{ "llm": { "conf": 0.82373506, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET library assembly" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.74819297, "rte": "az", "prob": 0.74819297 } ], "prob": 0.74819297, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7481929659843445, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.013318806886672974, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.6766130924224854, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00005626678466796875, "type": "json" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T20:03:55Z" }, "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "f1f43c4abe294433bab19fbfb49cfd4ad975869f38b5f93da96b854150a7277a", "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg", "risk": 3, "size": 35816, "type": "nupkg", "facts": { "metrics": { "file": { "size": 35816.0, "entropy": 7.92, "size_bytes": 35816.0 }, "binary": { "overall_entropy": 7.92, "peak_region_bytes": 31744.0, "peak_region_entropy": 7.8 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 2.41, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 34718.0, "compression.ratio": 0.55, "hidden_file_count": 2.0, "total_uncompressed": 63613.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.43, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25164.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.57, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "OpenRewrite.Recipes.CSharp.Core", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://docs.openrewrite.org/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/moderneinc/rewrite-migrate-csharp", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Moderne", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.3.0-snapshot.20260629175630", "source": "nupkg.version", "verified": false }, "identifier": { "value": "OpenRewrite.Recipes.CSharp.Core", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/client/managed::httpclient", "conf": 0.8199999928474426, "crit": 3, "desc": "System.Net.Http.HttpClient class usage", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::semver-pattern", "conf": 0.699999988079071, "crit": 2, "desc": "Semantic version pattern", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 521.0, "entropy": 5.17, "size_bytes": 521.0 }, "binary": { "overall_entropy": 5.17, "peak_region_bytes": 521.0, "peak_region_entropy": 5.17 } } }, "id": 1, "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg!!_rels/.rels", "sha": "970a7cf9e1ce29302da138af44dbab31018321ee4393b58639bb177cacdf303b", "size": 521, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 38, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk0%mewGT=/wO$ySCxdztwGV28v}/)[B0b7kAV^Z]ayPd#atczTr3ld2z!-\u0026[BrCgfy?j.qv@(Qfz!ZZzvqYP#swqEiBAg/cB7PuhzddK2z/fRUfjXTnv@=p5BzkVhj]", "ln": 8, "addr": 319 }, { "b": "arR^HjAL1AB3sIYwO#K1CxdztwGV28w)]g\u003ez/PMfxcpY9xKL}2ay]zjzE)]jv@(Qfz!Zztzeqr/Byw*6j]", "ln": 9, "addr": 437 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dAz!9B1zE)K1v\u003eR\u003elCxdztwI4+kxl4B5wI4zkxKL}2a%pxlzeB0ejT8:rhdX:bw\u00268F3fF\u003e:Fw\u0026hwOgDvuFv(4Uci5k2NgH-6]h8nY0iB%xSffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 507, "z": 89, "cf": 0.8999999761581421 } ], "ln": 10, "addr": 503 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 646, "z": 74, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 642 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 12, "addr": 661 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJo\u003e!9Tz/Y\u0026eBs{QdB9g]cq/)d)x(tR5z!%Mrx(v(=wPz\u003caB97#hv}u\u0026bC4CYnx(v(La#7Y7e\u0026tydaz2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 13, "addr": 701 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 874.0, "entropy": 5.12, "size_bytes": 874.0 }, "binary": { "overall_entropy": 5.12, "peak_region_bytes": 874.0, "peak_region_entropy": 5.12 } } }, "id": 2, "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg!!OpenRewrite.Recipes.CSharp.Core.nuspec", "risk": 1, "sha": "5f40891c314b50f6a40000c51b3e7062793eeddc20f50a7e4e05d19d9122626b", "size": 874, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 646, 74 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 38 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 507, 89 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000l^tVi00000nb@R\u00260SSx7Z!1Iag\u003eL=d0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "1AhG:00SJN4fcwUdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 11200, "z": 4, "cf": 1.0 } ], "ln": 11184 }, { "b": "mMpxgj#\u0026Q9o(BM+y?k^gq*ACawO\u003c4\u003epxiI0A+Pf0wPyQQv@2H=wK*MPvM)P*jAa.syHH\u003c!p5", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 22924, "z": 9, "cf": 0.800000011920929 } ], "ln": 22908 }, { "b": "x(ET8e\u003c\u0026MJvrcrtlVm0Re[w^m08EMBzC\u003e4\u0026A+PSbe)8$b08mfqA=l2qw]]Uax(!A9", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 26671, "z": 4, "cf": 0.6000000238418579 } ], "ln": 26655 }, { "b": "B7]Mg0b=v(r+lq)x(v\u003e?C4CYnx(v\u003e?mq^f?A+dQVAb](il3diWB97\u0026jx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9QDBvyB:wPh:9z/bL/wPRoEwPIv4x(Ffdz/bLND2[7sz7X!0CYUMgB8L{@q/)4]zF8sPze-{7x(!ig0b#v*By/Gg08EMBzC\u003e4\u0026A+PSbe\u003c\u0026MJvrcq!q*ACawO\u003c4{wPPK}BAzE4uU\u003cd(Bv*N=zawR+B-msLB4HmCA=k]dA==N%A=l8t08[e:By/qwoLFx:090(nBAh8kxf*AClU{sxASwi=Byex:B.LV5wPv=v", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 27450, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 27340, "z": 16, "cf": 1.0 }, { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 27261, "z": 7, "cf": 0.800000011920929 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 27401, "z": 10, "cf": 0.800000011920929 }, { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 27293, "z": 17, "cf": 0.949999988079071 } ], "ln": 27245 }, { "b": "nP5YWA+O%1Bo1)ywO#O\u0026now@)lU{EFzGC\u003eJB8L}+y?mD{zGC\u003e\u003ewPRoSz/o.^y?mD{zGC\u003eJB8I", "n": [ { "c": 3, "d": ".NET HTTP request client", "i": "micro-behaviors/communications/http/client/managed::request", "o": 29288, "z": 10, "cf": 0.8600000143051147 } ], "ln": 29272 }, { "b": "aolrWv/Q0sBPuBZASxUJzuaeDwDl=KaolrWw=J}Npxkhhwb]NewDl@PBo0A-Ck#sS", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 29981, "z": 4, "cf": 0.800000011920929 } ], "ln": 29965 }, { "b": "yYFOTwDhZUlJy^1ve$fBx8(GyA@Wr.Bo2$OwDi?MB]U}JyYFOTwDi?MzVBwHaok*", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 30149, "z": 3, "cf": 0.800000011920929 } ], "ln": 30133 }, { "b": "zVB!TwDjs.k(+\u003c7z#Y\u003e*o-O(cv/QJHzVB?UzVBwHBo0][p5)Y.q#/n=zVB!TwDjs.k(+\u003c7z#Y\u003e%k(+A}wb).Lp5", "n": [ { "c": 2, "d": ".NET Core reference", "i": "metadata/lang/compiler/managed::dotnet-core-reference", "o": 30908, "z": 21, "cf": 0.8500000238418579 } ], "ln": 30892 }, { "b": "x-I#IwDhYnA@Y$QBPqy[e=XSDmf3o!mGvDeve$cAwDl]OzVB!Tyxb)=rSDXhASydXx-J5Kzu8*100vxA069yDxAe", "n": [ { "c": 2, "d": ".NET Framework reference", "i": "metadata/lang/compiler/managed::framework-reference", "o": 31936, "z": 22, "cf": 0.8500000238418579 } ], "ln": 31920 }, { "b": "v/Q6u0d+2D0a=ds0ce6H0b8vz0cnb.0a(jH0ce5Z04[mY0cncV0ce6T0bqGR0a(i", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 34125, "z": 3, "cf": 0.800000011920929 } ], "ln": 34109 }, { "b": "0bhBP0aM1x08APr0a=dJ0ce6N0aV7v0cnb.0cOuJ0bITT0a=c[03Ry}04[m703Ry", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 34570, "z": 3, "cf": 0.800000011920929 } ], "ln": 34554 }, { "b": "ayO!\u003ee(Sq=mr\u0026lTAbo7@pgXS\u003ez/fSmw]]T$B8L@DIu9XW08%Bol${ZYy*?P:vqPMXr+lq)x(v(*4HUV", "n": [ { "c": 2, "d": "Newtonsoft.Json serialization library ref", "i": "micro-behaviors/data/serialize/json::json-newtonsoft", "o": 42496, "z": 15, "cf": 0.8500000238418579 } ], "ln": 42480 }, { "b": "aAz4jy***+asH!Nxd+.TB#g*ge\u00261\u003edaxi2=az+Q$wnb{]aszsWazC)tz/x/jz/f01e(R", "n": [ { "c": 2, "d": "CLR version string", "i": "metadata/lang/compiler/managed::clr-version", "o": 42743, "z": 6, "cf": 0.8999999761581421 } ], "ln": 42727 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 45568, "z": 5, "cf": 0.8999999761581421 } ], "ln": 45552 }, { "b": "0000000000006IigYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rri40000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 45662, "z": 15, "cf": 0.949999988079071 } ], "ln": 45646 }, { "b": "zVBUPA@Vgu001XM2MK(9lJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[zVBqFwDl-JzuakF003WjaohAxmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002^{z#:CHzu9MmwDl]", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 46082, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 46130, "z": 15, "cf": 0.699999988079071 } ], "ln": 46066 }, { "b": "lJz38ASxUJ001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WWce=WN9e=WN9003WjbME\u0026BnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002^{z#:CHzu9MmwDl]OASx!N", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 46234, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 46282, "z": 12, "cf": 0.699999988079071 } ], "ln": 46218 }, { "b": "xAibO001bw003%rbME\u0026Bpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002^{z#:CHzu9MmwDl]O", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 46426, "z": 16, "cf": 0.699999988079071 } ], "ln": 46410 }, { "b": "e=YzZyYFnK003ybaohAxpYLIozVBqFBPt[KBo25ove$cAwDhYg002^{z#:CHzu9MmwDl]OASx!", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 46538, "z": 11, "cf": 0.699999988079071 } ], "ln": 46522 }, { "b": "lJz38ASxUJ006q8m/SL\u0026pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WWce=WN9eDx?(zu6", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 46634, "z": 14, "cf": 0.8999999761581421 } ], "ln": 46618 }, { "b": "000000000000000000000kFNm3\u0026*ncwiG$[000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 47104, "z": 6, "cf": 0.8999999761581421 } ], "ln": 47088 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 45056, 5.73, "r-x" ], [ ".rsrc", 45568, 1536, 2.96, "r--" ], [ ".reloc", 47104, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 83363.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.88, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.09 }, "file": { "size": 47616.0, "entropy": 5.61, "size_bytes": 47616.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.73, "string_count": 587.0, "overall_entropy": 5.61, "entropy_variance": 5.33, "avg_string_length": 24.35, "max_string_length": 453.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.01, "string_length_stddev": 36.12, "largest_section_ratio": 0.95, "sentence_string_count": 61.0, "sentence_string_ratio": 0.1, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 45056.0, "entropy_max": 5.73, "entropy_mean": 2.92, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg!!lib/net10.0/OpenRewrite.Recipes.CSharp.Core.dll", "risk": 3, "sha": "b37df50960306245e365261eff8bf117454cb26dd1b5af385a3fdbdeceb6bab0", "size": 47616, "traits": [ { "id": "micro-behaviors/communications/http/client/managed::httpclient", "conf": 0.8199999928474426, "crit": 3, "desc": "System.Net.Http.HttpClient class usage", "spans": [ [ 29288, 10 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 46634, 14 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 27261, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 26671, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 27450, 11 ] ] }, { "id": "metadata/package/versioning::semver-pattern", "conf": 0.699999988079071, "crit": 2, "desc": "Semantic version pattern", "spans": [ [ 42743, 6 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 27340, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 46234, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 11200, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 45662, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 11200, 4 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 330, "entropy": 4.66 }, "json": { "parsed_bytes": 330, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 330, "peak_region_entropy": 4.66 } } }, "id": 4, "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg!!lib/net10.0/OpenRewrite.Recipes.CSharp.Core.runtimeconfig.json", "pid": 0, "risk": 1, "sha": "9950d4583cfc9a106857c0d5b8a75b53e8774852b57b80bc3823a74d44a4d87f", "size": 330, "traits": [ { "id": "metadata/file/extension/identity::json-txt-md-basename", "conf": 1.0, "crit": 2, "desc": "JSON, text, or markdown filename extension" }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 2, "desc": "Common web or JSON file extension" }, { "id": "metadata/file/format/conformance::json-document-opening", "conf": 0.95, "crit": 2, "desc": "File begins with a JSON document", "spans": [ [ 0, 0 ] ] } ], "type": "json" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 522.0, "entropy": 4.81, "size_bytes": 522.0 }, "binary": { "overall_entropy": 4.81, "peak_region_bytes": 522.0, "peak_region_entropy": 4.81 } } }, "id": 5, "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg!![Content_Types].xml", "sha": "28d38bf63bcbe7d3429e7e627e5bfff75079bdc28bff837c58e85cd3448718c3", "size": 522, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "File uses a document or configuration extension", "spans": [ [ 0, 19 ] ] } ], "type": "xml" }, { "id": 6, "sha": "913317c758518ed65e288359c5df22fffd49ec15b073ac4db55b4e8bf2691ce7", "path": "OpenRewrite.Recipes.CSharp.Core.0.3.0-snapshot.20260629175630.nupkg!!package/services/metadata/core-properties/5196c8025c444d398e86d068320632be.psmdcp", "size": 765, "type": "xml", "depth": 1 }, { "id": 7, "sha": "2791072cc75d465d45413de0fb06963ff6eeaa1a0fc692127894998a0fe718c5", "path": "OpenRewrite.Recipes.CSharp.Core@0.3.0-snapshot.20260629175630.registry.json", "size": 899, "type": "registry", "depth": 1 } ], "omitted_files": 2, "v": "8" } }