{ "ml": { "v": "7", "id": 6991, "lvl": -1, "conf": 0, "prob": 0.000010768572792585474, "type": "javascript", "version": "v18.18", "analyzed_at": "2026-09-21T22:35:25Z" }, "path": "vite-8.2.1.tgz", "raw": { "rev": "512ec", "files": [ { "id": 8075, "ctx": [ { "b": "abZy80000000zP3(2[1qB09I[SI-qC^$\u0026KUAUfQW=1m+Snp\u003e1\u003c-q", "ln": 0 }, { "b": "@rlFwtMB})oTY\u003c[of0E%wbkb]\u003e}FO]s]8Er^OGiLBB[=a[z7=}k55(NQ!u1Q1qZ9:C.]lZIc(71=N(6XOdo4!)2\u003eKG0$Mdnt75EvWk[*/PX[bAXBj@9859[[J:d#ujVs{OUvsQWqCd}7kKb?:=l]QtQ3Ga)KDF1xOnyv!K(LW{ao92UWIOU/+O6*5A=wB2X1@[IIR11G!}uAzpaePflT!O=AEio-7G(GGuxD3s]sb*jC}DF-WvE8)8]ox)NEZ6d)mcCl\u00261aR\u0026dCsVGMx%dBFgjKlfo)[0", "ln": 2007 } ], "mol": "K(Li₈)O₉(As₂C₅Co₂ErILaPS₅Xe₄)H₁₀(Po₃₁Cm₅₀Cr₂Db₄₄F₂₂HfMgOs₁₇TiU₇)Md₇(Bk₆InPa₁₂Pt₂V)", "pid": 337, "rel": "fetched", "sha": "f243199f6a0f64bd3c620797ce921a0fceded02530ed3165db226711c6331a19", "via": "https://registry.npmjs.org/vite/-/vite-8.2.1.tgz", "path": "pkg:npm/vite@8.2.1", "refs": [ { "to": "pkg:github/vitejs/vite", "off": 0, "kind": "repository" } ], "risk": 132, "size": 573565, "type": "npm", "depth": 2, "facts": { "metrics": { "file": { "size": 573565, "entropy": 8 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 573440, "peak_region_entropy": 7.84 }, "consistency": { "self_dependency": 0, "unused_runtime_deps": 1 } } }, "ident": { "name": { "value": "vite", "source": "npm.name", "verified": false }, "urls": [ { "url": "git+https://github.com/vitejs/vite.git", "kind": "repository", "source": "npm.repository.url" }, { "url": "https://vite.dev", "kind": "homepage", "source": "npm.homepage" } ], "trust": "unsigned", "authors": [ { "name": "Evan You", "role": "author", "source": "npm.author" } ], "version": { "value": "8.2.1", "source": "npm.version", "verified": false }, "identifier": { "value": "vite", "source": "npm.name", "verified": false } }, "traits": [ { "id": "micro-behaviors/ui/window/style::css-fixed-position", "conf": 0.9, "crit": 3, "desc": "CSS fixed-position declaration", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::helper-call-https-module-name", "conf": 1.0, "crit": 3, "desc": "Passes HTTPS module name to helper", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/url/reference::javascript-comment-url-reference", "conf": 0.9, "crit": 3, "desc": "JavaScript comment contains a URL", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable-call", "conf": 0.9, "crit": 3, "desc": "Calls exec with a command-named variable", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/runtime::js-webpack-bundle", "conf": 0.95, "crit": 2, "desc": "Webpack bundled JavaScript module", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/manipulation::log-redaction-option", "conf": 0.85, "crit": 3, "desc": "Log redaction option or call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 2, "desc": "HTTP URL string literal", "from": [ { "file": 3 } ] }, { "id": "metadata/build/bundler/runtime::vite-bundled", "conf": 0.95, "crit": 3, "desc": "Code bundled with Vite", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/exec::node-promisified-exec-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Node promisified exec API call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/hex::buffer-from-hex-dup", "conf": 0.8, "crit": 3, "desc": "Hex decoding/usage via Buffer.from", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/ipc/message::js-event-on-message", "conf": 0.8, "crit": 3, "desc": "JavaScript 'message' event listener" }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "from": [ { "file": 1 } ] }, { "id": "metadata/package/entrypoint::has-exports-field", "conf": 0.85, "crit": 2, "desc": "package.json declares an exports map" }, { "id": "metadata/file/size::javascript-small-file-5k", "conf": 0.7, "crit": 2, "desc": "JavaScript file under 5KB", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/header/cors::wildcard-cors-header-value", "conf": 0.95, "crit": 3, "desc": "CORS header entry specifies wildcard origin", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/enumerate/extension::javascript-json-filename-filter", "conf": 0.84, "crit": 3, "desc": "JavaScript filters JSON filenames", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::fs-readdir", "conf": 0.6, "crit": 3, "desc": "Calls Node.js readdir at least twice", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/buffer::uint8array-constructor", "conf": 0.9, "crit": 2, "desc": "Constructs a Uint8Array buffer", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/hook/interception::websocket-add-event-listener-prototype-assignment", "conf": 0.98, "crit": 3, "desc": "Overrides WebSocket event listener method", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::js-tsc-reexport-barrel", "conf": 0.96, "crit": 2, "desc": "Transpiled CommonJS re-export barrel", "from": [ { "off": 628703, "file": 9, "line": 18323 } ], "uses": [ 469 ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/websocket/receive::websocket-message-event-handler", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "WebSocket or tunnel message event handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-vim", "conf": 0.5, "crit": 1, "desc": "Repeated Vim name references", "from": [ { "file": 9 } ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/session::management-id-comparison--rx-8", "conf": 0.9, "crit": 3, "desc": ".indexOf() call against extension/id ID", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/window/dom-access::current-script-src-read", "conf": 0.88, "crit": 3, "desc": "Reads document.currentScript src URL", "from": [ { "file": 9 } ] }, { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 2, "desc": "File uses a source declaration extension", "from": [ { "file": 22 } ] }, { "id": "metadata/package/testing/scripted::coverage-markers-a", "conf": 1.0, "crit": 2, "desc": "Coverage marker family A", "from": [ { "off": 1122003, "file": 9, "line": 31435 } ], "uses": [ 558 ] }, { "id": "micro-behaviors/fs/write/file/full::node-write-file-promise", "conf": 0.9, "crit": 3, "desc": "Node asynchronously writes a file", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-while-switch-loop", "conf": 0.95, "crit": 3, "desc": "JavaScript while loop contains switch dispatch" }, { "id": "micro-behaviors/data/archive/format::application-zip-mime", "conf": 0.9, "crit": 3, "desc": "application/zip media-type literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/construct::invocation-root-path-join", "conf": 0.9, "crit": 3, "desc": "Builds a path under the invocation directory", "from": [ { "file": 9 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass-concat", "atk": "T1059.001", "conf": 0.9, "crit": 1, "desc": "Concatenated PowerShell execution policy bypass", "from": [ { "file": 9 } ], "uses": [ 448 ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-pycharm-app", "conf": 0.5, "crit": 3, "desc": "PyCharm macOS app bundle", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/io/stream::js-stream-write-call", "conf": 0.88, "crit": 3, "desc": "Calls a write method on a stream", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::node-server-listen-generic", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node generic server listens on endpoint", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/server/listener::create-server-factory-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Calls a createServer factory", "from": [ { "file": 2 } ] }, { "id": "objectives/execution/automation/prompt-agent::agent-grant-filesystem", "atk": "T1059,T1195.002", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Grants an agent filesystem access", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/fs/path/secret-config::npmrc-credentials", "atk": "T1552.001", "conf": 0.95, "crit": 3, "desc": "NPM registry credentials file path literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/module/require::dynamic-import-expression", "conf": 0.88, "crit": 3, "desc": "Dynamically imports a computed module reference", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/string/replace::url-target-replace-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns replaced text to a URL variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/hash/digest::hash-object-digest-call", "conf": 0.88, "crit": 3, "desc": "JavaScript hash-object digest call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer::buffer-from-utf8", "conf": 0.9, "crit": 3, "desc": "Creates Node.js Buffer from UTF-8 text", "from": [ { "file": 9 } ] }, { "id": "metadata/package/files/package-json::files-array-present", "conf": 0.92, "crit": 3, "desc": "Package.json declares a files allowlist" }, { "id": "metadata/package/dependencies/manifest/presence::has-optional-deps", "conf": 0.8, "crit": 3, "desc": "Package has optional dependencies" }, { "id": "micro-behaviors/process/hook/xhr::xhr-current-request-abort", "conf": 0.9, "crit": 3, "desc": "Aborts the current XMLHttpRequest", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/reassembly::buffer-uint32-length-read", "conf": 0.8, "crit": 2, "desc": "Reads a 32-bit integer from a Buffer", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/spawn::child-process-member-spawn", "conf": 0.85, "crit": 3, "desc": "Node.js child_process spawns an external process", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 1 } ] }, { "id": "well-known/lib/web/follow-redirects::follow-redirects-browser-warning", "conf": 0.99, "crit": 3, "desc": "follow-redirects browser-build exclusion warning", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "file": 3 }, { "off": 405959, "file": 9, "line": 11693 }, { "file": 19 } ], "uses": [ 19, 180, 196, 569 ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-property-fingerprint", "conf": 0.8, "crit": 3, "desc": "Reads multiple Node.js process properties", "from": [ { "file": 1 }, { "off": 7118, "file": 2, "line": 213 }, { "file": 8 }, { "off": 472019, "file": 9, "line": 13545 }, { "off": 570, "file": 15, "line": 19 }, { "file": 19 }, { "file": 20 } ], "uses": [ 137, 184, 485 ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call", "conf": 0.9, "crit": 3, "desc": "Calls a computed this method", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/ipc/message::postmessage-call", "conf": 0.86, "crit": 3, "desc": "Sends data with window or worker postMessage" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 1 } ] }, { "id": "metadata/build/bundler/asset::executable-code-after-source-map", "conf": 0.95, "crit": 3, "desc": "Code follows a source map directive", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/source/property/read::repeated-constructor-property-read", "conf": 0.9, "crit": 3, "desc": "Reads constructor properties repeatedly", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/identity::android-data-app-path", "conf": 0.9, "crit": 3, "desc": "Android application data path", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::quoted-font-path", "conf": 0.9, "crit": 3, "desc": "References a quoted font file path", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-methods-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Methods header name", "from": [ { "file": 9 } ] }, { "id": "well-known/lib/ui/vite::dist-node-runtime-chunk-path", "conf": 0.98, "crit": 3, "desc": "Vite node.js runtime chunk path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/response::http-versions", "conf": 0.75, "crit": 3, "desc": "HTTP protocol version strings", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/mem/alloc/heap::megabyte-buffer-allocation", "conf": 0.86, "crit": 3, "desc": "Source allocates a megabyte-sized buffer", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/get::javascript-get-method-text", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP GET request" }, { "id": "micro-behaviors/fs/write/file/full::write-file-async", "conf": 0.8, "crit": 3, "desc": "Node fs writes to a file asynchronously", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/response::http-401-unauthorized", "conf": 0.75, "crit": 3, "desc": "HTTP 401 unauthorized response text", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/shell/path::shell-executable-reference", "conf": 0.9, "crit": 3, "desc": "References a shell executable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/buffer::buffer-from-call", "conf": 0.4, "crit": 3, "desc": "Calls Buffer.from at least three times", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::multi-platform-branch", "atk": "T1082", "mbc": "E1082", "conf": 0.8, "crit": 3, "desc": "Multi-platform OS branching logic", "from": [ { "file": 1 }, { "file": 8 }, { "off": 389512, "file": 9, "line": 11171 } ], "uses": [ 95, 362, 513 ] }, { "id": "metadata/file/encoded::embedded-code-candidates-6", "conf": 0.8, "crit": 3, "desc": "Source has 6+ code-like string candidates", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/automation/agent::vulnerability-state-marker-vulnerable", "atk": "T1059,T1190,T1595", "conf": 0.82, "crit": 3, "desc": "Vulnerable or CVE state marker", "from": [ { "file": 31 } ] }, { "id": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "conf": 0.75, "crit": 3, "desc": "Indirect string replacement call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/dom/tree::browser-append-child", "conf": 0.8, "crit": 3, "desc": "Appends child DOM node", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/registry/access::powershell-registry-read", "atk": "T1012,T1112", "conf": 0.9, "crit": 3, "desc": "PowerShell reads a registry value", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors" }, { "id": "micro-behaviors/ui/window/dom-access::dom-text-content-read", "conf": 0.82, "crit": 3, "desc": "Reads DOM text content" }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::babel-helpers-import", "conf": 0.9, "crit": 2, "desc": "Imports Babel helper functions", "from": [ { "file": 19 } ] }, { "id": "metadata/package/error-handling::try-block-open", "conf": 0.5, "crit": 2, "desc": "Contains the opening of a try block", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/container/runtime::dockerenv", "conf": 0.7, "crit": 3, "desc": "Docker marker file reference", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/base64::long-base64-blob-decode-pair", "conf": 0.92, "crit": 3, "desc": "JavaScript decodes a long embedded Base64 blob", "from": [ { "off": 43863, "file": 1, "line": 1398 }, { "off": 14493, "file": 3, "line": 387 }, { "file": 8 }, { "off": 156374, "file": 9, "line": 4022 } ], "uses": [ 293, 297 ] }, { "id": "micro-behaviors/ui/window/form-input::generic-element-value-member-read", "conf": 0.92, "crit": 3, "desc": "Reads generic element value member", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::esbuild-bundled", "conf": 0.95, "crit": 2, "desc": "esbuild bundle output markers", "from": [ { "off": 3900, "file": 9, "line": 74 }, { "off": 1551, "file": 19, "line": 38 } ], "uses": [ 98, 333, 403, 576 ] }, { "id": "micro-behaviors/data/decode/symbol-base64::buffer-from-base64", "conf": 0.8, "crit": 3, "desc": "Base64 decoding via Buffer.from (JS)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/interpreter::powershell-executable-token", "conf": 0.98, "crit": 3, "desc": "PowerShell executable name reference", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::helper-call-child-process-module-name", "conf": 1.0, "crit": 3, "desc": "Passes child-process module name to helper", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/buffer::mixed-buffer-encodings", "conf": 0.6, "crit": 3, "desc": "Node.js code decodes both hexadecimal and Base64 buffers", "from": [ { "off": 43850, "file": 1, "line": 1398 }, { "file": 9 }, { "off": 5859, "file": 13, "line": 149 } ], "uses": [ 9, 85 ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-stdin-read", "conf": 0.9, "crit": 3, "desc": "Reads a JSON event payload from stdin", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/workers::worker-threads-import", "atk": "T1059.007", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Imports worker_threads module" }, { "id": "micro-behaviors/data/decode/custom::javascript-decode-function", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Defines a JavaScript decode function", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/decode/url::js-unescape-call", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript unescape", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/trojanized/app/replace::vscode-host-main-file-reference", "atk": "T1195.002,T1608.004", "conf": 0.94, "crit": 3, "desc": "Extension targets VS Code main.js", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::object-type-dispatch-switch", "conf": 0.93, "crit": 3, "desc": "Switch dispatches on an object type field", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-win32-check", "conf": 0.6, "crit": 2, "desc": "Checks whether Node.js runs on Windows", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "WebSocket protocol headers", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/hidden::encodedcommand-invocation", "atk": "T1059.001", "conf": 0.92, "crit": 4, "desc": "PowerShell EncodedCommand invocation", "from": [ { "file": 9 } ], "uses": [ 272 ] }, { "id": "metadata/build/bundler/wrapper::esbuild-bundled--export", "conf": 0.95, "crit": 3, "desc": "Contains the esbuild __export helper", "from": [ { "file": 9 } ] }, { "id": "objectives/anti-static/obfuscation/string/array::js-string-split", "conf": 0.6, "crit": 3, "desc": "Split to empty-delimiter char array", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/application-name::chromium-browser-name-literal", "conf": 0.4, "crit": 3, "desc": "String literal names the Chromium browser", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/arithmetic::source-xor-operation", "conf": 1.0, "crit": 3, "desc": "Source references XOR syntax", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/delete/directory::fs-rm-recursive", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Node.js fs.rm with recursive option", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-textarea-selector", "conf": 0.9, "crit": 1, "desc": "Browser selector targets textarea elements", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/secret-config::dotenv-filename-literal", "atk": "T1552.001", "conf": 0.85, "crit": 1, "desc": ".env filename literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/function/names::create-connection-call-target", "conf": 0.9, "crit": 3, "desc": "Call target named createConnection", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/encode/char-code::multiple-fromcharcode-calls", "conf": 0.92, "crit": 3, "desc": "Calls String.fromCharCode multiple times", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/url/object::browser-object-url", "conf": 0.88, "crit": 3, "desc": "Browser creates an object URL", "from": [ { "file": 19 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/websocket/server::websocket-send", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "WebSocket send() call", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL documentation context", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-typed-array-reconstruction", "conf": 0.96, "crit": 3, "desc": "Rebuilds Base64 data as typed bytes", "from": [ { "file": 3 }, { "off": 5883, "file": 8, "line": 109 }, { "off": 156374, "file": 9, "line": 4022 } ], "uses": [ 17, 169, 293 ] }, { "id": "micro-behaviors/data/source/property/attributes::define-property-variable-arguments", "conf": 0.92, "crit": 3, "desc": "Defines an object property using variables", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-font-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Inline web-font data URI context", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/os/env/secret-name::javascript-credential-env-read", "conf": 0.85, "crit": 3, "desc": "JavaScript reads a credential env var", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/send::javascript-socket-send", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "JavaScript socket send call", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/socket/ssl::node-tls-connect", "mbc": "C0001", "conf": 0.88, "crit": 3, "desc": "Node TLS module connects a socket", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-create-element", "conf": 0.96, "crit": 3, "desc": "Creates DOM element" }, { "id": "well-known/lib/ai/coding-assistant::auto-approval-ui-warning", "conf": 0.9, "crit": 3, "desc": "Auto-approval safety warning", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/process/create/script/automation::finder-scripting-target", "atk": "T1059.002", "conf": 0.7, "crit": 3, "desc": "Scripts the macOS Finder app", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/write/file/full::node-write-file-sync-call", "conf": 1.0, "crit": 3, "desc": "Node calls imported writeFileSync", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/read/file/full::readfilesync-call", "conf": 0.9, "crit": 3, "desc": "Calls readFileSync", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-object", "conf": 0.86, "crit": 3, "desc": "HTTP options object with host or port", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/websocket/server::ws-handle-upgrade-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "ws library completes the WebSocket handshake", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 3, "desc": "charCodeAt() method call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/dns/label::common-source-dns-query-api", "atk": "T1071.004", "conf": 0.88, "crit": 1, "desc": "Source references a common DNS query API", "from": [ { "file": 9 } ] }, { "id": "metadata/encoded-payload/url", "conf": 0.9, "crit": 3, "desc": "Percent-encoded content decoded" }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::os-release-call", "conf": 0.75, "crit": 3, "desc": "Queries OS release with os.release()", "from": [ { "file": 9 } ] }, { "id": "metadata/build/scaffold::node-template-copy-call", "conf": 0.9, "crit": 3, "desc": "Node template copy call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/style::zero-width-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element width to zero", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::js-indirect-eval-variable", "conf": 0.9, "crit": 3, "desc": "Indirect eval executes an identifier value", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/self::cwd-reference", "conf": 0.84, "crit": 3, "desc": "References the Node.js current working directory", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/websocket/handler::websocket-javascript-constructor", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "JavaScript WebSocket constructor", "from": [ { "file": 19 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/load/script::inline-percent-encoded-script-resource", "conf": 0.92, "crit": 3, "desc": "Loads JavaScript from a percent-encoded data URL", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content", "conf": 0.7, "crit": 2, "desc": "References the Node.js process.platform value", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/hook/webextension::webrequest-blocking-response-fragment", "conf": 0.9, "crit": 3, "desc": "Cancel or redirect response fragment", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/email/mime::mime-octet-stream", "conf": 0.85, "crit": 3, "desc": "Uses the application/octet-stream MIME type", "from": [ { "file": 9 } ] }, { "id": "metadata/package/versioning/scheme::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version" }, { "id": "metadata/package/name/convention::npm-has-name", "conf": 1.0, "crit": 2, "desc": "npm manifest declares a package name" }, { "id": "micro-behaviors/crypto/hash/digest::node-createhash-call", "conf": 0.65, "crit": 3, "desc": "Node.js createHash call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-url-origin-read", "conf": 0.94, "crit": 3, "desc": "Derives an origin from a URL", "from": [ { "file": 9 } ] }, { "id": "objectives/supply-chain/trojanized/app/replace::reverse-labeled-client-dir", "atk": "T1195.002,T1505.003", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Reversed client distribution path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/file/copy::fs-copyfileSync", "conf": 0.75, "crit": 3, "desc": "Copy file sync (fs.copyFileSync)", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/locale::language-label-code-en", "conf": 0.97, "crit": 2, "desc": "English UI language code", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket HTTP upgrade header", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/workers::new-worker-instance", "mbc": "C0017", "conf": 0.92, "crit": 3, "desc": "Creates Node.js worker thread instance", "from": [ { "file": 9 } ], "uses": [ 90, 402 ] }, { "id": "metadata/build/bundler/vscode::js-distribution-output-path", "conf": 0.96, "crit": 2, "desc": "JavaScript distribution output path", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/file::office-document-extension--pptx", "conf": 0.9, "crit": 3, "desc": "Office document file extension keyword (pptx)", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/read/file/full::read-text-utf8", "conf": 0.72, "crit": 2, "desc": "Reads file content as utf8", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/wasm::webassembly-module-instance-check", "conf": 0.85, "crit": 3, "desc": "Constructs WebAssembly Module or Instance", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/framing::node-be32-frame-length-read", "mbc": "C0001", "conf": 0.95, "crit": 3, "desc": "Reads BE32 frame length at offset zero", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/machine-id::createhash-call", "conf": 0.55, "crit": 3, "desc": "JavaScript references crypto.createHash", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-darwin-branch", "conf": 0.7, "crit": 2, "desc": "Branches on macOS platform value", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-svg-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains an inline SVG data URI", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/application/executable::browser-apps-brave", "conf": 0.5, "crit": 3, "desc": "Brave browser application-name token", "from": [ { "file": 9 } ] }, { "id": "objectives/persistence/system/surface/paths::launchservices-handler--rx-20", "atk": "T1547", "conf": 0.86, "crit": 3, "desc": "Matches 'LSHandlerURLScheme'", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission", "conf": 0.82, "crit": 3, "desc": "Emits object through named JavaScript event", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::json-object-variable-field", "conf": 0.84, "crit": 3, "desc": "JSON object includes a variable-valued field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/email/address::eastern-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Eastern consumer email domain suffix", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/data/serialize/object::js-serialise", "conf": 0.85, "crit": 3, "desc": "References a serialization-related symbol", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-create-method-reference", "conf": 0.85, "crit": 3, "desc": "References a DOM element creation method", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/telemetry::platform-profile-field", "conf": 0.95, "crit": 3, "desc": "Platform profile field name", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/credential::any-credential-path", "conf": 0.9, "crit": 1, "desc": "References a credential-bearing path", "from": [ { "off": 937373, "file": 9, "line": 26678 } ], "uses": [ 39, 105 ] }, { "id": "micro-behaviors/ui/window/navigation::browser-location-reload", "conf": 0.84, "crit": 3, "desc": "Reloads browser location", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment", "conf": 0.94, "crit": 3, "desc": "Assigns character code to array element", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-trailing-iife-closure", "conf": 0.85, "crit": 3, "desc": "JavaScript file ends with an IIFE" }, { "id": "micro-behaviors/communications/http/url/path::vite-fs-route-reference", "conf": 0.94, "crit": 3, "desc": "References Vite filesystem HTTP route", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/script/osascript::run-applescript-library", "atk": "T1059.002", "conf": 0.7, "crit": 3, "desc": "run-applescript library reference", "from": [ { "file": 9 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass-flag", "atk": "T1059.001", "conf": 0.95, "crit": 3, "desc": "ExecutionPolicy bypass flag", "from": [ { "file": 9 } ] }, { "id": "metadata/package/entrypoint::bin-field-declared", "conf": 0.95, "crit": 3, "desc": "Manifest declares a bin entry" }, { "id": "micro-behaviors/os/module/require::esm-side-effect-package-import", "conf": 0.9, "crit": 3, "desc": "ESM side-effect-only package import", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy", "conf": 0.8, "crit": 2, "desc": "Copies one indexed array element to another", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/fd/stdio::stdout-string", "conf": 0.3, "crit": 2, "desc": "References the stdout stream name", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 9 } ], "uses": [ 519 ] }, { "id": "metadata/lang/javascript-features::destructuring", "conf": 0.9, "crit": 2, "desc": "ES6 destructuring assignment" }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/telemetry/logging/event::extension-analytics-event-field", "conf": 0.93, "crit": 3, "desc": "Object literal has a bare event field", "from": [ { "file": 8 } ] }, { "id": "metadata/lang/locale::language-label-table-name", "conf": 0.95, "crit": 2, "desc": "Contains a UI language-label table", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/write/file/full::js-fs-write-sync", "conf": 1.0, "crit": 3, "desc": "Writes file via Node.js fs", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/commandline::check-argv", "conf": 0.8, "crit": 3, "desc": "Reads Node.js arguments through process.argv", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/session::management-id-comparison--rx-12", "conf": 0.9, "crit": 3, "desc": ".includes() against extension/id list", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-sublime", "conf": 0.5, "crit": 3, "desc": "Dev app sublime_text", "from": [ { "file": 9 } ] }, { "id": "metadata/file/string/command::script-many-shell-command-strings-100", "conf": 0.88, "crit": 3, "desc": "Script has 100+ shell-command-like strings", "from": [ { "file": 9 } ] }, { "id": "metadata/package/files/package-json::files-runtime-tree-ref", "conf": 0.85, "crit": 2, "desc": "Package files list includes runtime tree" }, { "id": "micro-behaviors/communications/dns/lookup/query::source-resolver-query", "conf": 0.92, "crit": 3, "desc": "Source or bytecode performs DNS resolution", "from": [ { "file": 9 } ], "uses": [ 332 ] }, { "id": "micro-behaviors/data/source/property/identity::result-code-script-property", "conf": 0.82, "crit": 3, "desc": "Reads a result or response code field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/navigation::browser-page-url-href-comparison", "conf": 0.9, "crit": 3, "desc": "Compares location.href to another value", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/theme::prefers-dark-color-scheme", "conf": 0.85, "crit": 3, "desc": "Checks the preferred dark color scheme", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/string/concat::array-join-empty-separator-text", "conf": 0.78, "crit": 3, "desc": "Array expression joined without separator", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/container/runtime::containerenv", "conf": 0.7, "crit": 3, "desc": "Container marker file reference", "from": [ { "file": 9 } ] }, { "id": "metadata/file/catalog/unicode::escaped-unicode-codepoint", "conf": 0.99, "crit": 3, "desc": "Escaped Unicode codepoint in source", "from": [ { "file": 1 } ] }, { "id": "metadata/build/bundler/asset::js-known-bundler-output", "conf": 0.95, "crit": 2, "desc": "File is known bundler/wrapper output", "from": [ { "off": 745949, "file": 9, "line": 21585 }, { "off": 483, "file": 19, "line": 13 } ], "uses": [ 4, 205, 247 ] }, { "id": "micro-behaviors/crypto/hash/digest::digest-method-call", "conf": 0.8, "crit": 3, "desc": "Calls a digest() method", "from": [ { "file": 1 } ] }, { "id": "metadata/package/scripts/develop::pkg-format-script-field", "conf": 0.6, "crit": 3, "desc": "\"format\": script in package.json" }, { "id": "metadata/file/format/media::pdf-media-marker", "conf": 0.9, "crit": 3, "desc": "References the PDF signature or media type", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/fd/stdio::js-readline-interface-create", "conf": 0.7, "crit": 3, "desc": "Creates a Node readline interface", "from": [ { "file": 9 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/command-network-surface::js-many-shell-command-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.86, "crit": 3, "desc": "Many shell command strings in JavaScript", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/response::server-response-send-end", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls server response send/end method", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/embedded::javascript", "conf": 1.0, "crit": 2, "desc": "javascript code embedded in string" }, { "id": "micro-behaviors/os/random/crypto::webcrypto-get-random-values", "conf": 0.96, "crit": 3, "desc": "Generates Web Crypto random bytes", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/runtime::js-vite-modulepreload-polyfill", "conf": 0.96, "crit": 2, "desc": "Contains Vite/Rollup module-preload polyfill", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/encode/base64::node-buffer-base64-encode", "mbc": "C0026", "conf": 0.95, "crit": 3, "desc": "Encodes Node.js Buffer output as Base64", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/watch/monitor::node-watch-file", "conf": 0.92, "crit": 3, "desc": "Node watches a file for changes", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/javascript-features::use-strict-directive", "conf": 0.6, "crit": 2, "desc": "Contains a JavaScript use strict directive", "from": [ { "file": 8 } ] }, { "id": "metadata/lang/javascript-features::const-let", "conf": 0.9, "crit": 2, "desc": "ES6 const/let declarations", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/javascript-features::arrow-function", "conf": 0.9, "crit": 2, "desc": "ES6 arrow function syntax" }, { "id": "micro-behaviors/communications/http/websocket::websocket-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "WebSocket class reference", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/reference::windows-path-like-string", "conf": 1.0, "crit": 2, "desc": "Contains a Windows drive-letter path" }, { "id": "metadata/package/documentation/source::readme-markdown-basename", "conf": 0.99, "crit": 2, "desc": "README Markdown basename", "from": [ { "file": 18 } ] }, { "id": "metadata/file/string/identity::jfif-or-jpeg-media-marker", "conf": 0.82, "crit": 3, "desc": "References JFIF or the JPEG media type", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "from": [ { "file": 19 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/container::container-self-cgroup", "conf": 0.66, "crit": 3, "desc": "Reads own cgroup (/proc/self/cgroup)", "from": [ { "file": 9 } ] }, { "id": "objectives/evasion/masquerade/process/path::path-public-temp-writable", "atk": "T1036.005", "mbc": "F0004", "conf": 0.6, "crit": 3, "desc": "Public or Temp writable-path marker", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/network/interface::node-exec-net-use-enumeration", "atk": "T1016", "conf": 0.92, "crit": 3, "desc": "Enumerates mapped drives via net use", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call", "conf": 0.88, "crit": 3, "desc": "Calls a matcher in a conditional expression", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/traverse::node-dirent-isdirectory", "conf": 0.72, "crit": 2, "desc": "Checks whether Node.js entries are directories", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Gmail consumer email domain suffix", "from": [ { "file": 9 } ] }, { "id": "objectives/command-and-control/dropper/execution/dropper-script::js-exec-filepath-call", "conf": 0.9, "crit": 3, "desc": "JavaScript executes payload variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/exec::node-promisified-exec-file", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "Node promisifies the file exec API", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/query::function-encoded-template-query-parameter", "conf": 0.92, "crit": 3, "desc": "Encodes query value with function", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/upload::upload-extension-allowlist-key", "conf": 0.94, "crit": 3, "desc": "Upload extension allowlist field", "from": [ { "file": 9 } ] }, { "id": "objectives/collection/stealer/session::decodeuricomponent-atob-chain", "atk": "T1539", "conf": 0.88, "crit": 3, "desc": "decodeURIComponent on atob output", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::module-compile-marker", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Node Module._compile runtime-code method", "from": [ { "file": 9 } ] }, { "id": "objectives/supply-chain/hidden-payload/eval::js-buffer-from-hex-text", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Buffer.from decodes a hex string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/module/require::node-builtin-modules-list", "conf": 0.9, "crit": 3, "desc": "Reads the Node builtin module name list", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/encode/char-code::long-numeric-array-literal", "conf": 0.9, "crit": 1, "desc": "Long numeric array literal", "from": [ { "file": 9 } ] }, { "id": "objectives/lateral-movement/brute-force/password::common-account-root-password-pair", "atk": "T1110.001", "conf": 0.86, "crit": 3, "desc": "Common account paired with root password", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "metadata/build/bundler/wrapper::js-esbuild-bundle-helpers", "conf": 0.98, "crit": 1, "desc": "Contains an esbuild-generated helper", "from": [ { "off": 1401, "file": 19, "line": 37 } ], "uses": [ 458 ] }, { "id": "micro-behaviors/data/decode/hex::multiple-node-hex-decodes", "conf": 0.8, "crit": 3, "desc": "Multiple Node.js hex decodes", "from": [ { "file": 1 } ] }, { "id": "metadata/build/toolchain::lex-word", "conf": 1.0, "crit": 3, "desc": "lex lexer-generator tool name", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/application/executable::browser-apps-firefox-exe", "conf": 0.5, "crit": 2, "desc": "Firefox Windows executable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/websocket/server::websocket-is-websocket", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "WebSocket.isWebSocket() check", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/system::javascript-windows-system32", "conf": 0.9, "crit": 3, "desc": "JavaScript System32 path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/wmi/query::browser-wql-query", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Browser script contains a WMI WQL query", "from": [ { "file": 9 } ] }, { "id": "metadata/package/homepage::has-homepage-field", "conf": 0.8, "crit": 2, "desc": "Package has homepage URL" }, { "id": "micro-behaviors/data/buffer::node-buffer-tostring-call", "conf": 0.88, "crit": 3, "desc": "Converts Node.js Buffer output to text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/websocket::ping-pong-pair", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "PING/PONG protocol marker", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/buffer::uint16-be-buffer-write", "conf": 0.85, "crit": 3, "desc": "Writes 16-bit big-endian buffer value", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::js-esbuild-bundle", "conf": 0.97, "crit": 2, "desc": "esbuild-bundled JavaScript module", "from": [ { "off": 2707, "file": 9, "line": 41 }, { "file": 19 } ], "uses": [ 235, 453 ] }, { "id": "metadata/file/string/application-name::brave-name", "conf": 0.4, "crit": 3, "desc": "References the Brave browser name", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/buffer::stream-write-buffer-arg", "conf": 0.9, "crit": 3, "desc": "Writes a buffer argument to a stream", "from": [ { "file": 9 } ] }, { "id": "objectives/impact/crypto-manipulation/weakening::generator-before-script", "atk": "T1565.001", "conf": 0.94, "crit": 3, "desc": "Orders generator before script", "from": [ { "file": 9 } ] }, { "id": "objectives/supply-chain/recon-exfil/host-profile/install-context::npm-data-exfil", "atk": "T1020", "mbc": "E1041", "conf": 0.95, "crit": 3, "desc": "NPM package exfiltrates system info via HTTP", "from": [ { "file": 9 } ], "uses": [ 13, 33, 52 ] }, { "id": "objectives/command-and-control/dropper/builder::embedded-vba-payload-decoder", "atk": "T1587.001,T1204.002", "mbc": "B0023", "conf": 0.85, "crit": 3, "desc": "Embeds a VBA base64 payload-decoder template", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/listener::nodejs-http-imported-create-server", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Node.js HTTP server created through an ES-module import", "from": [ { "off": 23536, "file": 2, "line": 708 }, { "off": 2190, "file": 9, "line": 31 } ], "uses": [ 37, 261 ] }, { "id": "micro-behaviors/fs/path/secret-config::package-or-netrc-credential-file", "atk": "T1552.001", "conf": 0.9, "crit": 3, "desc": "Package or netrc credential file reference", "from": [ { "off": 937373, "file": 9, "line": 26678 } ], "uses": [ 39 ] }, { "id": "micro-behaviors/communications/websocket/library::ws", "conf": 0.9, "crit": 3, "desc": "Node.js uses the ws WebSocket library", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler", "conf": 0.85, "crit": 3, "desc": "Registers asynchronous named event handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/json::parsed-or-environment-json-stringify", "conf": 0.86, "crit": 3, "desc": "Serializes parsed or environment data as JSON", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL public documentation", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/hook-file::install-hook-unauthorized-code-package-reference", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "Banner names package near unauthorized code", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/server/listener::node-http-create-server-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Imports Node.js http.createServer", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hooks-config-key", "conf": 0.9, "crit": 3, "desc": "AI agent hooks config key", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/encode/hex::buffer-hex", "conf": 1.0, "crit": 3, "desc": "Converts buffer to hex string", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/module/require::dynamic-external-import-promise-chain", "conf": 0.9, "crit": 3, "desc": "Chains on a lazily imported package", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/spawn::stdio-ignore", "mbc": "F0005", "conf": 0.85, "crit": 3, "desc": "Spawns a child with standard I/O ignored", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/javascript-features::export-async-let-var-brace", "conf": 0.8, "crit": 3, "desc": "Exports an ES module variable or binding", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/server/middleware::request-response-middleware-definition", "conf": 0.92, "crit": 3, "desc": "Defines request-response middleware function", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/websocket/server::websocket-message-handler", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "WebSocket message event handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call", "conf": 0.72, "crit": 3, "desc": "Sorts a JavaScript array", "from": [ { "file": 1 } ] }, { "id": "metadata/package/dependencies/manifest/count::npm-many-dev-dependencies", "conf": 0.7, "crit": 2, "desc": "npm manifest has many devDependencies" }, { "id": "micro-behaviors/process/create/hidden::encodedcommand-flag-js", "atk": "T1059.001", "conf": 0.86, "crit": 3, "desc": "PowerShell EncodedCommand flag in script literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/time/schedule/interval::repeated-settimeout", "conf": 0.9, "crit": 3, "desc": "Contains at least six setTimeout calls", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/module/require::dynamic-import-string-literal", "conf": 0.8, "crit": 3, "desc": "Dynamically imports a literal module path" }, { "id": "micro-behaviors/communications/socket/listen::node-net-create-server", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node net module creates a server", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/endpoint::remote-config-endpoint", "conf": 0.9, "crit": 3, "desc": "Hard-coded remote configuration endpoint", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/base64::multiple-node-base64-decodes", "conf": 0.8, "crit": 3, "desc": "Multiple Node.js Base64 decodes", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/response::http-403-forbidden", "conf": 0.75, "crit": 3, "desc": "HTTP 403 forbidden response text", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/query::encoded-template-query-parameter", "conf": 0.9, "crit": 3, "desc": "Encodes value in a URL query template", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/encode/base64::btoa-symbol", "conf": 0.78, "crit": 3, "desc": "Calls the browser btoa() Base64 encoder", "from": [ { "file": 9 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-20000", "conf": 0.9, "crit": 3, "desc": "Source has over 20000 comment bytes", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/process/fd/stdio::js-readline-line-event", "conf": 0.6, "crit": 3, "desc": "Handles readline input line by line", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-number-parse", "conf": 0.9, "crit": 3, "desc": "JavaScript hex-to-integer conversion", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/hook/event::process-on-unhandled-rejection", "conf": 0.9, "crit": 3, "desc": "Node process unhandledRejection handler", "from": [ { "file": 15 } ] }, { "id": "well-known/lib/ui/vite::dist-node-chunk", "conf": 0.98, "crit": 3, "desc": "Vite published node chunk path", "from": [ { "file": 9 } ], "uses": [ 61 ] }, { "id": "micro-behaviors/communications/url/encoded::inline-image-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains an inline image data URI", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/wmi/query::cim-instance-cmdlet", "conf": 0.8, "crit": 3, "desc": "Uses Get-CimInstance cmdlet", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/string/concat::leading-variable-dotted-name", "conf": 0.9, "crit": 3, "desc": "Dotted name built from a leading variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/syntax/schema::hostname-object-key", "conf": 0.9, "crit": 1, "desc": "Object literal declares a hostname key", "from": [ { "file": 9 } ] }, { "id": "metadata/package/publishing::has-funding", "conf": 0.85, "crit": 3, "desc": "Package has funding information" }, { "id": "micro-behaviors/data/source/unsafe::zlib-implementation-reference", "conf": 0.9, "crit": 3, "desc": "References a zlib implementation", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 3 } ] }, { "id": "metadata/package/license::mit-license-text", "conf": 0.8, "crit": 2, "desc": "MIT License named in text", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/crypto/hash/digest::node-createhash-md4-call", "conf": 0.9, "crit": 3, "desc": "Node.js createHash('md4') call", "from": [ { "file": 1 } ] }, { "id": "metadata/file/encoded::large-base64-like-literal", "conf": 0.8, "crit": 3, "desc": "Large Base64-like string literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-execsync", "conf": 1.0, "crit": 3, "desc": "Executes shell commands synchronously", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/locale::language-label-code-de", "conf": 0.97, "crit": 2, "desc": "German UI language code", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/user-agent::navigator-useragent-read", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Reads browser User-Agent string", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/raw::raw-socket-ref", "atk": "T1011", "mbc": "C0001", "conf": 0.7, "crit": 1, "desc": "Raw socket terminology", "from": [ { "file": 9 } ] }, { "id": "metadata/import/builtin::import-dns", "conf": 0.8, "crit": 3, "desc": "ESM import of the Node.js dns module", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/javascript-features::export-const-func-class", "conf": 0.75, "crit": 3, "desc": "Exports an ES module declaration", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/format/locale::js-locale-formatting-call", "conf": 0.9, "crit": 3, "desc": "JavaScript locale-aware formatting call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/encode/charcode::codepoint-at", "conf": 0.7, "crit": 3, "desc": "codePointAt() method call", "from": [ { "file": 9 } ] }, { "id": "metadata/package/completeness::has-github-config-1", "conf": 1.0, "crit": 3, "desc": "Package references GitHub (config/workflows)", "from": [ { "file": 16 } ] }, { "id": "well-known/lib/network/content-type::wilson-copyright", "conf": 0.99, "crit": 3, "desc": "content-type Wilson copyright header", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/encoded/unicode-escape::ansi-escape-sequence", "conf": 0.98, "crit": 3, "desc": "ANSI color escape sequence encoded", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/request/client::request-write-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "JavaScript writes HTTP request body", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/receive::node-socket-message-event", "atk": "T1071", "mbc": "C0001", "conf": 0.78, "crit": 3, "desc": "Node socket message event handler", "from": [ { "file": 9 } ] }, { "id": "metadata/build/ecosystem::npm-config-user-agent-env-name", "conf": 0.8, "crit": 3, "desc": "npm user-agent environment variable name", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/server/middleware::returns-request-middleware-function", "conf": 0.85, "crit": 3, "desc": "JavaScript returns request middleware function", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "from": [ { "file": 9 } ] }, { "id": "metadata/package/files/included::npm-publish-root-manifest", "conf": 0.95, "crit": 2, "desc": "Manifest sits at npm publish root", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/data/source/property/identity::host-user-object-fields", "conf": 0.9, "crit": 3, "desc": "Host or user object field keys", "from": [ { "file": 2 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass", "atk": "T1059.001", "conf": 0.95, "crit": 3, "desc": "PowerShell execution policy bypass", "from": [ { "off": 453268, "file": 9, "line": 13032 } ], "uses": [ 32, 173, 556 ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "child_process module name literal", "from": [ { "file": 9 } ] }, { "id": "metadata/build/minifier::void-zero", "conf": 0.6, "crit": 2, "desc": "Uses minifier-style void 0 for undefined", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/read/file/handle::file-read-api-call", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript readFile API", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/wasm::webassembly-instantiate", "conf": 0.85, "crit": 3, "desc": "Instantiates a WebAssembly module", "from": [ { "file": 9 } ] }, { "id": "metadata/package/versioning/scheme::mature-version", "conf": 0.7, "crit": 2, "desc": "Major version is 1 or higher" }, { "id": "micro-behaviors/communications/websocket/server::upgrade-handler", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP upgrade event handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/dom-access::browser-queryselectorall-call", "conf": 0.86, "crit": 3, "desc": "Queries multiple DOM elements", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Module scope assigns zero-argument call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/ssl::node-check-server-identity-callback", "mbc": "C0001", "conf": 0.88, "crit": 3, "desc": "Configures a TLS server-identity callback", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/response::server-response-statuscode-not-found", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Server response assigns HTTP 404 status", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-empty-module-exports", "conf": 0.8, "crit": 3, "desc": "CommonJS module exports an empty object", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/content-length::raw-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets an HTTP Content-Length header", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/inject/build-plugin::vite-transform-index-html-hook", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Plugin implements the HTML transform hook", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/browser::navigator-platform-read", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Reads navigator.platform browser identity", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/dns/label::source-dns-query-api", "atk": "T1071.004", "conf": 0.9, "crit": 1, "desc": "Source invokes a DNS query API", "from": [ { "file": 9 } ], "uses": [ 127 ] }, { "id": "metadata/build/bundler/wrapper::esbuild-bundled--tocommonjs", "conf": 0.95, "crit": 3, "desc": "Contains the esbuild __toCommonJS helper", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/build-artifacts::build-output-prune-context", "conf": 0.85, "crit": 3, "desc": "Build output pruning context", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/hex::buffer-from-hex-to-utf8", "conf": 0.85, "crit": 3, "desc": "Buffer hex decode to UTF-8", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::node-os-alias-homedir-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "Node os-alias home directory query", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-linux-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Linux platform value", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/websocket/send::member-ws-send-call", "conf": 0.94, "crit": 3, "desc": "Object WebSocket send call", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/encode/hex::js-to-string-hex", "conf": 0.95, "crit": 3, "desc": "Calls JavaScript toString with hex encoding", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/base64::node-base64-tostring-token", "conf": 0.86, "crit": 3, "desc": "Node base64 toString token", "from": [ { "file": 8 } ] }, { "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps", "conf": 0.85, "crit": 3, "desc": "Package declares a runtime dependency", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/process/io/stream::node-stdout-reference", "conf": 0.8, "crit": 3, "desc": "References Node.js stdout stream", "from": [ { "file": 2 } ] }, { "id": "well-known/lib/stdlib/lodash::modular-source", "conf": 0.9, "crit": 3, "desc": "Lodash modular source file", "from": [ { "off": 22922, "file": 1, "line": 771 } ], "uses": [ 534 ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-execasync-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Calls an asynchronous command execution wrapper", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program", "conf": 0.82, "crit": 3, "desc": "Node spawns a variable program path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/listen::node-server-listen-named", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node named server listens on endpoint", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/flags::powershell-policy-bypass-argv-pair", "atk": "T1059.001,T1562.001", "conf": 0.94, "crit": 3, "desc": "PowerShell Bypass as separate argv strings", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::js-indirect-eval", "conf": 0.7, "crit": 3, "desc": "Indirect eval or Function via comma operator" }, { "id": "micro-behaviors/os/sysinfo/cpu::node-cpu-information-query", "conf": 0.9, "crit": 3, "desc": "Queries Node CPU information", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-insert-mutate-method-reference", "conf": 0.85, "crit": 3, "desc": "References a DOM insertion or mutation method", "from": [ { "file": 3 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/hook-file::process-env-json-payload", "atk": "T1552.001", "conf": 0.94, "crit": 3, "desc": "Serializes process.env in JSON", "from": [ { "file": 9 } ] }, { "id": "objectives/evasion/file-hiding/path-system::hidden-opt-lib-reference", "atk": "T1564.001", "mbc": "F0005", "conf": 0.9, "crit": 3, "desc": "Hidden opt/lib path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call", "conf": 0.84, "crit": 3, "desc": "Calls Node.js synchronous directory enumeration", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/base64::buffer-from-base64-to-utf8", "conf": 0.85, "crit": 3, "desc": "Buffer base64 decode to UTF-8", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/write/file/full::node-fs-promises-import", "conf": 0.95, "crit": 2, "desc": "Imports the Node fs/promises API", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/inject/build-plugin::build-plugin-inject-to-placement", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Build plugin selects HTML injection point", "from": [ { "file": 9 } ] }, { "id": "metadata/package/config::excludes-identifier", "conf": 0.7, "crit": 3, "desc": "Uses an excludes identifier", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-subprotocol-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket subprotocol header", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-bounded-while-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript bounded while loop", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/hex::js-parseint-radix-16", "conf": 0.85, "crit": 3, "desc": "JavaScript parseInt with radix 16", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-darwin-check", "conf": 0.6, "crit": 2, "desc": "process.platform macOS check", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript source filename", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/generated::automatically-generated-source-marker", "conf": 0.85, "crit": 2, "desc": "Generated source provenance marker", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "from": [ { "file": 7 } ] }, { "id": "metadata/file/comment::source-at-most-two-comments", "conf": 0.88, "crit": 2, "desc": "Source has at most two comments", "from": [ { "file": 21 } ] }, { "id": "well-known/lib/format/mime-db::message-rfc822-mime-entry", "conf": 0.95, "crit": 3, "desc": "message/rfc822 MIME entry", "from": [ { "file": 9 } ] }, { "id": "well-known/lib/ui/vite::product-homepage", "conf": 0.98, "crit": 3, "desc": "Vite product homepage marker", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/inject/build-plugin::build-plugin-script-tag-descriptor", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Build plugin emits a script tag descriptor", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/dns/label::javascript-dns-api-reference", "atk": "T1071.004", "conf": 0.9, "crit": 3, "desc": "JavaScript DNS API reference", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/ipc/native-host::native-messaging-stdio-framing", "conf": 0.92, "crit": 3, "desc": "Length-prefixed framing on process stdio", "from": [ { "off": 24496, "file": 2, "line": 726 }, { "off": 113639, "file": 9, "line": 3215 } ], "uses": [ 47, 342, 447 ] }, { "id": "micro-behaviors/fs/directory/traverse::node-recursive-dirent-walk", "conf": 0.82, "crit": 3, "desc": "Recursively traverses a Node.js directory tree", "from": [ { "off": 86616, "file": 9, "line": 2452 } ], "uses": [ 222, 496 ] }, { "id": "micro-behaviors/data/decode/base64::standard-base64-alphabet-table", "conf": 0.88, "crit": 3, "desc": "Embeds the standard Base64 alphabet table", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member", "conf": 0.8, "crit": 3, "desc": "Reads the Node.js process.platform value", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detaches a handle with unref()", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/network/interface::node-network-interfaces-call", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Node.js network interface enumeration call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/spawn::shell-true", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "shell: true option", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::js-async-function-constructor", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "JavaScript AsyncFunction compiles code", "from": [ { "file": 8 } ] }, { "id": "metadata/build/bundler/asset::has-sourcemap", "conf": 0.9, "crit": 2, "desc": "Code has source map reference", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-start", "conf": 0.86, "crit": 3, "desc": "Starts a synchronous function expression", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/javascript-features::async-await", "conf": 0.9, "crit": 2, "desc": "ES2017 async/await syntax", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/script/osascript::node-applescript-library-reference", "atk": "T1059.002", "conf": 0.7, "crit": 3, "desc": "Node.js AppleScript library reference", "from": [ { "off": 445937, "file": 9, "line": 12791 } ], "uses": [ 172 ] }, { "id": "well-known/lib/ui/vite::npm-package-name", "conf": 0.98, "crit": 3, "desc": "Vite npm package name" }, { "id": "micro-behaviors/communications/socket/receive::node-socket-data-event", "atk": "T1071", "mbc": "C0001", "conf": 0.78, "crit": 3, "desc": "Node socket data event handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/buffer::source-right-shift-8-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 8 bits", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/app-data::chromium-browser-product-path-component", "conf": 0.78, "crit": 3, "desc": "Chromium product path component", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/write/file/full::write-file-call-target", "conf": 0.9, "crit": 3, "desc": "Calls an unqualified writeFile function", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-indonesian--atom-1", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"yang\"", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/client/resource::create-link-resource-element", "conf": 0.92, "crit": 3, "desc": "Creates a link resource element", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/package-manager::package-json-path-join", "conf": 0.84, "crit": 3, "desc": "Joins a path containing package.json", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/location::desktop-folder-target", "conf": 0.75, "crit": 3, "desc": "Desktop folder path reference", "from": [ { "file": 31 } ] }, { "id": "metadata/file/string/count::few-string-literals", "conf": 0.4, "crit": 3, "desc": "File has very few string literals", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/string/replace::js-url-variable-self-replace", "conf": 0.94, "crit": 3, "desc": "Rewrites a URL-named variable in place", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/string/split::js-split-string-property-access", "conf": 0.8, "crit": 3, "desc": "Builds a property name from split text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/string/replace::keyed-replacement-call", "conf": 0.96, "crit": 3, "desc": "Replaces text using a keyed replacement table", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/workers::worker-eval-true-option", "mbc": "C0017", "conf": 0.95, "crit": 3, "desc": "Enables eval in an object literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/format/csv/export::csv-content-type", "conf": 0.9, "crit": 3, "desc": "Declares text/csv content type", "from": [ { "file": 9 } ] }, { "id": "metadata/package/scripts/build::pkg-build-script-field", "conf": 0.6, "crit": 3, "desc": "Package declares a build script" }, { "id": "micro-behaviors/os/env/cicd::process-env-ci", "conf": 0.75, "crit": 3, "desc": "Reads CI environment flag", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/hook/instrumentation::object-send-call", "atk": "T1055", "conf": 0.88, "crit": 3, "desc": "JavaScript sends an object message", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/string/concat::join-empty-separator-call", "conf": 0.82, "crit": 3, "desc": "Joins values without a separator", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/workers::worker-constructor-call", "conf": 0.9, "crit": 3, "desc": "Worker constructor call", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::esbuild-bundled--copyprops", "conf": 0.95, "crit": 3, "desc": "Contains the esbuild __copyProps helper", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript split()", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/channel-agent::ai-agent-message-receive-c", "atk": "T1059", "mbc": "B0022", "conf": 0.86, "crit": 1, "desc": "Incoming-message handler name", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/ipc/message::js-message-event-listener", "conf": 0.85, "crit": 3, "desc": "Registers an event listener for message events", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/format/string::source-bytes-equals-literal", "conf": 0.94, "crit": 3, "desc": "Source contains a bytes= string literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/construct::script-dirname-ref", "conf": 0.6, "crit": 3, "desc": "References script directory path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::js-new-function-constructor", "conf": 0.7, "crit": 3, "desc": "Calls JavaScript's new Function constructor" }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "from": [ { "file": 9 } ] }, { "id": "metadata/package/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL" }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-pycharm-shell", "conf": 0.5, "crit": 3, "desc": "PyCharm shell launcher", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "Contains an HTTPS URL prefix", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/locale::language-label-table-codes-a", "conf": 0.9, "crit": 2, "desc": "Common UI language-code pair", "from": [ { "off": 12631, "file": 1, "line": 348 }, { "off": 160409, "file": 3, "line": 3939 }, { "off": 226412, "file": 9, "line": 6017 } ], "uses": [ 146 ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-string-function", "conf": 0.9, "crit": 3, "desc": "Top-level non-require string call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/ip/assignment::javascript-loopback-address-literal", "conf": 0.95, "crit": 3, "desc": "JavaScript call argument contains loopback" }, { "id": "micro-behaviors/process/interpreter/eval/compile::js-async-function-constructor-alias", "atk": "T1059.007", "conf": 0.97, "crit": 3, "desc": "Recovers the AsyncFunction constructor", "from": [ { "file": 8 } ] }, { "id": "metadata/package/scripts/build::has-build-script-build", "conf": 0.7, "crit": 3, "desc": "Package declares build script" }, { "id": "micro-behaviors/hardware/input/event::browser-keyboard-event-listener", "conf": 0.94, "crit": 3, "desc": "Registers a DOM keyboard event listener", "from": [ { "file": 19 } ] }, { "id": "objectives/command-and-control/dropper/node-bootstrap::slash-node", "conf": 1.0, "crit": 3, "desc": "/node path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-headers-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Headers header name", "from": [ { "file": 9 } ] }, { "id": "objectives/anti-static/obfuscation/eval/require::decode-named-function-decl", "atk": "T1059.007", "mbc": "B0024", "conf": 0.5, "crit": 3, "desc": "Function whose name contains Decode", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/env/package-manager::npm-config-user-agent", "conf": 0.8, "crit": 3, "desc": "Reads npm user-agent environment variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/build::network-destination-function-binding", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Network destination assigned from call", "from": [ { "file": 8 } ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/communications/http/request/client::request-end-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Ends a request-like object with .end()", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::js-indirect-eval-text", "conf": 0.9, "crit": 3, "desc": "Indirect eval via comma operator", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/vm::vm-createContext-call", "conf": 0.8, "crit": 3, "desc": "createContext symbol (vm or React/Vue/...)", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/websocket/handler::websocket-library-api-reference", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "WebSocket library or handler API reference", "from": [ { "file": 19 }, { "file": 20 } ], "uses": [ 134 ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-proxy-get-trap", "conf": 0.9, "crit": 3, "desc": "Proxy intercepts property reads", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::json-stringify-env-field", "conf": 0.88, "crit": 3, "desc": "JSON serialization includes an env field", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-iframe-element", "conf": 0.78, "crit": 1, "desc": "References an iframe HTML element", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source", "conf": 1.0, "crit": 3, "desc": "Source contains low-bit mask syntax", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/window/style::fixed-viewport-style", "conf": 0.9, "crit": 3, "desc": "Fixed CSS element spans viewport", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/fs/read/stream::create-read-stream", "conf": 0.92, "crit": 3, "desc": "Creates a file read stream", "from": [ { "file": 9 } ] }, { "id": "objectives/execution/exploit/watering-hole::html-loopback-host-reference", "atk": "T1203", "conf": 0.9, "crit": 3, "desc": "HTML references loopback host", "from": [ { "file": 31 } ] }, { "id": "metadata/package/scripts/develop::has-dev-workflow", "conf": 0.85, "crit": 3, "desc": "Package has development workflow scripts", "from": [ { "file": 16 } ], "uses": [ 198, 398, 541 ] }, { "id": "micro-behaviors/communications/http/request/result::http-send-object", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Send call has object payload", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-pycharm-exe", "conf": 0.5, "crit": 3, "desc": "PyCharm Windows executable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/workers::worker-eval-option", "atk": "T1059.007", "mbc": "C0017", "conf": 0.95, "crit": 3, "desc": "Node worker evaluates an inline source string", "from": [ { "off": 128474, "file": 9, "line": 3616 } ], "uses": [ 90, 396, 402 ] }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-emacs", "conf": 0.5, "crit": 3, "desc": "Repeated Emacs name references", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/com/object::namespace-method", "conf": 0.8, "crit": 3, "desc": "Shell namespace method string", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/javascript-features::export-default-const-func-class", "conf": 0.8, "crit": 3, "desc": "Exports an ES module declaration", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/fd/stdio::js-stdin-read", "conf": 0.88, "crit": 3, "desc": "Reads Node process stdin", "from": [ { "file": 9 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass-concat-full", "atk": "T1059.001", "conf": 0.9, "crit": 3, "desc": "Concatenated ExecutionPolicy bypass", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/inject/build-plugin::build-plugin-injects-page-script", "atk": "T1195.002", "conf": 0.94, "crit": 3, "desc": "Build plugin injects a script into every page", "from": [ { "off": 868100, "file": 9, "line": 24871 }, { "off": 110247, "file": 31, "line": 2721 } ], "uses": [ 330, 357, 369 ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-payload-call", "conf": 0.92, "crit": 3, "desc": "Serializes a payload object as JSON", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/llm/wire-marker::role-line-marker", "conf": 0.72, "crit": 1, "desc": "Quoted LLM role label", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connection-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket connection upgrade header", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::js-esbuild-bundle-defprop", "conf": 0.95, "crit": 2, "desc": "esbuild __defProp helper", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/module/require::dynamic-external-import-string-literal", "conf": 0.9, "crit": 3, "desc": "Dynamically imports a non-relative module path" }, { "id": "micro-behaviors/fs/path/token::developer-credential-stores", "atk": "T1552.001", "conf": 0.92, "crit": 3, "desc": "References developer credential store paths", "from": [ { "file": 9 } ], "uses": [ 254 ] }, { "id": "micro-behaviors/data/decode/hex::buffer-from-hex-call", "conf": 0.86, "crit": 3, "desc": "Buffer.from hex decoding", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/string/conversion::js-fromcharcode-alias", "conf": 0.9, "crit": 3, "desc": "Aliases String.fromCharCode conversion function", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::js-esbuild-helper-reexport", "conf": 0.98, "crit": 2, "desc": "esbuild __reExport helper", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/string/search::compiled-js-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of JavaScript regex patterns", "from": [ { "file": 1 } ] }, { "id": "metadata/package/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "micro-behaviors/time/query::js-triple-date-now", "conf": 0.4, "crit": 3, "desc": "3+ Date.now() calls", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/javascript-features::template-literal", "conf": 0.9, "crit": 2, "desc": "ES6 template literal syntax", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/module/require::node-lazy-net-builtin-import", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Defers loading a Node network builtin", "from": [ { "file": 9 } ] }, { "id": "metadata/package/error-handling::finally-keyword", "conf": 0.5, "crit": 2, "desc": "Contains a finally cleanup handler", "from": [ { "file": 9 } ] }, { "id": "metadata/package/error-handling::catch-keyword", "conf": 0.5, "crit": 2, "desc": "Contains a catch error handler", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/symbol-base64::atob-decode", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with JavaScript atob()", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/write/file/stage::source-temp-api-reference", "conf": 0.92, "crit": 1, "desc": "Source references temporary directory API", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::js-tslib-reexport-helper", "conf": 0.97, "crit": 2, "desc": "Calls a tslib/TypeScript re-export helper", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-win32-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Windows platform value", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/backdoor/tasking/http::encoded-command-token", "atk": "T1102", "conf": 0.86, "crit": 3, "desc": "EncodedCommand token", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/raw::raw", "atk": "T1011", "mbc": "C0001", "conf": 0.8, "crit": 3, "desc": "Create raw network sockets", "from": [ { "file": 9 } ], "uses": [ 301 ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster", "conf": 0.86, "crit": 3, "desc": "Dense computed-property call cluster (3+)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base64::btoa-utf8-safe-encode", "conf": 0.88, "crit": 3, "desc": "UTF-8-safe Base64 encoding via btoa()", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/module/require::node-lazy-fs-builtin-import", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Defers loading a Node filesystem builtin", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::js-variable-code-constructor-call", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Constructor receives a code variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-lower", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "References the lowercase websocket keyword", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/dom/create::dom-anchor-element-creation", "conf": 0.85, "crit": 3, "desc": "Creates an anchor DOM element", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/ipc/message::shared-worker-constructor", "conf": 0.86, "crit": 3, "desc": "Creates a browser SharedWorker", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/redirect::response-redirect-member-access", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Reads redirect target from response object", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/module/require::cjs-require-in-try", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside a try block", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::node-timing-safe-equal-text-call", "mbc": "C0029", "conf": 0.92, "crit": 3, "desc": "Node.js constant-time comparison call", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-version-access", "conf": 0.72, "crit": 3, "desc": "Reads Node.js version through process.version", "from": [ { "file": 2 } ] }, { "id": "metadata/package/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata" }, { "id": "micro-behaviors/process/create/shell/bridge::execSync-call", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Runs shell commands synchronously with execSync", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::object-exec-method-call", "atk": "T1059", "conf": 1.0, "crit": 1, "desc": "Calls an object exec method", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/dynamic/eval::new-function-iife", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Immediate new Function invocation pattern" }, { "id": "micro-behaviors/data/serialize/schema-object::command-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object command field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-sequence-field", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Structured object contains a task sequence field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/url/host::url-host-property-assignment", "conf": 0.82, "crit": 3, "desc": "Assigns a request or URL host property", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/javascript-features::spread-operator", "conf": 0.9, "crit": 2, "desc": "ES6 spread operator (in array/object context)", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-input-selector", "conf": 0.9, "crit": 1, "desc": "Browser selector targets input elements", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/directory/traverse::node-readdir-dirents", "conf": 0.74, "crit": 2, "desc": "Reads a Node.js directory with Dirent objects", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-liveness-field", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Structured object contains a liveness field", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/spawn::windowshide-option", "conf": 0.85, "crit": 3, "desc": "Node.js windowsHide spawn option", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/request/configuration::node-http-options-host-port", "conf": 0.86, "crit": 3, "desc": "HTTP options contain hostname and port", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-pycharm-path", "conf": 0.5, "crit": 3, "desc": "PyCharm path component", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/navigation::browser-location-path-read", "conf": 0.86, "crit": 3, "desc": "Reads current path from browser location", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/ui/window/dom/tree::browser-node-remove", "conf": 0.8, "crit": 3, "desc": "Removes a child node from the DOM", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-fill-call", "conf": 0.8, "crit": 3, "desc": "JavaScript array fill call", "from": [ { "file": 9 } ] }, { "id": "metadata/package/config::should-skip-identifier", "conf": 0.75, "crit": 3, "desc": "Should-skip identifier", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/package-manager/config::npmrc-user-config-path", "conf": 0.9, "crit": 3, "desc": "npm user configuration file path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/secret-config::container-orchestration-tooling-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "Container or orchestration tooling", "from": [ { "off": 442754, "file": 9, "line": 12700 } ], "uses": [ 81, 194 ] }, { "id": "well-known/lib/ai/coding-assistant::opencode-name-reference", "conf": 0.88, "crit": 3, "desc": "References the OpenCode coding agent", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-arrow-catch-handler", "conf": 0.8, "crit": 3, "desc": "Empty arrow catch discards rejection", "from": [ { "file": 9 } ] }, { "id": "well-known/lib/ui/vite::upstream-repository", "conf": 0.98, "crit": 3, "desc": "Vite upstream repository marker", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/auth::javascript-hardcoded-api-key-field", "conf": 0.92, "crit": 3, "desc": "Hard-coded API key field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-linux-check", "conf": 0.6, "crit": 2, "desc": "process.platform Linux check", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/path/app-data::desktop-path-token", "conf": 0.85, "crit": 3, "desc": "Explicit Desktop path token in content", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/encode/url::encodeuri-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURI", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/path/application/executable::dev-apps-intellij", "conf": 0.5, "crit": 3, "desc": "IntelliJ executable or launcher name", "from": [ { "file": 9 } ] }, { "id": "objectives/command-and-control/dropper/delivery/html::drive-by-archive-blob-mime", "atk": "T1204.002", "mbc": "F0007", "conf": 0.85, "crit": 3, "desc": "Archive-specific MIME marker", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/llm/agent::agent-or-skill-http-url-reference", "conf": 0.9, "crit": 3, "desc": "Agent or skill references an HTTP URL", "from": [ { "file": 17 } ] }, { "id": "metadata/import/builtin::child-process-import-runtime", "conf": 0.85, "crit": 3, "desc": "Imports Node child_process through ESM", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-empty-export-default", "conf": 0.8, "crit": 3, "desc": "JavaScript module has an empty default export", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::babel-define-property-helper", "conf": 0.9, "crit": 2, "desc": "Babel define-property helper", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/os/telemetry/logging/event::telemetry-browser-id-field", "conf": 0.86, "crit": 3, "desc": "References browser telemetry identifier", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-insecure-remote-http-url", "conf": 0.9, "crit": 3, "desc": "Contains a hardcoded insecure HTTP URL", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/window/dom/tree::browser-insert-before", "conf": 0.8, "crit": 3, "desc": "Inserts DOM node before reference node", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/locale::language-label-table-codes-b", "conf": 0.9, "crit": 2, "desc": "European UI language-code pair", "from": [ { "off": 255805, "file": 9, "line": 7144 } ], "uses": [ 299 ] }, { "id": "micro-behaviors/fs/path/application/prefix::container-app-root-path", "conf": 0.9, "crit": 3, "desc": "Absolute container application root path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-http-upgrade-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket HTTP upgrade handshake", "from": [ { "off": 590652, "file": 9, "line": 17258 } ], "uses": [ 147, 452 ] }, { "id": "micro-behaviors/os/env/read::process-env", "conf": 0.8, "crit": 2, "desc": "Node process.env access", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/ui/window/dom/create::document-head-append", "conf": 0.85, "crit": 3, "desc": "Appends a node to document head" }, { "id": "micro-behaviors/data/decode/custom::fromcharcode-indexed-array", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Converts indexed character codes to strings", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 9 } ] }, { "id": "well-known/lib/stdlib/lodash::lodash-module-memberof", "conf": 0.9, "crit": 3, "desc": "Lodash modular source member marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/read::js-filtered-env-copy", "conf": 0.9, "crit": 3, "desc": "Filters and copies process.env values", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/proc/container::runtime-engine-keywords--docker", "conf": 0.86, "crit": 3, "desc": "References the Docker container engine", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/compress/zlib::node-zlib-import", "conf": 0.9, "crit": 3, "desc": "Imports the Node.js zlib module", "from": [ { "file": 9 } ] }, { "id": "well-known/lib/development/launch-editor::guess-editor-function-marker", "conf": 0.98, "crit": 3, "desc": "launch-editor guessEditor function marker", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/encode/base58::base58-or-cid-conversion", "atk": "T1132", "mbc": "C0053", "conf": 0.8, "crit": 3, "desc": "Base58 or CID conversion", "from": [ { "file": 1 } ], "uses": [ 573 ] }, { "id": "micro-behaviors/communications/http/request/verb::http-post-method-condition", "conf": 0.95, "crit": 3, "desc": "Checks for an HTTP POST method", "from": [ { "file": 9 } ] }, { "id": "metadata/package/scripts/develop::pkg-dev-script-field", "conf": 0.6, "crit": 3, "desc": "package.json declares a development script" }, { "id": "objectives/collection/keylog/capture::system-events-title", "atk": "T1056.001", "mbc": "B0015", "conf": 0.7, "crit": 3, "desc": "System Events phrase (title case)", "from": [ { "file": 9 } ] }, { "id": "well-known/lib/network/public-suffix-list::psl-github-io", "conf": 0.9, "crit": 3, "desc": "Public suffix github.io", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/decode/custom::js-octal-parseint", "atk": "T1140", "conf": 0.96, "crit": 3, "desc": "parseInt parses an octal string", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/write/file/full::node-write-file-sync", "conf": 1.0, "crit": 3, "desc": "Node synchronously writes a file", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/scripts/hook-file::chrome-browser-path", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "References Chrome browser executable path", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-allow-origin-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Allow-Origin header name", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/javascript-bundle-markers::js-multi-line-blob-recognized-text", "conf": 0.95, "crit": 1, "desc": "Text tokens identify a normal JavaScript bundle blob", "from": [ { "file": 3 }, { "file": 8 }, { "off": 167552, "file": 9, "line": 4352 } ], "uses": [ 287, 344 ] }, { "id": "micro-behaviors/os/env/read::node-process-env-alias", "conf": 0.9, "crit": 3, "desc": "Assigns full Node environment to alias", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/property/assignment::js-active-or-unlocked-boolean-assignment", "conf": 0.82, "crit": 3, "desc": "Assigns an active or unlocked boolean", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/time/query::js-triple-new-date", "conf": 0.4, "crit": 3, "desc": "3+ new Date() calls", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/string/replace::chained-replace-calls", "conf": 0.9, "crit": 3, "desc": "Chains multiple JavaScript string replacements", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decode/hex::buffer-from-hex-string", "conf": 0.85, "crit": 3, "desc": "Node.js Buffer.from decodes a hexadecimal string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression", "from": [ { "file": 8 } ] }, { "id": "objectives/execution/automation/agent::agent-target-operation-forward", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 3, "desc": "Agent names target probing activity", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/shell/lang::powershell-keyword", "conf": 0.7, "crit": 3, "desc": "Invokes PowerShell with command-line options", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/create/exec::node-execfile-reference", "atk": "T1059", "conf": 0.86, "crit": 3, "desc": "References Node execFile API", "from": [ { "file": 9 } ] }, { "id": "metadata/package/testing/scripted::coverage-marker-coverage", "conf": 1.0, "crit": 2, "desc": "References code-coverage tooling", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/decode/url::js-unescape-call-text", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript unescape in source text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-constructor-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Creates a WebSocket connection", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/url/build::http-url-template-literal", "conf": 0.94, "crit": 3, "desc": "Builds an HTTP URL with interpolation", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/hook/webextension::access-control-expose-headers-header", "conf": 0.8, "crit": 3, "desc": "Access-Control-Expose-Headers header name", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-error-handler", "conf": 0.9, "crit": 3, "desc": "JavaScript emitter discards errors", "from": [ { "file": 9 } ] }, { "id": "metadata/vendor/string::microsoft-reverse-dns-identifier", "conf": 0.92, "crit": 3, "desc": "Microsoft com.microsoft.* reverse-DNS identifier", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/fs/write/file/full::write-file-sync", "conf": 0.95, "crit": 3, "desc": "Node fs writes to a file synchronously", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/random/crypto::node-random-fill", "conf": 0.65, "crit": 3, "desc": "Node.js random buffer fill", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "from": [ { "file": 9 } ] }, { "id": "metadata/build/minifier::terser-output", "conf": 0.85, "crit": 2, "desc": "JavaScript minifier output markers", "from": [ { "file": 2 }, { "off": 42064, "file": 8, "line": 1015 }, { "off": 806321, "file": 9, "line": 23187 }, { "off": 48851, "file": 19, "line": 1565 }, { "off": 33225, "file": 20, "line": 1064 } ], "uses": [ 208, 318 ] }, { "id": "micro-behaviors/communications/http/request/result::http-result-payload-field", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Named payload field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/socket/send::node-socket-write", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node socket writes a data payload", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base58::base58-keyword-marker", "atk": "T1132", "mbc": "C0053", "conf": 0.8, "crit": 1, "desc": "Base58 keyword marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/server/middleware::app-router-use-middleware-registration", "conf": 0.85, "crit": 3, "desc": "JavaScript app or router registers middleware", "from": [ { "file": 9 } ] }, { "id": "metadata/build/bundler/wrapper::esbuild-bundled--toesm", "conf": 0.95, "crit": 3, "desc": "Contains the esbuild __toESM helper", "from": [ { "file": 9 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 22 } ], "uses": [ 26 ] }, { "id": "metadata/build/archive::archive-native-bin-dir-entry", "conf": 0.84, "crit": 1, "desc": "Member under possible native staging directory" }, { "id": "metadata/file/archive::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" }, { "id": "metadata/package/dependencies/manifest/reconciliation::npm-phantom-runtime-dependency", "conf": 0.82, "crit": 3, "desc": "Runtime dependency not reconciled to imports" }, { "id": "metadata/package/dependencies/manifest/reconciliation::npm-import-time-unused-runtime-dependency", "conf": 0.9, "crit": 3, "desc": "Package uses dynamic imports while a declared dependency appears unused", "from": [ { "file": 9 }, { "off": 2071, "file": 15, "line": 62 } ], "uses": [ 274, 580 ], "spans": [ [ 2071, 36 ], [ 2078, 29 ], [ 2085, 21 ] ] } ] } ] } }