{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8619382381439209,
        "class": 0
      }
    ],
    "prob": 0.86193824,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.6979167,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.86193824,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 0.10545129,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T02:46:15Z"
  },
  "path": "certGenerator.ts",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(Dy)H(Po)",
        "k": {
          "source.imports[0]": "Bun.write",
          "source.imports[1]": "Object.keys",
          "source.imports[2]": "additionalIPs.map",
          "source.imports[3]": "additionalIPs.map.join",
          "source.imports[4]": "console.error",
          "source.imports[5]": "console.log",
          "source.imports[6]": "data.toString",
          "source.imports[7]": "daysValid.toString",
          "source.imports[8]": "dirname",
          "source.imports[9]": "execCommand",
          "source.strings[0]": "\n\n[req_ext]\nsubjectAltName = @alt_names\n\n[v3_ca]\nsubjectAltName = @alt_names\nbasicConstraints = CA:FALSE\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth\n\n[alt_names]\nDNS.1 = ",
          "source.strings[1]": "\nDNS.2 = localhost\nDNS.3 = *.local\nIP.1 = 127.0.0.1\nIP.2 = ::1\n",
          "source.strings[2]": "\n[req]\ndefault_bits = 2048\nprompt = no\ndefault_md = sha256\ndistinguished_name = dn\nreq_extensions = req_ext\nx509_extensions = v3_ca\n\n[dn]\nC=US\nST=State\nL=City\nO=Overlord\nOU=IT\nCN=",
          "source.strings[3]": "\n[req]\ndefault_bits = 2048\nprompt = no\ndefault_md = sha256\ndistinguished_name = dn\nreq_extensions = req_ext\nx509_extensions = v3_ca\n\n[dn]\nC=US\nST=State\nL=City\nO=Overlord\nOU=IT\nCN=${commonName}\n\n[req_ext]\nsubjectAltName = @alt_names\n\n[v3_ca]\nsubjectAltName = @alt_names\nbasicConstraints = CA:FALSE\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth\n\n[alt_names]\nDNS.1 = ${commonName}\nDNS.2 = localhost\nDNS.3 = *.local\nIP.1 = 127.0.0.1\nIP.2 = ::1\n${additionalIPs.map((ip, i) =\u003e `IP.${i + 3} = ${ip}`).join(\"\\n\")}\n",
          "source.strings[4]": "${certDir}/openssl.cnf",
          "source.strings[5]": "-config",
          "source.strings[6]": "-keyout",
          "source.strings[7]": "-newkey",
          "source.strings[8]": "-nodes",
          "source.strings[9]": "/openssl.cnf",
          "source.has_imports": true,
          "source.imports[10]": "existsSync",
          "source.imports[11]": "import",
          "source.imports[12]": "ips.push",
          "source.imports[13]": "mkdirSync",
          "source.imports[14]": "os.networkInterfaces",
          "source.imports[15]": "proc.on",
          "source.imports[16]": "proc.stderr.on",
          "source.imports[17]": "proc.stdout.on",
          "source.imports[18]": "reject",
          "source.imports[19]": "require",
          "source.imports[20]": "resolve",
          "source.imports[21]": "spawn",
          "source.imports[22]": "unlinkSync",
          "source.strings[10]": "Certificate generation failed: ",
          "source.strings[11]": "Certificate generation failed: ${error}",
          "source.strings[12]": "Command failed with code ",
          "source.strings[13]": "Command failed with code ${code}: ${stderr}",
          "source.strings[14]": "Failed to execute ",
          "source.strings[15]": "Failed to execute ${command}: ${err.message}",
          "source.strings[16]": "IP.${i + 3} = ${ip}",
          "source.strings[17]": "[TLS]   Certificate: ",
          "source.strings[18]": "[TLS]   Certificate: ${certPath}",
          "source.strings[19]": "[TLS]   Private Key: ",
          "source.strings[20]": "[TLS]   Private Key: ${keyPath}",
          "source.strings[21]": "[TLS] Common Name: ",
          "source.strings[22]": "[TLS] Common Name: ${commonName}",
          "source.strings[23]": "[TLS] Failed to generate certificate:",
          "source.strings[24]": "[TLS] Generating self-signed certificate...",
          "source.strings[25]": "[TLS] Valid for: ",
          "source.strings[26]": "[TLS] Valid for: ${daysValid} days",
          "source.strings[27]": "[TLS] ✓ Certificate generated successfully",
          "source.strings[28]": "child_process",
          "source.strings[29]": "localhost",
          "source.strings[30]": "openssl",
          "source.strings[31]": "rsa:2048",
          "source.strings[32]": "string",
          "source.strings[33]": "version",
          "source.functions[0]": "anonymous",
          "source.functions[1]": "certificatesExist",
          "source.functions[2]": "execCommand",
          "source.functions[3]": "generateSelfSignedCert",
          "source.functions[4]": "getLocalIPs",
          "source.functions[5]": "isOpenSSLAvailable"
        },
        "x": 3,
        "id": 0,
        "is": [
          "existsSync",
          "existsSync",
          "dirname",
          "existsSync",
          "mkdirSync",
          "console.log",
          "console.log",
          "console.log",
          "additionalIPs.map.join",
          "additionalIPs.map",
          "Bun.write",
          "execCommand",
          "daysValid.toString",
          "unlinkSync",
          "console.log",
          "console.log",
          "console.log",
          "console.error",
          "spawn",
          "proc.stdout.on",
          "data.toString",
          "proc.stderr.on",
          "data.toString",
          "proc.on",
          "resolve",
          "reject",
          "proc.on",
          "reject",
          "execCommand",
          "require",
          "os.networkInterfaces",
          "Object.keys",
          "ips.push",
          "import"
        ],
        "ms": {
          "file": {
            "size": 3496.0
          },
          "text": {
            "digit_ratio": 0.02,
            "space_count": 628.0,
            "total_lines": 161.0,
            "char_entropy": 5.0,
            "unique_chars": 84.0,
            "import_density": 21.12,
            "string_density": 0.55,
            "avg_line_length": 20.71,
            "high_byte_ratio": 0.0,
            "max_line_length": 79.0,
            "non_ascii_ratio": 0.0,
            "empty_line_ratio": 0.15,
            "last_line_length": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.23,
            "most_common_ratio": 0.06,
            "identifier_density": 0.69,
            "line_length_stddev": 19.38,
            "dynamic_import_ratio": 0.03,
            "normalized_import_count": 2.68,
            "normalized_string_count": 7.01,
            "repeated_char_sequences": 1.0,
            "suspicious_string_ratio": 0.12,
            "anonymous_function_ratio": 0.55,
            "max_inline_whitespace_run": 3.0,
            "normalized_function_count": 0.87,
            "imports_to_functions_ratio": 3.09,
            "strings_to_functions_ratio": 8.09,
            "suspicious_identifier_ratio": 0.05,
            "normalized_unique_identifiers": 5.87,
            "identifiers_to_functions_ratio": 3.91
          },
          "imports": {
            "total": 34.0,
            "unique_modules": 23.0,
            "dynamic_imports": 1.0,
            "third_party_count": 34.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 89.0,
            "avg_length": 23.3,
            "max_length": 553.0,
            "path_count": 1.0,
            "avg_entropy": 2.74,
            "total_bytes": 2074.0,
            "entropy_stddev": 1.09,
            "high_entropy_count": 1.0,
            "shell_command_strings": 11.0
          },
          "comments": {},
          "functions": {
            "total": 11.0,
            "anonymous": 6.0,
            "one_liners": 1.0,
            "length_stddev": 24.18,
            "avg_name_length": 15.8,
            "no_params_count": 11.0,
            "avg_length_lines": 17.0,
            "max_length_lines": 88.0,
            "min_length_lines": 1.0,
            "avg_nesting_depth": 0.91,
            "max_nesting_depth": 2.0,
            "high_entropy_names": 1.0,
            "density_per_100_lines": 6.83,
            "code_in_functions_ratio": 1.16
          },
          "identifiers": {
            "total": 111.0,
            "avg_length": 7.4,
            "max_length": 22.0,
            "min_length": 1.0,
            "avg_entropy": 2.37,
            "reuse_ratio": 0.39,
            "unique_count": 43.0,
            "length_stddev": 4.22,
            "sequential_names": 1.0,
            "single_char_count": 1.0,
            "single_char_ratio": 0.02,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.02,
            "all_lowercase_ratio": 0.53,
            "keyboard_pattern_names": 1.0
          }
        },
        "ss": [
          [
            22,
            "child_process"
          ],
          [
            23,
            "child_process"
          ],
          [
            89,
            "fs"
          ],
          [
            90,
            "fs"
          ],
          [
            119,
            "path"
          ],
          [
            120,
            "path"
          ],
          [
            164,
            "string"
          ],
          [
            183,
            "string"
          ],
          [
            206,
            "string"
          ],
          [
            254,
            "string"
          ],
          [
            311,
            "string"
          ],
          [
            328,
            "string"
          ],
          [
            547,
            "localhost"
          ],
          [
            548,
            "localhost"
          ],
          [
            753,
            "[TLS] Generating self-signed certificate..."
          ],
          [
            754,
            "[TLS] Generating self-signed certificate..."
          ],
          [
            815,
            "[TLS] Common Name: ${commonName}"
          ],
          [
            816,
            "[TLS] Common Name: "
          ],
          [
            866,
            "[TLS] Valid for: ${daysValid} days"
          ],
          [
            867,
            "[TLS] Valid for: "
          ],
          [
            896,
            " days"
          ],
          [
            926,
            "\n[req]\ndefault_bits = 2048\nprompt = no\ndefault_md = sha256\ndistinguished_name = dn\nreq_extensions = req_ext\nx509_extensions = v3"
          ],
          [
            927,
            "\n[req]\ndefault_bits = 2048\nprompt = no\ndefault_md = sha256\ndistinguished_name = dn\nreq_extensions = req_ext\nx509_extensions = v3"
          ],
          [
            1119,
            "\n\n[req_ext]\nsubjectAltName = @alt_names\n\n[v3_ca]\nsubjectAltName = @alt_names\nbasicConstraints = CA:FALSE\nkeyUsage = nonRepudiati"
          ],
          [
            1349,
            "\nDNS.2 = localhost\nDNS.3 = *.local\nIP.1 = 127.0.0.1\nIP.2 = ::1\n"
          ],
          [
            1443,
            "IP.${i + 3} = ${ip}"
          ],
          [
            1444,
            "IP."
          ],
          [
            1455,
            " = "
          ],
          [
            1471,
            "\\n"
          ],
          [
            1477,
            "\n"
          ],
          [
            1503,
            "${certDir}/openssl.cnf"
          ],
          [
            1514,
            "/openssl.cnf"
          ],
          [
            1605,
            "openssl"
          ],
          [
            1606,
            "openssl"
          ],
          [
            1624,
            "req"
          ],
          [
            1625,
            "req"
          ],
          [
            1637,
            "-x509"
          ],
          [
            1638,
            "-x509"
          ],
          [
            1652,
            "-newkey"
          ],
          [
            1653,
            "-newkey"
          ],
          [
            1669,
            "rsa:2048"
          ],
          [
            1670,
            "rsa:2048"
          ],
          [
            1687,
            "-nodes"
          ],
          [
            1688,
            "-nodes"
          ],
          [
            1703,
            "-keyout"
          ],
          [
            1704,
            "-keyout"
          ],
          [
            1735,
            "-out"
          ],
          [
            1736,
            "-out"
          ],
          [
            1765,
            "-days"
          ],
          [
            1766,
            "-days"
          ],
          [
            1808,
            "-config"
          ],
          [
            1809,
            "-config"
          ],
          [
            1918,
            "[TLS] ✓ Certificate generated successfully"
          ],
          [
            1919,
            "[TLS] ✓ Certificate generated successfully"
          ],
          [
            1983,
            "[TLS]   Certificate: ${certPath}"
          ],
          [
            1984,
            "[TLS]   Certificate: "
          ],
          [
            2036,
            "[TLS]   Private Key: ${keyPath}"
          ],
          [
            2037,
            "[TLS]   Private Key: "
          ],
          [
            2110,
            "[TLS] Failed to generate certificate:"
          ],
          [
            2111,
            "[TLS] Failed to generate certificate:"
          ],
          [
            2179,
            "Certificate generation failed: ${error}"
          ],
          [
            2180,
            "Certificate generation failed: "
          ],
          [
            2260,
            "string"
          ],
          [
            2274,
            "string"
          ],
          [
            2293,
            "string"
          ],
          [
            2449,
            "data"
          ],
          [
            2450,
            "data"
          ],
          [
            2531,
            "data"
          ],
          [
            2532,
            "data"
          ],
          [
            2605,
            "close"
          ],
          [
            2606,
            "close"
          ],
          [
            2715,
            "Command failed with code ${code}: ${stderr}"
          ],
          [
            2716,
            "Command failed with code "
          ],
          [
            2748,
            " "
          ],
          [
            2793,
            "error"
          ],
          [
            2794,
            "error"
          ],
          [
            2836,
            "Failed to execute ${command}: ${err.message}"
          ],
          [
            2837,
            "Failed to execute "
          ],
          [
            2865,
            " "
          ],
          [
            2996,
            "openssl"
          ],
          [
            2997,
            "openssl"
          ],
          [
            3008,
            "version"
          ],
          [
            3009,
            "version"
          ],
          [
            3106,
            "string"
          ],
          [
            3148,
            "os"
          ],
          [
            3149,
            "os"
          ],
          [
            3217,
            "string"
          ],
          [
            3358,
            "IPv4"
          ],
          [
            3359,
            "IPv4"
          ]
        ],
        "sz": 3496,
        "ts": [
          {
            "c": 0.30000001192092896,
            "d": "stderr string reference",
            "e": [
              "Command failed with code ${code}: ${stderr}"
            ],
            "i": "micro-behaviors/process/fd/stdio::stderr-string",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "spawn"
            ],
            "i": "objectives/command-and-control/dropper/standalone::js-python-stdin-payload-exec--rx-8",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Nested loops with multiple charAt calls",
            "e": [
              "for (const name of Object.keys(interfaces)) {\n      for (const iface of interfaces[name]) {"
            ],
            "i": "micro-behaviors/data/encode/permutation/loop::js-permutation-loop",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ES6 template literal syntax",
            "e": [
              "`IP.${i + 3} = ${"
            ],
            "i": "metadata/lang/javascript-features::template-literal",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              " for ("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "d": "certificate string reference",
            "e": [
              "certificate"
            ],
            "i": "micro-behaviors/crypto/certificate/usage::certificate-ref",
            "l": 2
          },
          {
            "a": "T1195.002",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "sync"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-storage-proxy-ops--rx-16",
            "l": 1
          },
          {
            "a": "T1016",
            "c": 0.800000011920929,
            "d": "IPv4 family literal check",
            "e": [
              "IPv4"
            ],
            "i": "objectives/discovery/system/fingerprint/network::ipv4-family-literal",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "sha256 hash algorithm",
            "e": [
              "sha256"
            ],
            "i": "objectives/discovery/system/fingerprint/runtime::sha256-keyword",
            "l": 2
          },
          {
            "a": "T1016",
            "c": 0.9200000166893005,
            "d": "Internal interface exclusion check",
            "e": [
              "!iface.internal"
            ],
            "i": "objectives/discovery/system/fingerprint/network::internal-interface-filter",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "local"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-storage-proxy-ops--rx-15",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Low string density base64 context",
            "e": [
              "text.string_density = 0.55"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "new Promise() usage marker",
            "e": [
              "new Promise("
            ],
            "i": "metadata/lang/javascript-features::has-promise-new",
            "l": 2
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "error"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Hardcoded localhost network host",
            "e": [
              "localhost"
            ],
            "i": "micro-behaviors/communications/ip/literal::localhost-source",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "key= or config= followed by shell metacharacter",
            "e": [
              "Key: ${keyPath}`);"
            ],
            "i": "micro-behaviors/process/create/shell/injection::iot-param-injection--rx-3",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 161.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1036.008",
            "c": 0.699999988079071,
            "d": "JS-syntax marker (var/const/require)",
            "e": [
              "const os = require("
            ],
            "i": "objectives/evasion/masquerade/extension/shebang::js-syntax-marker",
            "l": 1,
            "m": "F0008"
          },
          {
            "a": "T1059",
            "c": 0.7799999713897705,
            "d": "Socket data event handler",
            "e": [
              ".on(\"data\""
            ],
            "i": "objectives/command-and-control/reverse-shell/socket::on-data-event",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "toString method token",
            "e": [
              "toString"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-token",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "File deletion operation (Node.js/Python)",
            "e": [
              "unlinkSync"
            ],
            "i": "micro-behaviors/fs/directory/traverse::delete-unlink-node-py",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Localhost or IP literal string",
            "e": [
              "localhost"
            ],
            "i": "micro-behaviors/communications/http/url/path::local-ip-or-localhost-literal",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".toString() method call",
            "e": [
              ".toString()"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-call",
            "l": 1
          },
          {
            "a": "T1082",
            "c": 0.75,
            "d": "os.networkInterfaces() call",
            "e": [
              "os.networkInterfaces"
            ],
            "i": "objectives/discovery/system/fingerprint/hardware::os-networkinterfaces-call",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "x509 string reference",
            "e": [
              "x509"
            ],
            "i": "micro-behaviors/crypto/certificate/usage::x509-string",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "CommonJS require symbol",
            "e": [
              "require"
            ],
            "i": "metadata/lang/scripted::require-symbol",
            "l": 1
          },
          {
            "a": "T1195.002,T1105,T1059.007",
            "c": 0.9599999785423279,
            "d": "Regex component marker",
            "e": [
              "unlinkSync"
            ],
            "i": "objectives/supply-chain/install-hook/dropper/token::temp-javascript-require-unlink--rx-10",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "command"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "a": "T1210",
            "c": 0.8600000143051147,
            "d": "Redis KEYS command",
            "e": [
              "keys"
            ],
            "i": "objectives/lateral-movement/exploit/container::redis-keys-command",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (AST)",
            "e": [
              "for (const iface of interfaces[name]) {\n        if (iface.family === \"IPv4\" \u0026\u0026 !iface.internal) {\n  ...",
              "for (const name of Object.keys(interfaces)) {\n      for (const iface of interfaces[name]) {\n        ..."
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast",
            "l": 2
          },
          {
            "a": "T1552.001, T1041",
            "c": 0.9399999976158142,
            "d": "private keyword (case-insensitive)",
            "e": [
              "Private"
            ],
            "i": "objectives/supply-chain/recon-exfil/ai-cli::llm-cli-secret-search-prompt--rx-7",
            "l": 1,
            "m": "E1552"
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "extension"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::management-id-comparison--rx-5",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript console object",
            "e": [
              "console"
            ],
            "i": "micro-behaviors/os/console/io::js-console-object",
            "l": 1
          },
          {
            "a": "T1059",
            "c": 0.75,
            "d": "Runtime child_process import",
            "e": [
              "import { spawn } from \"child_process\""
            ],
            "i": "micro-behaviors/process/create/shell/bridge::child-process-import-runtime",
            "l": 3,
            "m": "C0017"
          },
          {
            "c": 0.800000011920929,
            "d": "Hardcoded loopback IPv4 address",
            "e": [
              "127.0.0.1"
            ],
            "i": "micro-behaviors/communications/ip/literal::loopback-ipv4-source",
            "l": 2
          },
          {
            "a": "T1552.001, T1041",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "toString"
            ],
            "i": "objectives/supply-chain/recon-exfil/ai-cli::github-content-base64-upload--rx-34",
            "l": 1,
            "m": "E1552"
          },
          {
            "a": "T1027",
            "c": 0.6000000238418579,
            "d": "No comments in code",
            "e": [
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Small file under 5KB",
            "e": [
              "certGenerator.ts"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k",
            "l": 1
          },
          {
            "a": "T1555",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "toString"
            ],
            "i": "objectives/credential-access/wallet/solana::solana-secretkey-serialization--rx-5",
            "l": 1
          },
          {
            "a": "T1016",
            "c": 0.8500000238418579,
            "d": "Enumerates network interfaces",
            "e": [
              "os.networkInterfaces"
            ],
            "i": "objectives/discovery/system/fingerprint/hardware::node-network",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "imports import",
            "e": [
              "import"
            ],
            "i": "metadata/import/npm::import",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "X.509 certificate handling (legitimate)",
            "e": [
              "x509",
              "certificate"
            ],
            "i": "micro-behaviors/crypto/certificate/usage::certificate-handling",
            "l": 2
          }
        ],
        "sha": "ec75a0466e7a80dd26a7c06ef55e412aef1cb2915be1d1facb7d07f40d4615cf",
        "path": "/data/samples/bad/projects/windows/backdoors/Overlord/Overlord-Server/src/certGenerator.ts",
        "type": "javascript"
      }
    ],
    "tv": "6a383"
  }
}