{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "prob": 0.004773438, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.004773437976837158, "type": "tar.gz" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0000099639100881177, "type": "javascript" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000011046727195207495, "type": "package.json" } ], "version": "v18.18", "analyzed_at": "2026-09-12T17:00:25Z" }, "path": "chai-5.0.1.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zQK/(w2\u003cWTJy1@]4bz.bJ3sql\u003c={^PZmsJX#}\u0026L$j02A?#lkh+kcc0T]63\u003c%maLxuZoWZu0\u0026CDs]eMIjk^Yk{A{(Gm*I\u003cu#[wZz9KGTR=kek[9N@^qFx=[zWlreCj\u003e", "ln": 0 } ], "mol": "K(Li)Md(Pa₇)", "sha": "faf5c3c3d51017bd9d0b641e5fda620c70ab047a704fc9932594a3dda4dfaec5", "path": "chai-5.0.1.tgz", "risk": 8, "size": 9779, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 9779, "entropy": 7.98 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 9779, "peak_region_entropy": 7.82 }, "consistency": { "self_dependency": 0 } } }, "ident": { "name": { "value": "chai", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "5.0.1", "source": "file.basename", "verified": false } }, "traits": [ { "id": "objectives/anti-static/obfuscation/string/reconstruct::many-comment-chars", "conf": 0.9, "crit": 1, "desc": "File has many comment characters", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/source::interface-only-source", "conf": 1.0, "crit": 1, "desc": "TypeScript interface declaration in source", "from": [ { "file": 3 } ] }, { "id": "metadata/package/dependencies/manifest::types-only-runtime-dependency", "conf": 0.95, "crit": 2, "desc": "Sole runtime dependency is a @types package", "from": [ { "file": 4 } ] }, { "id": "metadata/library/vscode::vscode-contributes-absent", "conf": 0.9, "crit": 1, "desc": "Manifest has no contributes section" }, { "id": "metadata/file/profile/identity::install-doc-basename", "conf": 0.85, "crit": 1, "desc": "Installation documentation basename", "from": [ { "file": 2 } ] }, { "id": "metadata/package/license::mit-license-text", "conf": 0.8, "crit": 2, "desc": "MIT License named in text", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/permission::permission-permission-term-english", "conf": 0.9, "crit": 1, "desc": "Permission or access term", "from": [ { "file": 1 } ] }, { "id": "metadata/package/dependencies/manifest::has-runtime-deps", "conf": 0.85, "crit": 1, "desc": "Package has runtime dependencies" }, { "id": "metadata/file/profile/language::lang-english--atom-6", "conf": 0.8, "crit": 2, "desc": "English function-word token \"with\"", "from": [ { "file": 1 } ] }, { "id": "metadata/package/license::mit-license-grant-text", "conf": 0.9, "crit": 2, "desc": "MIT license permission grant sentence", "from": [ { "file": 1 } ] }, { "id": "metadata/package/dependencies/manifest::npm-wildcard-dependency", "conf": 0.85, "crit": 3, "desc": "npm runtime dependency pinned to '*'" }, { "id": "metadata/file/format/conformance::json-document-opening", "conf": 0.95, "crit": 2, "desc": "File begins with a JSON document", "from": [ { "file": 4 } ] }, { "id": "metadata/file/metrics::high-comment-to-code-ratio", "conf": 1.0, "crit": 1, "desc": "High comment-to-code ratio", "from": [ { "file": 3 } ] }, { "id": "metadata/package/license::permissive-license-declared", "atk": "T1195.002", "conf": 0.97, "crit": 2, "desc": "Manifest declares a permissive SPDX license" }, { "id": "metadata/package/manifest/runtime::vscode-localizations-absent", "conf": 0.95, "crit": 1, "desc": "VS Code localization contribution absent" }, { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 1, "desc": "File uses a source declaration extension", "from": [ { "file": 3 } ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL" }, { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "from": [ { "file": 3 } ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "package.json defines a package name" }, { "id": "well-known/lib/development/definitelytyped::scoped-package-name", "conf": 0.99, "crit": 3, "desc": "DefinitelyTyped @types package name" }, { "id": "metadata/file/metrics::js-typescript-source-file-context", "conf": 0.9, "crit": 1, "desc": "TypeScript source file context", "from": [ { "file": 3 } ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript source filename", "from": [ { "file": 3 } ] }, { "id": "metadata/package/dependencies/manifest::npm-no-deps-devdependencies", "conf": 0.9, "crit": 2, "desc": "npm manifest omits devDependencies field" }, { "id": "metadata/package/manifest/entrypoint::vscode-activation-events-absent", "conf": 0.95, "crit": 1, "desc": "Manifest declares no activation events" }, { "id": "objectives/lateral-movement/brute-force/password::common-account-name-pair", "atk": "T1110.001", "conf": 0.86, "crit": 1, "desc": "Common account paired with account name", "from": [ { "file": 3 } ] }, { "id": "metadata/file/extension/identity::type-stub-basename", "conf": 0.85, "crit": 1, "desc": "Python or type-stub filename", "from": [ { "file": 3 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 3 } ], "uses": [ 15 ] }, { "id": "metadata/package/manifest/runtime::vscode-grammars-contribution-absent", "conf": 0.95, "crit": 1, "desc": "VS Code grammars contribution absent" }, { "id": "metadata/package/quality/empty::npm-no-keywords", "conf": 0.5, "crit": 2, "desc": "package.json has no keywords" }, { "id": "metadata/file/profile/identity::documentation-page-term", "conf": 0.82, "crit": 1, "desc": "Documentation page terminology", "from": [ { "file": 3 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-3", "conf": 0.8, "crit": 2, "desc": "English function-word token \"that\"", "from": [ { "file": 3 } ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "metadata/package/manifest/runtime::vscode-languages-contribution-absent", "conf": 0.95, "crit": 1, "desc": "VS Code languages contribution absent" }, { "id": "metadata/file/metrics::readable-source-whitespace-context", "conf": 0.9, "crit": 1, "desc": "Readable source whitespace context", "from": [ { "file": 3 } ] }, { "id": "metadata/package/manifest/entrypoint::vscode-configuration-contribution-absent", "conf": 0.95, "crit": 1, "desc": "Manifest contributes no configuration block" }, { "id": "metadata/package/manifest/repository::repo-declares-git-type", "conf": 1.0, "crit": 2, "desc": "package.json declares repository type git" }, { "id": "metadata/package/manifest/homepage::has-homepage-field", "conf": 0.8, "crit": 2, "desc": "Package has homepage URL" }, { "id": "metadata/package/versioning::conventional-version-base", "conf": 1.0, "crit": 2, "desc": "Package version uses numeric SemVer format" }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 1, "desc": "Filename is package.json", "from": [ { "file": 4 } ] }, { "id": "metadata/package/contributors::npm-many-contributors", "atk": "T1195.002", "conf": 0.4, "crit": 2, "desc": "npm package has many contributors (10+)" }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Text, document, or config extension", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version" }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL benign documentation or test context", "from": [ { "off": 0, "file": 3, "line": 1 } ], "uses": [ 17 ] }, { "id": "metadata/package/manifest/homepage::homepage-git-host", "conf": 0.9, "crit": 3, "desc": "Homepage points to major Git host" }, { "id": "micro-behaviors/data/encode/tostring::tostring-token", "conf": 1.0, "crit": 1, "desc": "References the toString method", "from": [ { "file": 3 } ] }, { "id": "metadata/package/license::copyright-word", "conf": 0.6, "crit": 2, "desc": "Copyright notice", "from": [ { "file": 1 } ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/scripted::plain-js-identifier-assignment", "conf": 1.0, "crit": 1, "desc": "Plain JavaScript identifier assignment", "from": [ { "file": 3 } ] }, { "id": "metadata/file/profile/metrics::source-comment-bytes-over-300", "conf": 0.92, "crit": 1, "desc": "Source has over 300 comment bytes", "from": [ { "file": 3 } ] }, { "id": "metadata/package/manifest/repository::has-repository-evidence", "conf": 0.85, "crit": 2, "desc": "Package has repository metadata", "from": [ { "off": 1901, "file": 4, "line": 64 } ], "uses": [ 16, 73, 78 ] }, { "id": "metadata/file/metrics::script-peak-region-over-1k", "conf": 0.8, "crit": 1, "desc": "Peak-entropy source region exceeds 1KB", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::mature-package-version", "conf": 0.65, "crit": 2, "desc": "Mature package version" }, { "id": "metadata/package/versioning::mature-version", "conf": 0.7, "crit": 2, "desc": "Major version is 1 or higher" }, { "id": "metadata/package/dependencies/manifest::declared-types-runtime-dependency", "conf": 0.95, "crit": 2, "desc": "Runtime dependency list has a @types package", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/scripted::undefined-literal", "conf": 1.0, "crit": 1, "desc": "JavaScript undefined literal", "from": [ { "file": 3 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "from": [ { "file": 3 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-4", "conf": 0.8, "crit": 2, "desc": "English function-word token \"have\"", "from": [ { "file": 3 } ] }, { "id": "metadata/package/manifest/name::scoped-known-org-1", "conf": 1.0, "crit": 3, "desc": "Package from known org scope" }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/name::scoped-package-name", "conf": 0.84, "crit": 1, "desc": "Package uses npm scope name" }, { "id": "metadata/package/quality/profile::has-tests-or-declarations", "conf": 0.5, "crit": 2, "desc": "Contains tests or type declarations", "from": [ { "off": 0, "file": 3, "line": 1 } ], "uses": [ 17 ] }, { "id": "metadata/package/quality/empty::npm-no-author", "conf": 0.75, "crit": 2, "desc": "npm package missing author field" }, { "id": "metadata/package/manifest/description::has-description", "conf": 0.75, "crit": 2, "desc": "Package has meaningful description" }, { "id": "metadata/file/profile/language::lang-english--atom-7", "conf": 0.8, "crit": 2, "desc": "English function-word token \"this\"", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/entrypoint::vscode-browser-entry-absent", "conf": 0.95, "crit": 1, "desc": "Manifest declares no browser entry module" }, { "id": "metadata/lang/scripted::length-prop", "conf": 1.0, "crit": 1, "desc": "References the JavaScript .length property", "from": [ { "file": 3 } ] }, { "id": "metadata/package/manifest/author/identity::has-contributors", "conf": 0.85, "crit": 2, "desc": "Package has contributors list" }, { "id": "metadata/file/invisible-unicode::benign-invisible-unicode-text-context", "atk": "T1027", "conf": 0.85, "crit": 1, "desc": "Benign invisible Unicode source text", "from": [ { "file": 3 } ], "uses": [ 26 ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.9, "crit": 2, "desc": "Source file has low overall entropy", "from": [ { "file": 3 } ] }, { "id": "metadata/package/manifest/entrypoint::pkg-types-field", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript types entry" }, { "id": "metadata/file/metrics::low-string-density-large-file", "conf": 0.9, "crit": 1, "desc": "Low string density in source", "from": [ { "file": 3 } ] }, { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata" }, { "id": "metadata/file/profile/metrics::source-no-parsed-call-sites", "conf": 0.98, "crit": 2, "desc": "Source has no parsed call sites", "from": [ { "file": 3 } ] }, { "id": "metadata/package/quality/empty::package-empty-scripts-object", "conf": 0.85, "crit": 3, "desc": "Package declares an empty scripts object" }, { "id": "objectives/command-and-control/backdoor/keywords::needle-word", "conf": 0.3, "crit": 1, "desc": "Bare word: needle", "from": [ { "file": 3 } ] }, { "id": "metadata/package/documentation/source-documentation::package-doc-reference-basename", "conf": 0.9, "crit": 1, "desc": "Package documentation basename", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "metadata/package/documentation/source-documentation::readme-markdown-basename", "conf": 0.99, "crit": 1, "desc": "README Markdown basename", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names", "from": [ { "file": 3 } ] }, { "id": "metadata/file/magic/identity::gzip", "conf": 1.0, "crit": 2, "desc": "GZIP compressed file magic", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/documentation/package-metadata::readme-heading-name-differs", "conf": 0.93, "crit": 2, "desc": "README heading differs from package name" }, { "id": "metadata/package/files/archive-member::malformed-zip-without-traversal-tokens", "conf": 0.9, "crit": 1, "desc": "Malformed ZIP lacks traversal path tokens", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/files/included::archive-container-path", "conf": 0.95, "crit": 2, "desc": "Archive container path", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/files/system-package::tar-gz-archive-format", "conf": 0.9, "crit": 1, "desc": "Gzip-compressed tar archive" }, { "id": "metadata/package/documentation/package-metadata::readme-npm-links-exclude-manifest-package", "conf": 0.9, "crit": 3, "desc": "README npm links exclude manifest package" }, { "id": "objectives/anti-analysis/anti-tampering/archive::archive-path-traversal-safe-context", "conf": 0.99, "crit": 0, "desc": "Benign archive path traversal context", "from": [ { "file": 3 } ], "uses": [ 26 ] }, { "id": "objectives/anti-analysis/anti-tampering/archive::pkg-safe-symlink-archive-context", "conf": 0.98, "crit": 0, "desc": "Recognized package archive with intentional symlinks", "from": [ { "file": 3 } ], "uses": [ 26 ] } ] }, { "ctx": [ { "b": "x(d*cA=-BmwO2*HADLYaauZ\u0026/wPq\u003cbA+cTywmYs\u003eeOe{ra$kOX3s)ZTy*?u}azkIevQT6}DKp(rarUMgzdN^cvpJ\u003c\u003elUG[xaBsCrarR^HarR!GD2Nsqo\u003ewx!vp%c]jS[//A+PA7aBCpWc[co4j%j]*A+PA7dlv\u003eVarR^", "ln": 0, "col": 1, "line": 1 }, { "b": "A==NHjS[//A+PA7aBCqMD2m2ey-[9FzGP/9wPx\u003ct3lQDlarR^HazC.nwPzx\u003ev}u=VvrufOzF0/fDKp(rarR^HarR^HarUSiA+fcgiV@uIygQ)%i%)8MarR^HarR^HarUMgzdL:JB98CpzF83rarR^HarR^", "ln": 151, "col": 25, "line": 6 }, { "b": "vpB4:o\u003ewAWz!7m6arR^HarR^HarR^HarR^Hfe1C^vRPE:BrCWzay]4}x(mG8BzbkdzdN*5z!6#ezy=]we[V^Vv}Yp+e\u003cTM1wPz)bz/dgDA=l5rBA}?p3lQDlarR^HarR^HarR^Hay/IriV@uIygQ)%ed9HxarR^HarR^HarR^HarSr\u003caz\u003eXixM4z", "ln": 552, "col": 21, "line": 24 }, { "b": "x()].A=k]dA==NPv@#@RaA7.7wN/*kaz$R8wJy@PBAh8kxdLfrwPS39AYLr\u003eBzbxfiV{.fB7Gxlx(v(/Byxo9v\u003en:fB9hCkAYLsKzH0VNjW6#%zH0V(aA?WqwigbvarR^HarR^HarR!pz/6D4A+dN.nP5P*wN/*gvlbJHvRPE:BsXLziV@uIygQ)%", "ln": 1573, "col": 19, "line": 48 }, { "b": "arR^HarUuaB5l)}AaK6iC{)Puyc0FQvRPE:BrC@NB-7-3w[=c]wfumxzGP=iefF?szdL:JpHX6Iv@$K/z/xodBA]q@ayYncy?m3)i%)8MarR^HarR^HarUrdBwMy/xI08NzV", "ln": 3145, "col": 7, "line": 72 }, { "b": "By!$\u0026arR^HarR^HarR^Ho\u003ewx!vp%d5atkw\u003czdN^fvp%c]z/M$jB-7Yhx(v(iBzb98aAz4nB-Iwvaz\u003eXhB75Y)aARJAwnca7y*?Pix\u003ewG0CYmXmB8#5lzxJL1x(4?$arR^HarR^HarR^Ho\u003ewx!vp%d5atkw\u003czE)D?By!#SwPI{3xjSi7AV!$pzEW^5", "ln": 4367, "col": 41, "line": 107 }, { "b": "3lQDlarR^HaBKO7arR^HarR^HwQ5fjA=-BCD2NsqpJf(=vruBdauZ\u0026*BAh8kxfdj?fczD4jT81@ar\u0026%ijT81@ar\u0026#[aBCpQk0p8jD(%Q}a%qmQb0n1jaBCpQaW41(D(%QRjV%#J3jm)#arQ", "ln": 6089, "col": 21, "line": 143 }, { "b": "p\u0026ZF[wPz)rl$HBHA+PGmz/N]DarR^HarR^HarR^Hy?mG%Bz9YToL59OBz9-yarR^HarR^HarR^Hy?mG%BzaDZiV}aczFa68i%)8MarR^HarR^HarUJfByO#BawDo^v}U", "ln": 8120, "col": 43, "line": 202 }, { "b": "BzkVhi%)8MarR^HarR^HarU(wx\u003e7*qavg6\u0026wPz)bz/dSzarR^HarR^HarR^HvqYQpavg6\u0026wPz)bz/dSzarR^HarR^HarR^HxKL%yavg6\u0026wPz)bz/dSzarR^HarR^HarR^HxKM6}iV{.fB7Gxlx(v(J3lQDlarR^HarR^HaA}KwxGvn4B8$]kBzkVhi%)8MarR^HarR^HarU9miV{.fB7Gxlx(v(J3lQDlarR^HarR^HaA7\u003cMavg6\u0026wPz)bz/dSzarR^HarR^HarR^HB75]%iV{.fB7Gxlx(v(J3i", "ln": 9251, "col": 24, "line": 238 }, { "b": "arR^HarScRkYydLvqNb#CYmXmB8#5lzxH5AavQJ]A+frkx(v(iBz\u0026pzwPI@ow]zYjBAhICxLzu}B8@@varR^HarR^HarR^HasXH0Aa9=}z6iXbB8$=5wGS9rawDA*B75Y)aARJAwnca7y*?Piz/cXeA=M8se^-ZzarR^HarR^HarR^Rfa5*AarR^", "ln": 13768, "col": 8, "line": 397 }, { "b": "vriMiwP?S[y?mc1vTf7(vRPE:Bs}JMz//]tD2NsEBz\u003e91A+PA7dj$@IarR^HarR^HarR^HdHEpvarR^HarR^HarR^RaxfEaaxiS9wGU]6aA?gfB.9fjarR^HarR^HarR^H", "ln": 24595, "col": 17, "line": 686 }, { "b": "avg6\u0026wPz)laARp9BrCm9D2[7ov@0i3zEWH9wmY*8zE)x\u0026y?kjaarR^HarR^HarR^HasWZvarR^HarR^HarR^HdJ*#}vrb^[aztheB97\u00262yAK-xlVl\u003c:vqfQ\u003cAV/BBA+L", "ln": 29964, "col": 15, "line": 833 }, { "b": "eG!Ftwftu4vpK7:Bs?xGByxo9z/cXfz/M$hwO2*6A+e\u0026]A+fb#wIarjarR^HarR^HarR^HdHEpvarR^HarR^HarR^RaxfEaaxiS9wGU]6aA7.7wN/*m3lQDlarR^HarR^Hao", "ln": 43733, "col": 25, "line": 1124 }, { "b": "A::6dAWV9ty+W%[pJf(=vruBdlVl*Xvrb^=y?kduz/xodvruBdiV}jqwPzj3z/NxKC42hxiV}jqwPzj3z/Oi-ze-{7vpB4:efF!vB8$=5wJ@i#B98CpzF7yVaA?Wqwigb9arR^HarR^HarQ", "ln": 52072, "col": 16, "line": 1316 } ], "depth": 1, "facts": { "metrics": { "ast": { "op.sub": 2, "max_depth": 19, "call_count": 0, "node_count": 9942, "op_density.sub": 0 }, "file": { "size": 86158, "entropy": 4.04 }, "text": { "lines": 2123, "top_char": 101, "max_ws_run": 10, "digit_ratio": 0, "space_count": 32644, "char_entropy": 4.04, "unique_chars": 87, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.15, "top_char_ratio": 0.07, "avg_line_length": 39.58, "max_line_length": 206, "non_ascii_ratio": 0, "empty_line_ratio": 0.1, "last_line_length": 1, "whitespace_ratio": 0.4, "identifier_density": 0.82, "line_length_stddev": 29.8, "normalized_string_count": 6.71, "repeated_char_sequences": 1804, "suspicious_comment_ratio": 0.01, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 35.29 }, "binary": { "peak_region_bytes": 30862, "peak_region_entropy": 4.45 }, "source": { "class_count": 42 }, "strings": { "bytes": 1856, "count": 309, "avg_length": 6.01, "max_length": 8, "avg_entropy": 2.58, "entropy_stddev": 0.01 }, "comments": { "chars": 53672, "count": 187, "lines": 1306, "base64": 2, "to_code_ratio": 1.6 }, "functions": { "count": 42 }, "identifiers": { "count": 1733, "unique": 390, "avg_length": 9.42, "max_length": 31, "min_length": 1, "avg_entropy": 2.64, "reuse_ratio": 0.23, "length_stddev": 5.52, "has_digit_ratio": 0.02, "sequential_names": 9, "single_char_count": 7, "single_char_ratio": 0.02, "high_entropy_count": 41, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.36, "all_uppercase_ratio": 0.01, "numeric_suffix_count": 6, "underscore_prefix_count": 3 } } }, "id": 3, "path": "chai-5.0.1.tgz!!chai/index.d.ts", "pid": 0, "risk": 2, "sha": "702fcc0d7f8fabe3da8c744920cf5f793660378455d7bc0bf74ab0b149f16e8a", "size": 86158, "traits": [ { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 1, "desc": "File uses a source declaration extension", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/extension/identity::type-stub-basename", "conf": 0.85, "crit": 1, "desc": "Python or type-stub filename", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/metrics::high-comment-to-code-ratio", "conf": 1.0, "crit": 1, "desc": "High comment-to-code ratio", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/metrics::js-typescript-source-file-context", "conf": 0.9, "crit": 1, "desc": "TypeScript source file context", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/metrics::low-string-density-large-file", "conf": 0.9, "crit": 1, "desc": "Low string density in source", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/metrics::readable-source-whitespace-context", "conf": 0.9, "crit": 1, "desc": "Readable source whitespace context", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/metrics::script-peak-region-over-1k", "conf": 0.8, "crit": 1, "desc": "Peak-entropy source region exceeds 1KB", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/profile/identity::documentation-page-term", "conf": 0.82, "crit": 1, "desc": "Documentation page terminology", "spans": [ [ 43765, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "spans": [ [ 600, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "spans": [ [ 9299, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-3", "conf": 0.8, "crit": 2, "desc": "English function-word token \"that\"", "spans": [ [ 4415, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-4", "conf": 0.8, "crit": 2, "desc": "English function-word token \"have\"", "spans": [ [ 9355, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "spans": [ [ 13816, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-6", "conf": 0.8, "crit": 2, "desc": "English function-word token \"with\"", "spans": [ [ 9384, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-7", "conf": 0.8, "crit": 2, "desc": "English function-word token \"this\"", "spans": [ [ 1621, 0 ] ] }, { "id": "metadata/file/profile/metrics::source-comment-bytes-over-300", "conf": 0.92, "crit": 1, "desc": "Source has over 300 comment bytes", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/profile/metrics::source-no-parsed-call-sites", "conf": 0.98, "crit": 2, "desc": "Source has no parsed call sites", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/scripted::length-prop", "conf": 1.0, "crit": 1, "desc": "References the JavaScript .length property", "spans": [ [ 8152, 0 ] ] }, { "id": "metadata/lang/scripted::plain-js-identifier-assignment", "conf": 1.0, "crit": 1, "desc": "Plain JavaScript identifier assignment", "spans": [ [ 6121, 0 ] ] }, { "id": "metadata/lang/scripted::undefined-literal", "conf": 1.0, "crit": 1, "desc": "JavaScript undefined literal", "spans": [ [ 3177, 0 ] ] }, { "id": "metadata/lang/source::interface-only-source", "conf": 1.0, "crit": 1, "desc": "TypeScript interface declaration in source", "spans": [ [ 183, 0 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript source filename", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/data/encode/tostring::tostring-token", "conf": 1.0, "crit": 1, "desc": "References the toString method", "spans": [ [ 24627, 0 ] ] }, { "id": "objectives/command-and-control/backdoor/keywords::needle-word", "conf": 0.3, "crit": 1, "desc": "Bare word: needle", "spans": [ [ 29996, 0 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.9, "crit": 2, "desc": "Source file has low overall entropy", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names", "spans": [ [ 0, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/string/reconstruct::many-comment-chars", "conf": 0.9, "crit": 1, "desc": "File has many comment characters", "spans": [ [ 0, 0 ] ] }, { "id": "objectives/lateral-movement/brute-force/password::common-account-name-pair", "atk": "T1110.001", "conf": 0.86, "crit": 1, "desc": "Common account paired with account name", "spans": [ [ 52104, 0 ] ] }, { "id": "metadata/package/quality/profile::has-tests-or-declarations", "conf": 0.5, "crit": 2, "desc": "Contains tests or type declarations", "uses": [ 18 ], "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "uses": [ 0 ], "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL benign documentation or test context", "uses": [ 18 ], "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/invisible-unicode::benign-invisible-unicode-text-context", "atk": "T1027", "conf": 0.85, "crit": 1, "desc": "Benign invisible Unicode source text", "uses": [ 31 ], "spans": [ [ 0, 0 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "DKp(rarR\u003eCvqPN1iV]RiBA}?pB1.3pvqc]p3lQDlar\u003e#uA=U@kzx.a:a#H#be?[L33lQDlar\u003eucB7ol8Acb/jzx.a:b2\u0026\u0026bwM98Vx(FepwmYv!zFsibz/fRsw]zYjv}Yp+a$K6zarR^JxM4:0Aa9x\u003cb03?\u003cxMOunB2\u003e%cxk8E3BZ=$kz/4c}wObT]x(){5C#P6dwN)CZwObT]x(){5C#P6dwN)DoA+e/nzddHcwPxCCD2NtofjOW7x^b8narR^Hb5y$6wO#N2b03?\u003co?wqded9HxarR\u003erz/fVqx\u003c#jbz/P[yiV}SlarR^HarR^HDKp(rarR^HarR^HarR\u003eCvqPN1iV]RkvrcDjC42nhwmY^7q!6GVz/N3M3lQDlarR^HarR^Har\u003eDjBzb/arDz.(zEEx[b03?\u003clsB[RC4tUred9HxarR^HarR^HarR\u003eJA+({Xar\u003eGvBz#pZfe3%LBzb/ae[n*pfg68/BARhoa{]CnarR^HarV7-3lQDlarR^HaBsCrarR^HarR^HarR^JzEEx[b03?\u003cl2HjNwP]m-A=leta$K6zarR^HarR^HarR^Jxk8E3BZ!u(wPzV%zdK[Lar\u003c9wlum0*zxZRsarR^HarR^HarR^Hb6v{xb03?\u003cxMOunB2\u003e%cxk8E3BZ=$kz/4c[m).lmCwXPiarR^HarR^HEe", "ln": 0, "col": 1, "line": 1 }, { "b": "x\u003e7{53lQDlarR^HaBKOtarR!jed9HxarR\u003eID2NssiV]R-z!a0bwG\u0026VjarR^Hb5H+5zx.a:a%FMBarR^Hb6n9HwPG4Rar\u003eJqwmZ0rwg?$Ba$K6zarR^JA+fidB7]-mA^n\u0026\u0026aBsCrarR^HarR^JBA}?pb03?\u003cxk8Died9HxarR^HarR\u003eJA+({Xar\u003eGvBz#pZfe3%LBzb/ae[n*pfgow-x(mTbwO=S\u003eD2Nt9fgow-x(mTbwO=S\u003eD2Nt9e[X)ua$K6zarR^HarR^Jwnc6}v@#TfC{ko(b6n9HwPGImxKLQ03lQDlaBL^FarR^Hb6dmmx(Ffnb03\u0026[EjLZFarR^JwmYZ\u003ezE^r@v}/H}b03\u0026[3lQDlarR^Har\u003c6)D2NtofjXT9A4LTvy:7[.a$s=zarR^HEjLZFarR^JAaJQ3l$HsGzE^r@v}/H}b03\u0026[EjLZFarR^JBA}?pB5m0*y?W%7wPydRzGGDcBvY?YxD/FWb4-I-g=5P0hAiPJw\u0026a3QhF3wQhzwO$whm.8i5b2Ow=", "ln": 1763, "col": 51, "line": 56 } ], "depth": 1, "facts": { "imp": [ [ "*", "@types/deep-eql" ] ], "metrics": { "file": { "size": 2247, "entropy": 4.33 }, "binary": { "peak_region_bytes": 199, "peak_region_entropy": 4.82 } } }, "id": 4, "mol": "K(Li)Md(Pa₆)", "path": "chai-5.0.1.tgz!!chai/package.json", "pid": 0, "refs": [ { "to": "pkg:github/definitelytyped/definitelytyped", "off": 1909, "kind": "repository" }, { "to": "pkg:npm/%40types/deep-eql", "off": 2057, "kind": "dependency" } ], "risk": 5, "sha": "ec590a6f47d5067187321221cdf6159304a7079a735883c521ecdb5df40ebfb8", "size": 2247, "traits": [ { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field", "spans": [ [ 0, 21 ] ] }, { "id": "metadata/file/format/conformance::json-document-opening", "conf": 0.95, "crit": 2, "desc": "File begins with a JSON document", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/library/vscode::vscode-contributes-absent", "conf": 0.9, "crit": 1, "desc": "Manifest has no contributes section" }, { "id": "metadata/package/contributors::npm-many-contributors", "atk": "T1195.002", "conf": 0.4, "crit": 2, "desc": "npm package has many contributors (10+)", "spans": [ [ 226, 0 ] ] }, { "id": "metadata/package/dependencies/manifest::declared-types-runtime-dependency", "conf": 0.95, "crit": 2, "desc": "Runtime dependency list has a @types package", "spans": [ [ 2030, 0 ] ] }, { "id": "metadata/package/dependencies/manifest::has-runtime-deps", "conf": 0.85, "crit": 1, "desc": "Package has runtime dependencies", "spans": [ [ 2030, 0 ] ] }, { "id": "metadata/package/dependencies/manifest::npm-no-deps-devdependencies", "conf": 0.9, "crit": 2, "desc": "npm manifest omits devDependencies field" }, { "id": "metadata/package/dependencies/manifest::types-only-runtime-dependency", "conf": 0.95, "crit": 2, "desc": "Sole runtime dependency is a @types package", "spans": [ [ 2030, 0 ] ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 1, "desc": "Filename is package.json", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/license::permissive-license-declared", "atk": "T1195.002", "conf": 0.97, "crit": 2, "desc": "Manifest declares a permissive SPDX license", "spans": [ [ 204, 0 ] ] }, { "id": "metadata/package/manifest/author/identity::has-contributors", "conf": 0.85, "crit": 2, "desc": "Package has contributors list", "spans": [ [ 226, 0 ] ] }, { "id": "metadata/package/manifest/description::has-description", "conf": 0.75, "crit": 2, "desc": "Package has meaningful description", "spans": [ [ 57, 0 ] ] }, { "id": "metadata/package/manifest/entrypoint::vscode-activation-events-absent", "conf": 0.95, "crit": 1, "desc": "Manifest declares no activation events" }, { "id": "metadata/package/manifest/entrypoint::vscode-browser-entry-absent", "conf": 0.95, "crit": 1, "desc": "Manifest declares no browser entry module" }, { "id": "metadata/package/manifest/entrypoint::vscode-configuration-contribution-absent", "conf": 0.95, "crit": 1, "desc": "Manifest contributes no configuration block" }, { "id": "metadata/package/manifest/homepage::has-homepage-field", "conf": 0.8, "crit": 2, "desc": "Package has homepage URL", "spans": [ [ 111, 0 ] ] }, { "id": "metadata/package/manifest/homepage::homepage-git-host", "conf": 0.9, "crit": 3, "desc": "Homepage points to major Git host", "spans": [ [ 111, 73 ] ] }, { "id": "metadata/package/manifest/name::scoped-known-org-1", "conf": 1.0, "crit": 3, "desc": "Package from known org scope", "spans": [ [ 6, 11 ] ] }, { "id": "metadata/package/manifest/name::scoped-package-name", "conf": 0.84, "crit": 1, "desc": "Package uses npm scope name", "spans": [ [ 6, 0 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata", "spans": [ [ 1854, 0 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL", "spans": [ [ 1901, 0 ] ] }, { "id": "metadata/package/manifest/repository::repo-declares-git-type", "conf": 1.0, "crit": 2, "desc": "package.json declares repository type git", "spans": [ [ 1878, 0 ] ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host", "spans": [ [ 1901, 54 ] ] }, { "id": "metadata/package/manifest/runtime::vscode-grammars-contribution-absent", "conf": 0.95, "crit": 1, "desc": "VS Code grammars contribution absent" }, { "id": "metadata/package/manifest/runtime::vscode-languages-contribution-absent", "conf": 0.95, "crit": 1, "desc": "VS Code languages contribution absent" }, { "id": "metadata/package/manifest/runtime::vscode-localizations-absent", "conf": 0.95, "crit": 1, "desc": "VS Code localization contribution absent" }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "package.json defines a package name", "spans": [ [ 6, 0 ] ] }, { "id": "metadata/package/quality/empty::package-empty-scripts-object", "conf": 0.85, "crit": 3, "desc": "Package declares an empty scripts object", "spans": [ [ 2011, 21 ] ] }, { "id": "metadata/package/versioning::conventional-version-base", "conf": 1.0, "crit": 2, "desc": "Package version uses numeric SemVer format", "spans": [ [ 33, 0 ] ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version", "spans": [ [ 33, 0 ] ] }, { "id": "well-known/lib/development/definitelytyped::scoped-package-name", "conf": 0.99, "crit": 3, "desc": "DefinitelyTyped @types package name", "spans": [ [ 6, 11 ] ] }, { "id": "metadata/package/dependencies/manifest::npm-wildcard-dependency", "conf": 0.85, "crit": 3, "desc": "npm runtime dependency pinned to '*'", "spans": [ [ 2030, 1 ] ] }, { "id": "metadata/package/manifest/entrypoint::pkg-types-field", "conf": 0.9, "crit": 3, "desc": "Package declares TypeScript types entry", "spans": [ [ 1827, 10 ] ] }, { "id": "metadata/package/quality/empty::npm-no-author", "conf": 0.75, "crit": 2, "desc": "npm package missing author field" }, { "id": "metadata/package/quality/empty::npm-no-keywords", "conf": 0.5, "crit": 2, "desc": "package.json has no keywords" }, { "id": "metadata/package/versioning::mature-package-version", "conf": 0.65, "crit": 2, "desc": "Mature package version", "spans": [ [ 33, 0 ] ] }, { "id": "metadata/package/versioning::mature-version", "conf": 0.7, "crit": 2, "desc": "Major version is 1 or higher", "spans": [ [ 33, 0 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-evidence", "conf": 0.85, "crit": 2, "desc": "Package has repository metadata", "uses": [ 19, 20, 22 ], "spans": [ [ 1854, 0 ] ] } ], "type": "package.json" } ], "rev": "c7f7e", "v": "8" } }