA?spB7]Mge=", "ln": 17, "addr": 472 }, { "b": "b{:WkxK@r5vru74BrC:rA=U@kzxJ\u003efaARphB0bpkv}xL0wGUYdazCY", "ln": 18, "addr": 530 }, { "b": "arT{0B7w\u0026]DM$m!z/xojBy/u2Es2jfwObgVz/PAgBu\u003cnPA::kUv%8*jwO#P#A=LPlDM$m[tXm[{wPI@Uvrcx%C%DE\u0026AaKoowO#4bb(", "ln": 710, "addr": 27862 }, { "b": "Ee", "ln": 711, "addr": 27944 }, { "b": "tX4zTtXm[{wPI@Uvrcx%C%DE\u0026AaKoowO#49tXnb2B-I5fwPRf?z/PAgBu\u003cnRwK7cACYVh)z!\u0026{4tXm[{wPI@Uvru6Cv}YB-yI4H9B8UL$wQK", "n": [ { "c": 1, "d": "Credential-access vocabulary word: token", "i": "objectives/credential-access/theft/keywords::token", "o": 28001, "z": 5, "cf": 0.30000001192092896 } ], "ln": 712, "addr": 27946 }, { "b": "tX4zTtXm[{wPI@Uvru6Cv}YB-yI4H9B8UL$wQtZ", "ln": 713, "addr": 28033 }, { "b": "arT{2CYm8ewmo7(wPz3\u0026w{vN4Aa9l/tXm[{wPI@Uvru6CzE[6mkY*{WwO}", "ln": 714, "addr": 28065 }, { "b": "Ee", "ln": 2942, "addr": 104447 }, { "b": "tX4zTtXm[{wPI@UwmYvrAb](bwPI{hAZg\u003c7bqKP(", "ln": 2943, "addr": 104449 }, { "b": "arR%Mbqyr7azC.mBAhIlBzkVhay/7[AV==Fz/PY6y-)j@ByPl1wHPeMbqHx8azC.mBAhIlBzkVhay/7[AV==sv@#BdwHN", "n": [ { "c": 1, "d": "LLM prompt/instruction marker component", "i": "objectives/evasion/security-bypass/llm/override::llm-instruction-marker", "o": 104491, "z": 11, "cf": 0.7200000286102295 } ], "ln": 2944, "addr": 104482 }, { "b": "arR%MbqQD9ay]4}vrDydaz@qIz/x/jz/f01az#sswPzG{ayPq6efGdIx\u003e7*0Ab]J1wN]v[ayPekaA8vnwPw]4A+xCP", "ln": 2945, "addr": 104557 }, { "b": "arR%MarR^HarR^HarR^HarR^Hx\u003ewGfxK@q%wObv[y\u0026*!lB0b4hAccvRaARphB0bshvqZcezF{UoAcb/jzEEu7zyC", "ln": 2946, "addr": 104630 }, { "b": "tW}?=wOcp3z/PAgBu\u003cwFw\u003cyl0iEJbbDT78)w*o2Pbqyz/g9X21bo]2\u0026bq*X\u003chx%C9bo]e)brpe", "ln": 3192, "addr": 114471 }, { "b": "tXm[{wPI@UwmYvrAb](bwPI{hA^I\u003eQDOG}}Es0m", "ln": 3193, "addr": 114531 }, { "b": "arT{3z/PAgBu\u003c}Vze:PqB.8WrasedvwO+}1wGV8dwGU]ix\u003eIc$vqG#", "n": [ { "c": 1, "d": "Destructive-action word: delete", "i": "objectives/impact/destroy/keywords::delete-verb--delete", "o": 114586, "z": 6, "cf": 0.8999999761581421 } ], "ln": 3194, "addr": 114563 }, { "b": "arT{2CYm8ewmo7(wPz3/z/PAgBu\u003c!=z!0v1B8M7:B76l6tXee0vqYQ:w]}Q8DNe", "ln": 3195, "addr": 114607 }, { "b": "arR^HarT{hxK$B^B.$YmAb]h}z/PAgBu\u003c!=z!0v1B3KLMw]{pkeNh[aA+frlkYy:Zv}x.5kYh0#", "ln": 3196, "addr": 114658 }, { "b": "arR^HarV2owQ5f5zE^W6v}y0(w]zZ3B96V+z!9B2z/P}+A+frmy\u0026\u003ccmEi!", "ln": 6009, "addr": 229704 }, { "b": "arR^HEi!", "ln": 6010, "addr": 229751 }, { "b": "arR^HtZf^\u003cw)w}^A+frlkXB[KvQT7rBy/rdDT7f3A+frlkY*NOAd62", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 229758, "z": 30, "cf": 0.8999999761581421 } ], "ln": 6011, "addr": 229758 }, { "b": "arV7U", "ln": 6012, "addr": 229802 }, { "b": "arT{6w\u003c6yhz/PAgBu\u003cFPz^)c\u003ekY*NOz#", "ln": 6013, "addr": 229807 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 3.0, "call_count": 0.0, "node_count": 13.0, "identifier_count": 2.0 }, "file": { "size": 350382.0, "entropy": 4.81, "size_bytes": 350382.0 }, "text": { "digit_ratio": 0.03, "space_count": 33784.0, "total_lines": 9259.0, "char_entropy": 4.81, "unique_chars": 95.0, "escape_density": 0.03, "lines_over_200": 14.0, "avg_line_length": 36.84, "high_byte_ratio": 0.0, "max_line_length": 377.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.0, "hex_escape_count": 3.0, "last_line_length": 28.0, "long_token_count": 121.0, "whitespace_ratio": 0.12, "most_common_ratio": 0.1, "identifier_density": 0.0, "line_length_stddev": 28.58, "unicode_escape_count": 111.0, "repeated_char_sequences": 255.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 25.0, "trailing_whitespace_lines": 2.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 0.15 }, "binary": { "overall_entropy": 4.81, "peak_region_bytes": 201902.0, "peak_region_entropy": 5.05 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.source_as_unknown": 1.0 }, "identifiers": { "count": 2.0, "total": 2.0, "avg_length": 4.0, "max_length": 4.0, "min_length": 4.0, "avg_entropy": 2.0, "reuse_ratio": 1.0, "unique_count": 2.0, "all_lowercase_ratio": 0.5 } } }, "id": 4, "path": "tex-forest-2.1.5.tgz!!share/texmf-dist/tex/latex/forest/forest.sty", "risk": 1, "sha": "d76fb1da47f5a92e1f41cd2cbd928f7de85acfb3c2fbd8d7ae8f2fef9fff376e", "size": 350382, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 6, 4 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 114586, 6 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive removal-word component", "spans": [ [ 114586, 6 ] ] }, { "id": "metadata/encoded-payload/unicode-escape", "conf": 0.8999999761581421, "crit": 2, "desc": "Decoded unicode-escape content", "spans": [ [ 229758, 30 ] ] } ], "type": "kotlin" }, { "ctx": [ { "b": "b{-", "ln": 1, "addr": 0 }, { "b": "b{:WkxLzJgx(+zex(4u6u$Ks$wPI@By?WugwN]B+B1RJQC{+c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 6, "z": 4, "cf": 0.800000011920929 } ], "ln": 2, "addr": 3 }, { "b": "b{:WDwO#71vru6\u003eaA}KwxDRzgwGUJ4v@(:jx(ChqBzkM9BA]F", "ln": 3, "addr": 43 }, { "b": "b{-", "ln": 4, "addr": 83 }, { "b": "b{:WkxK@r8A+Pf2zEEu7B8Mhwv}u={x(4v4aA}yqwJx", "n": [ { "c": 1, "d": "Source/test target word", "i": "objectives/impact/destroy/keywords::target-source-test", "o": 102, "z": 12, "cf": 0.8799999952316284 } ], "ln": 5, "addr": 86 }, { "b": "b{-", "ln": 6, "addr": 121 }, { "b": "b{:WCz/PAgBs?ryvSKejBA!]Jd0GxExDRkjBzkVhB2\u003eBKwN]B+B0\u0026y", "ln": 7, "addr": 124 }, { "b": "b{-", "ln": 14, "addr": 369 }, { "b": "b{:WkxLzJgCw?Iqaz\u003eLjayX[8wncabA+P09By!#9vqYQez/M$qz!9M]x\u003ep/$B-7-3AV/EqwD", "ln": 15, "addr": 372 }, { "b": "b{:Wzz/f91BzkVhB0bykaARpdawuiywMQ6KA=kY7v@@?\u0026BZ/f3v\u003c1DVv}xL0wH[%nx([31AV/KpA=U@kzxHU^gx", "n": [ { "c": 1, "d": "Project/workspace target word", "i": "objectives/impact/destroy/keywords::target-project", "o": 457, "z": 7, "cf": 0.8600000143051147 } ], "ln": 16, "addr": 430 }, { "b": "b{:WLw/#hex(+zkx\u003e7Z(B7DFjAV==sBrC\u003cEB-FQyAcb/jzyDYpzH0vvvru73aA?spB7]Mge=", "ln": 17, "addr": 500 }, { "b": "b{:WkxK@r5vru74BrC:rA=U@kzxJ\u003efaARphB0bpkv}xL0wGUYdazCY", "ln": 18, "addr": 558 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 3.0, "call_count": 0.0, "node_count": 13.0, "identifier_count": 2.0 }, "file": { "size": 2255.0, "entropy": 4.89, "size_bytes": 2255.0 }, "text": { "digit_ratio": 0.03, "space_count": 372.0, "total_lines": 77.0, "char_entropy": 4.89, "unique_chars": 70.0, "avg_line_length": 28.29, "max_line_length": 88.0, "last_line_length": 38.0, "whitespace_ratio": 0.2, "most_common_ratio": 0.08, "identifier_density": 0.03, "line_length_stddev": 22.08, "repeated_char_sequences": 3.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 20.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 0.32 }, "binary": { "overall_entropy": 4.89, "peak_region_bytes": 2255.0, "peak_region_entropy": 4.77 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.source_as_unknown": 1.0 }, "identifiers": { "count": 2.0, "total": 2.0, "avg_length": 4.0, "max_length": 4.0, "min_length": 4.0, "avg_entropy": 2.0, "reuse_ratio": 1.0, "unique_count": 2.0, "all_lowercase_ratio": 0.5 } } }, "id": 5, "path": "tex-forest-2.1.5.tgz!!share/texmf-dist/tex/latex/forest/forest-lib-edges.sty", "risk": 1, "sha": "4f62d58df831a324c6da1d6a49bac0399e185b4266b1a12493370f1c94e75d13", "size": 2255, "traits": [ { "id": "objectives/impact/destroy/keywords::target-project", "conf": 0.8600000143051147, "crit": 1, "desc": "Project/workspace target word", "spans": [ [ 457, 7 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 6, 4 ] ] }, { "id": "objectives/impact/destroy/keywords::target-source-test", "conf": 0.8799999952316284, "crit": 1, "desc": "Source/test target word", "spans": [ [ 102, 12 ] ] } ], "type": "kotlin" }, { "id": 6, "sha": "52880cb63fc8f815a6c17234f88750f7fa9d3225b8423915c5a3fd1d952a3ce2", "path": "tex-forest-2.1.5.tgz!!share/texmf-dist/tex/latex/forest/forest-lib-linguistics.sty", "risk": 1, "size": 4491, "type": "kotlin", "depth": 1 }, { "id": 7, "sha": "992c2ab7ffd0fd608285d83a60daed0bcf3a337473897bd374737b02fc9836ff", "path": "tex-forest-2.1.5.tgz!!share/texmf-dist/tex/latex/forest/forest-index.sty", "risk": 1, "size": 16270, "type": "kotlin", "depth": 1 }, { "id": 8, "sha": "6bf834eae47db5e7c2656595903d1b85a8d6724af54cb11ac7ec48ccf7eaeeba", "path": "tex-forest-2.1.5.tgz!!share/texmf-dist/tex/latex/forest/forest-doc.sty", "risk": 1, "size": 8576, "type": "kotlin", "depth": 1 } ], "omitted_files": 3, "rev": "46112", "v": "8" } }