{
  "llm": {
    "conf": 0.97311336,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.8-27B",
    "before": {
      "lvl": -1,
      "prob": 0.9598707,
      "class": "benign"
    },
    "outcome": "suspicious",
    "interpretation": "Typosquatting, zero downloads, recent release"
  },
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": 279,
    "conf": 80,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9598707,
        "rte": "az",
        "prob": 0.9598707
      },
      {
        "cls": 0,
        "raw": 0.8920856,
        "rte": "az/npm",
        "prob": 0.8920856
      }
    ],
    "prob": 0.97311336,
    "files": [
      {
        "id": 0,
        "lvl": 279,
        "conf": 80,
        "prob": 0.9731133580207825,
        "type": "npm"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00002905726432800293,
        "type": "package.json"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001327196787315188,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-10-01T06:37:48Z"
  },
  "path": "bc-phone-number-5.0.7.tgz",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "abZy8000000@}UGU$\u0026g\u003c5qAvhdny{B^qScPrly7nM(du9(M0?(U}sZYr\u0026CFE93XM5d\u003cNJ%\u003c(C\u003e{?t9Nu2L?6Bf4UaH/02KmH%oJlkLWZPT:\u003cz]Gf?y7zH!z(BUea!}VS\u0026dRdUP2i1=?ZTnSZ/3JL89nw2bus8lz(lU!GqD?d7:G%fM\u0026WKg9UIrcUIJ!l\u0026Q-M]*Mqr)$No?ilA2?!vWZ/%vM0c\u003epJqYzZ).J9J1z*-2klja?{qU\u0026%-X8TX@0uDp=.3+!+jNCzi",
            "ln": 0
          }
        ],
        "mol": "O(S)Md(Pa₆)",
        "sha": "fb20931c588d3ffb23715b8dcfa71509011dd4b6d81771beb15280f64e69325b",
        "path": "/data/samples/incoming/forager/javascript/npmjs.org/_/bc-phone-number/bc-phone-number-5.0.7.tgz",
        "risk": 42,
        "size": 264,
        "type": "npm",
        "facts": {
          "metrics": {
            "file": {
              "size": 264,
              "entropy": 7.11
            },
            "parse": {
              "error_count": 1
            },
            "binary": {
              "peak_region_bytes": 264,
              "peak_region_entropy": 7.11
            }
          }
        },
        "ident": {
          "name": {
            "value": "bc-phone-number",
            "source": "npm.name",
            "verified": false
          },
          "trust": "unsigned",
          "version": {
            "value": "5.0.7",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "bc-phone-number",
            "source": "npm.name",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/package/entrypoint::main-root-javascript-entry",
            "conf": 0.9,
            "crit": 2,
            "desc": "Root JavaScript main entrypoint"
          },
          {
            "id": "metadata/package/scaffold::npm-unmodified-init-skeleton",
            "conf": 0.85,
            "crit": 3,
            "desc": "Unmodified npm init skeleton package",
            "from": [
              {
                "off": 115,
                "file": 1,
                "line": 7
              }
            ],
            "uses": [
              5,
              6,
              7,
              12,
              13
            ]
          },
          {
            "id": "metadata/package/files/included::package-json-basename",
            "conf": 0.95,
            "crit": 3,
            "desc": "Filename is package.json",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/freeform::npm-module-type-sidecar-type-field",
            "conf": 0.95,
            "crit": 3,
            "desc": "npm module-format sidecar type field"
          },
          {
            "id": "metadata/package/versioning/scheme::npm-has-version",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package version"
          },
          {
            "id": "metadata/package/empty::npm-empty-author",
            "conf": 0.75,
            "crit": 2,
            "desc": "package.json author field is empty"
          },
          {
            "id": "metadata/package/scripts/develop::npm-init-default-test",
            "conf": 0.95,
            "crit": 3,
            "desc": "Default npm-init placeholder test script"
          },
          {
            "id": "metadata/package/license::npm-undescribed-isc-license",
            "atk": "T1195.002",
            "conf": 0.95,
            "crit": 3,
            "desc": "Undescribed npm package uses ISC license"
          },
          {
            "id": "metadata/package/name/convention::npm-has-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "npm manifest declares a package name"
          },
          {
            "id": "metadata/package/files/included::npm-publish-root-manifest",
            "conf": 0.95,
            "crit": 2,
            "desc": "Manifest sits at npm publish root",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field"
          },
          {
            "id": "metadata/package/empty::npm-empty-description-any",
            "conf": 0.85,
            "crit": 1,
            "desc": "Package description metadata is empty or absent",
            "from": [
              {
                "off": 4,
                "file": 1,
                "line": 2
              }
            ],
            "uses": [
              4,
              8,
              13
            ]
          },
          {
            "id": "metadata/package/versioning/scheme::mature-version",
            "conf": 0.7,
            "crit": 2,
            "desc": "Major version is 1 or higher"
          },
          {
            "id": "metadata/package/empty::npm-empty-description",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json description field is empty"
          },
          {
            "id": "metadata/package/files/included::npm-package-manifest-member",
            "conf": 0.95,
            "crit": 2,
            "desc": "Archive carries npm package manifest"
          },
          {
            "id": "metadata/package/files/missing-entrypoint::npm-main-entrypoint-not-shipped",
            "conf": 0.92,
            "crit": 3,
            "desc": "npm main entrypoint absent from archive",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              0,
              9,
              14
            ],
            "spans": [
              [
                0,
                20
              ]
            ]
          },
          {
            "id": "objectives/supply-chain/trojanized/dist::release-ships-no-runtime-code",
            "atk": "T1195.002",
            "conf": 0.9,
            "crit": 4,
            "desc": "Release declares an entry point it omits",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              0,
              9,
              14
            ],
            "spans": [
              [
                0,
                20
              ]
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "DKp(rb5Q?awG\u003ceTb4t4lAa\u003cfcwI4!xzdm6%a$K6zar\u003e#uA=U@kzx.a:a#H#be\u0026K$93lQDnwmY*(A+PGmx(v(kiV]Q\u003ced9Hxb5H+5zx.a:b57}9wQ2?xB0rdxarR\u003eHv@=p5BAnS!aBsCrarR^JBy/Jnb03?\u003cwN/y(ay39VA=M8siV@rUaARgoBrCTzwN/B^x\u003ep*Wa%niVaz2!iBrApZ3lQEted9Hxb5p+nCw?IjB0rT/tu@=!arR\u003epB-.qnAW0K!a%FMBarR\u003eAx\u003e7Z(B7DKRar\u003cxQlN15*arR\u003eID2NssiV]RRz/6ufzFBkp3vJl",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 251,
              "entropy": 4.49
            },
            "binary": {
              "peak_region_bytes": 251,
              "peak_region_entropy": 4.49
            }
          }
        },
        "id": 1,
        "ident": {
          "name": {
            "value": "bc-phone-number",
            "source": "npm.name",
            "verified": false
          },
          "trust": "unsigned",
          "version": {
            "value": "5.0.7",
            "source": "npm.version",
            "verified": false
          },
          "identifier": {
            "value": "bc-phone-number",
            "source": "npm.name",
            "verified": false
          }
        },
        "mol": "Md(Pa₅)",
        "path": "/data/samples/incoming/forager/javascript/npmjs.org/_/bc-phone-number/bc-phone-number-5.0.7.tgz!!package/package.json",
        "pid": 0,
        "refs": [
          {
            "to": "index.js",
            "off": 85,
            "kind": "local"
          }
        ],
        "risk": 6,
        "sha": "ca549cdcd8c53d676898737ff91010698b84eee057909b29b292f87cef172741",
        "size": 251,
        "traits": [
          {
            "id": "supply-chain/missing-author",
            "conf": 0.5,
            "crit": 3,
            "desc": "Package has empty or missing author field",
            "spans": [
              [
                0,
                21
              ]
            ]
          },
          {
            "id": "metadata/package/empty::npm-empty-description",
            "conf": 0.85,
            "crit": 2,
            "desc": "package.json description field is empty",
            "spans": [
              [
                55,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/entrypoint::main-root-javascript-entry",
            "conf": 0.9,
            "crit": 2,
            "desc": "Root JavaScript main entrypoint",
            "spans": [
              [
                76,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/files/included::npm-publish-root-manifest",
            "conf": 0.95,
            "crit": 2,
            "desc": "Manifest sits at npm publish root"
          },
          {
            "id": "metadata/package/files/included::package-json-basename",
            "conf": 0.95,
            "crit": 3,
            "desc": "Filename is package.json"
          },
          {
            "id": "metadata/package/freeform::npm-module-type-sidecar-type-field",
            "conf": 0.95,
            "crit": 3,
            "desc": "npm module-format sidecar type field",
            "spans": [
              [
                230,
                8
              ]
            ]
          },
          {
            "id": "metadata/package/name/convention::npm-has-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "npm manifest declares a package name",
            "spans": [
              [
                4,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/scripts/develop::npm-init-default-test",
            "conf": 0.95,
            "crit": 3,
            "desc": "Default npm-init placeholder test script",
            "spans": [
              [
                115,
                41
              ]
            ]
          },
          {
            "id": "metadata/package/versioning/scheme::npm-has-version",
            "conf": 1.0,
            "crit": 2,
            "desc": "package.json defines a package version",
            "spans": [
              [
                33,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/empty::npm-empty-author",
            "conf": 0.75,
            "crit": 2,
            "desc": "package.json author field is empty",
            "spans": [
              [
                194,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/license::npm-undescribed-isc-license",
            "atk": "T1195.002",
            "conf": 0.95,
            "crit": 3,
            "desc": "Undescribed npm package uses ISC license",
            "spans": [
              [
                210,
                3
              ]
            ]
          },
          {
            "id": "metadata/package/versioning/scheme::mature-version",
            "conf": 0.7,
            "crit": 2,
            "desc": "Major version is 1 or higher",
            "spans": [
              [
                33,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/empty::npm-empty-description-any",
            "conf": 0.85,
            "crit": 1,
            "desc": "Package description metadata is empty or absent",
            "uses": [
              1,
              6,
              8
            ],
            "spans": [
              [
                4,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/scaffold::npm-unmodified-init-skeleton",
            "conf": 0.85,
            "crit": 3,
            "desc": "Unmodified npm init skeleton package",
            "uses": [
              1,
              7,
              9,
              10,
              11
            ],
            "spans": [
              [
                33,
                5
              ],
              [
                55,
                0
              ],
              [
                115,
                41
              ],
              [
                210,
                3
              ]
            ]
          }
        ],
        "type": "package.json"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 751,
              "entropy": 4.72
            },
            "binary": {
              "peak_region_bytes": 751,
              "peak_region_entropy": 4.72
            },
            "registry": {
              "age_days": 0,
              "file_count": 1,
              "maintainers": 1,
              "published_at": 1790835669,
              "releases_24h": 2,
              "releases_48h": 2,
              "is_deprecated": 0,
              "release_count": 2,
              "security_hold": 0,
              "unpacked_size": 251,
              "version_removed": 0,
              "downloads_recent": 0,
              "package_age_days": 4010,
              "first_published_at": 1444318909,
              "has_install_script": 0,
              "previous_published_at": 1790834600,
              "publisher_in_maintainers": 1,
              "days_since_previous_release": 0
            }
          }
        },
        "id": 2,
        "mol": "O(S)Md(Re)",
        "path": "bc-phone-number@5.0.7.registry.json",
        "pid": 0,
        "rel": "registry",
        "risk": 2,
        "role": "sidecar",
        "sha": "42621aa913ac11f4553ae502f99cc626a99cd5eb240380fa99a6f914574f8e67",
        "size": 751,
        "traits": [
          {
            "id": "metadata/registry::established-package",
            "conf": 1.0,
            "crit": 3,
            "desc": "Package is at least one year old"
          },
          {
            "id": "metadata/registry::few-releases",
            "conf": 1.0,
            "crit": 3,
            "desc": "Three or fewer releases"
          },
          {
            "id": "metadata/registry::low-adoption",
            "conf": 1.0,
            "crit": 3,
            "desc": "Near-zero recent downloads for registry package"
          },
          {
            "id": "metadata/registry::single-maintainer",
            "conf": 1.0,
            "crit": 3,
            "desc": "Registry package lists one maintainer"
          },
          {
            "id": "metadata/registry::freshly-published",
            "conf": 1.0,
            "crit": 3,
            "desc": "Release published within seven days"
          },
          {
            "id": "objectives/supply-chain/impersonation/registry/publish::freshly-published-unestablished-package",
            "conf": 0.7,
            "crit": 3,
            "desc": "Fresh low-adoption registry release",
            "uses": [
              2,
              4
            ]
          }
        ],
        "type": "registry"
      }
    ],
    "rev": "c1ea9",
    "v": "8"
  }
}