{ "ml": { "v": "7", "id": 248, "lvl": -1, "conf": 0, "prob": 0.000025947889298549853, "type": "javascript", "version": "v18.18", "analyzed_at": "2026-09-22T17:35:52Z" }, "path": "github-releases-to-discord@v1.13.1", "raw": { "rev": "75c9b", "files": [ { "id": 337, "mol": "K₄(AmLi₄McTe₄)O₈(As₃C₅Ca₃ErEu₂I₄S₈Xe₄)H₇(Cm₄₇Cr₃Db₄₀F₇Os₁₁Po₉U₂)Md₆(Bk₄In₂₅Pa₁₉Pt₃)", "pid": 9, "rel": "fetched", "sha": "e6cd255a9b74f2326308d87469bfe92613c6cfd9ffdbbc74a04e9f645bf9199e", "via": "https://codeload.github.com/sethcohen/github-releases-to-discord/tar.gz/v1.13.1", "path": "pkg:github/sethcohen/github-releases-to-discord@v1.13.1", "risk": 94, "size": 2210763, "type": "gz", "depth": 2, "facts": { "metrics": { "file": { "size": 2210763, "entropy": 8 }, "binary": { "peak_region_bytes": 2205643, "peak_region_entropy": 7.86 }, "consistency": { "self_dependency": 0, "unused_runtime_deps": 0 } } }, "traits": [ { "id": "micro-behaviors/data/string/concat::join-empty-separator-call", "conf": 0.82, "crit": 3, "desc": "Joins values without a separator", "from": [ { "file": 13 } ] }, { "id": "metadata/import/npm/relative/1/endpoints-to-methods::relative/1/endpoints-to-methods", "conf": 0.95, "crit": 2, "desc": "imports ./endpoints-to-methods", "from": [ { "file": 301 } ] }, { "id": "metadata/package/scripts/build::has-release-scripts-2", "conf": 1.0, "crit": 3, "desc": "Package release management scripts (pre/post)", "from": [ { "file": 199 } ] }, { "id": "micro-behaviors/os/telemetry/logging/llm::agent-session-repository-field", "mbc": "C0069", "conf": 0.9, "crit": 3, "desc": "Agent telemetry repository identity field", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/relative/1/errors/base/js::relative/1/errors/base/js", "conf": 0.95, "crit": 2, "desc": "imports ./errors/base.js", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/communications/http/message::http-message-json-call", "conf": 0.9, "crit": 3, "desc": "Calls JSON method on HTTP-style object", "from": [ { "file": 267 } ] }, { "id": "metadata/build/ci/github-actions::types-dts-basename", "conf": 0.94, "crit": 2, "desc": "TypeScript declaration basename", "from": [ { "file": 284 } ] }, { "id": "objectives/credential-access/env/secrets/source-control::github-token-indicators", "atk": "T1552.001", "conf": 0.7, "crit": 3, "desc": "GitHub token variable indicators", "from": [ { "off": 41684, "file": 297, "line": 737 }, { "off": 32235, "file": 330, "line": 306 }, { "off": 1820, "file": 426, "line": 41 }, { "off": 620, "file": 427, "line": 12 }, { "off": 1209, "file": 435, "line": 29 }, { "off": 306, "file": 436, "line": 8 } ], "uses": [ 256 ] }, { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "micro-behaviors/os/env/cicd::github-path-file", "conf": 0.85, "crit": 3, "desc": "GITHUB_PATH environment file", "from": [ { "file": 458 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-trailing-iife-closure", "conf": 0.85, "crit": 3, "desc": "JavaScript file ends with an IIFE", "from": [ { "file": 192 } ] }, { "id": "micro-behaviors/data/source/property/attributes::define-property-variable-arguments", "conf": 0.92, "crit": 3, "desc": "Defines an object property using variables", "from": [ { "file": 261 } ] }, { "id": "metadata/import/npm/relative/1/auth::relative/1/auth", "conf": 0.95, "crit": 2, "desc": "imports ./auth", "from": [ { "file": 404 } ] }, { "id": "metadata/import/npm/relative/1/body/js::relative/1/body/js", "conf": 0.95, "crit": 2, "desc": "imports ./body.js", "from": [ { "file": 143 } ] }, { "id": "metadata/package/testing/presence/fixture::test-filename-pattern", "conf": 0.6, "crit": 2, "desc": "Common test filename pattern", "from": [ { "file": 215 } ] }, { "id": "metadata/package/scripts/develop::has-test-script", "conf": 1.0, "crit": 2, "desc": "package.json declares a test script" }, { "id": "metadata/import/builtin::require-http", "conf": 0.75, "crit": 3, "desc": "Imports the Node.js HTTP module", "from": [ { "file": 130 } ] }, { "id": "metadata/import/npm/relative/1/route::relative/1/route", "conf": 0.95, "crit": 2, "desc": "imports ./Route", "from": [ { "file": 244 } ] }, { "id": "metadata/import/npm/webidl-conversions::webidl-conversions", "conf": 0.95, "crit": 2, "desc": "imports webidl-conversions", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "conf": 0.4, "crit": 3, "desc": "References the XMLHttpRequest HTTP client", "from": [ { "file": 192 } ] }, { "id": "micro-behaviors/data/buffer::javascript-write-then-end-stream", "conf": 0.9, "crit": 3, "desc": "JavaScript writes then ends a stream", "from": [ { "file": 261 } ] }, { "id": "micro-behaviors/os/module/require::dynamic-import-string-literal", "conf": 0.8, "crit": 3, "desc": "Dynamically imports a literal module path" }, { "id": "micro-behaviors/communications/http/response::http-401-unauthorized", "conf": 0.75, "crit": 3, "desc": "HTTP 401 unauthorized response text", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/communications/http/request/client::req-write", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Write data to HTTP request stream", "from": [ { "file": 418 } ] }, { "id": "micro-behaviors/os/telemetry/logging/warning::node-process-emit-warning", "conf": 0.9, "crit": 3, "desc": "Node.js process emit-warning call" }, { "id": "objectives/execution/automation/skill::skill-stage-encoding-agent", "atk": "T1059", "conf": 0.92, "crit": 3, "desc": "Skill or agent mentions encoding action", "from": [ { "file": 265 } ] }, { "id": "metadata/package/testing/presence/path::test-path-basename", "conf": 1.0, "crit": 2, "desc": "Test path basename", "from": [ { "file": 215 } ] }, { "id": "micro-behaviors/communications/http/upload::node-manual-multipart-body", "conf": 0.96, "crit": 3, "desc": "Builds Node multipart form-data body", "from": [ { "file": 192 } ] }, { "id": "metadata/import/npm/relative/1/responseheaders::relative/1/responseheaders", "conf": 0.95, "crit": 2, "desc": "imports ./ResponseHeaders", "from": [ { "file": 247 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "from": [ { "file": 7 } ] }, { "id": "metadata/build/ci/step::mutable-version-action-ref", "conf": 0.9, "crit": 3, "desc": "Workflow action uses mutable version tag" }, { "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps", "conf": 0.85, "crit": 3, "desc": "Package declares a runtime dependency", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format/structured::sourcemap-raw-signature", "conf": 0.95, "crit": 3, "desc": "JavaScript source map raw signature", "from": [ { "file": 414 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-header-from-token", "atk": "T1071.001", "mbc": "C0002", "conf": 0.93, "crit": 3, "desc": "Bearer header from token", "from": [ { "file": 421 } ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "from": [ { "file": 156 }, { "file": 157 }, { "file": 215 }, { "file": 490 }, { "file": 503 } ], "uses": [ 357, 411, 596 ] }, { "id": "metadata/file/naming::many-high-entropy-identifiers", "conf": 0.7, "crit": 2, "desc": "High proportion of high-entropy identifiers", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/communications/http/post::url-encoded-content-type", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses URL-encoded HTTP form content", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/fs/read/file/full::read-text-utf8", "conf": 0.72, "crit": 2, "desc": "Reads file content as utf8", "from": [ { "file": 438 } ] }, { "id": "objectives/supply-chain/hidden-payload/staging::build-surface-claimed", "atk": "T1195.002", "conf": 0.82, "crit": 1, "desc": "Package claims generated build output", "uses": [ 45, 187, 394, 443, 543 ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-start", "conf": 0.86, "crit": 3, "desc": "Starts a synchronous function expression", "from": [ { "file": 27 } ] }, { "id": "micro-behaviors/process/io/stream::js-stream-write-call", "conf": 0.88, "crit": 3, "desc": "Calls a write method on a stream", "from": [ { "file": 25 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/brand-impersonation::credential-lure-support-label", "atk": "T1583.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "Support lure label in URL host", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::user-collection-path-token", "conf": 0.92, "crit": 3, "desc": "user collection URL path segment", "from": [ { "file": 233 } ] }, { "id": "metadata/package/documentation/package-metadata::references-changelog-1", "conf": 0.7, "crit": 3, "desc": "Package references CHANGELOG", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/manipulation::replacement-redaction-marker", "conf": 0.8, "crit": 3, "desc": "Replaces data with a redaction marker", "from": [ { "file": 283 } ] }, { "id": "metadata/package/entrypoint::main-dist-entrypoint", "conf": 0.8, "crit": 2, "desc": "Package main targets dist output" }, { "id": "micro-behaviors/communications/http/services/github::github-contents-read-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents read endpoint path", "from": [ { "file": 292 } ] }, { "id": "metadata/package/entrypoint::bin-field-declared", "conf": 0.95, "crit": 3, "desc": "Manifest declares a bin entry" }, { "id": "micro-behaviors/data/decode/custom::js-charcode-byte-mask", "atk": "T1140", "conf": 0.94, "crit": 3, "desc": "Masks character code to one byte", "from": [ { "file": 65 } ] }, { "id": "metadata/import/npm/octokit/plugin-paginate-rest::octokit/plugin-paginate-rest", "conf": 0.95, "crit": 3, "desc": "imports @octokit/plugin-paginate-rest", "from": [ { "file": 426 } ] }, { "id": "micro-behaviors/process/create/vcs/git::git-update-ref-command", "conf": 0.94, "crit": 3, "desc": "Updates a Git reference", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "from": [ { "file": 215 } ] }, { "id": "metadata/import/npm/relative/1/normalize-paginated-list-response::relative/1/normalize-paginated-list-response", "conf": 0.95, "crit": 2, "desc": "imports ./normalize-paginated-list-response", "from": [ { "file": 323 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-version-access", "conf": 0.72, "crit": 3, "desc": "Reads Node.js version through process.version", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/crypto/hash/digest::digest-method-call", "conf": 0.8, "crit": 3, "desc": "Calls a digest() method", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/request/verb::http-post-method-condition", "conf": 0.95, "crit": 3, "desc": "Checks for an HTTP POST method", "from": [ { "file": 145 } ] }, { "id": "metadata/package/scripts/develop::pkg-format-script-field", "conf": 0.6, "crit": 3, "desc": "\"format\": script in package.json" }, { "id": "metadata/package/documentation/package-metadata::has-changelog-tooling", "conf": 0.9, "crit": 3, "desc": "Package uses changelog/versioning tooling", "from": [ { "file": 290 } ] }, { "id": "micro-behaviors/process/io/stream::node-stdout-reference", "conf": 0.8, "crit": 3, "desc": "References Node.js stdout stream", "from": [ { "file": 438 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-git-blob-api-endpoint", "conf": 0.88, "crit": 3, "desc": "GitHub Git blob API endpoint", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/relative/1/interfaces::relative/1/interfaces", "conf": 0.95, "crit": 2, "desc": "imports ./interfaces", "from": [ { "file": 419 } ] }, { "id": "metadata/package/agent-skill::agent-skill-frontmatter-fields", "conf": 0.86, "crit": 3, "desc": "Agent skill frontmatter fields", "from": [ { "file": 463 } ] }, { "id": "well-known/app/finance/bitcoin-core::test-tree-member", "conf": 0.98, "crit": 3, "desc": "Bitcoin Core test, CI, or contrib member", "from": [ { "file": 469 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-leading-promise-chain-call", "conf": 0.84, "crit": 3, "desc": "Leading promise-chain call at module scope", "from": [ { "file": 166 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-image-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains an inline image data URI", "from": [ { "file": 215 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-org-repositories-endpoint", "conf": 0.94, "crit": 3, "desc": "GitHub organization repositories API endpoint", "from": [ { "file": 330 } ] }, { "id": "metadata/lang/generated::codegen-source-path", "conf": 0.9, "crit": 2, "desc": "Code generation source path", "from": [ { "file": 233 } ] }, { "id": "metadata/import/npm/relative/1/util/omit::relative/1/util/omit", "conf": 0.95, "crit": 2, "desc": "imports ./util/omit", "from": [ { "file": 376 } ] }, { "id": "metadata/import/npm/relative/1/url::relative/1/url", "conf": 0.95, "crit": 2, "desc": "imports ./URL", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/response::node-response-pipe", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Pipes a Node HTTP response stream", "from": [ { "file": 261 } ] }, { "id": "micro-behaviors/os/module/require::node-system-module-import-set", "conf": 0.88, "crit": 3, "desc": "Imports at least two Node system modules", "from": [ { "file": 438 }, { "off": 904, "file": 446, "line": 14 }, { "file": 455 }, { "off": 2201, "file": 458, "line": 35 }, { "file": 461 } ], "uses": [ 455, 581 ] }, { "id": "objectives/exfiltration/http/agent::repo2skill-github-token-marker", "atk": "T1041,T1552.001", "conf": 0.99, "crit": 3, "desc": "GitHub token marker", "from": [ { "file": 409 } ] }, { "id": "metadata/import/npm/relative/1/with-authorization-prefix::relative/1/with-authorization-prefix", "conf": 0.95, "crit": 2, "desc": "imports ./with-authorization-prefix", "from": [ { "file": 405 } ] }, { "id": "micro-behaviors/communications/http/upload::form-data-append", "conf": 0.7, "crit": 3, "desc": "Appends data to FormData", "from": [ { "file": 139 } ] }, { "id": "metadata/import/npm/relative/1/error::relative/1/error", "conf": 0.95, "crit": 2, "desc": "imports ./error", "from": [ { "file": 345 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call", "conf": 0.95, "crit": 3, "desc": "Invokes preserved console method with arguments", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/communications/http/request/client::request-end-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Ends a request-like object with .end()", "from": [ { "file": 418 } ] }, { "id": "metadata/import/npm/relative/1/util/url-template::relative/1/util/url-template", "conf": 0.95, "crit": 2, "desc": "imports ./util/url-template", "from": [ { "file": 376 } ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/browser-automation::authentication-token-name-literal", "conf": 0.9, "crit": 3, "desc": "Authentication token name literal", "from": [ { "file": 297 } ] }, { "id": "metadata/import/npm/relative/1/utils/js::relative/1/utils/js", "conf": 0.95, "crit": 2, "desc": "imports ./utils.js", "from": [ { "file": 9 } ] }, { "id": "metadata/import/npm/process::process", "conf": 0.95, "crit": 3, "desc": "imports node:process", "from": [ { "file": 198 } ] }, { "id": "metadata/encoded-payload/url", "conf": 0.9, "crit": 3, "desc": "Percent-encoded content decoded" }, { "id": "metadata/import/npm/relative/1/v35/js::relative/1/v35/js", "conf": 0.95, "crit": 2, "desc": "imports ./v35.js", "from": [ { "file": 59 } ] }, { "id": "metadata/import/npm/relative/1/endpointdefaults::relative/1/endpointdefaults", "conf": 0.95, "crit": 2, "desc": "imports ./EndpointDefaults", "from": [ { "file": 251 } ] }, { "id": "metadata/import/npm/relative/1/v4/js::relative/1/v4/js", "conf": 0.95, "crit": 2, "desc": "imports ./v4.js", "from": [ { "file": 64 } ] }, { "id": "well-known/tool/development/cli/dev-cli/nx::nx-root-test-script", "conf": 0.99, "crit": 3, "desc": "Nx generated root-test script" }, { "id": "metadata/build/bundler/wrapper::js-tsc-reexport-barrel", "conf": 0.96, "crit": 2, "desc": "Transpiled CommonJS re-export barrel", "from": [ { "off": 74, "file": 418, "line": 3 }, { "off": 18, "file": 426, "line": 2 }, { "off": 18, "file": 429, "line": 2 }, { "off": 18, "file": 435, "line": 2 }, { "off": 18, "file": 449, "line": 2 }, { "off": 58, "file": 455, "line": 3 }, { "off": 18, "file": 458, "line": 2 }, { "off": 18, "file": 461, "line": 2 } ], "uses": [ 180, 360 ] }, { "id": "metadata/import/npm/net::net", "conf": 0.95, "crit": 3, "desc": "imports net", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/communications/http/request/json::module-execution-http-call", "conf": 0.95, "crit": 3, "desc": "Module initialization calls an HTTP client" }, { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 2, "desc": "File uses a source declaration extension", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-https-url", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL decoded to https", "from": [ { "file": 74 } ] }, { "id": "metadata/import/npm/relative/1/hook::relative/1/hook", "conf": 0.95, "crit": 2, "desc": "imports ./hook", "from": [ { "file": 404 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "from": [ { "file": 421 } ] }, { "id": "well-known/lib/web/whatwg-url::basic-url-parse-api", "conf": 0.99, "crit": 3, "desc": "whatwg-url basicURLParse API marker", "from": [ { "file": 7 } ] }, { "id": "metadata/lang/generated::automatically-generated-source-marker", "conf": 0.85, "crit": 2, "desc": "Generated source provenance marker", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/http/request/client::generic-request-method-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.4, "crit": 3, "desc": "Generic .request() method call", "from": [ { "file": 261 } ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "micro-behaviors/os/random/crypto::webcrypto-get-random-values", "conf": 0.96, "crit": 3, "desc": "Generates Web Crypto random bytes", "from": [ { "file": 66 } ] }, { "id": "metadata/import/npm/relative/1/index::relative/1/index", "conf": 0.95, "crit": 2, "desc": "imports ./index", "from": [ { "file": 416 } ] }, { "id": "metadata/package/files/runtime::typescript-source-tree-artifact", "conf": 0.95, "crit": 3, "desc": "Source file under src", "from": [ { "file": 138 } ] }, { "id": "metadata/import/npm/zlib::zlib", "conf": 0.95, "crit": 3, "desc": "imports node:zlib", "from": [ { "file": 145 } ] }, { "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest", "atk": "T1195.002", "conf": 0.98, "crit": 3, "desc": "GitHub Action action.yml manifest", "from": [ { "file": 466 } ] }, { "id": "micro-behaviors/data/manipulation::log-redaction-option", "conf": 0.85, "crit": 3, "desc": "Log redaction option or call", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 7 } ] }, { "id": "well-known/lib/network/public-suffix-list::psl-github-io", "conf": 0.9, "crit": 3, "desc": "Public suffix github.io", "from": [ { "file": 25 } ] }, { "id": "metadata/import/npm/relative/1/requestparameters::relative/1/requestparameters", "conf": 0.95, "crit": 2, "desc": "imports ./RequestParameters", "from": [ { "file": 244 } ] }, { "id": "micro-behaviors/communications/http/content-length::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "from": [ { "file": 144 } ] }, { "id": "metadata/import/npm/relative/1/command::relative/1/command", "conf": 0.95, "crit": 2, "desc": "imports ./command", "from": [ { "file": 444 } ] }, { "id": "metadata/package/homepage::homepage-monorepo-package-subdirectory", "conf": 0.95, "crit": 3, "desc": "Homepage points to monorepo package directory" }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 130 } ] }, { "id": "metadata/build/bundler/wrapper::js-umd-wrapper", "conf": 0.9, "crit": 2, "desc": "Universal Module Definition (UMD) wrapper", "from": [ { "file": 27 } ] }, { "id": "metadata/import/npm/relative/1/url-state-machine::relative/1/url-state-machine", "conf": 0.95, "crit": 2, "desc": "imports ./url-state-machine", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/socket/connect::node-net-commonjs-import", "conf": 0.9, "crit": 3, "desc": "Imports the Node net module with require", "from": [ { "file": 130 } ] }, { "id": "objectives/exfiltration/sensitive-data::js-secret-value-request-field", "atk": "T1041", "mbc": "B0030", "conf": 0.96, "crit": 3, "desc": "JavaScript request body names a secret value", "from": [ { "file": 297 } ] }, { "id": "metadata/import/npm/octokit/graphql::octokit/graphql", "conf": 0.95, "crit": 3, "desc": "imports @octokit/graphql", "from": [ { "file": 386 } ] }, { "id": "metadata/package/freeform::ci-badge-reference-b", "conf": 0.8, "crit": 3, "desc": "References GitHub Actions", "from": [ { "file": 410 } ] }, { "id": "metadata/build/ci/step::action-main-entrypoint", "conf": 1.0, "crit": 3, "desc": "Action declares a main entrypoint" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/url/query::query-serializer-call", "conf": 0.9, "crit": 3, "desc": "Calls a URL query serializer", "from": [ { "file": 150 } ] }, { "id": "objectives/impact/destroy/keywords::target-project", "conf": 0.86, "crit": 3, "desc": "Delete action targets project or workspace", "from": [ { "file": 233 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Exactly one line exceeds 1000 chars", "from": [ { "file": 135 } ] }, { "id": "objectives/command-and-control/dropper/delivery/html::drive-by-archive-blob-mime", "atk": "T1204.002", "mbc": "F0007", "conf": 0.85, "crit": 3, "desc": "Archive-specific MIME marker", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript split()", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/request/body::request-body-property-access", "conf": 0.84, "crit": 3, "desc": "Accesses a request body property", "from": [ { "file": 145 } ] }, { "id": "metadata/import/npm/relative/1/base/js::relative/1/base/js", "conf": 0.95, "crit": 2, "desc": "imports ./base.js", "from": [ { "file": 147 } ] }, { "id": "metadata/import/npm/relative/1/generated/method-types::relative/1/generated/method-types", "conf": 0.95, "crit": 2, "desc": "imports ./generated/method-types", "from": [ { "file": 294 } ] }, { "id": "metadata/package/scripts/develop::has-git-hooks", "conf": 0.9, "crit": 3, "desc": "Package uses git hooks tooling", "from": [ { "file": 56 } ] }, { "id": "metadata/package/files/dependency::node-modules-path", "conf": 1.0, "crit": 3, "desc": "File located under a node_modules directory", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "micro-behaviors/communications/http/request/client::request-write-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "JavaScript writes HTTP request body", "from": [ { "file": 418 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler", "conf": 0.85, "crit": 3, "desc": "Registers asynchronous named event handler", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/communications/http/get::javascript-get-method-text", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP GET request" }, { "id": "metadata/import/npm/relative/1/octokitresponse::relative/1/octokitresponse", "conf": 0.95, "crit": 2, "desc": "imports ./OctokitResponse", "from": [ { "file": 244 } ] }, { "id": "metadata/package/entrypoint::main-root-javascript-entry", "conf": 0.9, "crit": 2, "desc": "Root JavaScript main entrypoint" }, { "id": "micro-behaviors/data/llm/agent::agent-or-skill-http-url-reference", "conf": 0.9, "crit": 3, "desc": "Agent or skill references an HTTP URL", "from": [ { "file": 127 } ] }, { "id": "micro-behaviors/data/string/replace::js-url-variable-self-replace", "conf": 0.94, "crit": 3, "desc": "Rewrites a URL-named variable in place", "from": [ { "file": 212 } ] }, { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "from": [ { "file": 22 } ] }, { "id": "metadata/file/string/count::string-count-over-10000", "conf": 0.95, "crit": 3, "desc": "File holds 10000 or more strings", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/octokit/types::octokit/types", "conf": 0.95, "crit": 3, "desc": "imports @octokit/types", "from": [ { "file": 268 } ] }, { "id": "micro-behaviors/communications/http/url/tld::reserved-documentation-tld-url", "conf": 0.95, "crit": 3, "desc": "URL uses RFC 2606 reserved documentation TLD", "from": [ { "file": 152 } ] }, { "id": "micro-behaviors/communications/http/user-agent::navigator-useragent-read", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Reads browser User-Agent string", "from": [ { "file": 122 } ] }, { "id": "metadata/file/format/structured::sourcemap-typescript-sources-raw", "conf": 0.85, "crit": 3, "desc": "TypeScript source map raw signature", "from": [ { "file": 414 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 455 } ] }, { "id": "metadata/package/files/dependency::node-modules-nested-package-json", "conf": 1.0, "crit": 3, "desc": "package.json nested under node_modules", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-api-endpoint", "conf": 0.86, "crit": 3, "desc": "GitHub repository contents API endpoint", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::country-name", "conf": 0.5, "crit": 3, "desc": "country_name data field", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 3, "desc": "charCodeAt() method call", "from": [ { "file": 13 } ] }, { "id": "metadata/build/ci/github-actions::octokit-openapi-types-path", "conf": 0.94, "crit": 2, "desc": "Octokit OpenAPI package path", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "from": [ { "file": 438 } ] }, { "id": "micro-behaviors/crypto/hash/digest::node-createhash-call", "conf": 0.65, "crit": 3, "desc": "Node.js createHash call", "from": [ { "file": 76 } ] }, { "id": "metadata/import/npm/relative/1/url-impl/js::relative/1/url-impl/js", "conf": 0.95, "crit": 2, "desc": "imports .//URL-impl.js", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression", "from": [ { "file": 25 } ] }, { "id": "objectives/evasion/security-bypass/llm/prompt::llm-doc-follow-instruction", "atk": "T1562", "conf": 0.86, "crit": 3, "desc": "AI source-follow directive", "from": [ { "file": 118 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-authenticated-user-endpoint", "conf": 0.94, "crit": 3, "desc": "GitHub authenticated-user API endpoint", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/relative/1/endpoint-with-defaults::relative/1/endpoint-with-defaults", "conf": 0.95, "crit": 2, "desc": "imports ./endpoint-with-defaults", "from": [ { "file": 367 } ] }, { "id": "metadata/import/npm/octokit/core::octokit/core", "conf": 0.95, "crit": 3, "desc": "imports @octokit/core", "from": [ { "file": 295 } ] }, { "id": "metadata/import/npm/relative/1/paginate::relative/1/paginate", "conf": 0.95, "crit": 2, "desc": "imports ./paginate", "from": [ { "file": 324 } ] }, { "id": "micro-behaviors/os/env/secret-name::credential-env-read", "conf": 0.9, "crit": 3, "desc": "Reads a credential-bearing environment variable", "from": [ { "off": 41684, "file": 297, "line": 737 }, { "off": 32235, "file": 330, "line": 306 }, { "off": 1820, "file": 426, "line": 41 }, { "off": 620, "file": 427, "line": 12 }, { "off": 1209, "file": 435, "line": 29 }, { "off": 306, "file": 436, "line": 8 } ], "uses": [ 256 ] }, { "id": "micro-behaviors/data/source/arithmetic::source-xor-operation", "conf": 1.0, "crit": 3, "desc": "Source references XOR syntax", "from": [ { "file": 77 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-client-id-field", "conf": 0.65, "crit": 3, "desc": "OAuth client_id field", "from": [ { "file": 233 } ] }, { "id": "metadata/package/testing/presence/fixture::mocha-describe-call", "conf": 0.6, "crit": 2, "desc": "Mocha describe() call", "from": [ { "file": 215 } ] }, { "id": "metadata/package/entrypoint::pkg-module-field", "conf": 0.6, "crit": 2, "desc": "\"module\": field in package.json", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-write-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents write endpoint path", "from": [ { "file": 292 } ] }, { "id": "micro-behaviors/communications/socket/ssl::reject-unauthorized-false", "conf": 0.9, "crit": 3, "desc": "Node TLS check disabled by option", "from": [ { "file": 418 } ] }, { "id": "metadata/import/npm/relative/1/lib/register::relative/1/lib/register", "conf": 0.95, "crit": 2, "desc": "imports ./lib/register", "from": [ { "file": 226 } ] }, { "id": "metadata/import/npm/relative/1/core::relative/1/core", "conf": 0.95, "crit": 2, "desc": "imports ./core", "from": [ { "file": 444 } ] }, { "id": "metadata/import/npm/octokit/openapi-types::octokit/openapi-types", "conf": 0.95, "crit": 3, "desc": "imports @octokit/openapi-types", "from": [ { "file": 233 } ] }, { "id": "metadata/import/npm/relative/1/v1/js::relative/1/v1/js", "conf": 0.95, "crit": 2, "desc": "imports ./v1.js", "from": [ { "file": 64 } ] }, { "id": "metadata/package/files/runtime::javascript-utils-basename", "conf": 0.85, "crit": 3, "desc": "JavaScript utils.js basename", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/buffer::source-right-shift-16-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 16 bits", "from": [ { "file": 63 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-string-function", "conf": 0.9, "crit": 3, "desc": "Top-level non-require string call", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/hook/webextension::webrequest-request-body-marker", "conf": 0.9, "crit": 3, "desc": "WebRequest request body field marker", "from": [ { "file": 233 } ] }, { "id": "metadata/package/documentation/security-advisory::ghsa-identifier", "conf": 0.92, "crit": 3, "desc": "References a GitHub Security Advisory identifier", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::rest-admin-config-user-endpoints", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "REST admin config endpoints", "from": [ { "file": 233 } ] }, { "id": "metadata/import/npm/fetch-blob/file/js::fetch-blob/file/js", "conf": 0.95, "crit": 2, "desc": "imports fetch-blob/file.js", "from": [ { "file": 194 } ] }, { "id": "objectives/anti-static/obfuscation/control-flow/retry::switch-decoy-cases", "conf": 0.8, "crit": 3, "desc": "Switch statement with decoy literal cases", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/os/env/cicd::github-env-file", "conf": 0.85, "crit": 3, "desc": "GITHUB_ENV environment file", "from": [ { "file": 458 } ] }, { "id": "metadata/package/repository::repo-github-shorthand", "conf": 0.9, "crit": 3, "desc": "Repository uses GitHub shorthand" }, { "id": "metadata/build/bundler/wrapper::js-tslib-reexport-helper", "conf": 0.97, "crit": 2, "desc": "Calls a tslib/TypeScript re-export helper", "from": [ { "file": 418 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::authorization-header-index-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Authorization header property assignment", "from": [ { "file": 421 } ] }, { "id": "metadata/import/npm/relative/1/file/js::relative/1/file/js", "conf": 0.95, "crit": 2, "desc": "imports ./file.js", "from": [ { "file": 202 } ] }, { "id": "metadata/build/ci/secret::step-token-input-secret-reference", "conf": 0.95, "crit": 3, "desc": "Step token input references an Actions secret" }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL documentation context", "from": [ { "file": 22 } ] }, { "id": "metadata/import/npm/relative/1/authinterface::relative/1/authinterface", "conf": 0.95, "crit": 2, "desc": "imports ./AuthInterface", "from": [ { "file": 236 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-issue-label-api", "conf": 0.84, "crit": 3, "desc": "GitHub issue label endpoint path", "from": [ { "file": 292 } ] }, { "id": "metadata/package/entrypoint::types-dist-entrypoint", "conf": 0.8, "crit": 2, "desc": "Package types targets dist output" }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/os/random/crypto::node-random-fill", "conf": 0.65, "crit": 3, "desc": "Node.js random buffer fill", "from": [ { "file": 78 } ] }, { "id": "objectives/supply-chain/trojanized/library/remote-eval::icons-path-fragment", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "Hardcoded icons path fragment", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 465 } ] }, { "id": "micro-behaviors/communications/http/auth::access-token-field-reference", "conf": 0.96, "crit": 3, "desc": "Access-token field reference", "from": [ { "file": 233 } ] }, { "id": "metadata/import/npm/actions/core::actions/core", "conf": 0.95, "crit": 2, "desc": "imports @actions/core", "from": [ { "file": 465 } ] }, { "id": "metadata/lang/encoded/unicode-escape::ansi-escape-sequence", "conf": 0.98, "crit": 3, "desc": "ANSI color escape sequence encoded", "from": [ { "file": 463 } ] }, { "id": "metadata/package/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL" }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL public documentation", "from": [ { "file": 297 } ] }, { "id": "well-known/tool/sysadmin/github-runner::config-script", "conf": 0.95, "crit": 3, "desc": "Self-hosted runner config script", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster", "conf": 0.86, "crit": 3, "desc": "Dense computed-property call cluster (3+)", "from": [ { "file": 9 } ] }, { "id": "metadata/import/npm/relative/2/requestheaders::relative/2/requestheaders", "conf": 0.95, "crit": 2, "desc": "imports ../RequestHeaders", "from": [ { "file": 233 } ] }, { "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call", "conf": 0.94, "crit": 3, "desc": "DirectoryEntry property write API call", "from": [ { "file": 418 } ] }, { "id": "micro-behaviors/os/random/crypto::node-random-generation", "conf": 0.72, "crit": 3, "desc": "Node.js cryptographic random-value generation", "from": [ { "file": 78 }, { "file": 95 } ], "uses": [ 189 ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors" }, { "id": "metadata/import/npm/relative/1/stringify/js::relative/1/stringify/js", "conf": 0.95, "crit": 2, "desc": "imports ./stringify.js", "from": [ { "file": 60 } ] }, { "id": "metadata/import/npm/relative/2/requestrequestoptions::relative/2/requestrequestoptions", "conf": 0.95, "crit": 2, "desc": "imports ../RequestRequestOptions", "from": [ { "file": 233 } ] }, { "id": "metadata/import/npm/relative/1/lib/mappingtable/json::relative/1/lib/mappingtable/json", "conf": 0.95, "crit": 2, "desc": "imports ./lib/mappingTable.json", "from": [ { "file": 135 } ] }, { "id": "metadata/import/npm/relative/1/lib/add::relative/1/lib/add", "conf": 0.95, "crit": 2, "desc": "imports ./lib/add", "from": [ { "file": 226 } ] }, { "id": "metadata/import/npm/relative/1/errors/fetch-error/js::relative/1/errors/fetch-error/js", "conf": 0.95, "crit": 2, "desc": "imports ./errors/fetch-error.js", "from": [ { "file": 145 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "from": [ { "file": 37 } ] }, { "id": "metadata/import/npm/crypto::crypto", "conf": 0.95, "crit": 3, "desc": "imports crypto", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/data/buffer::node-buffer-tostring-call", "conf": 0.88, "crit": 3, "desc": "Converts Node.js Buffer output to text", "from": [ { "file": 421 } ] }, { "id": "metadata/build/minifier::js-umd-wrapper-amd-minified", "conf": 0.9, "crit": 2, "desc": "Contains a minified UMD AMD branch", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/communications/http/header/custom::multipart-upload", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "Multipart form data upload", "from": [ { "file": 139 } ], "uses": [ 259 ] }, { "id": "metadata/import/npm/relative/1/iterator::relative/1/iterator", "conf": 0.95, "crit": 2, "desc": "imports ./iterator", "from": [ { "file": 321 } ] }, { "id": "micro-behaviors/communications/http/request/action-resource::foreign-principal-id-field", "conf": 0.94, "crit": 3, "desc": "Other-principal identity field", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Module scope assigns zero-argument call", "from": [ { "file": 25 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/prepare::prepare-runs-package-manager-build", "atk": "T1195.002", "conf": 0.95, "crit": 3, "desc": "prepare runs package-manager build" }, { "id": "metadata/import/npm/relative/1/requestheaders::relative/1/requestheaders", "conf": 0.95, "crit": 2, "desc": "imports ./RequestHeaders", "from": [ { "file": 241 } ] }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 2, "desc": "File path or name indicates test code", "from": [ { "file": 215 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 22 } ], "uses": [ 34, 91, 218 ] }, { "id": "metadata/import/npm/tls::tls", "conf": 0.95, "crit": 3, "desc": "imports tls", "from": [ { "file": 130 } ] }, { "id": "metadata/import/npm/web-streams-polyfill/dist/ponyfill/es2018/js::web-streams-polyfill/dist/ponyfill/es2018/js", "conf": 0.95, "crit": 2, "desc": "imports web-streams-polyfill/dist/ponyfill.es2018.js", "from": [ { "file": 198 } ] }, { "id": "objectives/impact/crypto-manipulation/hijack-transfer::solana-config-yml-name", "atk": "T1565.001", "mbc": "B0020", "conf": 0.94, "crit": 3, "desc": "Solana config.yml filename", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-bracket-github", "conf": 0.8, "crit": 3, "desc": "process.env bracket access for github vars", "from": [ { "file": 429 } ] }, { "id": "metadata/file/string/cicd::github-workflow-file-path", "conf": 0.98, "crit": 3, "desc": "GitHub Actions workflow file path", "from": [ { "file": 469 } ] }, { "id": "micro-behaviors/os/group/membership::privileged-local-group-name", "atk": "T1098", "conf": 0.9, "crit": 3, "desc": "References a privileged local group", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/fs/path/application/prefix::container-app-root-path", "conf": 0.9, "crit": 3, "desc": "Absolute container application root path", "from": [ { "file": 233 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "from": [ { "file": 145 } ] }, { "id": "micro-behaviors/communications/http/form::multipart-form", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "multipart/form-data content type", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/communications/http/response::http-403-forbidden", "conf": 0.75, "crit": 3, "desc": "HTTP 403 forbidden response text", "from": [ { "file": 297 } ] }, { "id": "metadata/import/npm/actions/github::actions/github", "conf": 0.95, "crit": 2, "desc": "imports @actions/github", "from": [ { "file": 465 } ] }, { "id": "metadata/import/npm/relative/1/requestrequestoptions::relative/1/requestrequestoptions", "conf": 0.95, "crit": 2, "desc": "imports ./RequestRequestOptions", "from": [ { "file": 241 } ] }, { "id": "micro-behaviors/data/encode/url::encodeuri-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURI", "from": [ { "file": 352 } ] }, { "id": "objectives/exfiltration/sensitive-data::http-body-payload-variable", "atk": "T1041", "mbc": "B0030", "conf": 0.84, "crit": 3, "desc": "HTTP body uses payload variable", "from": [ { "file": 465 } ] }, { "id": "metadata/import/npm/relative/1/dist/index/js::relative/1/dist/index/js", "conf": 0.95, "crit": 2, "desc": "imports ./dist/index.js", "from": [ { "file": 55 } ] }, { "id": "metadata/import/builtin::require-https", "conf": 0.78, "crit": 3, "desc": "Imports the Node.js HTTPS module", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/communications/http/request/client::node-fetch-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Imports the node-fetch HTTP client", "from": [ { "file": 267 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::group-collection-path-token", "conf": 0.92, "crit": 3, "desc": "group collection URL path segment", "from": [ { "file": 233 } ] }, { "id": "metadata/import/npm/util::util", "conf": 0.95, "crit": 2, "desc": "imports util", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "from": [ { "file": 145 } ] }, { "id": "micro-behaviors/data/decode/url::js-unescape-call", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript unescape", "from": [ { "file": 61 } ] }, { "id": "metadata/import/npm/relative/1/lib/tunnel::relative/1/lib/tunnel", "conf": 0.95, "crit": 2, "desc": "imports ./lib/tunnel", "from": [ { "file": 131 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-repository-archive-api-endpoint", "conf": 0.94, "crit": 3, "desc": "GitHub repository source-archive API endpoint", "from": [ { "file": 233 } ] }, { "id": "micro-behaviors/process/hook/webextension::dnr-referer-header", "conf": 0.8, "crit": 3, "desc": "DNR rule names Referer header", "from": [ { "file": 138 } ] }, { "id": "metadata/import/npm/relative/1/signal::relative/1/signal", "conf": 0.95, "crit": 2, "desc": "imports ./Signal", "from": [ { "file": 240 } ] }, { "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment", "conf": 0.94, "crit": 3, "desc": "Assigns character code to array element", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/communications/http/request/route::status-checkin-route", "atk": "T1071.001", "mbc": "C0002", "conf": 0.92, "crit": 3, "desc": "HTTP status, check-in, or heartbeat route", "from": [ { "file": 233 } ] }, { "id": "metadata/package/entrypoint::has-multiple-entries", "conf": 0.85, "crit": 3, "desc": "Package has multiple entry points", "from": [ { "file": 15 } ], "uses": [ 163, 268, 439 ] }, { "id": "metadata/file/format/structured::sourcemap", "conf": 1.0, "crit": 3, "desc": "JavaScript source map", "from": [ { "file": 24 } ] }, { "id": "metadata/package/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "metadata/import/npm/relative/1/regex/js::relative/1/regex/js", "conf": 0.95, "crit": 2, "desc": "imports ./regex.js", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/data/source/arithmetic::js-bitwise-arithmetic-chain", "conf": 0.8, "crit": 3, "desc": "JavaScript bitwise arithmetic and shift chain", "from": [ { "file": 65 } ] }, { "id": "metadata/package/files/runtime::javascript-lib-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript file under lib", "from": [ { "file": 6 } ] }, { "id": "objectives/anti-static/obfuscation/syntax::js-split-custom-delimiter", "conf": 0.8, "crit": 3, "desc": "Split with custom delimiter", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-github-run-id", "conf": 0.78, "crit": 3, "desc": "Reads GITHUB_RUN_ID CI variable", "from": [ { "file": 438 } ] }, { "id": "micro-behaviors/data/source/property/identity::repository-object-fields", "conf": 0.9, "crit": 3, "desc": "Repository identity object field keys", "from": [ { "file": 438 } ] }, { "id": "micro-behaviors/os/env/vcs::github-token-name-reference", "conf": 0.9, "crit": 3, "desc": "References the GITHUB_TOKEN environment variable", "from": [ { "file": 297 } ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/session::admin-security-url-targets--rx-1", "conf": 0.88, "crit": 3, "desc": "admin/security page path under host", "from": [ { "file": 330 } ] }, { "id": "objectives/command-and-control/dropper/delivery/http::bun-loader-build-id", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Bun loader build identifier", "from": [ { "file": 233 } ] }, { "id": "micro-behaviors/communications/http/header/custom::boundary-param", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 2, "desc": "Contains an HTTP multipart boundary parameter", "from": [ { "file": 139 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "from": [ { "file": 139 } ] }, { "id": "metadata/import/npm/stream::stream", "conf": 0.95, "crit": 2, "desc": "imports node:stream", "from": [ { "file": 145 } ] }, { "id": "metadata/file/data-blob::js-max-string-length-short", "conf": 0.8, "crit": 3, "desc": "JavaScript strings capped at five", "from": [ { "file": 22 } ] }, { "id": "metadata/build/bundler/wrapper::js-umd-wrapper-amd", "conf": 0.9, "crit": 2, "desc": "Contains a UMD wrapper's AMD branch", "from": [ { "file": 27 } ] }, { "id": "metadata/import/npm/relative/2/src::relative/2/src", "conf": 0.95, "crit": 2, "desc": "imports ../src", "from": [ { "file": 215 } ] }, { "id": "metadata/lang/javascript-features::cjs-exports-pattern", "conf": 0.6, "crit": 3, "desc": "Defines CommonJS named exports", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/graphql::api-route", "conf": 0.92, "crit": 3, "desc": "GraphQL API route request" }, { "id": "micro-behaviors/data/encode/base64::node-buffer-base64-encode", "mbc": "C0026", "conf": 0.95, "crit": 3, "desc": "Encodes Node.js Buffer output as Base64", "from": [ { "file": 421 } ] }, { "id": "metadata/package/entrypoint::has-exports-field", "conf": 0.85, "crit": 2, "desc": "package.json declares an exports map" }, { "id": "metadata/file/string/count::few-string-literals", "conf": 0.4, "crit": 3, "desc": "File has very few string literals", "from": [ { "file": 77 } ] }, { "id": "micro-behaviors/communications/http/request/route::reset-token-path", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP path contains a reset-token route", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-graphql-path-option", "conf": 0.94, "crit": 3, "desc": "GitHub GraphQL request path option", "from": [ { "file": 335 } ] }, { "id": "well-known/malware/backdoor/snow::unc6692-mailbox-repair-lure", "atk": "T1059", "conf": 0.92, "crit": 3, "desc": "UNC6692 mailbox repair lure", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/worker_threads::worker_threads", "conf": 0.95, "crit": 2, "desc": "imports worker_threads", "from": [ { "file": 155 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-method-preservation", "conf": 0.95, "crit": 3, "desc": "Preserves original JavaScript console methods", "from": [ { "file": 386 } ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "file": 27 } ], "uses": [ 88, 112, 211, 263, 489, 520 ] }, { "id": "metadata/package/files/package-json::files-array-present", "conf": 0.92, "crit": 3, "desc": "Package.json declares a files allowlist" }, { "id": "metadata/import/npm/relative/1/requestinterface::relative/1/requestinterface", "conf": 0.95, "crit": 2, "desc": "imports ./RequestInterface", "from": [ { "file": 253 } ] }, { "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format", "conf": 0.9, "crit": 3, "desc": "Code formats a zero-padded integer", "from": [ { "file": 194 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "from": [ { "file": 261 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-proxy-get-trap", "conf": 0.9, "crit": 3, "desc": "Proxy intercepts property reads", "from": [ { "file": 146 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-actions-environments-api", "conf": 0.9, "crit": 3, "desc": "GitHub Actions environments API path", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/relative/1/utils/is-redirect/js::relative/1/utils/is-redirect/js", "conf": 0.95, "crit": 2, "desc": "imports ./utils/is-redirect.js", "from": [ { "file": 143 } ] }, { "id": "metadata/import/npm/relative/1/internal/utils::relative/1/internal/utils", "conf": 0.95, "crit": 2, "desc": "imports ./internal/utils", "from": [ { "file": 426 } ] }, { "id": "metadata/import/npm/events::events", "conf": 0.95, "crit": 2, "desc": "imports events", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/process/create/load/local::try-require-empty-catch-text", "atk": "T1059.007", "conf": 0.97, "crit": 3, "desc": "Try-wrapped require with empty catch text", "from": [ { "file": 261 } ] }, { "id": "objectives/execution/automation/prompt-agent::agent-grant-credentials", "atk": "T1059,T1195.002", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Grants an agent credentials or keys access", "from": [ { "file": 297 } ] }, { "id": "metadata/package/dependencies/manifest/presence::npm-no-runtime-dependencies", "conf": 0.9, "crit": 2, "desc": "npm manifest declares no runtime dependencies", "from": [ { "file": 4 } ], "uses": [ 300, 371 ] }, { "id": "metadata/import/npm/node-domexception::node-domexception", "conf": 0.95, "crit": 2, "desc": "imports node-domexception", "from": [ { "file": 202 } ] }, { "id": "micro-behaviors/ui/help::command-run-instruction", "conf": 0.84, "crit": 3, "desc": "Command execution help instruction", "from": [ { "file": 190 } ] }, { "id": "metadata/import/npm/relative/1/graphql::relative/1/graphql", "conf": 0.95, "crit": 2, "desc": "imports ./graphql", "from": [ { "file": 342 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/string/replace::url-target-replace-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns replaced text to a URL variable", "from": [ { "file": 212 } ] }, { "id": "metadata/import/npm/relative/1/utils/get-search/js::relative/1/utils/get-search/js", "conf": 0.95, "crit": 2, "desc": "imports ./utils/get-search.js", "from": [ { "file": 144 } ] }, { "id": "metadata/file/format/conformance::parse-error", "conf": 0.9, "crit": 3, "desc": "Structured document fails to parse", "from": [ { "file": 21 } ] }, { "id": "supply-chain/install-hook/prepare", "conf": 0.8, "crit": 3, "desc": "Package has 'prepare' hook that runs during install" }, { "id": "micro-behaviors/fs/proc/container::runtime-engine-keywords--docker", "conf": 0.86, "crit": 3, "desc": "References the Docker container engine", "from": [ { "file": 330 } ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64" }, { "id": "micro-behaviors/communications/ip/endpoint::ftp-port-21", "conf": 0.6, "crit": 3, "desc": "FTP service port number", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "from": [ { "file": 7 } ] }, { "id": "metadata/package/dependencies/manifest/presence::npm-no-dependencies-field", "conf": 0.9, "crit": 2, "desc": "npm manifest omits dependencies field" }, { "id": "metadata/import/npm/relative/1/errors/abort-error/js::relative/1/errors/abort-error/js", "conf": 0.95, "crit": 2, "desc": "imports ./errors/abort-error.js", "from": [ { "file": 145 } ] }, { "id": "micro-behaviors/data/decode/custom::js-indexof-source-token", "atk": "T1140", "conf": 0.75, "crit": 3, "desc": "JavaScript indexOf lookup uses character input", "from": [ { "file": 352 } ] }, { "id": "micro-behaviors/process/hook/xhr::xhr-prototype-access", "conf": 0.6, "crit": 3, "desc": "Assigns an XMLHttpRequest prototype method", "from": [ { "file": 192 } ] }, { "id": "metadata/build/bundler/javascript-bundle-markers::js-multi-line-blob-recognized-text", "conf": 0.95, "crit": 1, "desc": "Text tokens identify a normal JavaScript bundle blob", "from": [ { "off": 3279, "file": 215, "line": 76 } ], "uses": [ 65 ] }, { "id": "micro-behaviors/data/serialize/object::js-serialise", "conf": 0.85, "crit": 3, "desc": "References a serialization-related symbol", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/octokit/endpoint::octokit/endpoint", "conf": 0.95, "crit": 3, "desc": "imports @octokit/endpoint", "from": [ { "file": 267 } ] }, { "id": "micro-behaviors/ui/window/notify/message::password-invalid-feedback", "conf": 0.84, "crit": 3, "desc": "Password feedback says the value is invalid", "from": [ { "file": 297 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/hook-file::process-env-report-field", "atk": "T1552.001", "conf": 0.94, "crit": 3, "desc": "Places process.env in report field", "from": [ { "file": 438 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 352 } ] }, { "id": "micro-behaviors/communications/url/external/github::github-raw-file-url", "atk": "T1105", "conf": 0.84, "crit": 3, "desc": "References a GitHub raw file URL", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/process/info/commandline::check-argv", "conf": 0.8, "crit": 3, "desc": "Reads Node.js arguments through process.argv", "from": [ { "file": 64 } ] }, { "id": "objectives/credential-access/phishing/mfa-relay::browser-verification-data-property", "atk": "T1056.002,T1111,T1041,T1566.002", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Browser verification data field names", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/http/content-length::content-length-zero", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length zero header", "from": [ { "file": 352 } ] }, { "id": "metadata/import/npm/relative/1/v3/js::relative/1/v3/js", "conf": 0.95, "crit": 2, "desc": "imports ./v3.js", "from": [ { "file": 64 } ] }, { "id": "metadata/import/npm/relative/1/utils::relative/1/utils", "conf": 0.95, "crit": 2, "desc": "imports ./utils", "from": [ { "file": 435 } ] }, { "id": "micro-behaviors/data/buffer::source-right-shift-8-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 8 bits", "from": [ { "file": 63 } ] }, { "id": "metadata/import/npm/relative/1/get-buffer-response::relative/1/get-buffer-response", "conf": 0.95, "crit": 2, "desc": "imports ./get-buffer-response", "from": [ { "file": 277 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0xff hex byte token", "from": [ { "file": 63 } ] }, { "id": "metadata/import/npm/relative/1/parse::relative/1/parse", "conf": 0.95, "crit": 2, "desc": "imports ./parse", "from": [ { "file": 367 } ] }, { "id": "micro-behaviors/fs/read/file/full::readfilesync-call", "conf": 0.9, "crit": 3, "desc": "Calls readFileSync", "from": [ { "file": 438 } ] }, { "id": "objectives/execution/exploit/network-service/exploit-automation::nuclei-remote-http-target-field", "conf": 0.93, "crit": 3, "desc": "Nuclei example hardcodes an HTTP target", "from": [ { "file": 280 } ] }, { "id": "metadata/import/npm/relative/1/generated/paginating-endpoints::relative/1/generated/paginating-endpoints", "conf": 0.95, "crit": 2, "desc": "imports ./generated/paginating-endpoints", "from": [ { "file": 311 } ] }, { "id": "micro-behaviors/data/decode/url::js-unescape-call-text", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript unescape in source text", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/communications/http/webhook::webhook-registration-call", "conf": 0.86, "crit": 3, "desc": "Webhook registration call", "from": [ { "file": 292 } ] }, { "id": "micro-behaviors/communications/socket/receive::node-socket-data-event", "atk": "T1071", "mbc": "C0001", "conf": 0.78, "crit": 3, "desc": "Node socket data event handler", "from": [ { "file": 145 } ] }, { "id": "metadata/import/npm/relative/1/endpointinterface::relative/1/endpointinterface", "conf": 0.95, "crit": 2, "desc": "imports ./EndpointInterface", "from": [ { "file": 244 } ] }, { "id": "metadata/import/npm/relative/1/utils/referrer/js::relative/1/utils/referrer/js", "conf": 0.95, "crit": 2, "desc": "imports ./utils/referrer.js", "from": [ { "file": 144 } ] }, { "id": "metadata/file/string/telemetry::user-name-field", "conf": 0.9, "crit": 3, "desc": "userName field name", "from": [ { "file": 330 } ] }, { "id": "metadata/package/testing/presence/scripted::it-call", "conf": 0.6, "crit": 3, "desc": "it() function call", "from": [ { "file": 215 } ] }, { "id": "metadata/import/npm/relative/1/util/add-query-parameters::relative/1/util/add-query-parameters", "conf": 0.95, "crit": 2, "desc": "imports ./util/add-query-parameters", "from": [ { "file": 376 } ] }, { "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source", "conf": 1.0, "crit": 3, "desc": "Source contains low-bit mask syntax", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/http/post::request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Sets POST as an HTTP request method", "from": [ { "file": 335 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/http/telemetry::client-id-request-header", "conf": 0.9, "crit": 3, "desc": "Client-Id HTTP request header literal", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::https-port-443-protocol", "conf": 0.6, "crit": 3, "desc": "References HTTPS service port 443", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/write/file/append::append-file-sync", "conf": 0.95, "crit": 3, "desc": "Node fs appends to a file synchronously", "from": [ { "file": 455 } ] }, { "id": "metadata/import/npm/relative/1/oidc-utils::relative/1/oidc-utils", "conf": 0.95, "crit": 2, "desc": "imports ./oidc-utils", "from": [ { "file": 458 } ] }, { "id": "metadata/package/scripts/build::has-build-script-build", "conf": 0.7, "crit": 3, "desc": "Package declares build script" }, { "id": "metadata/import/npm/actions/http-client::actions/http-client", "conf": 0.95, "crit": 2, "desc": "imports @actions/http-client", "from": [ { "file": 429 } ] }, { "id": "micro-behaviors/communications/socket/ssl::node-tls-connect", "mbc": "C0001", "conf": 0.88, "crit": 3, "desc": "Node TLS module connects a socket", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call", "conf": 0.72, "crit": 3, "desc": "Sorts a JavaScript array", "from": [ { "file": 146 } ] }, { "id": "metadata/build/minifier::js-min-or-map-basename", "conf": 0.9, "crit": 3, "desc": "JavaScript minified or map basename", "from": [ { "file": 39 } ] }, { "id": "metadata/import/npm/before-after-hook::before-after-hook", "conf": 0.95, "crit": 2, "desc": "imports before-after-hook", "from": [ { "file": 386 } ] }, { "id": "metadata/import/npm/tr46::tr46", "conf": 0.95, "crit": 2, "desc": "imports tr46", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-create-repo-auto-init-field", "conf": 0.84, "crit": 3, "desc": "GitHub create-repo auto-init field", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/relative/1/defaults::relative/1/defaults", "conf": 0.95, "crit": 2, "desc": "imports ./defaults", "from": [ { "file": 365 } ] }, { "id": "micro-behaviors/data/encode/charcode::codepoint-at", "conf": 0.7, "crit": 3, "desc": "codePointAt() method call", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/url/query::js-urlsearchparams-construction", "conf": 0.95, "crit": 3, "desc": "Builds URL query parameters", "from": [ { "file": 150 } ] }, { "id": "metadata/package/repository::npm-name-repo-mismatch", "conf": 0.8, "crit": 3, "desc": "Package and repository names differ", "from": [ { "file": 129 } ] }, { "id": "metadata/package/dependencies/manifest/count::npm-many-dev-dependencies", "conf": 0.7, "crit": 2, "desc": "npm manifest has many devDependencies" }, { "id": "micro-behaviors/communications/http/body::request-write-raw-data-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "HTTP request writes a raw data variable", "from": [ { "file": 418 } ] }, { "id": "metadata/import/npm/relative/1/response/js::relative/1/response/js", "conf": 0.95, "crit": 2, "desc": "imports ./response.js", "from": [ { "file": 145 } ] }, { "id": "micro-behaviors/os/module/require::js-side-effect-require", "conf": 0.75, "crit": 3, "desc": "Side-effect require without binding", "from": [ { "file": 157 } ] }, { "id": "metadata/import/npm/relative/1/types::relative/1/types", "conf": 0.95, "crit": 2, "desc": "imports ./types", "from": [ { "file": 285 } ] }, { "id": "micro-behaviors/communications/ssh/connect::ssh-string", "atk": "T1021.004", "conf": 0.4, "crit": 1, "desc": "References the SSH protocol", "from": [ { "file": 233 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 214 }, { "file": 215 }, { "file": 503 } ], "uses": [ 218, 510 ] }, { "id": "micro-behaviors/process/create/load/local::cjs-local-require-call", "atk": "T1059.007", "conf": 0.9, "crit": 3, "desc": "CommonJS local-module require call", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/write/file/shell::shell-profile-append-call", "conf": 0.9, "crit": 3, "desc": "Appends with the appendFile API", "from": [ { "file": 455 } ] }, { "id": "metadata/build/bundler/wrapper::js-tsc-reexport-getter", "conf": 0.97, "crit": 2, "desc": "Transpiled re-export getter (tsc/babel barrel)", "from": [ { "file": 458 } ] }, { "id": "metadata/import/npm/relative/1/fetch::relative/1/fetch", "conf": 0.95, "crit": 2, "desc": "imports ./Fetch", "from": [ { "file": 240 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 472 } ] }, { "id": "metadata/package/repository::repo-owner-project-coordinate", "conf": 0.9, "crit": 3, "desc": "Repository uses owner/project coordinate" }, { "id": "objectives/supply-chain/install-hook/scripts/prepare::prepare-runs-webpack-rollup--rollup", "atk": "T1195.002", "conf": 0.95, "crit": 1, "desc": "prepare runs webpack or rollup (rollup)" }, { "id": "metadata/import/npm/node-fetch::node-fetch", "conf": 0.95, "crit": 3, "desc": "imports node-fetch", "from": [ { "file": 267 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-user-repos-endpoint-path", "conf": 0.9, "crit": 3, "desc": "GitHub authenticated-user repos endpoint", "from": [ { "file": 233 } ] }, { "id": "metadata/import/npm/relative/1/nil/js::relative/1/nil/js", "conf": 0.95, "crit": 2, "desc": "imports ./nil.js", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/data/source/property/read::repeated-constructor-property-read", "conf": 0.9, "crit": 3, "desc": "Reads constructor properties repeatedly", "from": [ { "file": 261 } ] }, { "id": "metadata/package/dependencies/lockfile::package-lock-resolved-url", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "Lockfile dependency resolved URL" }, { "id": "metadata/import/npm/relative/1/file-command::relative/1/file-command", "conf": 0.95, "crit": 2, "desc": "imports ./file-command", "from": [ { "file": 458 } ] }, { "id": "metadata/package/dependencies/manifest/presence::npm-empty-dependencies-object", "conf": 0.95, "crit": 2, "desc": "npm manifest has empty dependencies object", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access", "from": [ { "file": 418 } ] }, { "id": "micro-behaviors/communications/http/webhook::webhook-post-method-field", "conf": 0.9, "crit": 3, "desc": "Webhook specifies HTTP POST", "from": [ { "file": 465 } ] }, { "id": "metadata/file/format/structured::sourcemap-sources-content", "conf": 0.9, "crit": 3, "desc": "Source map sourcesContent array", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/data/source/prototype::return-this-body", "conf": 0.7, "crit": 3, "desc": "Function body returns this", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call", "conf": 0.9, "crit": 3, "desc": "Calls a computed this method", "from": [ { "file": 139 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--azure", "conf": 0.4, "crit": 3, "desc": "Public cloud provider name (Azure)", "from": [ { "file": 330 } ] }, { "id": "objectives/supply-chain/credential-theft/registry::js-octet-stream-upload", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "JavaScript uploads octet-stream body", "from": [ { "file": 192 } ] }, { "id": "metadata/package/dependencies/lockfile::resolved-registry-hostname", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Lockfile resolves through a registry host" }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-contents-delete-endpoint", "conf": 0.9, "crit": 3, "desc": "GitHub repository contents delete endpoint path", "from": [ { "file": 292 } ] }, { "id": "metadata/package/testing/scripted::js-bdd-describe-text", "conf": 0.75, "crit": 2, "desc": "JavaScript describe() test call", "from": [ { "file": 215 } ] }, { "id": "micro-behaviors/fs/path/secret-config::ssh-tooling-or-transcript-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "SSH tooling or documentation transcript", "from": [ { "file": 233 }, { "file": 317 }, { "off": 582427, "file": 330, "line": 9623 } ], "uses": [ 356, 448 ] }, { "id": "metadata/package/entrypoint::parent-module-build-entry", "conf": 0.93, "crit": 3, "desc": "Package module targets parent build tree" }, { "id": "metadata/build/bundler/wrapper::babel-define-property-helper", "conf": 0.9, "crit": 2, "desc": "Babel define-property helper", "from": [ { "file": 305 } ] }, { "id": "well-known/tool/sysadmin/github-runner::configuration", "conf": 0.9, "crit": 3, "desc": "Self-hosted runner configuration", "from": [ { "off": 15345, "file": 297, "line": 324 }, { "off": 40126, "file": 330, "line": 442 } ], "uses": [ 197, 483 ] }, { "id": "objectives/supply-chain/install-hook/dropper/shell::github-ci-identity-fields", "atk": "T1195.002,T1574.007", "conf": 0.9, "crit": 3, "desc": "Reads GitHub CI actor and repository", "from": [ { "file": 438 } ] }, { "id": "well-known/lib/data/ioredis::ioredis-utils-parse-url", "conf": 1.0, "crit": 3, "desc": "ioredis parseURL utility", "from": [ { "file": 7 } ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/decode/custom::js-octal-parseint", "atk": "T1140", "conf": 0.96, "crit": 3, "desc": "parseInt parses an octal string", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/process/create/load/local::top-level-require-method-call", "atk": "T1059.007", "conf": 0.9, "crit": 3, "desc": "Top-level method call on require result", "from": [ { "file": 156 } ] }, { "id": "micro-behaviors/os/env/cicd::github-actions-oidc-token-request-env", "conf": 0.96, "crit": 3, "desc": "Actions OIDC token request env vars", "from": [ { "file": 452 } ] }, { "id": "metadata/import/npm/relative/2/types::relative/2/types", "conf": 0.95, "crit": 2, "desc": "imports ../types", "from": [ { "file": 298 } ] }, { "id": "metadata/package/entrypoint::bin-dist-entrypoint", "conf": 0.85, "crit": 2, "desc": "Package bin targets dist output" }, { "id": "micro-behaviors/data/source/syntax/schema::username-object-key", "conf": 0.9, "crit": 3, "desc": "Object literal declares a username key", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::content-object-field", "conf": 0.8, "crit": 3, "desc": "JSON content object field", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::javascript-basic-auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JavaScript Basic Authorization header", "from": [ { "file": 421 } ] }, { "id": "metadata/file/catalog/service::service-name-github", "conf": 0.6, "crit": 3, "desc": "GitHub service name", "from": [ { "file": 241 } ] }, { "id": "metadata/import/npm/assert::assert", "conf": 0.95, "crit": 2, "desc": "imports assert", "from": [ { "file": 64 } ] }, { "id": "objectives/supply-chain/hidden-payload/trojan::decoder-array-push-ast", "atk": "T1195.002", "mbc": "B0032", "conf": 0.76, "crit": 3, "desc": "Pushes indexed or character-coded decoder values", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/relative/1/util/lowercase-keys::relative/1/util/lowercase-keys", "conf": 0.95, "crit": 2, "desc": "imports ./util/lowercase-keys", "from": [ { "file": 377 } ] }, { "id": "micro-behaviors/communications/http/request/body::email-collection-body-field", "atk": "T1589.002", "mbc": "E1589", "conf": 0.85, "crit": 3, "desc": "Body field naming email contact collection", "from": [ { "file": 233 } ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/fetch-blob/from/js::fetch-blob/from/js", "conf": 0.95, "crit": 2, "desc": "imports fetch-blob/from.js", "from": [ { "file": 139 } ] }, { "id": "metadata/import/npm/relative/1/md5/js::relative/1/md5/js", "conf": 0.95, "crit": 2, "desc": "imports ./md5.js", "from": [ { "file": 62 } ] }, { "id": "metadata/import/npm/relative/2/uuid-bin::relative/2/uuid-bin", "conf": 0.95, "crit": 2, "desc": "imports ../uuid-bin", "from": [ { "file": 116 } ] }, { "id": "micro-behaviors/data/format/html::markdown-remote-image-source", "conf": 0.9, "crit": 3, "desc": "Markdown references a remote image", "from": [ { "file": 117 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/wrappy::wrappy", "conf": 0.95, "crit": 2, "desc": "imports wrappy", "from": [ { "file": 137 } ] }, { "id": "metadata/lang/source::repeated-large-integer-arrays", "conf": 0.8, "crit": 3, "desc": "Repeated long numeric array literals", "from": [ { "file": 65 } ] }, { "id": "metadata/package/testing/scripted::js-bdd-suite", "conf": 0.85, "crit": 2, "desc": "JavaScript BDD test suite", "from": [ { "off": 144, "file": 215, "line": 7 } ], "uses": [ 330, 382 ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "from": [ { "file": 22 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/prepare::prepare-runs-webpack-rollup", "atk": "T1195.002", "conf": 0.95, "crit": 1, "desc": "prepare runs webpack or rollup", "from": [ { "file": 186 } ], "uses": [ 364 ] }, { "id": "metadata/import/npm/relative/1/endpointoptions::relative/1/endpointoptions", "conf": 0.95, "crit": 2, "desc": "imports ./EndpointOptions", "from": [ { "file": 253 } ] }, { "id": "micro-behaviors/communications/http/url/github::github-web-raw-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "GitHub web raw file URL", "from": [ { "file": 330 } ] }, { "id": "metadata/lang/locale::readme-language-nav-marker", "conf": 0.95, "crit": 3, "desc": "README links to a translated README", "from": [ { "file": 117 } ] }, { "id": "objectives/impact/system/power::shutdown-keyword", "conf": 0.98, "crit": 3, "desc": "Shell invokes a power command", "from": [ { "file": 25 } ] }, { "id": "metadata/import/npm/octokit/auth-token::octokit/auth-token", "conf": 0.95, "crit": 3, "desc": "imports @octokit/auth-token", "from": [ { "file": 386 } ] }, { "id": "metadata/import/npm/formdata-polyfill/esm/min/js::formdata-polyfill/esm/min/js", "conf": 0.95, "crit": 2, "desc": "imports formdata-polyfill/esm.min.js", "from": [ { "file": 139 } ] }, { "id": "metadata/import/npm/tunnel::tunnel", "conf": 0.95, "crit": 2, "desc": "imports tunnel", "from": [ { "file": 418 } ] }, { "id": "micro-behaviors/os/module/require::esm-side-effect-local-import", "conf": 0.9, "crit": 3, "desc": "ESM side-effect-only local import", "from": [ { "file": 200 } ] }, { "id": "metadata/import/npm/relative/1/util/remove-undefined-properties::relative/1/util/remove-undefined-properties", "conf": 0.95, "crit": 2, "desc": "imports ./util/remove-undefined-properties", "from": [ { "file": 377 } ] }, { "id": "metadata/import/npm/relative/1/parse/js::relative/1/parse/js", "conf": 0.95, "crit": 2, "desc": "imports ./parse.js", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::commonjs-module-reexport", "conf": 0.92, "crit": 3, "desc": "CommonJS module re-exports required package", "from": [ { "file": 131 } ] }, { "id": "metadata/import/npm/relative/1/headers/js::relative/1/headers/js", "conf": 0.95, "crit": 2, "desc": "imports ./headers.js", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/relative/1/parameters-and-response-types::relative/1/parameters-and-response-types", "conf": 0.95, "crit": 2, "desc": "imports ./parameters-and-response-types", "from": [ { "file": 297 } ] }, { "id": "metadata/import/npm/octokit/plugin-rest-endpoint-methods::octokit/plugin-rest-endpoint-methods", "conf": 0.95, "crit": 3, "desc": "imports @octokit/plugin-rest-endpoint-methods", "from": [ { "file": 426 } ] }, { "id": "metadata/file/format/structured::sourcemap-typescript-sources", "conf": 0.9, "crit": 3, "desc": "Source map of TypeScript sources", "from": [ { "file": 24 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-20000", "conf": 0.9, "crit": 3, "desc": "Source has over 20000 comment bytes", "from": [ { "file": 22 } ] }, { "id": "metadata/import/npm/relative/1/sha1/js::relative/1/sha1/js", "conf": 0.95, "crit": 2, "desc": "imports ./sha1.js", "from": [ { "file": 59 } ] }, { "id": "metadata/import/npm/fs::fs", "conf": 0.95, "crit": 3, "desc": "imports node:fs", "from": [ { "file": 202 } ] }, { "id": "metadata/package/scripts/build::has-build-script-1", "conf": 1.0, "crit": 3, "desc": "Package has compiled build script", "from": [ { "file": 186 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::content-type-header", "conf": 0.5, "crit": 3, "desc": "References an HTTP Content-Type header", "from": [ { "file": 192 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::basic-auth-credential-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Basic auth credential literal", "from": [ { "file": 297 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-prefix", "conf": 1.0, "crit": 2, "desc": "Node.js test filename prefix", "from": [ { "file": 156 } ] }, { "id": "metadata/package/entrypoint::has-side-effects", "conf": 0.85, "crit": 3, "desc": "Package declares sideEffects metadata", "from": [ { "file": 56 } ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "metadata/package/entrypoint::pkg-types-field", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript types entry" }, { "id": "micro-behaviors/os/module/require::cjs-require-in-catch-fallback", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside a catch fallback", "from": [ { "file": 198 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-api-host", "conf": 0.86, "crit": 3, "desc": "GitHub API host reference", "from": [ { "file": 297 } ] }, { "id": "metadata/package/files/package-json::files-dist-ref", "conf": 0.85, "crit": 2, "desc": "Package files list includes the dist directory" }, { "id": "micro-behaviors/communications/http/oauth::oauth-client-credentials", "conf": 0.86, "crit": 3, "desc": "OAuth client credential fields", "uses": [ 161, 573 ] }, { "id": "metadata/import/npm/relative/1/requestmethod::relative/1/requestmethod", "conf": 0.95, "crit": 2, "desc": "imports ./RequestMethod", "from": [ { "file": 242 } ] }, { "id": "metadata/build/ci/github-actions::workflow-definition-path", "conf": 0.99, "crit": 3, "desc": "GitHub Actions workflow definition path", "from": [ { "file": 469 } ] }, { "id": "micro-behaviors/data/decode/custom::js-charcode-mask-unescape-decoder", "atk": "T1140", "conf": 0.96, "crit": 3, "desc": "CharCode mask near JavaScript unescape", "from": [ { "file": 65 } ], "uses": [ 48, 240 ] }, { "id": "micro-behaviors/communications/ssh/keys::ed25519-key-text-fragment", "conf": 1.0, "crit": 3, "desc": "Contains SSH Ed25519 key-like text", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-app-installation-token-api", "conf": 0.88, "crit": 3, "desc": "GitHub App installation token endpoint path", "from": [ { "file": 292 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-graphql-api-endpoint", "conf": 0.96, "crit": 3, "desc": "GitHub GraphQL API endpoint", "from": [ { "file": 438 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::http-port-80", "conf": 0.6, "crit": 3, "desc": "HTTP service port number", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/http::http", "conf": 0.95, "crit": 3, "desc": "imports http", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "from": [ { "file": 61 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-3f", "mbc": "B0032", "conf": 0.5, "crit": 3, "desc": "0x3f hex byte token", "from": [ { "file": 60 } ] }, { "id": "metadata/import/builtin::require-os", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js os module", "from": [ { "file": 438 } ] }, { "id": "objectives/execution/automation/agent::vulnerability-state-marker-vulnerable", "atk": "T1059,T1190,T1595", "conf": 0.82, "crit": 3, "desc": "Vulnerable or CVE state marker", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/os/module/require::cjs-require-in-try", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside a try block", "from": [ { "file": 155 } ] }, { "id": "metadata/import/npm/relative/1/path-utils::relative/1/path-utils", "conf": 0.95, "crit": 2, "desc": "imports ./path-utils", "from": [ { "file": 458 } ] }, { "id": "micro-behaviors/communications/http/request/action-resource::named-other-principal", "conf": 0.92, "crit": 3, "desc": "Named other-principal variable", "from": [ { "file": 233 } ] }, { "id": "micro-behaviors/process/hook/xhr::xhr-prototype-send-eq", "conf": 0.7, "crit": 3, "desc": "XMLHttpRequest.prototype.send assignment", "from": [ { "file": 192 } ] }, { "id": "metadata/import/npm/buffer::buffer", "conf": 0.95, "crit": 3, "desc": "imports node:buffer", "from": [ { "file": 145 } ] }, { "id": "metadata/import/npm/relative/1/requestoptions::relative/1/requestoptions", "conf": 0.95, "crit": 2, "desc": "imports ./RequestOptions", "from": [ { "file": 251 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::accounts-endpoint-path", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Accounts endpoint path", "from": [ { "file": 233 } ] }, { "id": "micro-behaviors/data/compress/zlib::node-zlib-import", "conf": 0.9, "crit": 3, "desc": "Imports the Node.js zlib module", "from": [ { "file": 145 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-protocol-reference", "conf": 0.5, "crit": 3, "desc": "References the OAuth 2 protocol" }, { "id": "metadata/import/npm/octokit/core/dist-types/types::octokit/core/dist-types/types", "conf": 0.95, "crit": 3, "desc": "imports @octokit/core/dist-types/types", "from": [ { "file": 427 } ] }, { "id": "micro-behaviors/data/source/property/identity::host-user-object-fields", "conf": 0.9, "crit": 3, "desc": "Host or user object field keys", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/relative/1/merge::relative/1/merge", "conf": 0.95, "crit": 2, "desc": "imports ./merge", "from": [ { "file": 367 } ] }, { "id": "metadata/package/scripts/lifecycle::builtin-pipe-execute-benign-package-context", "conf": 0.99, "crit": 3, "desc": "Known-good package context for pipe-execute heuristic", "from": [ { "file": 56 } ], "uses": [ 529 ] }, { "id": "metadata/import/npm/uuid::uuid", "conf": 0.95, "crit": 2, "desc": "imports uuid", "from": [ { "file": 455 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "from": [ { "file": 418 } ] }, { "id": "well-known/lib/crypto/uuid::uuid-package-name", "conf": 0.98, "crit": 3, "desc": "uuid npm package manifest name" }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 25 } ] }, { "id": "metadata/package/scripts/build::has-release-scripts-1", "conf": 1.0, "crit": 3, "desc": "Package has release script" }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-number-parse", "conf": 0.9, "crit": 3, "desc": "JavaScript hex-to-integer conversion", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/email/mime::mime-octet-stream", "conf": 0.85, "crit": 3, "desc": "Uses the application/octet-stream MIME type", "from": [ { "file": 192 } ] }, { "id": "metadata/import/npm/octokit/request-error::octokit/request-error", "conf": 0.95, "crit": 3, "desc": "imports @octokit/request-error", "from": [ { "file": 267 } ] }, { "id": "well-known/tool/detection/redaction::redacted-replacement-marker", "conf": 0.9, "crit": 3, "desc": "REDACTED replacement marker" }, { "id": "micro-behaviors/communications/http/url/navigation::url-object-host-read", "conf": 0.9, "crit": 3, "desc": "Extracts host from a constructed URL", "from": [ { "file": 140 } ] }, { "id": "metadata/import/npm/once::once", "conf": 0.95, "crit": 2, "desc": "imports once", "from": [ { "file": 283 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-github-repository", "conf": 0.78, "crit": 3, "desc": "Reads GITHUB_REPOSITORY CI variable", "from": [ { "file": 438 } ] }, { "id": "well-known/tool/sysadmin/github-runner::config-args", "conf": 0.95, "crit": 3, "desc": "Self-hosted runner config args", "from": [ { "file": 297 } ] }, { "id": "objectives/credential-access/messaging/telegram::telegram-web-auth-storage-marker", "atk": "T1555", "conf": 0.95, "crit": 3, "desc": "Telegram Web authentication storage marker", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/relative/1/version::relative/1/version", "conf": 0.95, "crit": 2, "desc": "imports ./version", "from": [ { "file": 275 } ] }, { "id": "metadata/import/npm/relative/1/request/js::relative/1/request/js", "conf": 0.95, "crit": 2, "desc": "imports ./request.js", "from": [ { "file": 145 } ] }, { "id": "micro-behaviors/crypto/asymmetric/ssh::ed25519-public-key-literal", "conf": 0.9, "crit": 3, "desc": "Structurally complete SSH Ed25519 public key", "from": [ { "file": 330 } ] }, { "id": "metadata/file/comment::source-at-most-two-comments", "conf": 0.88, "crit": 2, "desc": "Source has at most two comments", "from": [ { "file": 10 } ] }, { "id": "metadata/build/minifier::js-umd-wrapper-minified", "conf": 0.9, "crit": 2, "desc": "Contains a minified UMD CommonJS branch", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/communications/http/form::formdata-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Constructs browser FormData", "from": [ { "file": 139 } ] }, { "id": "metadata/package/documentation/package-metadata::readme-install-scoped-package-command", "conf": 0.9, "crit": 3, "desc": "README recommends scoped package installation", "from": [ { "file": 280 } ] }, { "id": "micro-behaviors/communications/http/user-agent::mobile-user-agent-header-map-read", "conf": 0.94, "crit": 3, "desc": "Reads User-Agent from a header map", "from": [ { "file": 386 } ] }, { "id": "micro-behaviors/communications/http/curl::curl-command-remote-url", "conf": 0.85, "crit": 3, "desc": "curl command names a remote HTTP(S) URL", "from": [ { "file": 463 } ] }, { "id": "metadata/import/npm/https::https", "conf": 0.95, "crit": 3, "desc": "imports https", "from": [ { "file": 130 } ] }, { "id": "metadata/import/npm/relative/1/v5/js::relative/1/v5/js", "conf": 0.95, "crit": 2, "desc": "imports ./v5.js", "from": [ { "file": 64 } ] }, { "id": "metadata/build/bundler/asset::has-sourcemap", "conf": 0.9, "crit": 2, "desc": "Code has source map reference", "from": [ { "file": 25 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 3 } ] }, { "id": "metadata/import/npm/url::url", "conf": 0.95, "crit": 2, "desc": "imports node:url", "from": [ { "file": 144 } ] }, { "id": "metadata/import/npm/relative/1/rng/js::relative/1/rng/js", "conf": 0.95, "crit": 2, "desc": "imports ./rng.js", "from": [ { "file": 60 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-create-repo-api", "conf": 0.9, "crit": 3, "desc": "Explicit GitHub repository creation API request", "from": [ { "off": 133173, "file": 233, "line": 2333 }, { "file": 330 } ], "uses": [ 366 ] }, { "id": "micro-behaviors/communications/proxy/tunnel::cloudflared-tunnel-subcommand", "atk": "T1090", "conf": 0.84, "crit": 3, "desc": "cloudflared tunnel subcommand", "from": [ { "file": 418 } ] }, { "id": "metadata/build/config::js-config-export-binding", "conf": 0.9, "crit": 2, "desc": "JavaScript config exports named binding", "from": [ { "file": 86 } ] }, { "id": "metadata/import/npm/data-uri-to-buffer::data-uri-to-buffer", "conf": 0.95, "crit": 2, "desc": "imports data-uri-to-buffer", "from": [ { "file": 145 } ] }, { "id": "metadata/import/package::dep-eslint", "conf": 0.9, "crit": 3, "desc": "Depends on ESLint", "from": [ { "file": 5 } ] }, { "id": "well-known/tool/sysadmin/github-runner::worker", "conf": 0.95, "crit": 3, "desc": "GitHub Actions Runner.Worker identifier", "from": [ { "file": 443 } ] }, { "id": "metadata/import/npm/fetch-blob::fetch-blob", "conf": 0.95, "crit": 2, "desc": "imports fetch-blob", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-actions-api-client-import", "conf": 0.98, "crit": 3, "desc": "Imports the GitHub Actions API client", "from": [ { "file": 465 } ] }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "from": [ { "file": 117 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 2, "desc": "File is in common test directory", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/process/hook/xhr::send-hook", "conf": 0.85, "crit": 3, "desc": "XMLHttpRequest.send method hooking", "from": [ { "file": 192 }, { "file": 197 } ], "uses": [ 460 ] }, { "id": "metadata/file/comment::js-many-base64-like-comments", "conf": 0.97, "crit": 3, "desc": "Many Base64-like comment spans in JavaScript", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Encoded URL references MDN documentation", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/data/encode/embedded::base64-like-comment-content", "conf": 0.94, "crit": 3, "desc": "JavaScript comment contains Base64-like content" }, { "id": "metadata/import/npm/is-plain-object::is-plain-object", "conf": 0.95, "crit": 2, "desc": "imports is-plain-object", "from": [ { "file": 267 } ] }, { "id": "metadata/import/npm/universal-user-agent::universal-user-agent", "conf": 0.95, "crit": 2, "desc": "imports universal-user-agent", "from": [ { "file": 267 } ] }, { "id": "micro-behaviors/data/format/json::json-result-field", "conf": 0.8, "crit": 3, "desc": "JSON result or response field key", "from": [ { "file": 143 } ] }, { "id": "metadata/import/npm/relative/1/validate/js::relative/1/validate/js", "conf": 0.95, "crit": 2, "desc": "imports ./validate.js", "from": [ { "file": 57 } ] }, { "id": "metadata/package/homepage::homepage-git-host", "conf": 0.9, "crit": 3, "desc": "Homepage points to major Git host" }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/process/hook/webextension::dnr-set-operation", "conf": 0.8, "crit": 3, "desc": "DNR operation set", "from": [ { "file": 330 } ] }, { "id": "micro-behaviors/data/buffer::buffer-from-utf8", "conf": 0.9, "crit": 3, "desc": "Creates Node.js Buffer from UTF-8 text", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "from": [ { "file": 66 } ] }, { "id": "well-known/tool/detection/redaction::secret-pattern-token-label", "conf": 0.95, "crit": 3, "desc": "Secret scanner token label", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/relative/1/util/merge-deep::relative/1/util/merge-deep", "conf": 0.95, "crit": 2, "desc": "imports ./util/merge-deep", "from": [ { "file": 377 } ] }, { "id": "micro-behaviors/communications/url/reference::javascript-comment-url-reference", "conf": 0.9, "crit": 3, "desc": "JavaScript comment contains a URL", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/string/replace::chained-replace-calls", "conf": 0.9, "crit": 3, "desc": "Chains multiple JavaScript string replacements", "from": [ { "file": 192 } ] }, { "id": "micro-behaviors/communications/http/upload::github-uploads-api", "conf": 0.8, "crit": 3, "desc": "GitHub release asset upload endpoint path", "from": [ { "file": 292 } ] }, { "id": "metadata/build/ecosystem::npm-logical-or-fallback", "conf": 0.95, "crit": 1, "desc": "npm script uses logical-OR fallback" }, { "id": "micro-behaviors/data/llm/agent::sensitive-item-transmission-phrase", "conf": 0.9, "crit": 3, "desc": "Sensitive-item transmission phrase", "from": [ { "file": 145 } ] }, { "id": "metadata/import/npm/relative/1/streams/cjs::relative/1/streams/cjs", "conf": 0.95, "crit": 2, "desc": "imports ./streams.cjs", "from": [ { "file": 200 } ] }, { "id": "objectives/command-and-control/channel/covert::port-443-constant-assignment", "atk": "T1573,T1043", "mbc": "C0022.002", "conf": 0.7, "crit": 3, "desc": "Assigns 443 to a port variable", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission", "conf": 0.82, "crit": 3, "desc": "Emits object through named JavaScript event", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/fs/write/file/full::js-file-write", "conf": 0.9, "crit": 3, "desc": "JavaScript file write operation", "from": [ { "off": 1602, "file": 455, "line": 38 } ], "uses": [ 337 ] }, { "id": "micro-behaviors/communications/ipc/message::postmessage-call", "conf": 0.86, "crit": 3, "desc": "Sends data with window or worker postMessage", "from": [ { "file": 155 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-create-repo-and-contents-write", "conf": 0.95, "crit": 3, "desc": "Creates a GitHub repo and writes contents", "from": [ { "file": 233 }, { "off": 501115, "file": 330, "line": 7329 } ], "uses": [ 146, 590 ] }, { "id": "micro-behaviors/fs/read/stream::create-read-stream", "conf": 0.92, "crit": 3, "desc": "Creates a file read stream", "from": [ { "file": 202 } ] }, { "id": "metadata/package/keywords/identity::npm-keyword-browser", "conf": 0.9, "crit": 3, "desc": "Package declares browser keyword" }, { "id": "micro-behaviors/data/source/unsafe::zlib-implementation-reference", "conf": 0.9, "crit": 3, "desc": "References a zlib implementation", "from": [ { "file": 145 } ] }, { "id": "metadata/import/npm/relative/1/summary::relative/1/summary", "conf": 0.95, "crit": 2, "desc": "imports ./summary", "from": [ { "file": 458 } ] }, { "id": "metadata/package/completeness::has-github-config-1", "conf": 1.0, "crit": 3, "desc": "Package references GitHub (config/workflows)", "from": [ { "file": 56 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Very short domain in URL", "from": [ { "file": 330 } ] }, { "id": "metadata/package/entrypoint::module-dist-entrypoint", "conf": 0.8, "crit": 2, "desc": "Package module targets dist output" }, { "id": "metadata/import/npm/stream/web::stream/web", "conf": 0.95, "crit": 2, "desc": "imports node:stream/web", "from": [ { "file": 198 } ] }, { "id": "objectives/impact/crypto-manipulation/weakening::commitment-before-generator", "atk": "T1565.001", "conf": 0.94, "crit": 3, "desc": "Orders commitment before generator", "from": [ { "file": 305 } ] }, { "id": "metadata/import/npm/relative/1/index/js::relative/1/index/js", "conf": 0.95, "crit": 2, "desc": "imports ./index.js", "from": [ { "file": 156 } ] }, { "id": "metadata/package/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata" }, { "id": "micro-behaviors/crypto/asymmetric/key::armored-named-private-key-header", "conf": 0.95, "crit": 3, "desc": "References named armored private-key header", "from": [ { "file": 330 } ] }, { "id": "metadata/import/npm/deprecation::deprecation", "conf": 0.95, "crit": 2, "desc": "imports deprecation", "from": [ { "file": 283 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-issues-api", "conf": 0.88, "crit": 3, "desc": "GitHub issues API path", "from": [ { "file": 330 } ] }, { "id": "well-known/lib/crypto/uuid::uuid-dist-path", "conf": 0.96, "crit": 3, "desc": "uuid package dist member path", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/data/buffer::source-right-shift-24-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 24 bits", "from": [ { "file": 63 } ] }, { "id": "metadata/import/npm/actions/http-client/lib/auth::actions/http-client/lib/auth", "conf": 0.95, "crit": 2, "desc": "imports @actions/http-client/lib/auth", "from": [ { "file": 452 } ] }, { "id": "micro-behaviors/data/control-flow/loop::c-family-full-byte-search-loop", "conf": 0.88, "crit": 3, "desc": "C-family loops over all byte values", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "from": [ { "file": 267 } ] }, { "id": "metadata/import/npm/relative/1/lib/remove::relative/1/lib/remove", "conf": 0.95, "crit": 2, "desc": "imports ./lib/remove", "from": [ { "file": 226 } ] }, { "id": "metadata/import/npm/relative/1/proxy::relative/1/proxy", "conf": 0.95, "crit": 2, "desc": "imports ./proxy", "from": [ { "file": 418 } ] }, { "id": "well-known/tool/development/editor/atom-editor::atom-github-credential-helper-context--rx-2", "conf": 0.98, "crit": 3, "desc": "GitHub viewer login GraphQL query", "from": [ { "file": 338 } ] }, { "id": "supply-chain/install-hook/prepublish", "conf": 0.8, "crit": 3, "desc": "Package has 'prepublish' hook that runs during install" }, { "id": "metadata/import/npm/punycode::punycode", "conf": 0.95, "crit": 2, "desc": "imports punycode", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/path::path", "conf": 0.95, "crit": 2, "desc": "imports node:path", "from": [ { "file": 202 } ] }, { "id": "metadata/import/npm/relative/1/utils/is/js::relative/1/utils/is/js", "conf": 0.95, "crit": 2, "desc": "imports ./utils/is.js", "from": [ { "file": 144 } ] }, { "id": "micro-behaviors/process/create/workers::worker-threads-require", "atk": "T1059.007", "mbc": "C0017", "conf": 0.92, "crit": 3, "desc": "Requires worker_threads module", "from": [ { "file": 155 } ] }, { "id": "metadata/import/npm/relative/1/version/js::relative/1/version/js", "conf": 0.95, "crit": 2, "desc": "imports ./version.js", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/communications/http/server/request::request-network-target-field", "conf": 0.9, "crit": 3, "desc": "HTTP request selects a network target", "from": [ { "file": 138 } ] }, { "id": "metadata/file/encoded::base64-compatible-data-context", "conf": 0.95, "crit": 3, "desc": "Test path or known Base64-compatible standard data", "from": [ { "file": 214 }, { "file": 215 } ], "uses": [ 510 ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call", "conf": 0.88, "crit": 3, "desc": "Calls a matcher in a conditional expression", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/load/local::cjs-side-effect-local-require", "atk": "T1059.007", "conf": 0.9, "crit": 3, "desc": "CommonJS side-effect-only require", "from": [ { "file": 116 } ] }, { "id": "micro-behaviors/data/llm/agent::agent-or-skill-server-reference", "conf": 0.9, "crit": 3, "desc": "Agent or skill references a server endpoint", "from": [ { "file": 132 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-graphql-client-import", "conf": 0.96, "crit": 3, "desc": "Imports the Octokit GraphQL client", "from": [ { "file": 386 } ] }, { "id": "metadata/import/npm/relative/1/with-defaults::relative/1/with-defaults", "conf": 0.95, "crit": 2, "desc": "imports ./with-defaults", "from": [ { "file": 275 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-client-secret-field", "conf": 0.65, "crit": 3, "desc": "OAuth client_secret field" }, { "id": "metadata/import/npm/relative/2/octokitresponse::relative/2/octokitresponse", "conf": 0.95, "crit": 2, "desc": "imports ../OctokitResponse", "from": [ { "file": 233 } ] }, { "id": "metadata/file/catalog/unicode::escaped-unicode-codepoint", "conf": 0.99, "crit": 3, "desc": "Escaped Unicode codepoint in source", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member", "conf": 0.8, "crit": 3, "desc": "Reads the Node.js process.platform value", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/communications/url/host::url-host-property-assignment", "conf": 0.82, "crit": 3, "desc": "Assigns a request or URL host property", "from": [ { "file": 7 } ] }, { "id": "metadata/import/npm/whatwg-url::whatwg-url", "conf": 0.95, "crit": 2, "desc": "imports whatwg-url", "from": [ { "file": 261 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy", "conf": 0.8, "crit": 2, "desc": "Copies one indexed array element to another", "from": [ { "file": 3 } ] }, { "id": "metadata/import/builtin::require-fs", "conf": 0.7, "crit": 2, "desc": "Imports the Node.js fs module", "from": [ { "file": 438 } ] }, { "id": "micro-behaviors/os/env/cicd::process-env-bracket-runner", "conf": 0.85, "crit": 3, "desc": "process.env bracket access for runner vars", "from": [ { "file": 458 } ] }, { "id": "metadata/import/npm/relative/1/util/extract-url-variable-names::relative/1/util/extract-url-variable-names", "conf": 0.95, "crit": 2, "desc": "imports ./util/extract-url-variable-names", "from": [ { "file": 376 } ] }, { "id": "metadata/import/npm/relative/1/generated/endpoints::relative/1/generated/endpoints", "conf": 0.95, "crit": 2, "desc": "imports ./generated/Endpoints", "from": [ { "file": 244 } ] }, { "id": "well-known/lib/network/public-suffix-list::psl-readthedocs", "conf": 0.9, "crit": 3, "desc": "Public suffix readthedocs.io", "from": [ { "file": 297 } ] }, { "id": "micro-behaviors/data/serialize/object::js-deserialise", "conf": 0.85, "crit": 3, "desc": "References a deserialization-related symbol", "from": [ { "file": 418 } ] }, { "id": "metadata/import/npm/relative/1/context::relative/1/context", "conf": 0.95, "crit": 2, "desc": "imports ./context", "from": [ { "file": 426 } ] }, { "id": "metadata/package/publishing::npm-public-publish-access", "conf": 0.9, "crit": 3, "desc": "npm package is configured for public publishing" }, { "id": "supply-chain/suspicious-name", "conf": 0.7, "crit": 3, "desc": "Package name 'web-streams-ponyfill-es2018' matches suspicious patterns" }, { "id": "micro-behaviors/communications/http/services/github::github-create-repo", "conf": 0.9, "crit": 3, "desc": "GitHub repository creation workflow API", "from": [ { "file": 233 }, { "file": 330 } ], "uses": [ 501 ] }, { "id": "metadata/import/npm/octokit/request::octokit/request", "conf": 0.95, "crit": 3, "desc": "imports @octokit/request", "from": [ { "file": 335 } ] }, { "id": "metadata/package/completeness::has-typescript", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript tooling", "from": [ { "file": 18 } ] }, { "id": "metadata/import/npm/encoding::encoding", "conf": 0.95, "crit": 3, "desc": "imports encoding", "from": [ { "file": 261 } ] }, { "id": "micro-behaviors/communications/http/url/build::network-destination-function-binding", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Network destination assigned from call", "from": [ { "file": 7 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 11 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-pattern", "conf": 1.0, "crit": 2, "desc": "Node.js test filename pattern", "from": [ { "file": 156 }, { "file": 157 }, { "file": 215 }, { "file": 490 }, { "file": 503 } ], "uses": [ 436 ] }, { "id": "metadata/import/npm/relative/1/fetch-wrapper::relative/1/fetch-wrapper", "conf": 0.95, "crit": 2, "desc": "imports ./fetch-wrapper", "from": [ { "file": 273 } ] }, { "id": "micro-behaviors/os/telemetry/logging/event::extension-analytics-event-field", "conf": 0.93, "crit": 3, "desc": "Object literal has a bare event field", "from": [ { "file": 330 } ] } ] } ] } }