{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.2832695245742798,
        "class": 0
      }
    ],
    "prob": 0.28326952,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.28326952,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.19900933,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 0.2557252,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T10:32:43Z"
  },
  "path": "74435f3db5729e6c1a6c52f558f27fa1.js",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H₂(Cm₃F)",
        "x": 3,
        "ff": {
          "i": [
            [
              "",
              "t.getFullYear"
            ],
            [
              "",
              "t.getMonth"
            ],
            [
              "",
              "t.getDate"
            ],
            [
              "",
              "t.map.join.replace"
            ],
            [
              "",
              "t.map.join"
            ],
            [
              "",
              "t.map"
            ],
            [
              "",
              "window.localStorage.getItem"
            ],
            [
              "",
              "JSON.parse"
            ],
            [
              "",
              "console.warn"
            ],
            [
              "",
              "Object.fromEntries"
            ],
            [
              "",
              "window.localStorage.setItem"
            ],
            [
              "",
              "JSON.stringify"
            ],
            [
              "",
              "console.warn"
            ],
            [
              "",
              "window.screen.availHeight.toString"
            ],
            [
              "",
              "window.screen.availWidth.toString"
            ],
            [
              "",
              "r.setKey"
            ],
            [
              "",
              "r.isFresh"
            ],
            [
              "",
              "e.append"
            ],
            [
              "",
              "e.append"
            ],
            [
              "",
              "e.append"
            ],
            [
              "",
              "w.forEach"
            ],
            [
              "",
              "e.append"
            ],
            [
              "",
              "window.navigator.sendBeacon"
            ],
            [
              "",
              "Object.fromEntries"
            ],
            [
              "",
              "window.fetch"
            ],
            [
              "",
              "JSON.stringify"
            ],
            [
              "",
              "r.persist"
            ],
            [
              "",
              "window.ga.getAll"
            ],
            [
              "",
              "n.get"
            ],
            [
              "",
              "e.get"
            ],
            [
              "",
              "window.gtag"
            ],
            [
              "",
              "window.dataLayer.push"
            ],
            [
              "",
              "window.setTimeout"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 30.0,
              "bind_count": 27.0,
              "call_count": 60.0,
              "node_count": 1547.0,
              "target_count": 35.0,
              "member_depth_max": 4.0,
              "string_bind_count": 6.0,
              "string_literal_count": 38.0,
              "array_literal_max_length": 8.0,
              "string_concat_chain_max_length": 5.0
            },
            "file": {
              "size": 2330.0,
              "entropy": 5.21,
              "size_bytes": 2330.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 21.0,
              "total_lines": 1.0,
              "char_entropy": 5.21,
              "unique_chars": 79.0,
              "lines_over_200": 1.0,
              "lines_over_500": 1.0,
              "string_density": 38.0,
              "avg_line_length": 2330.0,
              "lines_over_1000": 1.0,
              "max_line_length": 2330.0,
              "last_line_length": 2330.0,
              "long_token_count": 11.0,
              "whitespace_ratio": 0.01,
              "most_common_ratio": 0.08,
              "identifier_density": 279.0,
              "normalized_string_count": 38.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0,
              "suspicious_identifier_ratio": 0.25
            },
            "source": {
              "function_count": 5.0
            },
            "strings": {
              "total": 38.0,
              "url_count": 2.0,
              "avg_length": 8.26,
              "max_length": 44.0,
              "avg_entropy": 2.08,
              "empty_count": 8.0,
              "total_bytes": 314.0,
              "entropy_stddev": 1.33
            },
            "functions": {
              "count": 5.0,
              "anonymous": 13.0,
              "avg_params": 0.94,
              "max_params": 2.0,
              "one_liners": 18.0,
              "avg_name_length": 1.0,
              "no_params_count": 6.0,
              "avg_length_lines": 1.0,
              "max_length_lines": 1.0,
              "min_length_lines": 1.0,
              "nested_functions": 5.0,
              "avg_nesting_depth": 1.44,
              "max_nesting_depth": 3.0,
              "single_char_names": 5.0,
              "single_char_params": 17.0,
              "avg_param_name_length": 1.0,
              "density_per_100_lines": 1800.0,
              "code_in_functions_ratio": 18.0
            },
            "identifiers": {
              "total": 279.0,
              "avg_length": 5.51,
              "max_length": 17.0,
              "min_length": 1.0,
              "avg_entropy": 1.84,
              "reuse_ratio": 0.26,
              "unique_count": 73.0,
              "length_stddev": 3.62,
              "sequential_names": 18.0,
              "single_char_count": 18.0,
              "single_char_ratio": 0.25,
              "all_lowercase_ratio": 0.66,
              "all_uppercase_ratio": 0.01
            }
          },
          "s": [
            [
              43,
              "u8",
              "https://tracking-api.g2.com"
            ],
            [
              44,
              "u8",
              "https://tracking-api.g2.com"
            ],
            [
              80,
              "u8",
              "1399"
            ],
            [
              81,
              "u8",
              "1399"
            ],
            [
              89,
              "u8",
              "external"
            ],
            [
              90,
              "u8",
              "external"
            ],
            [
              147,
              "u8",
              "g2tracking"
            ],
            [
              148,
              "u8",
              "g2tracking"
            ],
            [
              298,
              "u8",
              ","
            ],
            [
              299,
              "u8",
              ","
            ],
            [
              985,
              "u8",
              "aid"
            ],
            [
              986,
              "u8",
              "aid"
            ],
            [
              995,
              "u8",
              "ua"
            ],
            [
              996,
              "u8",
              "ua"
            ],
            [
              1004,
              "u8",
              "sr"
            ],
            [
              1005,
              "u8",
              "sr"
            ],
            [
              1062,
              "u8",
              "x"
            ],
            [
              1063,
              "u8",
              "x"
            ],
            [
              1070,
              "u8",
              "lang"
            ],
            [
              1071,
              "u8",
              "lang"
            ],
            [
              1105,
              "u8",
              "tz"
            ],
            [
              1106,
              "u8",
              "tz"
            ],
            [
              1154,
              "u8",
              "sid"
            ],
            [
              1155,
              "u8",
              "sid"
            ],
            [
              1164,
              "u8",
              "uid"
            ],
            [
              1165,
              "u8",
              "uid"
            ],
            [
              1174,
              "u8",
              "e"
            ],
            [
              1175,
              "u8",
              "e"
            ],
            [
              1292,
              "u8",
              "pid"
            ],
            [
              1293,
              "u8",
              "pid"
            ],
            [
              1310,
              "u8",
              "p"
            ],
            [
              1311,
              "u8",
              "p"
            ],
            [
              1326,
              "u8",
              "s"
            ],
            [
              1327,
              "u8",
              "s"
            ],
            [
              1498,
              "u8",
              "Content-Type"
            ],
            [
              1499,
              "u8",
              "Content-Type"
            ],
            [
              1513,
              "u8",
              "application/json"
            ],
            [
              1514,
              "u8",
              "application/json"
            ],
            [
              1540,
              "u8",
              "POST"
            ],
            [
              1541,
              "u8",
              "POST"
            ],
            [
              1623,
              "u8",
              "${n}/attribution_tracking/conversions/assign"
            ],
            [
              1628,
              "u8",
              "/attribution_tracking/conversions/assign"
            ],
            [
              1681,
              "u8",
              "${n}/attribution_tracking/conversions/assign"
            ],
            [
              1686,
              "u8",
              "/attribution_tracking/conversions/assign"
            ],
            [
              1769,
              "u8",
              "${n}/attribution_tracking/conversions/assign"
            ],
            [
              1774,
              "u8",
              "/attribution_tracking/conversions/assign"
            ],
            [
              1980,
              "u8",
              "trackingId"
            ],
            [
              1981,
              "u8",
              "trackingId"
            ],
            [
              2021,
              "u8",
              "clientId"
            ],
            [
              2022,
              "u8",
              "clientId"
            ],
            [
              2079,
              "u8",
              "get"
            ],
            [
              2080,
              "u8",
              "get"
            ],
            [
              2087,
              "u8",
              "client_id"
            ],
            [
              2088,
              "u8",
              "client_id"
            ],
            [
              2163,
              "u8",
              "get"
            ],
            [
              2164,
              "u8",
              "get"
            ],
            [
              2171,
              "u8",
              "client_id"
            ],
            [
              2172,
              "u8",
              "client_id"
            ],
            [
              2294,
              "u8",
              "https://www.criteo.com/br/login/"
            ],
            [
              2295,
              "u8",
              "https://www.criteo.com/br/login/"
            ]
          ],
          "v": {
            "source.language": "javascript",
            "source.imports[0]": "JSON.parse",
            "source.imports[1]": "JSON.stringify",
            "source.imports[2]": "Object.fromEntries",
            "source.imports[3]": "console.warn",
            "source.imports[4]": "e.append",
            "source.imports[5]": "e.get",
            "source.imports[6]": "n.get",
            "source.imports[7]": "r.isFresh",
            "source.imports[8]": "r.persist",
            "source.imports[9]": "r.setKey",
            "source.strings[0]": "${n}/attribution_tracking/conversions/assign",
            "source.strings[1]": "/attribution_tracking/conversions/assign",
            "source.strings[2]": "Content-Type",
            "source.strings[3]": "application/json",
            "source.strings[4]": "clientId",
            "source.strings[5]": "client_id",
            "source.strings[6]": "external",
            "source.strings[7]": "g2tracking",
            "source.strings[8]": "https://tracking-api.g2.com",
            "source.strings[9]": "https://www.criteo.com/br/login/",
            "source.has_imports": true,
            "source.imports[10]": "t.getDate",
            "source.imports[11]": "t.getFullYear",
            "source.imports[12]": "t.getMonth",
            "source.imports[13]": "t.map",
            "source.imports[14]": "t.map.join",
            "source.imports[15]": "t.map.join.replace",
            "source.imports[16]": "w.forEach",
            "source.imports[17]": "window.dataLayer.push",
            "source.imports[18]": "window.fetch",
            "source.imports[19]": "window.ga.getAll",
            "source.imports[20]": "window.gtag",
            "source.imports[21]": "window.localStorage.getItem",
            "source.imports[22]": "window.localStorage.setItem",
            "source.imports[23]": "window.navigator.sendBeacon",
            "source.imports[24]": "window.screen.availHeight.toString",
            "source.imports[25]": "window.screen.availWidth.toString",
            "source.imports[26]": "window.setTimeout",
            "source.strings[10]": "trackingId",
            "source.functions[0]": "anonymous",
            "source.functions[1]": "f",
            "source.functions[2]": "h",
            "source.functions[3]": "l",
            "source.functions[4]": "n",
            "source.functions[5]": "t",
            "source.functions[6]": "u",
            "source.functions[7]": "y"
          },
          "ca": [
            [
              "e.append",
              "p"
            ],
            [
              "e.append",
              "pid"
            ],
            [
              "e.append",
              "s"
            ],
            [
              "e.get",
              "clientId"
            ],
            [
              "f",
              ""
            ],
            [
              "h",
              "${n}/attribution_tracking/conversions/assign"
            ],
            [
              "n.get",
              "trackingId"
            ],
            [
              "t.map().join",
              ","
            ],
            [
              "t.map().join().replace",
              ""
            ],
            [
              "window.dataLayer.push",
              "client_id"
            ],
            [
              "window.dataLayer.push",
              "get"
            ],
            [
              "window.fetch",
              "Content-Type"
            ],
            [
              "window.fetch",
              "POST"
            ],
            [
              "window.fetch",
              "application/json"
            ],
            [
              "window.gtag",
              "client_id"
            ],
            [
              "window.gtag",
              "get"
            ]
          ],
          "ct": [
            "Date",
            "FormData",
            "JSON.parse",
            "JSON.stringify",
            "Object.fromEntries",
            "console.warn",
            "e.append",
            "e.get",
            "f",
            "h",
            "l",
            "n",
            "n.get",
            "r.isFresh",
            "r.persist",
            "r.setKey",
            "t.getDate",
            "t.getFullYear",
            "t.getMonth",
            "t.map",
            "t.map().join",
            "t.map().join().replace",
            "u",
            "w.forEach",
            "window.dataLayer.push",
            "window.fetch",
            "window.ga.getAll",
            "window.gtag",
            "window.localStorage.getItem",
            "window.localStorage.setItem",
            "window.navigator.sendBeacon",
            "window.screen.availHeight.toString",
            "window.screen.availWidth.toString",
            "window.setTimeout",
            "y"
          ],
          "id": "javascript",
          "mc": [
            "JSON.parse",
            "JSON.stringify",
            "Object.fromEntries",
            "console.warn",
            "document.location",
            "document.location.href",
            "e.append",
            "e.get",
            "n.get",
            "r.isFresh",
            "r.persist",
            "r.setKey",
            "t.getDate",
            "t.getFullYear",
            "t.getMonth",
            "t.length",
            "t.map",
            "t.map().join",
            "t.map().join().replace",
            "w.forEach",
            "window.dataLayer",
            "window.dataLayer.push",
            "window.fetch",
            "window.ga",
            "window.ga.getAll",
            "window.gtag",
            "window.localStorage",
            "window.localStorage.getItem",
            "window.localStorage.setItem",
            "window.navigator",
            "window.navigator.language",
            "window.navigator.sendBeacon",
            "window.navigator.userAgent",
            "window.screen",
            "window.screen.availHeight",
            "window.screen.availHeight.toString",
            "window.screen.availWidth",
            "window.screen.availWidth.toString",
            "window.setTimeout"
          ]
        },
        "id": 0,
        "sz": 2330,
        "ts": [
          {
            "a": "T1552.001",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "fetch"
            ],
            "i": "objectives/supply-chain/credential-theft/registry::js-creds-to-fetch--rx-12",
            "l": 1
          },
          {
            "d": "JSON.parse call",
            "e": [
              "JSON.parse(t)"
            ],
            "i": "micro-behaviors/data/serialize/json::json-parse-call",
            "l": 2
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "HTTP POST method",
            "e": [
              "\"POST\""
            ],
            "i": "micro-behaviors/communications/http/post::post",
            "l": 1,
            "m": "C0002"
          },
          {
            "c": 1.0,
            "d": "JavaScript includes method",
            "e": [
              "includes"
            ],
            "i": "metadata/lang/scripted::includes-method",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "innerHTML/location.href rewrite (page blocker shape)",
            "e": [
              "location.href"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-page-block",
            "l": 1
          },
          {
            "a": "T1552.001",
            "c": 0.800000011920929,
            "d": "Private key file suffix",
            "e": [
              ".key"
            ],
            "i": "micro-behaviors/fs/path/sensitive/credentials::private-key-suffix",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "fetch/XMLHttpRequest/http(s) require (flatted tamper fragment)",
            "e": [
              "fetch"
            ],
            "i": "well-known/lib/flatted::flatted-tamper-network",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              "{for("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "JSON.parse call in staged payload loader",
            "e": [
              "JSON.parse("
            ],
            "i": "objectives/command-and-control/dropper/execution/script-dropper::json-parse-call-raw",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many single-char params",
            "e": [
              "functions.single_char_params = 17.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::single-char-params",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (AST)",
            "e": [
              "for(let e=0,i=t.length;e\u003ci;e++)n(t[e])"
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Short sidecar-sized source",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/package/config::short-sidecar-file",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny JavaScript file lines",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::tiny-javascript-file-lines",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".toString() method call",
            "e": [
              ".toString()"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-call",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "location.href"
            ],
            "i": "micro-behaviors/communications/http/url/path::browser-location-host-ref--rx-1",
            "l": 1
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "warn"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-5",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "application/json"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-18",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "74435f3db5729e6c1a6c52f558f27fa1.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 2330.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "key=/config= followed by shell metachar",
            "e": [
              "key=t.map((("
            ],
            "i": "micro-behaviors/process/create/shell/injection::iot-param-injection--rx-3",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "-api suffix",
            "e": [
              "-api"
            ],
            "i": "objectives/supply-chain/trojanized/library/framework::api-suffix",
            "l": 1
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "Content-Type"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-21",
            "l": 1
          },
          {
            "a": "T1090.004",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "append"
            ],
            "i": "objectives/command-and-control/infrastructure/dns-pin::js-hosts-file-write--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "pid string literal",
            "e": [
              "pid"
            ],
            "i": "objectives/supply-chain/hidden-payload/runtime::pid-literal",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript console object",
            "e": [
              "console"
            ],
            "i": "micro-behaviors/os/console/io::js-console-object",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "JavaScript static key string assignment",
            "e": [
              "=\"https://tracking-api.g2.com\""
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTPS protocol prefix",
            "e": [
              "https://"
            ],
            "i": "micro-behaviors/communications/http/protocol::https-prefix",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "toString method token",
            "e": [
              "toString"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-token",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "HTTP configuration field (headers)",
            "e": [
              "headers:"
            ],
            "i": "micro-behaviors/communications/http/request/client::http-config-headers",
            "l": 2
          },
          {
            "c": 0.6499999761581421,
            "d": "OAuth client_id field",
            "e": [
              "client_id"
            ],
            "i": "micro-behaviors/communications/http/oauth::oauth-client-id-field",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 18.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "JavaScript Date object construction",
            "e": [
              "new Date"
            ],
            "i": "micro-behaviors/time/query::js-new-date",
            "l": 2
          },
          {
            "d": "JSON.stringify call",
            "e": [
              "JSON.stringify"
            ],
            "i": "micro-behaviors/data/serialize/json::json-stringify-call",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "HTTP configuration field (body)",
            "e": [
              "body:"
            ],
            "i": "micro-behaviors/communications/http/request/client::http-config-body",
            "l": 2
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "send"
            ],
            "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "JavaScript substring search call",
            "e": [
              "includes("
            ],
            "i": "micro-behaviors/data/string/search::js-includes-indexof-call",
            "l": 2
          },
          {
            "a": "T1041",
            "c": 0.75,
            "d": "HTTP upload request call token",
            "e": [
              "fetch"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm-install-targeting::upload-request-call",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "74435f3db5729e6c1a6c52f558f27fa1.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1082",
            "c": 0.75,
            "d": "Reads browser User-Agent string",
            "e": [
              "navigator.userAgent"
            ],
            "i": "micro-behaviors/communications/http/cookies::navigator-useragent-read",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.75,
            "d": "Reads browser UI language",
            "e": [
              "navigator.language"
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::navigator-language",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 2330.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.7799999713897705,
            "d": "Hex arithmetic in string operations",
            "e": [
              "1e4*t.getFullYear()",
              "500",
              "100",
              "100*t.getMonth()",
              "1e4",
              "500*l(w)"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/hex::hex-string-arithmetic",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Many one-line source function definitions",
            "e": [
              "functions.one_liners = 18.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-one-liner-functions",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1071.001",
            "c": 0.7200000286102295,
            "d": "POST method field in request config",
            "e": [
              "method:\"POST\""
            ],
            "i": "micro-behaviors/communications/http/request/client::post-method-text",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.699999988079071,
            "d": "Browser localStorage access",
            "e": [
              "localStorage."
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::browser-local-storage-access",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Browser localStorage write access",
            "e": [
              "localStorage.setItem("
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::localstorage-set",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "Appends data to FormData",
            "e": [
              "FormData;e.append(\"pid\",a),e.append(\"p\",t),e.append(\"s\",o),w.forEach((([t,n])=\u003ee.append("
            ],
            "i": "micro-behaviors/communications/http/upload::form-data-append",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "FormData upload class marker",
            "e": [
              "FormData"
            ],
            "i": "micro-behaviors/communications/http/post::formdata-class",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.699999988079071,
            "d": "Browser localStorage read access",
            "e": [
              "localStorage.getItem("
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::localstorage-get",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "High function density",
            "e": [
              "functions.density_per_100_lines = 1800.00"
            ],
            "i": "metadata/file/text/metrics::high-function-density",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Browser storage setItem call",
            "e": [
              "localStorage.setItem"
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::browser-storage-setitem",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "74435f3db5729e6c1a6c52f558f27fa1.js"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.8600000143051147,
            "d": "Recursive retry decrements counter",
            "e": [
              "l(t-1)"
            ],
            "i": "objectives/supply-chain/trojanized/library/remote-eval::self-recursion-minus-one",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Browser storage getItem call",
            "e": [
              "localStorage.getItem"
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::browser-storage-getitem",
            "l": 3
          },
          {
            "a": "T1071.001",
            "c": 0.7200000286102295,
            "d": "fetch with POST method",
            "e": [
              "fetch(n,{headers:{\"Content-Type\":\"application/json\"},method:\"POST"
            ],
            "i": "micro-behaviors/communications/http/post::fetch-post-call",
            "l": 3,
            "m": "C0002"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.01"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "d": "HTTP configuration fields (method/body/headers)",
            "e": [
              "headers:",
              "body:"
            ],
            "i": "micro-behaviors/communications/http/request/client::http-config-fields",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "HTTP/HTTPS client request capability",
            "e": [
              "headers:",
              "method:\"POST\"",
              "body:"
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::http-client-comp",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Minified/compressed code (multiple indicators)",
            "e": [
              "identifiers.sequential_names = 18.00",
              "functions.density_per_100_lines = 1800.00",
              "text.whitespace_ratio = 0.01",
              "functions.one_liners = 18.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Persists data in browser storage",
            "e": [
              "localStorage.getItem",
              "localStorage.setItem"
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::browser-storage-persistence",
            "l": 3
          }
        ],
        "sha": "ef4b59ff2c38caeee17ee4a1994bfad69aa8b7e271ca30fb820216315d467f30",
        "path": "74435f3db5729e6c1a6c52f558f27fa1.js",
        "type": "javascript"
      }
    ],
    "tv": "9ea7c"
  }
}