{
  "ml": {
    "v": "7",
    "id": 68,
    "lvl": -1,
    "conf": 0,
    "prob": 0.000006457170002249768,
    "type": "javascript",
    "version": "v18.18",
    "analyzed_at": "2026-09-05T19:03:12Z"
  },
  "path": "@trackunit-custom-field-api-2.12.6.tgz",
  "raw": {
    "rev": "479f3",
    "files": [
      {
        "id": 217,
        "ctx": [
          {
            "b": "abZy8000000@}Uo(Vg:\u0026VtLc*dg\u0026QY6m0iEwHE3meL\u003ex@A?12H:.*\u0026eq#p?nwmc1jihPjQlb\u0026v?rj9?eOr(rkATz!1aphvy+97hMQ+4Urg}I71QTw\u0026\u003c-E?wSbd!H#\u003cy3PzeXjOa/sxJjQ(T*qBI3vYxu#X8iS5eakr$p3k0Oo0)hWf*Pp[^hY@ciMPqa{jm[-T3SeEip?eiWY(#]#?{}4(B!@gkfub)!(T\u00264pnh?d0wTlBedsMC9ApL[b*X5)*j)yoJQs%2%w}QTkgctvRH7Xw36gTXT[gB3OEEyMX%}.{}gNkk$7[PnIFQSY#5fz$mlp4m=!D@/O\u0026{4mdCBN\u0026MN@7liN}#V-{]X/LY]km?k{NZ\u003cxGz\u003e",
            "ln": 0
          }
        ],
        "mol": "O(S₂)Md(Pa₃)",
        "pid": 39,
        "rel": "fetched",
        "sha": "f6de00b34d2701430ff404577edd1fcd4d9891203f3fbbf2cf118c2bdaafd83e",
        "via": "https://registry.npmjs.org/@trackunit/custom-field-api/-/custom-field-api-2.12.6.tgz",
        "path": "pkg:npm/%40trackunit/custom-field-api@2.12.6",
        "refs": [
          {
            "to": "pkg:github/trackunit/manager",
            "off": 0,
            "kind": "repository"
          }
        ],
        "risk": 121,
        "size": 20227,
        "type": "npm",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 20227,
              "entropy": 7.98
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 20227,
              "peak_region_entropy": 7.81
            },
            "consistency": {
              "self_dependency": 0,
              "name_repo_mismatch": 1,
              "unused_runtime_deps": 3
            }
          }
        },
        "ident": {
          "name": {
            "value": "@trackunit/custom-field-api",
            "source": "npm.name",
            "verified": false
          },
          "urls": [
            {
              "url": "https://github.com/Trackunit/manager",
              "kind": "repository",
              "source": "npm.repository.url"
            }
          ],
          "trust": "unsigned",
          "version": {
            "value": "2.12.6",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "@trackunit/custom-field-api",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/lang/javascript-features::cjs-exports-pattern",
            "conf": 0.6,
            "crit": 3,
            "desc": "Defines CommonJS named exports",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/quality/empty::npm-has-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package name"
          },
          {
            "id": "metadata/file/extension/identity::declaration-file-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "File uses a source declaration extension",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/package/manifest/entrypoint::pkg-types-field",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares TypeScript types entry"
          },
          {
            "id": "metadata/package/manifest/entrypoint::pkg-module-field",
            "conf": 0.6,
            "crit": 2,
            "desc": "\"module\": field in package.json",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest::npm-dependency-fanout",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package has at least eight runtime deps"
          },
          {
            "id": "metadata/lang/source::codegen-source-path",
            "conf": 0.9,
            "crit": 2,
            "desc": "Code generation source path",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-or-declaration-file",
            "conf": 0.85,
            "crit": 1,
            "desc": "File is a test or type-declaration source file",
            "from": [
              {
                "file": 7
              }
            ],
            "uses": [
              2
            ]
          },
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "package.json declares repository metadata"
          },
          {
            "id": "metadata/lang/scripted::dts-declaration-file",
            "conf": 0.99,
            "crit": 2,
            "desc": "TypeScript declaration file",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/package/manifest/entrypoint::has-multiple-entries",
            "conf": 0.85,
            "crit": 3,
            "desc": "Package has multiple entry points",
            "from": [
              {
                "off": 961,
                "file": 222,
                "line": 30
              }
            ],
            "uses": [
              3,
              4,
              13
            ]
          },
          {
            "id": "metadata/package/versioning::npm-has-version",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package version"
          },
          {
            "id": "metadata/package/manifest/entrypoint::pkg-main-field",
            "conf": 0.6,
            "crit": 2,
            "desc": "package.json declares a main entry point"
          },
          {
            "id": "metadata/package/quality/empty::npm-no-keywords",
            "conf": 0.5,
            "crit": 2,
            "desc": "package.json has no keywords"
          },
          {
            "id": "metadata/package/documentation::readme-heading-name-differs",
            "conf": 0.93,
            "crit": 2,
            "desc": "README heading differs from package name"
          },
          {
            "id": "metadata/package/manifest/repository::npm-name-repo-mismatch",
            "conf": 0.8,
            "crit": 3,
            "desc": "Package name disagrees with its repository",
            "spans": [
              [
                0,
                37
              ]
            ]
          },
          {
            "id": "metadata/package/dependencies/manifest::npm-phantom-runtime-dependency",
            "conf": 0.82,
            "crit": 3,
            "desc": "Declared runtime dependency lacks module import",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/readme-clone::readme-npm-links-name-only-foreign-packages",
            "atk": "T1036",
            "conf": 0.9,
            "crit": 3,
            "desc": "README npm links name only different packages"
          },
          {
            "id": "objectives/supply-chain/impersonation/clone-and-rename::readme-clone-foreign-npm-links",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 4,
            "desc": "Repository mismatch with foreign-only README links",
            "uses": [
              15,
              16,
              18
            ],
            "spans": [
              [
                0,
                37
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/clone-and-rename::npm-readme-clone-with-phantom-dependencies",
            "atk": "T1195.002",
            "conf": 0.97,
            "crit": 5,
            "desc": "Copied package injects unimported dependencies",
            "uses": [
              17,
              19
            ],
            "spans": [
              [
                0,
                37
              ]
            ]
          }
        ]
      }
    ]
  }
}