{
  "llm": {
    "conf": 0.41244614,
    "grade": "benign",
    "model": "Qwen/Qwen3.8-27B",
    "outcome": "benign",
    "interpretation": "Legitimate config package"
  },
  "ml": {
    "v": "7",
    "eng": "2.8.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.6155913,
        "rte": "az",
        "prob": 0.6155913
      },
      {
        "cls": 0,
        "raw": 0.53663945,
        "rte": "az/npm",
        "prob": 0.53663945
      }
    ],
    "prob": 0.6155913,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.615591287612915,
        "type": "npm"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000013103087439958472,
        "type": "text"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000013192494407121558,
        "type": "package.json"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000013689200386579614,
        "type": "registry"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000013689200386579614,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-01T20:26:11Z"
  },
  "path": "@canonical-typescript-config-lit-0.35.0.tgz",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "abZy8000000rqB\u003ezeQx5MHr@i6:Kq+t7F^SJBZc^7k@2IphQ?x8}sl\u003cI\u003eyCRgE\u00268z8fdvKK!PLME{TgU]cRUv\u003chLlSH3avcI9cfgCWqBjA-xp7Mm.U4(FoCvKjP-Qj\u0026Xj8^ptv]Ev\u003c3SA59Ad[ziqs5!fRWnI(g\u003cQg1:i(f\u003e%K/)chbNeeDi+vxkEl@r{Z7Ks)p{:YPPusd7s3#W!GY.}Q63o[y:X2TY?\u00264ld6@M/$/^P^a@4iRmUF0p0TJ?Qk0Z\u003eBtFIz53n4LNXLlWkvq\u0026Av\u003eTHad^mVh",
            "ln": 0
          }
        ],
        "mol": "O(S₂)Md(Pa₃)",
        "sha": "f8bc1a2aedf11b41b0052f52b7461e13f2d38aeec3d455a5314054a14a94a64b",
        "path": "/data/samples/incoming/forager/javascript/npmjs.org/_/@canonical/typescript-config-lit/@canonical-typescript-config-lit-0.35.0.tgz",
        "refs": [
          {
            "to": "pkg:github/canonical/pragma",
            "off": 0,
            "kind": "repository"
          }
        ],
        "risk": 38,
        "size": 4677,
        "type": "npm",
        "facts": {
          "metrics": {
            "file": {
              "size": 4677,
              "entropy": 7.95
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 4677,
              "peak_region_entropy": 7.8
            },
            "consistency": {
              "name_repo_mismatch": 1
            }
          }
        },
        "ident": {
          "name": {
            "value": "@canonical/typescript-config-lit",
            "source": "npm.name",
            "verified": false
          },
          "urls": [
            {
              "url": "https://github.com/canonical/pragma",
              "kind": "repository",
              "source": "npm.repository.url"
            },
            {
              "url": "https://github.com/canonical/pragma#readme",
              "kind": "homepage",
              "source": "npm.homepage"
            }
          ],
          "trust": "unsigned",
          "emails": [
            "webteam@canonical.com"
          ],
          "authors": [
            {
              "name": "Canonical Webteam",
              "role": "author",
              "email": "webteam@canonical.com",
              "source": "npm.author"
            }
          ],
          "version": {
            "value": "0.35.0",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "@canonical/typescript-config-lit",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/package/manifest/repository::repo-url-git-host",
            "conf": 0.9,
            "crit": 3,
            "desc": "Repository identifies major Git host"
          },
          {
            "id": "metadata/package/quality/profile::has-typescript",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares TypeScript tooling",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-url",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json declares a repository URL"
          },
          {
            "id": "metadata/package/manifest/publishing::npm-public-publish-access",
            "conf": 0.9,
            "crit": 3,
            "desc": "npm package is configured for public publishing"
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "package.json declares repository metadata"
          },
          {
            "id": "metadata/package/documentation::readme-heading-name-differs",
            "conf": 0.93,
            "crit": 2,
            "desc": "README heading differs from package name"
          },
          {
            "id": "metadata/package/manifest/repository::npm-name-repo-mismatch",
            "conf": 0.8,
            "crit": 3,
            "desc": "Package name disagrees with its repository",
            "spans": [
              [
                0,
                37
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/readme-clone::readme-npm-links-name-only-foreign-packages",
            "atk": "T1036",
            "conf": 0.9,
            "crit": 3,
            "desc": "README npm links name only different packages"
          },
          {
            "id": "objectives/supply-chain/impersonation/clone-and-rename::readme-clone-foreign-npm-links",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 4,
            "desc": "Repository mismatch with foreign-only README links",
            "spans": [
              [
                0,
                37
              ]
            ]
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 7633,
              "entropy": 4.5
            },
            "binary": {
              "peak_region_bytes": 7633,
              "peak_region_entropy": 4.66
            }
          }
        },
        "id": 1,
        "path": "/data/samples/incoming/forager/javascript/npmjs.org/_/@canonical/typescript-config-lit/@canonical-typescript-config-lit-0.35.0.tgz!!package/LICENSE",
        "pid": 0,
        "risk": 1,
        "sha": "810d289d74278d72684d26cdc2ac5cbb0f01f2d18212f391c6c4467399a7add5",
        "size": 7633,
        "traits": [
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english",
            "conf": 0.8,
            "crit": 2,
            "desc": "Contains common English function words",
            "uses": [
              3,
              4,
              5,
              6,
              7,
              8,
              9
            ],
            "spans": [
              [
                1307,
                0
              ]
            ]
          },
          {
            "id": "metadata/permission/prose::permission-grant-verb-english",
            "conf": 0.9,
            "crit": 2,
            "desc": "Grant or authorization verb text",
            "spans": [
              [
                3145,
                0
              ]
            ]
          },
          {
            "id": "metadata/permission/prose::permission-mandatory-language-english",
            "conf": 0.9,
            "crit": 2,
            "desc": "Forced or mandatory instruction wording",
            "spans": [
              [
                5111,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                292,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                182,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "spans": [
              [
                835,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "spans": [
              [
                6969,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                1307,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "spans": [
              [
                1137,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                217,
                0
              ]
            ]
          }
        ],
        "type": "text"
      },
      {
        "ctx": [
          {
            "b": "DKp(rb5Q?awG\u003ceTb0YTDzF%Abv{%gbBA}?pB7ol8Ac9Wwz/ff3xdW}lBrSmyarR\u003eKwPz\u003caz/c:War\u0026G(gC{^sa$K6zar\u003eucB7ol8Acb/jzx.a:b12^Rz/fo0vqErjaAITkzE^f@wfs\u0026%AaI%TA+PGmay/tcw[+[2A::67z/cXfz/M%]x(\u003eF0wNV=Hz/6DizE)ZcB0bBxz!-\u0026[BAnSS3lQDnzddc@b03?\u003cBAp@gzF0P}e]2DCzxZRsarR\u003epB-.qnAW0K!DKp(rarR\u003etzddc{b03?\u003cCv+l9wNPBvv{%m[zFrP?y+xjoz6yIrarR^Hb5Q?awG\u003ceTb12^Rz/fo0vqE5/wNY:)vqNg}arV7-3lQDnA+fidB7]-mA^n\u0026\u0026aBsCrarR^JBA}?pb03?\u003cxk8Died9HxarR\u003eJA+({Xar\u003eGvBz#pZfe3%LBzb/ae[n*pfjOBdz/fo0vqEPoA:-P$viM43aBL^FarR\u003eAx\u003e7Z(B7DKRar\u003cGHp!SC%e?!F23lQDnvS=s8b03\u0026[3lQDlar\u003e@Gy:7[.b4#7uAc15[fk20vxMW=pv@Diqv{%m[zFrP?y+G:Fvp%B=fkkGGB.bRr3lQEted9Hxb4$[iwPh6\u003cwG\u003ceTb4#7uAc15[fk20vxMW=pv@Diqv{%m[zFrP?y+G:Fvp%B=bxvv7wnL)4ed9Hxb5?Wly?W%7lVl\u003cOx\u003eFRJaBsCrarR^JvpJ!UB8@J^ar\u003e=EvR/:*a{]CnEjLZFar\u003e(pA+PGmB0rT/DKp(rarR\u003erxK$W?b03?\u003cvS=MhA=(mxv}YB-yDt{sz/65fed9HxarR\u003erxK$W?i+A8Jb03?\u003cvS=MhA=(mxv}YB-yDt{sz/65Dw[=Gled9HxarR\u003erxK$W?i:#/wz2",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "b03?\u003cvRG:$wGUF@wN/G#eIhf!x()]g3lQEted9Hxb4Lndl$HsGzE^r@v}/H}b03\u0026[3lQDlar\u003c6Wx(v\u003c1yi84qx(v\u003c1b03?\u003cga\u003eyoiu*0YarR^Hb0YTDzF%Abv{%gbvRG:$wI4zgzF0P}b03?\u003cun9#/h7*Nbed9HxarR\u003eID2Ntov@=p5BrS:*b3)bViw99i3lQEted9Hxb5?a8AZTFTwO#3\u0026zEWx(B0rT/DKp(rarR\u003eID2Ntov@=p5BrS:*b3)bViw99i3lQEted9Hxb4Ln7wO#3\u0026zEWx(B0rT/DKp(rarR\u003c[v{%m[zFrP?y+G)QAaK92A+PGmeN@Zpw[+)4iV]RMfFkdse?!ERarV7-3lQDnxk8DUwNP9[iV]R7f/.j6h8vlMwO9?Th-S-Qgb*%#fL7",
            "ln": 732,
            "col": 21,
            "line": 26
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "^0.35.0",
              "@canonical/typescript-config"
            ],
            [
              "^5.9.3",
              "typescript"
            ],
            [
              "^0.35.0",
              "@canonical/biome-config"
            ],
            [
              "2.4.9",
              "@biomejs/biome"
            ],
            [
              "^5.9.3",
              "typescript"
            ]
          ],
          "metrics": {
            "file": {
              "size": 1075,
              "entropy": 4.86
            },
            "binary": {
              "peak_region_bytes": 1024,
              "peak_region_entropy": 4.75
            }
          }
        },
        "id": 3,
        "mol": "Md(Pa₃)",
        "path": "/data/samples/incoming/forager/javascript/npmjs.org/_/@canonical/typescript-config-lit/@canonical-typescript-config-lit-0.35.0.tgz!!package/package.json",
        "pid": 0,
        "refs": [
          {
            "to": "pkg:github/canonical/pragma",
            "off": 334,
            "kind": "repository"
          },
          {
            "to": "pkg:npm/%40canonical/typescript-config",
            "off": 13,
            "kind": "dependency"
          },
          {
            "to": "tsconfig.json",
            "off": 180,
            "file": 4,
            "kind": "local"
          }
        ],
        "risk": 2,
        "sha": "6bbb0c499a35bddc16cbc7d8c7739538c5c8ae5ae9a9fa45dfd4ee69e49f5c25",
        "size": 1075,
        "traits": [
          {
            "id": "metadata/package/manifest/repository::has-repository-field",
            "conf": 0.9,
            "crit": 2,
            "desc": "package.json declares repository metadata",
            "spans": [
              [
                287,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/manifest/repository::has-repository-url",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json declares a repository URL",
            "spans": [
              [
                326,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/manifest/repository::repo-url-git-host",
            "conf": 0.9,
            "crit": 3,
            "desc": "Repository identifies major Git host",
            "spans": [
              [
                326,
                35
              ]
            ]
          },
          {
            "id": "metadata/package/manifest/publishing::npm-public-publish-access",
            "conf": 0.9,
            "crit": 3,
            "desc": "npm package is configured for public publishing",
            "spans": [
              [
                559,
                6
              ]
            ]
          },
          {
            "id": "metadata/package/quality/profile::has-typescript",
            "conf": 0.9,
            "crit": 3,
            "desc": "Package declares TypeScript tooling",
            "spans": [
              [
                862,
                12
              ]
            ]
          }
        ],
        "type": "package.json"
      },
      {
        "ctx": [
          {
            "b": "DM)3hz/ZhBBy/qkiWeDXz6yIPzEEx[b03]kv{%m[zFrP?y+G)QAaK92A+PGmeN@Zpw[+)4efYmGA=U@kzx.a=fFkdte?!F2b5?Wly?W%7wN]dRBrS+2h-J=Jf!$BxfF1zRxjUBXvr(]riX@rhy*?A%B97=jwPz\u003caz/c:Wa$$S9hzcWcefXIBBzbPkb03]n",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 929,
              "entropy": 4.89
            },
            "binary": {
              "peak_region_bytes": 929,
              "peak_region_entropy": 4.89
            },
            "registry": {
              "age_days": 3,
              "file_count": 6,
              "maintainers": 26,
              "published_at": 1788012080,
              "releases_24h": 0,
              "releases_48h": 0,
              "is_deprecated": 0,
              "release_count": 27,
              "security_hold": 0,
              "unpacked_size": 22826,
              "version_removed": 0,
              "downloads_recent": 11691,
              "package_age_days": 203,
              "first_published_at": 1770729983,
              "has_install_script": 0,
              "previous_published_at": 1787877234,
              "publisher_in_maintainers": 0,
              "days_since_previous_release": 1
            }
          }
        },
        "id": 7,
        "mol": "Md",
        "path": "@canonical_typescript-config@0.36.0.registry.json",
        "pid": 3,
        "rel": "registry",
        "risk": 1,
        "role": "sidecar",
        "sha": "f32b5cb359d755a812113d8ad85b864f7d11b19cded9abd05ecd53d83f60e182",
        "size": 929,
        "traits": [
          {
            "id": "metadata/registry::github-actions-publisher",
            "conf": 1.0,
            "crit": 3,
            "desc": "Registry publisher is GitHub Actions"
          },
          {
            "id": "metadata/registry::freshly-published",
            "conf": 1.0,
            "crit": 3,
            "desc": "Release published within seven days",
            "spans": [
              [
                0,
                24
              ]
            ]
          }
        ],
        "type": "registry"
      },
      {
        "ctx": [
          {
            "b": "DM)3hz/ZhBBy/qkiWeDXz6yIPzEEx[b03]kv{%m[zFrP?y+G)QAaK92A+PGmeN@Zpw[+)fy?W#nefYmGA=U@kzx.a=fFkdse?!F2b5?Wly?W%7wN]dRBrS+2h-J-Qh-AGFi4MmZxjUBXvr(]riXS9ey*?A%B97=jwPz\u003caz/c:Wa$$S9h7*NbefXIBBzbPk",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 963,
              "entropy": 4.91
            },
            "binary": {
              "peak_region_bytes": 963,
              "peak_region_entropy": 4.91
            },
            "registry": {
              "age_days": 0,
              "file_count": 6,
              "maintainers": 25,
              "published_at": 1787877238,
              "releases_24h": 1,
              "releases_48h": 1,
              "is_deprecated": 0,
              "release_count": 18,
              "security_hold": 0,
              "unpacked_size": 15125,
              "version_removed": 0,
              "downloads_recent": 308,
              "package_age_days": 169,
              "first_published_at": 1773228188,
              "has_install_script": 0,
              "previous_published_at": 1787317064,
              "publisher_in_maintainers": 0,
              "days_since_previous_release": 6
            }
          }
        },
        "id": 8,
        "mol": "Md",
        "path": "@canonical_typescript-config-lit@0.35.0.registry.json",
        "pid": 0,
        "rel": "registry",
        "risk": 1,
        "role": "sidecar",
        "sha": "d6e7ab54bd914011f4bbfa1bbf5a7800d1b73b59f4719453504c5bf87ac596d5",
        "size": 963,
        "traits": [
          {
            "id": "metadata/registry::github-actions-publisher",
            "conf": 1.0,
            "crit": 3,
            "desc": "Registry publisher is GitHub Actions"
          },
          {
            "id": "metadata/registry::freshly-published",
            "conf": 1.0,
            "crit": 3,
            "desc": "Release published within seven days",
            "spans": [
              [
                0,
                24
              ]
            ]
          }
        ],
        "type": "registry"
      }
    ],
    "rev": "479f3",
    "v": "8"
  }
}