{ "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "prob": 0.0, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0, "type": "npm" }, { "id": 1, "type": "javascript" }, { "id": 2, "type": "javascript" }, { "id": 3, "type": "markdown" }, { "id": 4, "type": "package.json" }, { "id": 5, "type": "javascript" }, { "id": 6, "type": "markdown" }, { "id": 7, "type": "markdown" } ], "version": "v18.18", "analyzed_at": "2026-07-12T23:07:50Z" }, "path": "sanitize-caja-0.1.4.tgz", "raw": { "files": [ { "id": 0, "mol": "H₃(Db₃OsU)", "sha": "fe138ad01ebba24f3c84211bc6e1cc94b333e04bb21674b0eae406e2ef75734f", "path": "sanitize-caja-0.1.4.tgz", "refs": [ { "to": "git://github.com/mapbox/sanitize-caja.git", "off": 0, "kind": "repository" } ], "risk": 8, "size": 22465, "type": "npm", "facts": { "metrics": { "file": { "size": 22465.0, "entropy": 7.99, "size_bytes": 22465.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 22465.0, "peak_region_entropy": 7.83 } } }, "ident": { "name": { "value": "sanitize-caja", "source": "npm.name", "verified": false }, "urls": [ { "url": "git://github.com/mapbox/sanitize-caja.git", "kind": "repository", "source": "npm.repository.url" } ], "trust": "unsigned", "authors": [ { "name": "Tom MacWright", "role": "author", "source": "npm.author" } ], "version": { "value": "0.1.4", "source": "npm.version", "verified": false }, "identifier": { "value": "sanitize-caja", "source": "npm.name", "verified": false } }, "traits": [ { "id": "metadata/lang/scripted::plain-js-identifier-assignment", "conf": 1.0, "crit": 1, "desc": "Plain JavaScript identifier assignment", "from": [ { "file": 2 } ] }, { "id": "metadata/package/documentation::references-license-1", "conf": 0.7, "crit": 2, "desc": "Package references LICENSE/LICENCE", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "atk": "T1614", "mbc": "B0007.003", "conf": 0.6, "crit": 1, "desc": "Country code ID literal (repeated)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-url-line-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "JavaScript commented URL line context", "from": [ { "file": 1 } ], "spans": [ [ 161, 11 ], [ 219, 15 ] ] }, { "id": "micro-behaviors/os/clipboard/access::browser-textarea-copy-staging", "atk": "T1115", "conf": 0.85, "crit": 3, "desc": "Browser stages text for clipboard copy", "from": [ { "file": 2 } ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.9, "crit": 2, "desc": "Script overall entropy stays low", "from": [ { "file": 2 } ], "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-text-content-read", "conf": 0.82, "crit": 1, "desc": "Reads DOM text content", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-undefined-string-compare", "conf": 0.6, "crit": 2, "desc": "Compares value against the undefined string", "from": [ { "file": 2 } ] }, { "id": "metadata/library/structure::js-image-data-url", "conf": 0.9, "crit": 2, "desc": "JavaScript image data URL literal", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "from": [ { "file": 1 } ], "spans": [ [ 0, 16 ] ] }, { "id": "objectives/anti-static/obfuscation/syntax::inline-media-data-uri", "conf": 1.0, "crit": 2, "desc": "Inline media data URI asset", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/identity::documentation-page-term", "conf": 0.82, "crit": 1, "desc": "Documentation page terminology", "from": [ { "file": 2 } ] }, { "id": "metadata/file/metrics::single-char-params", "conf": 0.7, "crit": 1, "desc": "Many single-char function parameters", "from": [ { "file": 2 } ] }, { "id": "metadata/package/config::short-sidecar-file", "conf": 0.8, "crit": 1, "desc": "Short sidecar-sized source", "from": [ { "file": 1 } ], "spans": [ [ 0, 24 ] ] }, { "id": "well-known/lib/blessed::blessed-unicode-helper-text", "conf": 0.9, "crit": 1, "desc": "Blessed unicode helper text", "from": [ { "file": 2 } ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "from": [ { "file": 6 } ], "spans": [ [ 0, 9 ] ] }, { "id": "objectives/anti-static/obfuscation/string/conceal::js-join-empty-assignment-tail", "conf": 0.97, "crit": 1, "desc": "Variable assigned join('') deobfuscation tail", "from": [ { "file": 2 } ] }, { "id": "metadata/file/invisible-unicode::test-file-context", "atk": "T1027", "conf": 0.85, "crit": 1, "desc": "Test, generated, or declaration-file context", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 1, "desc": "charCodeAt() method call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/string/search::js-includes-indexof-call", "conf": 0.82, "crit": 2, "desc": "JavaScript substring search call", "from": [ { "file": 2 } ] }, { "id": "metadata/file/metrics::low-string-density-large-file", "conf": 0.9, "crit": 1, "desc": "Low string density in source", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL benign documentation or test context", "from": [ { "file": 1 }, { "file": 2 }, { "file": 5 } ], "spans": [ [ 0, 19 ], [ 161, 11 ], [ 219, 15 ] ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Identifies test files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/tostring::tostring-call", "conf": 1.0, "crit": 1, "desc": ".toString() method call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/encode/hex::parseint-16", "conf": 1.0, "crit": 2, "desc": "parseInt with radix 16", "from": [ { "file": 2 } ] }, { "id": "metadata/package/quality/profile::has-tests", "crit": 2, "desc": "Embedded test-code markers present", "from": [ { "file": 1 }, { "off": 207, "file": 4, "line": 10 } ], "spans": [ [ 207, 14 ] ] }, { "id": "objectives/command-and-control/remote-command/control::command-json-field", "atk": "T1059.007", "mbc": "B0022", "conf": 0.78, "crit": 1, "desc": "Command JSON field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/terminal::ansi-erase-op", "conf": 0.84, "crit": 1, "desc": "ANSI terminal erase operation", "from": [ { "file": 2 } ] }, { "id": "metadata/library/structure::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Any JS bundle or minified asset output", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/scripted::undefined-literal", "conf": 1.0, "crit": 1, "desc": "JavaScript undefined literal", "from": [ { "file": 1 } ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "npm package has name field" }, { "id": "metadata/package/documentation::has-jsdoc-type", "conf": 0.7, "crit": 2, "desc": "Code has JSDoc @type", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "conf": 0.96, "crit": 1, "desc": "main_* architecture payload name", "from": [ { "file": 2 } ] }, { "id": "metadata/library/structure::js-dist-asset-bundle", "conf": 0.9, "crit": 2, "desc": "Generated dist JavaScript asset", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::for-loop-content", "conf": 0.3, "crit": 2, "desc": "for loop (content)", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "atk": "T1059", "conf": 0.8, "crit": 1, "desc": "Shell execution wrapper", "from": [ { "file": 2 } ] }, { "id": "metadata/permission/capture::permission-grant-verb", "conf": 0.86, "crit": 1, "desc": "Permission-grant action verb keyword", "from": [ { "file": 2 } ] }, { "id": "metadata/package/testing/presence/harness::test-path-basename", "conf": 1.0, "crit": 1, "desc": "Test path basename", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/string/encoding::js-charat-loop", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 1, "desc": "charAt in loop pattern", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-4", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 1, "desc": "charCodeAt call marker", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/eval/dynamic::export-iife-closure", "conf": 0.85, "crit": 1, "desc": "Trailing IIFE closure indicating auto-exec", "from": [ { "file": 2 } ] }, { "id": "metadata/permission/capture::capture-device-term", "conf": 0.86, "crit": 1, "desc": "Media capture device term keyword", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::size-prop--height", "conf": 1.0, "crit": 1, "desc": "DOM or CSS size property (height)", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/infrastructure/tracking::command-field", "conf": 0.7, "crit": 1, "desc": "Command tasking field in schema", "from": [ { "file": 2 } ] }, { "id": "metadata/package/documentation::package-doc-reference-basename", "conf": 0.9, "crit": 1, "desc": "Package documentation basename", "from": [ { "file": 3 } ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "from": [ { "file": 6 } ], "spans": [ [ 0, 9 ] ] }, { "id": "metadata/package/scripts::has-test-script", "conf": 1.0, "crit": 1, "desc": "package defines test script" }, { "id": "micro-behaviors/data/encode/tostring::tostring-token", "conf": 1.0, "crit": 1, "desc": "toString method token", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-recognized-text", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Recognized multiline blob text", "from": [ { "file": 1 } ] }, { "id": "metadata/package/keywords/identity::npm-keyword-html", "conf": 0.9, "crit": 1, "desc": "Package declares html keyword" }, { "id": "micro-behaviors/process/create/load/remote-code::js-dom-script-literal", "atk": "T1105", "conf": 0.8, "crit": 1, "desc": "script string literal", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 2, "desc": "High overall text entropy (encoded", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.8, "crit": 1, "desc": "High-entropy region mass over 1KB", "from": [ { "file": 1 } ], "spans": [ [ 0, 35 ] ] }, { "id": "objectives/command-and-control/dropper/execution/browser::dom-script-text-body-assign", "conf": 0.8, "crit": 1, "desc": "Assigns code body into DOM element text", "from": [ { "file": 2 } ] }, { "id": "metadata/library/structure::vscode-root-js-bundle", "conf": 0.95, "crit": 2, "desc": "VS Code root JavaScript bundle", "from": [ { "file": 2 } ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "from": [ { "file": 1 } ], "spans": [ [ 0, 8 ] ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/scripted::js-export-boundary", "crit": 1, "desc": "JS module export syntax", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/hidden-payload/runtime::worker-host-serial-assessment--rx-13", "atk": "T1195.002, T1059.007", "conf": 0.94, "crit": 1, "desc": "WMI NAME field marker", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/identity::install-doc-basename", "conf": 0.85, "crit": 1, "desc": "Installation documentation basename", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/script/wsh::wsh-do-while-close", "conf": 0.8, "crit": 1, "desc": "Do-while close marker", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/url/encoded::percent-encoded-octet-context", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 1, "desc": "Percent-encoded octet context", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-recognized-text--rx-6", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Inline data-image URI in multiline blob", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/eval/loader::return-empty-join", "atk": "T1027", "mbc": "B0032", "conf": 0.86, "crit": 1, "desc": "Empty-join return value", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4", "conf": 0.84, "crit": 1, "desc": "path join artifact for package.json load", "from": [ { "file": 2 } ] }, { "id": "metadata/file/format::vocab-array", "conf": 0.97, "crit": 1, "desc": "String literal contains array word", "from": [ { "file": 2 } ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "npm package has version field" }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.8, "crit": 3, "desc": "Assigns DOM innerHTML", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 2, "desc": "Repository uses common git host" }, { "id": "metadata/library/runtime::js-module-exports", "conf": 1.0, "crit": 2, "desc": "JavaScript module exports", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::conventional-version-base", "conf": 1.0, "crit": 2, "desc": "Uses standard version format" }, { "id": "metadata/file/metrics::peak-region-encoded-entropy", "conf": 0.8, "crit": 1, "desc": "Peak region at encoded-blob entropy", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/hidden-payload/eval::byte-loop-fromcharcode-append", "atk": "T1195.002", "conf": 0.9, "crit": 1, "desc": "Loop appends decoded fromCharCode bytes", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "Package has repository URL" }, { "id": "metadata/package/license::apache-license-text", "conf": 0.8, "crit": 2, "desc": "Apache License text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/encode/char-code::xor-operator", "conf": 0.6, "crit": 1, "desc": "Bitwise XOR operator", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/dropper/execution/browser::string-fromcharcode-symbol", "conf": 0.8, "crit": 1, "desc": "JavaScript uses String.fromCharCode", "from": [ { "file": 2 } ] }, { "id": "metadata/file/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file", "from": [ { "file": 5 } ] }, { "id": "metadata/package/manifest/repository::has-repository-evidence", "conf": 0.85, "crit": 2, "desc": "Package has repository metadata", "from": [ { "off": 394, "file": 4, "line": 21 } ] }, { "id": "objectives/command-and-control/remote-command/socketio-control::socketio-command-event-name", "atk": "T1059.007", "mbc": "B0022", "conf": 0.82, "crit": 1, "desc": "Socket.io command event name", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/session::extension-page-block", "conf": 0.9, "crit": 1, "desc": "innerHTML/location.href rewrite", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/name::npm-hyphenated-multiword-name", "conf": 0.7, "crit": 2, "desc": "npm hyphenated multiword name" }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript basename", "from": [ { "file": 1 } ], "spans": [ [ 0, 8 ] ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-empty-join-call", "conf": 0.72, "crit": 1, "desc": "JavaScript array empty join call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Base64 encoding keyword", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/syntax/keyword::js-keyword-decodeuricomponent", "conf": 0.7, "crit": 2, "desc": "decodeURIComponent function", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "mbc": "B0032", "crit": 1, "desc": "0xff hex byte token", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/string/conceal::js-split-wrapper", "conf": 0.8, "crit": 1, "desc": "split() function wrapper", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/ui/manipulation/core::ai-chat-innerhtml-write", "atk": "T1491", "conf": 0.9, "crit": 1, "desc": "AI chat innerHTML write", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "Package has repository field" }, { "id": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode", "atk": "T1027.003", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Node.js require call in non-code file", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::js-reference", "conf": 0.7, "crit": 1, "desc": "JavaScript extension reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-iframe-element", "conf": 0.78, "crit": 1, "desc": "Contains iframe text token", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "String.fromCharCode call", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 1, "desc": "String.fromCharCode call marker", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 1, "desc": "JavaScript split() method call", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encoded::exported-decryptor", "conf": 0.8, "crit": 1, "desc": "Module exports decryption function", "from": [ { "file": 5 } ] }, { "id": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "atk": "T1027", "mbc": "B0032", "crit": 1, "desc": "Decoded property function alias", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/encode/hex::loop-step-2", "conf": 1.0, "crit": 2, "desc": "Loop with step 2", "from": [ { "file": 2 } ] }, { "id": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast", "conf": 0.82, "crit": 1, "desc": "Array literal joined with empty string", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-charcode-decoder", "conf": 0.9, "crit": 3, "desc": "JavaScript hex escape decoder", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/scripted::js-key-assignment-declaration", "conf": 1.0, "crit": 1, "desc": "var/let/const key-like assignment declaration", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/scripted::js-require-binding", "conf": 0.4, "crit": 1, "desc": "CommonJS require() binding declaration", "from": [ { "file": 1 } ], "spans": [ [ 0, 28 ] ] }, { "id": "metadata/package/license::copyright-word", "conf": 0.6, "crit": 2, "desc": "Copyright notice", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "from": [ { "file": 2 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File in a test directory", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/decoy/cloaking::adspect-action-router-cases--rx-11", "conf": 0.9, "crit": 1, "desc": "Repeated meta or form action labels", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::size-prop--width", "conf": 1.0, "crit": 1, "desc": "DOM or CSS size property (width)", "from": [ { "file": 2 } ] }, { "id": "objectives/credential-access/theft/keywords::cred-upper", "conf": 0.45, "crit": 1, "desc": "CRED credential label", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encoded::js-fromcharcode-decoder", "atk": "T1027", "conf": 0.8, "crit": 1, "desc": "String built from character codes", "from": [ { "file": 2 } ] }, { "id": "metadata/package/testing/presence/harness::test-spec-path-benign-context", "conf": 1.0, "crit": 1, "desc": "Test or spec path context", "from": [ { "file": 1 } ] }, { "id": "well-known/tool/sysadmin/kubernetes/iac::kubernetes-manifest-kind", "conf": 0.86, "crit": 1, "desc": "Kubernetes kind field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/encode/url::encodeuri-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURI", "from": [ { "file": 2 } ] }, { "id": "metadata/file/metrics::single-long-line", "conf": 0.9, "crit": 1, "desc": "Very long line", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::low-whitespace", "conf": 0.7, "crit": 2, "desc": "Very low whitespace ratio (minified/compressed)", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/scripted::require-symbol", "conf": 1.0, "crit": 1, "desc": "CommonJS require symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::string-literal-equality-check", "conf": 0.92, "crit": 1, "desc": "String literal equality or membership check", "from": [ { "file": 2 } ] }, { "id": "metadata/file/metrics::js-readable-source-context", "conf": 0.9, "crit": 1, "desc": "Readable JavaScript source context", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 1, "desc": "Filename is package.json", "from": [ { "file": 4 } ] }, { "id": "metadata/package/dependencies::has-dev-deps", "conf": 0.8, "crit": 1, "desc": "Package has devDependencies" }, { "id": "metadata/package/manifest/description::has-description", "conf": 0.75, "crit": 2, "desc": "Package has meaningful description" }, { "id": "micro-behaviors/data/control-flow/analysis::js-function-call-method", "conf": 0.84, "crit": 2, "desc": "Invokes function with .call()", "from": [ { "file": 2 } ] }, { "id": "metadata/build/minifier::use-strict-quote", "conf": 0.6, "crit": 1, "desc": "use strict directive string", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/eval/loader::decoded-property-constructor", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Decoded property constructor access", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/string/encoding::js-array-join-symbol", "crit": 1, "desc": "Join using empty string delimiter", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/buffer::offset-write", "conf": 0.7, "crit": 2, "desc": "Writing data to buffer at calculated offset", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/scripted::length-prop", "conf": 1.0, "crit": 1, "desc": "JavaScript length property", "from": [ { "file": 2 } ] }, { "id": "metadata/encoded-payload/unicode-escape", "conf": 0.9, "crit": 2, "desc": "Decoded unicode-escape content" }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File in a common test directory path", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/impersonation/npm-clone::repo-mismatch-indicator", "atk": "T1195.002", "mbc": "E1195.002", "crit": 1, "desc": "Repository URL may not match publisher" } ] }, { "ctx": [ { "b": "C42zlBy/JnauZ\u0026/wPq\u003cbA+cTDByxc1cN*V\u0026wPI@A", "n": [ { "c": 3, "d": "JS build-config-injector compat noise markers", "i": "objectives/supply-chain/trojanized/app/config-injection::js-build-config-compatibility-marker", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "arR^HB75%2Bzl5jauZ\u0026/wPq\u003cbA+cTDe?O!8dlv", "ln": 2, "addr": 33 }, { "b": "", "ln": 3, "addr": 64 }, { "b": "By/Jnc)%7AzFsibDsXDPazb+lv@#B6zyxPQaBs", "ln": 4, "addr": 65 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)@RBzY\u0026H$AWJp!cUvpnayX=1cN?a", "ln": 5, "addr": 96 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jd0oArwObT]wN)kvcNQu8", "n": [ { "c": 1, "d": "JavaScript undefined literal", "i": "metadata/lang/scripted::undefined-literal", "o": 161, "z": 9, "cf": 1.0 } ], "ln": 6, "addr": 140 }, { "b": "", "ln": 7, "addr": 177 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b\u003ezd:#jA:}lRxMOuniXJc#z/mmrz/4dtz/mmEzF7dScN*O]jzwUBaAINkjTaMYBz%n]fj]cve[n*pfj]cve]UYvb0Ew9asy(uvp%c]B8\u003e+kvpBp@y\u0026%\u0026hcN?a", "n": [ { "c": 1, "d": "Encoded URL benign documentation or test context", "i": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "o": 178, "z": 77, "cf": 0.95 } ], "ln": 8, "addr": 178 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b=azt!bw\u003c4tGvrt{sw]zPvvQTp3k4X.KjtgbbcN*O]jyHA=z/m-\u003evlM4\u0026asyYdByuqmA+)9Li@", "ln": 9, "addr": 298 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b#v@=p5BuTbHwPz(vb4++ia$kScB7ol8Acan\u003edj=?]efDrYv@=p5BrCWlxd2b\u0026", "n": [ { "c": 1, "d": "script string literal", "i": "micro-behaviors/process/create/load/remote-code::js-dom-script-literal", "o": 402, "z": 29, "cf": 0.8 } ], "ln": 10, "addr": 380 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b/x)7RkwizbGz/l*-xLxNZwnciJcN*O?cP\u003e{NB%7HfjTaGRzZ4wUx/[4Vx)8V/dlv", "ln": 11, "addr": 453 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b=azt!bw\u003c4tKBAzE.fe3)YvqP$1wIdFhz6zeQz/m-\u003evlM4/egiL*azt!bw\u003c4tKBAzE.fe3)YvqP$1wIdFhz6zeQz/m-\u003evlM4\u0026asyPbB8L(qBy=OqA+)9Li@", "ln": 12, "addr": 528 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b=azt!bw\u003c4tKBAzFyiXJc$CWUDdy?kkez/3WZw]zPIfjv3(dj=\u0026evixl7wOa7HxMOunB2\u003e%cwQ4T2Abo8rv@Didk4X.KjtgbbcOcw/vpBp@y\u0026%\u0026hazt\u003esAc0dAA+)9Li@", "ln": 13, "addr": 646 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b=azt!bw\u003c4tPvqfL1z-RGGz:m=uAXp\u003cuz6zeQz/m-\u003evlM4/egiL*azt!bw\u003c4tPvqfL1z-RGGz:m=uAXp\u003cuz6zeQz/m-\u003evlM4\u0026asz2mx(4)fiV@M=y:QU[", "ln": 14, "addr": 772 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b\u003ew].r%wJ\u0026j$C4SEDzFTl1wiBvqwPz(vwn+$2zdNQbe[w)qvqfQdk0gGjw].r%wJ?E\u003cegh!@asy(nA:-/@cN?a", "n": [ { "c": 1, "d": "Contains iframe text token", "i": "micro-behaviors/ui/window/manage/dom::browser-iframe-element", "o": 912, "z": 6, "cf": 0.78 } ], "ln": 15, "addr": 889 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b#C4SEDzFTl1wiBvqwPz(vwn+$2zdNQbe[w)qvqfQdj%}^gcNQC/cV:DzcN?a", "n": [ { "c": 1, "d": "Peak region at encoded-blob entropy", "i": "metadata/file/metrics::peak-region-encoded-entropy", "o": 1024, "z": 512, "cf": 0.8 } ], "ln": 16, "addr": 981 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b#C4R}ozFTl1wiBvqwPz(vwn+$2zdNQbe[w)qvqfQdk0gGtC4S#^dj=?]efDrYC4SfKi@", "ln": 17, "addr": 1053 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc)}b\u003ew].r%wJ\u003cZAzY\u0026H$AY=0?w].r%wJ?E\u003cegh!@asy(nA:-/@cN?a", "ln": 18, "addr": 1131 }, { "b": "", "ln": 19, "addr": 1195 }, { "b": "arR^HC42zlAbGqhjS(a.vrt{sx(do\u003ewIn1uxffNhB7El^enncKpF#x\u003cogJSkk%W!5pe+eamo9$^k%XaCk%W!5wKw:^k%W!8pC^i8sv2ksk%!aqlSm2.nKC^RnOgn4yIu72k%W!MCt*$EDo\u003c?.pbc@Uk$2l[lq.DhvR4?\u003ek%W?NfJ7}+fJx\u003e*zdDgFxK+)Vl1z=ZgFzU4BZW73yfsU9y!OXaD0i7GBX\u003ezyk%W!cmPiq+lrlS\u003ev(E}qlsL1cCss/1qeYSSvS$ErDn[ldhA0#[D1{t[v[wyFB:3?PhBzgiv)TTwmOmcfz+KRRBXlj\u003exh8rxi7!D^xI7#%l3v9Gx)h6+D391Kl1b3(gIgn@CwPVjB5+!3xj\u003e7Wmme!bxid.(lW8y0rZPhZz=6g}xk6}Ko?x7)s4El\u0026xjs[!g\u0026C#tAbN:Fg+@Vtx\u0026NF*qE:oPlu)D-l]^4Xx/f)af/:5}hGBazqy+Wix\u003e8ixiBK:5Dpzy5hci^RnLr+TB3RMQsXZ!gizReqz7]TksxoY[B$V\u0026[mpFnoh/0.gzadcfnl5nrlW0D!fLiZ+s.J1\u003ez!R7gAz7aCmmHfRoL)](xI?PEqf3OBnLqMgyhX2(t55v+m0yB/n\u003egZRsAFB)y/+QRg/)BYvrl-:zbTe6r+cnLqaa@lBu03jyJ0u]r.k5.p/7pGx\u0026eRCr:^Z{h-AN4yDk)9gh]N1ABRA$f(*(aBAg}yh8/nuB.KA(n[QR4gJchCz/PVeqfV7{gKqMmi8j3WDu%P/wO2%wACow)r=Jy=B2OhVoeFC6h*wFqw]hyeAbO^1y\u003cy7#rY1\u0026rBz++]zeSGHzd^3/ngOsisX%5%BA.Q#A-=y4g/WZmB97#6B67*=s4tb9mLN[-gGOWnB8%6MmSH%MBT{c=nO@J)s8Y\u0026LoHJxlf\u0026oOZzzMz\u0026wmES6t2ndumr\u003c5CA=l2ciy(.kmOv[\u003cyedAnl32EXmRuvlAyAltqd\u0026@$lpkx.oJBIEs-lP1lp2o=w]IDyB9I[Bmqb+9k%W!5k#Q=:pF%?ylS(#LjTSq", "n": [ { "c": 2, "d": "Inline media data URI asset", "i": "objectives/anti-static/obfuscation/syntax::inline-media-data-uri", "o": 1211, "z": 22, "cf": 1.0 } ], "ln": 20, "addr": 1196 }, { "b": "arR^HC42zlxMO9cauZ?{jzwUBaAINkjT8l@d\u003ce!GxcnYEcN7-4i@", "ln": 21, "addr": 2016 }, { "b": "arR^HBs}cABZY8mB75%2Bzl5jc$)Zty:*]GBzU?Basy(uxcp.[ByuqmA+)9Li@", "ln": 22, "addr": 2058 } ], "depth": 1, "facts": { "imp": [ [ "", "test" ], [ "", "require" ], [ "", "sanitize" ], [ "", "require" ], [ "", "test" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "png" ], [ "", "html" ], [ "", "t.equal" ], [ "", "sanitize" ], [ "", "t.end" ], [ "", "../" ], [ "", "tape" ] ], "mbr": [ "require().test", "t.end", "t.equal" ], "tgt": [ "require", "sanitize", "t.end", "t.equal", "test" ], "metrics": { "ast": { "op.add": 2.0, "max_depth": 12.0, "bind_count": 4.0, "call_count": 32.0, "node_count": 468.0, "member_count": 3.0, "op_density.add": 0.0, "identifier_count": 8.0, "member_depth_max": 2.0, "string_literal_count": 42.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 2126.0, "entropy": 5.78, "size_bytes": 2126.0 }, "text": { "digit_ratio": 0.07, "space_count": 127.0, "total_lines": 25.0, "char_entropy": 5.78, "unique_chars": 79.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 1.68, "avg_line_length": 84.04, "max_line_length": 819.0, "empty_line_ratio": 0.16, "last_line_length": 3.0, "long_token_count": 1.0, "whitespace_ratio": 0.07, "most_common_ratio": 0.05, "identifier_density": 2.24, "line_length_stddev": 155.15, "normalized_string_count": 8.4, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 97.0, "suspicious_identifier_ratio": 0.13, "normalized_unique_identifiers": 1.72 }, "binds": { "count": 4.0 }, "calls": { "count": 32.0 }, "binary": { "overall_entropy": 5.78, "peak_region_bytes": 1024.0, "peak_region_entropy": 6.0 }, "imports": { "count": 2.0, "relative_ratio": 0.5, "unique_modules": 2.0, "relative_imports": 1.0, "third_party_count": 2.0, "third_party_ratio": 1.0 }, "members": { "count": 3.0 }, "strings": { "total": 42.0, "avg_length": 35.74, "max_length": 802.0, "path_count": 1.0, "avg_entropy": 3.31, "email_count": 2.0, "empty_count": 6.0, "total_bytes": 1501.0, "entropy_stddev": 1.04, "high_entropy_count": 1.0, "embedded_code_candidates": 1.0 }, "functions": { "anonymous": 1.0, "avg_params": 1.0, "max_params": 1.0, "avg_length_lines": 22.0, "max_length_lines": 22.0, "min_length_lines": 22.0, "single_char_params": 1.0, "avg_param_name_length": 1.0, "density_per_100_lines": 4.0, "code_in_functions_ratio": 0.88 }, "identifiers": { "count": 8.0, "total": 56.0, "avg_length": 4.38, "max_length": 8.0, "min_length": 1.0, "avg_entropy": 1.75, "reuse_ratio": 0.14, "unique_count": 8.0, "length_stddev": 2.12, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.13, "all_lowercase_ratio": 1.0 } } }, "id": 1, "path": "sanitize-caja-0.1.4.tgz!!package/test/sanitize.js", "pid": 0, "refs": [ { "to": "../", "off": 57, "file": 5, "kind": "local" } ], "risk": 2, "sha": "a98529cded8a8f2f6810b7e68cf98a1d2d79baf17461a7bdbffaeebeb1f776de", "size": 2126, "traits": [ { "id": "metadata/package/testing/presence/harness::test-path-basename", "conf": 1.0, "crit": 1, "desc": "Test path basename", "spans": [ [ 0, 12 ] ] }, { "id": "metadata/lang/scripted::undefined-literal", "conf": 1.0, "crit": 1, "desc": "JavaScript undefined literal", "spans": [ [ 161, 9 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript basename", "spans": [ [ 0, 11 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "spans": [ [ 0, 11 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.8, "crit": 1, "desc": "High-entropy region mass over 1KB", "spans": [ [ 0, 34 ] ] }, { "id": "metadata/package/config::short-sidecar-file", "conf": 0.8, "crit": 1, "desc": "Short sidecar-sized source", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/lang/scripted::require-symbol", "conf": 1.0, "crit": 1, "desc": "CommonJS require symbol", "spans": [ [ 11, 7 ] ] }, { "id": "metadata/file/metrics::single-long-line", "conf": 0.9, "crit": 1, "desc": "Very long line", "spans": [ [ 1196, 819 ] ] }, { "id": "metadata/library/structure::js-image-data-url", "conf": 0.9, "crit": 2, "desc": "JavaScript image data URL literal", "spans": [ [ 1211, 22 ] ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-url-line-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "JavaScript commented URL line context", "spans": [ [ 178, 77 ] ] }, { "id": "objectives/anti-static/obfuscation/syntax::inline-media-data-uri", "conf": 1.0, "crit": 2, "desc": "Inline media data URI asset", "spans": [ [ 1211, 22 ] ] }, { "id": "metadata/lang/scripted::js-require-binding", "conf": 0.4, "crit": 1, "desc": "CommonJS require() binding declaration", "spans": [ [ 0, 19 ] ] }, { "id": "metadata/file/metrics::peak-region-encoded-entropy", "conf": 0.8, "crit": 1, "desc": "Peak region at encoded-blob entropy", "spans": [ [ 1024, 1024 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File in a common test directory path", "spans": [ [ 0, 24 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 2, "desc": "High overall text entropy (encoded", "spans": [ [ 0, 24 ] ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Base64 encoding keyword", "spans": [ [ 1226, 6 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-recognized-text--rx-6", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Inline data-image URI in multiline blob", "spans": [ [ 1211, 10 ] ] }, { "id": "metadata/file/metrics::low-whitespace", "conf": 0.7, "crit": 2, "desc": "Very low whitespace ratio (minified/compressed)", "spans": [ [ 0, 28 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-iframe-element", "conf": 0.78, "crit": 1, "desc": "Contains iframe text token", "spans": [ [ 912, 6 ] ] }, { "id": "micro-behaviors/process/create/load/remote-code::js-dom-script-literal", "atk": "T1105", "conf": 0.8, "crit": 1, "desc": "script string literal", "spans": [ [ 402, 29 ], [ 439, 10 ] ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/package/testing/presence/harness::test-spec-path-benign-context", "conf": 1.0, "crit": 1, "desc": "Test or spec path context", "spans": [ [ 0, 12 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File in a test directory", "spans": [ [ 0, 24 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-recognized-text", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Recognized multiline blob text", "spans": [ [ 1211, 10 ], [ 1226, 6 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL benign documentation or test context", "spans": [ [ 178, 77 ] ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Identifies test files", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/package/quality/profile::has-tests", "crit": 2, "desc": "Embedded test-code markers present", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/file/invisible-unicode::test-file-context", "atk": "T1027", "conf": 0.85, "crit": 1, "desc": "Test, generated, or declaration-file context", "spans": [ [ 0, 24 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "", "n": [ { "c": 2, "d": "Any script file", "i": "metadata/file/extension/identity::script-file", "o": 0, "z": 19, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "fe1Cnz/x#xx\u003eIa3asGPaatLS9fD-(7z!A($aw3DXe=", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 4, "z": 9, "cf": 0.6 } ], "ln": 2, "addr": 1 }, { "b": "fe0", "ln": 3, "addr": 35 }, { "b": "fe1Cwx\u003e7Z(B7F(8B-7-3AV/EqwGToTvpJ$ZawuGVwO#N2efE#8A=U@kzxHX!fD.==xK@qgoLF0FzGxwkdlv", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 56, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Apache License text", "i": "metadata/package/license::apache-license-text", "o": 60, "z": 14, "cf": 0.8 } ], "ln": 4, "addr": 38 }, { "b": "fe1C[z/)gtvr\u0026#kz/^aAB7DFoxLzJgw[=6)az2!cwPh-lx(k56z/6Dfx\u003c\u003e)?wGVhhBz8!sxK@qWx\u003e7Z(B7D%", "ln": 5, "addr": 105 }, { "b": "fe1CJz/)gtvr\u0026#lvSV3)zxJvgv@DsiaA7\u003cmBzbkdoLF0FzGxwivrq", "ln": 6, "addr": 173 }, { "b": "fe0", "ln": 7, "addr": 216 }, { "b": "fe1B\u003carR^HxMOuniXJdgCxUVFAa9l\u0026wId[wxd[7nv}xL0wPGH#nKC{wq:\u0026n[e?^", "n": [ { "c": 1, "d": "Encoded URL benign documentation or test context", "i": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "o": 219, "z": 15, "cf": 0.95 } ], "ln": 8, "addr": 219 }, { "b": "fe0", "ln": 9, "addr": 270 }, { "b": "fe1CFzFS)9B0bHmADL#owN(])C{3KmAbok#vpB4:az+FgaA8oyvp%Q(wN({9zY\u0026+iaA}\u003cuBzkS9efG1Lw]@l9A+b", "ln": 10, "addr": 273 }, { "b": "w{503BzkVhay/C6vru6eB7n({zdLmvv@=c\u003ewO#Q7vqH0oay]zcvqfQgaAhmtBsXLNvruflaAqKnA^ohUw].r)zdNQbdiJ%", "ln": 63, "addr": 1921 }, { "b": "arU\u0026oAV/HBx=]LYzE[2mrz(yp", "ln": 64, "addr": 1997 }, { "b": "arR^HarUlkv@C)?nOgzox(!xqgamiNxK#3(efE}\u003cnNB\u003eSq:B8JpGG$MuRa11q:T8Ao*@z+qEq^?mmoNtr7PwHq^Q$8", "n": [ { "c": 1, "d": "CRED credential label", "i": "objectives/credential-access/theft/keywords::cred-upper", "o": 2076, "z": 4, "cf": 0.45 } ], "ln": 65, "addr": 2018 }, { "b": "arR^HarUlkv@C)?nOgzox(!xqgai", "ln": 66, "addr": 2091 }, { "b": "arR^HarR^HarUfmwN]v\u0026Bzkf1B1wClqB$j-nMd]GoIX.Ul%\u0026IXuSfr.mnliTpF$K!qBJ#xpe\u003c!JoJbpEec", "ln": 67, "addr": 2114 }, { "b": "arR^HarUlkv@C)?nOgzox(!xqc$EmkvqfQdec", "ln": 68, "addr": 2180 }, { "b": "arR^HarUSwA=-A/ats{5aAhmtBs}VNq/)4]zF7vDauyS.B.\u003e\u003eB", "n": [ { "c": 1, "d": ".toString() method call", "i": "micro-behaviors/data/encode/tostring::tostring-call", "o": 2231, "z": 11, "cf": 1.0 } ], "ln": 69, "addr": 2210 }, { "b": "arR^HarUlkv@C)?nOgzox(!xqgam9IBz9iFrz(y}l}HryoIwk-mmpGOpg3*-r7HvBec", "ln": 70, "addr": 2251 }, { "b": "arR^HarUMAy?$T", "ln": 71, "addr": 2305 }, { "b": "arUxgasIkLwPA5BaBs", "ln": 73, "addr": 2350 }, { "b": "arR^Hx\u003ewFocV:xIx(mMhau.\u003eJaAR)FwP8f6ADL\u0026kC{%\u003e.", "ln": 74, "addr": 2365 }, { "b": "arR^HarU/Ex!BErBw=K\u003eqfuC\u003cC{)VPwPA5GA+fiavpJ\u003c%fi.:EcoT4miybl2vj=!jtRgySc0-fpefFIwv@C)?pI%.)dlv", "n": [ { "c": 1, "d": "Bitwise XOR operator", "i": "micro-behaviors/data/encode/char-code::xor-operator", "o": 2440, "z": 1, "cf": 0.6 } ], "ln": 75, "addr": 2402 }, { "b": "arR^HEir9qB7DFv", "ln": 76, "addr": 2477 }, { "b": "arR^HarU/Ex!BErBu%.Vp*[xMzdN*2A=STGB.bPsdlv", "ln": 77, "addr": 2490 }, { "b": "Ee", "ln": 81, "addr": 2549 }, { "b": "w{503BzkVhaz2C2z!9AJw\u003c{@UB98EKB-7=iv{%s/wkDYPBswtV", "ln": 82, "addr": 2551 }, { "b": "arUxgasFQUBAh8kxd1/+jS[\u0026(AaJ%1aA.NkB7nS$wN[RCA=--MDJ", "ln": 83, "addr": 2592 }, { "b": "arR^HA+funA=91hzEWP}wMqS1lVl*Xz/fc7BsqoHwPIu\u0026AaJMRvrcDsi@", "n": [ { "c": 3, "d": "URL-encodes data via encodeURIComponent", "i": "micro-behaviors/data/encode/url::encode-uri-component-call", "o": 2645, "z": 18, "cf": 0.7 } ], "ln": 84, "addr": 2634 }, { "b": "arV7", "ln": 85, "addr": 2680 }, { "b": "arUYoBAIRwaz#sry=.", "ln": 86, "addr": 2684 }, { "b": "Eld", "ln": 87, "addr": 2699 }, { "b": "asY2", "ln": 96, "addr": 3042 }, { "b": "w{503BzkVhaz2C2z!9AJw\u003c{@UB98EUd0oAsB7nS$wN[RCA=-\u0026PwQ5rqvjrsC", "ln": 97, "addr": 3046 }, { "b": "arUxgasFQUBAh8kxd1/+jS[\u0026(AaJ%1aA.NkB7nS$wN[RCA=--MDJ", "ln": 98, "addr": 3095 }, { "b": "arR^HA+funA=91hzEWP}wMqS1d0oAsB7nS$wN[RCA=--.A+fiavpJ\u003c%wQ5rqvjSKjzEWP}wLWhPdlv", "n": [ { "c": 3, "d": "URL-encodes data via encodeURI", "i": "micro-behaviors/data/encode/url::encodeuri-call", "o": 3148, "z": 9, "cf": 0.7 } ], "ln": 99, "addr": 3137 }, { "b": "arV7", "ln": 100, "addr": 3200 }, { "b": "arUYoBAIRwaz#sry=.", "ln": 101, "addr": 3204 }, { "b": "Eld", "ln": 102, "addr": 3219 }, { "b": "fdFB]v@DmdwPz)layMy5xKL{\u0026v@#p5azCZotu\u0026\u003cpeNg1?h^ELFzY\u0026+oB0bQCy-)qbv@C)?wftD6B.M2cy?mHae*8R%", "ln": 103, "addr": 3222 }, { "b": "w{503BzkVhaz2C2z!9APzE\u003ekaxEL6J", "ln": 104, "addr": 3295 }, { "b": "arU\u0026oAV/lxjS[lFe[nN6AZK+QwKgz^fEY6", "n": [ { "c": 1, "d": "charCodeAt call marker", "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-4", "o": 3330, "z": 13, "cf": 0.92 } ], "ln": 105, "addr": 3320 }, { "b": "arUYoBAIRwaswD.as!MZfFLssg=mfIi5%n\u003elQTvjcOw[xvraUQc[5%Qk0y8CdiG@WfNdgUas^", "n": [ { "c": 1, "d": "charAt in loop pattern", "i": "objectives/anti-static/obfuscation/string/encoding::js-charat-loop", "o": 3363, "z": 25, "cf": 0.7 } ], "ln": 106, "addr": 3348 }, { "b": "arR^HarS3=f!$Kwh8WxMiyb#0l}6M)e[nN6AZs^}zxHnGfNdgUi@", "ln": 107, "addr": 3407 }, { "b": "Ee", "ln": 108, "addr": 3449 }, { "b": "arU\u0026oAV/rzjS[SXA=1SYBz97wvrufii@", "ln": 159, "addr": 4721 }, { "b": "arSr\u003cawV(\u003eC{1:)e?Xt-wOc3bBz\u0026ply*?BcwO}", "ln": 160, "addr": 4747 }, { "b": "arU\u0026oAV/xBjS)M!qBKtWuQNE-mmg3IqDWu$k#6*wmn^F\u003cmlp", "n": [ { "c": 1, "d": "Plain JavaScript identifier assignment", "i": "metadata/lang/scripted::plain-js-identifier-assignment", "o": 4784, "z": 32, "cf": 1.0 } ], "ln": 161, "addr": 4778 }, { "b": "arSr\u003caxJa%A+fiavpJ\u003c\u003eCwhejas5V:Cw7Y2xDRe2ByO#}B0a)lfcB.nw]zZ3aARpdatbn?vR64TB-RapBzbxf", "ln": 162, "addr": 4817 }, { "b": "arSr\u003cazk?9A:-\u003ccwO2{9Bzb98iS", "ln": 163, "addr": 4886 }, { "b": "arSr\u003casG2{aA}xtzE[05AV/EDA=91daAz4fvrujbwGU@2Bz8!hzGG!tvqWh@vSME7B-.gqAa9\u003c4e=", "ln": 166, "addr": 5036 }, { "b": "arUomAV==Nvr9Ggj0k}\u003eauZ\u0026^e]\u003eJxy***+c#{\u003cYcNpz]djDw.jS[Y9aAeC^aAn?MDWN%", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 5099, "z": 6, "cf": 0.5 } ], "ln": 167, "addr": 5098 }, { "b": "arUYoBAIRwaAfy", "ln": 168, "addr": 5154 }, { "b": "arR^HarSr\u003caAz4mz!%PdaAg+hxDRnmz/xody\u003cu", "ln": 216, "addr": 6592 }, { "b": "arR^HarUxgasIqBze:r9w[+*!p*[DVe[nN6AZK+QwKgz^fEXa/jV%]wCRS\u003eNfdF7$asY2[aBtjNfe1C!vruf9x(+zqwO+^%x)a4", "n": [ { "c": 1, "d": "charCodeAt call marker", "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-4", "o": 6633, "z": 25, "cf": 0.92 } ], "ln": 217, "addr": 6623 }, { "b": "arR^HarR^HC42zlvpBpQvrUKRBz8^Way/tay*?p7wNw$^BAn\u003csvSME7B-.g{A+NdswPQ*UCtIZ\u0026xECqLE0^4:cN/", "ln": 218, "addr": 6703 }, { "b": "asXHkxLzJgv@bN{B0a$hzGGr3zGu}wwPS39A=SvizE:(5wPS39A=Svnz/M$xxK@r9vrcEhaA7\u003cmBzbkdrz(yv", "ln": 257, "addr": 7685 }, { "b": "asXHkxK@qGBAxYVwPR3St0aDWBuRuuBAxY/wPR3St0aDWBuQ*:wPRQ7woe(lwPS6nzxK4mwGUI{v@C)?wft\u00261A=-AQeG/aM", "ln": 258, "addr": 7754 }, { "b": "asXG@v@C)?k6p)We]UltB7D:Efj]cvb@de-vr9.Ae[X:qp*[DVc[dniv@C)?j%k5-y?$kmwPS6nzxK4mwGUI{v@C)?wft\u00261Bz9i", "n": [ { "c": 1, "d": "Percent-encoded octet context", "i": "micro-behaviors/communications/url/encoded::percent-encoded-octet-context", "o": 7855, "z": 3, "cf": 0.85 } ], "ln": 259, "addr": 7831 }, { "b": "asXG@BAxY1w]zPgvQTptflzq1e=", "ln": 260, "addr": 7911 }, { "b": "asW", "ln": 261, "addr": 7933 }, { "b": "arU=tx(+[Fv}YB\u003cwNuMyaAy[mq!6GLzdL^", "ln": 284, "addr": 8807 }, { "b": "arU=tx(+[pA+e=)zGGP3y\u0026-@ajS[=NCscyZwmYU2x\u003c\u003e?0i@", "ln": 285, "addr": 8835 }, { "b": "arU=tx(+[qz/5]%zEjIHaAy[ml#M{Jx(l0", "n": [ { "c": 1, "d": "main_* architecture payload name", "i": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "o": 8882, "z": 5, "cf": 0.96 } ], "ln": 286, "addr": 8873 }, { "b": "arU=tx(+[Cz/P@bauZ\u0026^z/P}Y", "ln": 287, "addr": 8901 }, { "b": "arU=tx(+[Cvruf\u0026auZ\u0026/vrUKRBz9-", "ln": 288, "addr": 8922 }, { "b": "arSr!dG", "ln": 291, "addr": 9004 }, { "b": "arR^Rav73]AaHesl2}0OD3\u003cHLy\u00261I", "n": [ { "c": 2, "d": "Recognized developer credential marker", "i": "objectives/credential-access/cloud/devops-bundle::developer-credential-sweep-recognized-marker", "o": 9015, "z": 5, "cf": 0.95 } ], "ln": 292, "addr": 9010 }, { "b": "arR^Rf8", "ln": 293, "addr": 9034 }, { "b": "arUxgasIbIy?$jqjV%{fxLzJuAa9\u003c4uNWaAaA8yAe]U@OxEE$ox(+[Cvruf\u0026dlwV2", "ln": 307, "addr": 9458 }, { "b": "arUxgasIbIy?$jqjV%{fxLzJuADL\u0026kD0-0yDMWlHBs}JPB7=%Hkpn08Bzbxfe]=2BA^q1vj0n}", "ln": 308, "addr": 9511 }, { "b": "arUxgasIbIy?$jqjV%{fxLzJuw].r)zdNQbuNWaAaA8yAe]U@OxECkMcOcxZxLzJuw].r)zdNQbuNX5VEe", "ln": 309, "addr": 9571 }, { "b": "arUYoBAIRwaA8yAe]2rszyu\u003eWdlv", "n": [ { "c": 3, "d": "Array literal joined with empty string", "i": "objectives/execution/interpreter/scripting/host::array-join-empty-string", "o": 9646, "z": 8, "cf": 0.8 } ], "ln": 310, "addr": 9637 }, { "b": "Eld", "ln": 311, "addr": 9660 }, { "b": "", "ln": 312, "addr": 9663 }, { "b": "rz(yvAb](sz/*nzwIdFez/fbejS[uVzEW^5z/cWCdiJ%", "ln": 313, "addr": 9664 }, { "b": "arSr\u003cayP85ay/tbzeTqmvSDyhB7Gxkaz2!cwPh-lq^\u003coDA+MUjz*b=kv{%B\u0026aARpdaAI4awO(0h", "ln": 320, "addr": 9944 }, { "b": "arUYoBAIRwaARphB1RJzxK#3(uMZWxay]4[z!9AVqB%k]ze:AhwO#PrBzbxfe]$JowO(0=dk2ZXoMbb^AZKnRwHF#?", "n": [ { "c": 2, "d": "decodeURIComponent function", "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-decodeuricomponent", "o": 10030, "z": 18, "cf": 0.7 } ], "ln": 321, "addr": 10005 }, { "b": "Eld", "ln": 322, "addr": 10078 }, { "b": "arUxgasIbsCtJi#BswtV", "ln": 385, "addr": 11868 }, { "b": "arR^HzE[2*z/P}xjS)Hxzdm6%c#JQup\u0026yw@dlv", "ln": 386, "addr": 11885 }, { "b": "arR^Hx\u003ewFozE[2*z/P}xaW4$hc#JQup\u0026yw@asni+CXgM1w*]eKDJ", "n": [ { "c": 1, "d": "0xff hex byte token", "i": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "o": 11947, "z": 4, "cf": 0.5 } ], "ln": 387, "addr": 11916 }, { "b": "arR^HarU=tA=ldAzE[2mmriA!AWSq4vpQH1z/P}xzGP/9wPw[vas!NLwP{%?A=--(", "ln": 388, "addr": 11958 }, { "b": "arR^HEe", "ln": 389, "addr": 12011 }, { "b": "asY2", "ln": 455, "addr": 13760 }, { "b": "rz(yvAb](sz/*nzwIe4nBu%.Vp*[xMzdN*2A=Su^azb+lv@#B6zxHuDvrb^[B15kU", "ln": 456, "addr": 13764 }, { "b": "arUxgasItSAaJ%1aAg+fvqQ6djV$}JcVrEewN/*fdiJ%", "n": [ { "c": 1, "d": "String literal equality or membership check", "i": "micro-behaviors/data/control-flow/analysis::string-literal-equality-check", "o": 13838, "z": 11, "cf": 0.92 } ], "ln": 457, "addr": 13817 }, { "b": "arR^Hx\u003ewFoaT?qrA:-*aazC.mByx5%wP8f6l2}0OC{@", "ln": 458, "addr": 13853 }, { "b": "arR^HarR^Hcmf\u0026-Aa9=}zf3?lzGx]dzEWl@w/%(UygQ)%", "ln": 459, "addr": 13888 }, { "b": "arR^HarR^HarR^HE0^5jvRPE:Bs}JMz//]tD2NsEBz\u003e91A+PA7e[nsay::mhA:-*adiG=%jS(aRz^)D)v@@?VA=LPlt{?6IaBs", "n": [ { "c": 2, "d": "Invokes function with .call()", "i": "micro-behaviors/data/control-flow/analysis::js-function-call-method", "o": 13965, "z": 13, "cf": 0.84 }, { "c": 1, "d": "String literal contains array word", "i": "metadata/file/format::vocab-array", "o": 13992, "z": 5, "cf": 0.97 } ], "ln": 460, "addr": 13925 }, { "b": "arR^HarU\u0026oAV/mhCtIZ*vqQ6djS)%mi@", "ln": 461, "addr": 14004 }, { "b": "arR^HarU\u0026oAV/6sjS(shi@", "ln": 462, "addr": 14030 }, { "b": "arR^HarUomAV==Nvr9GaazCZoAa9=}zf4cGDJ", "ln": 463, "addr": 14048 }, { "b": "arR^HarR^HC42zlB%5{\u003cAa9=}zf5]%t@@", "n": [ { "c": 1, "d": "Decoded property constructor access", "i": "objectives/anti-static/obfuscation/eval/loader::decoded-property-constructor", "o": 14086, "z": 17, "cf": 0.9 } ], "ln": 464, "addr": 14078 }, { "b": "arR^HarR^Hx\u003ewFocV:xIx(mMhau.\u003eJaAR)FwP8f6B$1LX", "ln": 465, "addr": 14105 }, { "b": "arR^HarR^HarUMkCtIZ*vqQ6\u0026d\u003etstauZ\u0026.i@", "ln": 466, "addr": 14142 }, { "b": "arU\u0026oAV/vAwPA5.B.h:Vax@bk", "ln": 474, "addr": 14283 }, { "b": "arU\u0026oAV/BmAa9=}Bz(gxjS(a1i@", "ln": 475, "addr": 14304 }, { "b": "arUomAV==Nvr9G9auZ\u00263j0nnXjrOPKA:-*ae]k9pxlm/GdiJ%", "n": [ { "c": 1, "d": "JavaScript length property", "i": "metadata/lang/scripted::length-prop", "o": 14355, "z": 6, "cf": 1.0 } ], "ln": 476, "addr": 14326 }, { "b": "arR^HC42zlyAL+.Aa9=}zf5]@d\u003es)!", "ln": 477, "addr": 14366 }, { "b": "arR^HC42zlB%5{\u003cAa9=}zf5]@d\u003es)!", "ln": 478, "addr": 14391 }, { "b": "arR^HEe", "ln": 483, "addr": 14574 }, { "b": "arV7", "ln": 484, "addr": 14580 }, { "b": "arU=tx(+[DB.bPsuM.GOADL\u0026kC%VT=e]2rszyu\u003eWdlv", "n": [ { "c": 1, "d": "Variable assigned join('') deobfuscation tail", "i": "objectives/anti-static/obfuscation/string/conceal::js-join-empty-assignment-tail", "o": 14591, "z": 26, "cf": 0.97 } ], "ln": 485, "addr": 14584 }, { "b": "arUYoBAIRwaARphB2%", "ln": 486, "addr": 14619 }, { "b": "Eld", "ln": 487, "addr": 14634 }, { "b": "arR^HarU=tx(+[Cvrb^[lT:FrwNuMyax@bk", "ln": 492, "addr": 14754 }, { "b": "arR^HEir9qB7DFv", "ln": 493, "addr": 14783 }, { "b": "arR^HarU\u0026oAV!\u003e8x\u00265kUvqQ6djS[.%B8U@fBsn!Dcr@=vfdw%", "n": [ { "c": 1, "d": "JavaScript split() method call", "i": "micro-behaviors/data/string/split::js-split-call", "o": 14818, "z": 7, "cf": 0.8 } ], "ln": 494, "addr": 14796 }, { "b": "arR^HarU\u0026oAV/pyBrAZ?tu%q", "ln": 495, "addr": 14836 }, { "b": "arR^HarU\u0026oAV/cujS(shi@", "ln": 496, "addr": 14856 }, { "b": "arU\u0026oAV/shauZ\u0026?xLzJuAa9=}z9}-wxK$Kj", "ln": 528, "addr": 15997 }, { "b": "arU\u0026oAV/sfA:-*aauZ\u0026Kt@@", "ln": 529, "addr": 16026 }, { "b": "arUomAV==Nvr9G8auZ\u00263efFZJjS(Buazz@XaAg*yy?mG%Bz9-Ux=[]?atLw*DJ", "n": [ { "c": 2, "d": "Loop with step 2", "i": "micro-behaviors/data/encode/hex::loop-step-2", "o": 16047, "z": 45, "cf": 1.0 } ], "ln": 530, "addr": 16045 }, { "b": "arR^Hx\u003ewFoyH}=ljV$}JAar9^t}3[y", "ln": 531, "addr": 16095 }, { "b": "arR^HarUxgasIbsCuec*B.acZwmZ0djrO/Qy\u0026%rge]k9pxlm/oaBs", "ln": 532, "addr": 16120 }, { "b": "arR^HEir9qB7DFv", "ln": 535, "addr": 16222 }, { "b": "arR^HarUSiA:-*ae]U@OxEE?ftwmv]aAg*{x=[]Gf\u003cMj\u0026", "ln": 536, "addr": 16235 }, { "b": "arR^HEe", "ln": 537, "addr": 16272 }, { "b": "arV7", "n": [ { "c": 3, "d": "Executes script files", "i": "objectives/execution/condition/platform::executes-scripts", "o": 16280, "z": 9, "cf": 0.6 } ], "ln": 538, "addr": 16278 }, { "b": "arU(wx(4u6c#JQur://!wL3=IwQ2sWaA?gfB.bRDy?mG%Bz99CDJ", "ln": 539, "addr": 16282 }, { "b": "arR^HAa9=}zf4sGB-RjAyH}=xaA?gfB.bR#zE[2)vqH6$nP56ICQ\u003epIdlv", "ln": 540, "addr": 16324 }, { "b": "arV7", "ln": 541, "addr": 16371 }, { "b": "arU\u0026oAV/sfA:-/Vvq)tLaBwI#", "ln": 579, "addr": 17501 }, { "b": "arUomAV==Nvr9G8auZ\u00263j0nkWjrO-Vx(+[Cvrb^[lT:FrwNv6awO#d5xGEtJas/O$gast)", "ln": 580, "addr": 17522 }, { "b": "arR^HC42zlyH}=ljS[\u0026Wx(+[Cvrb^[lT:FrwNwUQd\u003es)R", "n": [ { "c": 1, "d": "var/let/const key-like assignment declaration", "i": "metadata/lang/scripted::js-key-assignment-declaration", "o": 17583, "z": 9, "cf": 1.0 } ], "ln": 581, "addr": 17579 }, { "b": "arR^HarU\u0026oy\u0026%qijS[\u0026Wx(+[Cvrb^[lT:FrwNwUQd\u003es)!", "ln": 582, "addr": 17616 }, { "b": "arR^Hx\u003ewFoaT?bqC{3*saAg+fvqO.EA49jUDJ", "ln": 583, "addr": 17653 }, { "b": "asXHAx(^Z1vRGE$vruj4zxJ!cBzbP6aA.:pwftubaw+\u003cjnMW9QwOld4vr9G4CYmXmB8#5lzGvuKx(\u003eFiB0bveBAIRjy-)e7wb", "ln": 640, "addr": 19245 }, { "b": "asXHzz/6ufzG6A2v}u^8zY\u003cgzwGUz7A+e)ay*?ubwQ5fmwPI{bz/cXfz/M$tvrcB6zF78lxK@r9z//MdBzkf1azbthwD", "ln": 641, "addr": 19323 }, { "b": "asXHzz/6DizE)ZcB0bykayMx)qB@0KwObH]wO#0?e=", "n": [ { "c": 1, "d": "Documentation page terminology", "i": "metadata/file/profile/identity::documentation-page-term", "o": 19420, "z": 9, "cf": 0.82 } ], "ln": 642, "addr": 19397 }, { "b": "asW", "ln": 643, "addr": 19431 }, { "b": "asXG@A6vlmwGUP6y\u002613lx(mMay?W=#azC)tBzbkdA+e)ay*?ubwQ5fmwPI{bz/cXfz/M$fA+eV{x(mMnwn=WfayL", "ln": 644, "addr": 19434 }, { "b": "asXGRarR{^auZ\u0026\u003eCxUVNv@\u003cnBv}^Mbwov", "ln": 664, "addr": 20172 }, { "b": "asXGRarR{!auZ\u00262AckRyx\u003eqx#flIqHf8", "ln": 665, "addr": 20199 }, { "b": "asXGRarR{/auZ\u0026fB-7-3w[=c]wiG", "n": [ { "c": 1, "d": "JavaScript undefined literal", "i": "metadata/lang/scripted::undefined-literal", "o": 20237, "z": 9, "cf": 1.0 } ], "ln": 666, "addr": 20225 }, { "b": "asXGRarR{*auZ\u0026fB-7-3w[=c]wiG", "ln": 667, "addr": 20248 }, { "b": "asXGRarR{?auZ?(qE%VMBy!$", "ln": 668, "addr": 20271 }, { "b": "", "ln": 738, "addr": 22191 }, { "b": "A+funA=911qB@}", "ln": 739, "addr": 22192 }, { "b": "EjlM[i@", "n": [ { "c": 1, "d": "Trailing IIFE closure indicating auto-exec", "i": "objectives/anti-static/obfuscation/eval/dynamic::export-iife-closure", "o": 22204, "z": 6, "cf": 0.85 } ], "ln": 740, "addr": 22204 }, { "b": "", "ln": 741, "addr": 22210 }, { "b": "fe1Cnz/x#xx\u003eIa3av*u*xkzc4nP52\u003c", "ln": 742, "addr": 22211 }, { "b": "fe1Cwx\u003e7Z(B7F(8B-7-3AV/EqwGToTvpJ$ZawuGVwO#0?axA5]B7]MgatLM6", "n": [ { "c": 2, "d": "Package references LICENSE/LICENCE", "i": "metadata/package/documentation::references-license-1", "o": 22265, "z": 7, "cf": 0.7 } ], "ln": 743, "addr": 22236 }, { "b": "fe1ClB-.LmwO#71vru6\u003eayPvmo(B[(mRc3KgbQgegDEiEiY5Pmmn)edgb7Bs", "ln": 744, "addr": 22285 }, { "b": "arS4gr9q)-cPSwaec", "ln": 753, "addr": 22468 }, { "b": "arS45r834liV{djec", "ln": 754, "addr": 22482 }, { "b": "arS46l)\u003e2rg+n", "n": [ { "c": 1, "d": "Country code ID literal (repeated)", "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "o": 22498, "z": 4, "cf": 0.6 } ], "ln": 755, "addr": 22496 }, { "b": "arS46l@DDycPSwcec", "ln": 756, "addr": 22507 }, { "b": "arS46l@DDyqZTQGhy[", "ln": 757, "addr": 22521 }, { "b": "arS44oIW#voKyKXo*{A\u003cau7?", "n": [ { "c": 1, "d": "WMI NAME field marker", "i": "objectives/supply-chain/hidden-payload/runtime::worker-host-serial-assessment--rx-13", "o": 22546, "z": 4, "cf": 0.94 } ], "ln": 758, "addr": 22536 }, { "b": "arS49pEvAwuRS)Ymjgbsi4L", "ln": 759, "addr": 22556 }, { "b": "arS40oHhPQmn\u003eM{aup$", "ln": 760, "addr": 22575 }, { "b": "arS4uA+eVui=[!tx(mD)CQCJ{fF0", "ln": 818, "addr": 23696 }, { "b": "arS4uA+eVui=[!JxjVfjiV{dhec", "ln": 819, "addr": 23719 }, { "b": "arS4uB.2i8iYZ+?zGG]qy\u0026Z%+attt", "n": [ { "c": 1, "d": "Media capture device term keyword", "i": "metadata/permission/capture::capture-device-term", "o": 23744, "z": 5, "cf": 0.86 } ], "ln": 820, "addr": 23741 }, { "b": "arS4uB.2i8iY.7}z/v6+attt", "ln": 821, "addr": 23765 }, { "b": "arS4uB.2i8iY.a?wnbE+A=l8tcPSwcec", "ln": 822, "addr": 23785 }, { "b": "arS4vB-..zzAo?2D2NsxiV{ac", "ln": 834, "addr": 24059 }, { "b": "arS4vB-..zzAo?4vqH6$cPSw7ec", "ln": 835, "addr": 24080 }, { "b": "arS4wvqZl%B2(u}wOC^\u003cBsf9(fF0", "n": [ { "c": 1, "d": "DOM or CSS size property (height)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--height", "o": 24113, "z": 6, "cf": 1.0 } ], "ln": 836, "addr": 24102 }, { "b": "arS4wvqZl%B2(vax\u003ehs0cPSw7ec", "n": [ { "c": 1, "d": "DOM or CSS size property (width)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--width", "o": 24136, "z": 5, "cf": 1.0 } ], "ln": 837, "addr": 24125 }, { "b": "arS4wvq{s5z/dP%vqGT\u003czymE/fF0", "ln": 838, "addr": 24147 }, { "b": "arS4wz!}D}vqGT\u003czymE/fF0", "ln": 839, "addr": 24170 }, { "b": "arS4wz!%6bz/{1Wi^a}Fx\u003eIrhiV{ac", "ln": 849, "addr": 24381 }, { "b": "arS4wz!%6bz/{1Wi^kpGBz93.attt", "ln": 850, "addr": 24406 }, { "b": "arS4wz/6u1zE+^?v}YB-yH}37iV{ac", "n": [ { "c": 1, "d": "Command JSON field", "i": "objectives/command-and-control/remote-command/control::command-json-field", "o": 24433, "z": 8, "cf": 0.78 } ], "ln": 851, "addr": 24430 }, { "b": "arS4wz/6u1zE+^?v@Dj3vqYQ6iV{ph", "ln": 852, "addr": 24455 }, { "b": "arS4wz/6u1zE+^?wnc9[vR/Q^cPSw7ec", "ln": 853, "addr": 24480 }, { "b": "arS4BAYMm5x)KtriV{ac", "ln": 887, "addr": 25197 }, { "b": "arS4BAYMm9x\u003ehs0cPSw7ec", "ln": 888, "addr": 25214 }, { "b": "arS4Cw].r%wJz\u003eXy?WK1cPSw7ec", "n": [ { "c": 1, "d": "Contains iframe text token", "i": "micro-behaviors/ui/window/manage/dom::browser-iframe-element", "o": 25235, "z": 6, "cf": 0.78 } ], "ln": 889, "addr": 25232 }, { "b": "arS4Cw].r%wJz\u003e:A:-/@vSco$wPxdVattt", "ln": 890, "addr": 25254 }, { "b": "arS4Cw].r%wJz\u003e=wOC^\u003cBsf9(fF0", "ln": 891, "addr": 25282 }, { "b": "arS4NA:-D[iYZ!.w)]*#Bsf9(fF0", "ln": 1053, "addr": 28783 }, { "b": "arS4NA:-D[iY.4\u003czE+aQattt", "n": [ { "c": 2, "d": "Recognized cloud config marker", "i": "objectives/exfiltration/stealer/credential/token::cloud-config-recognized-marker", "o": 28816, "z": 4, "cf": 0.95 } ], "ln": 1054, "addr": 28806 }, { "b": "arS4NA:-D[iY.7=vR6v6iV{ac", "ln": 1055, "addr": 28826 }, { "b": "arS4wz!{^ZatLF", "ln": 1107, "addr": 29735 }, { "b": "arS4wz!%6bz/{1DiV{dd", "ln": 1108, "addr": 29747 }, { "b": "arS4wz/6u1zE+aQatLF", "n": [ { "c": 1, "d": "Socket.io command channel", "i": "objectives/command-and-control/remote-command/socketio-control::socketio-command-channel", "o": 29767, "z": 7, "cf": 0.88 } ], "ln": 1109, "addr": 29764 }, { "b": "arS4xvrt{9iV{ac", "ln": 1110, "addr": 29780 }, { "b": "arS4xvrt{]x(!wziV{ac", "ln": 1111, "addr": 29793 }, { "b": "arS4zz/fUAiV{ac", "ln": 1125, "addr": 29986 }, { "b": "arS4zz/o-eAWJ)\u003cfF0", "ln": 1126, "addr": 29999 }, { "b": "arS4zz/PXxiV{ac", "n": [ { "c": 1, "d": "Repeated meta or form action labels", "i": "objectives/evasion/decoy/cloaking::adspect-action-router-cases--rx-11", "o": 30017, "z": 4, "cf": 0.9 } ], "ln": 1127, "addr": 30014 }, { "b": "arS4zA:-/@cPSw9h-95", "ln": 1128, "addr": 30027 }, { "b": "arS4zA:-/@B7GCviV{gpgaS", "ln": 1129, "addr": 30043 }, { "b": "arS4GwO#SriV{ac", "ln": 1155, "addr": 30390 }, { "b": "arS4GwPRudiV{gpg+n", "n": [ { "c": 1, "d": "Repeated meta or form action labels", "i": "objectives/evasion/decoy/cloaking::adspect-action-router-cases--rx-11", "o": 30406, "z": 4, "cf": 0.9 } ], "ln": 1156, "addr": 30403 }, { "b": "arS4GwPRH7cPSw7ec", "ln": 1157, "addr": 30418 }, { "b": "arSr\u003cazb+lv@#B6zEEu}BA]0yw/#hewGUJ4v%8T1zGE1nB8AvEayPC4x(4i!y?kj", "ln": 1447, "addr": 38226 }, { "b": "arU\u0026oAV!}hBzk\u0026xoMa\u0026+B-o==wO(0@BrAZ", "ln": 1448, "addr": 38278 }, { "b": "arR^HarS6WB-7-3w[=c]wg5GyjV%{fD2Ntkw/#qizE^WfasnATCwg@9z*bzkwn+$2zdNQbcTwe", "ln": 1449, "addr": 38306 }, { "b": "arR^HarR^HarS(\u003eCwg@9z*bzkwn+$2zdNQbcTwumA+eW3wKQADzdNQbc)%aFCYWwmwNM@nauyS.B.\u003e\u003eQ", "n": [ { "c": 3, "d": "Browser stages text for clipboard copy", "i": "micro-behaviors/os/clipboard/access::browser-textarea-copy-staging", "o": 38397, "z": 24, "cf": 0.85 } ], "ln": 1450, "addr": 38366 }, { "b": "arSr!dG", "ln": 1451, "addr": 38431 }, { "b": "arR^RavG^Jz!9B2ayPdgnk@qSaz2Cjx([RM", "ln": 1452, "addr": 38437 }, { "b": "arR^R", "ln": 1453, "addr": 38466 }, { "b": "arR^R", "ln": 1482, "addr": 39051 }, { "b": "arR^Rav6)OA:-/cDVKpHx(mNiaz$R8wGV8dwGUG3zGGDcBrC47BA.qczxK4mwGSuEcM(\u0026nwft#cwGSuZcOt", "ln": 1483, "addr": 39056 }, { "b": "arR^Rav6%UBAIRwaBwfKA+PA7Eiq@vB7]J8y?j-izFrQ0wmV([z!9AhAbPDdBrC1kayMylBAh8kxd:", "n": [ { "c": 1, "d": "Blessed unicode helper text", "i": "well-known/lib/blessed::blessed-unicode-helper-text", "o": 39154, "z": 7, "cf": 0.9 } ], "ln": 1484, "addr": 39123 }, { "b": "arR^Rf8", "ln": 1485, "addr": 39186 }, { "b": "arUoszEW^5z/cXlz/oAlA7aU^x([RGzEEx[diJ%", "ln": 1486, "addr": 39192 }, { "b": "arR^Hx\u003ewFomnu/Nr7PISe[!WmpJ{XMA=k]dA==NPzEEx[djDx^aAz4nB-Ivxmnu/Nr7PIStw^\u003e^wNdwuEe", "ln": 1489, "addr": 39325 }, { "b": "arR^HC42zlz6g$:zEEx[e]t3sv}Wo3wN/B\u003evqFwNv{%s/qE}ps", "ln": 1490, "addr": 39391 }, { "b": "arR^Hx\u003ewFoz7cPO", "ln": 1491, "addr": 39432 }, { "b": "arR^HarUYoBAIRwax9x5x(mMow].*blUG[GlVlHDc#-QnB7E{XBsq0gf\u003cMsMf!+49i@", "n": [ { "c": 3, "d": "String.fromCharCode call", "i": "micro-behaviors/data/encode/char-code::fromcharcode-call", "o": 39458, "z": 19, "cf": 0.9 } ], "ln": 1492, "addr": 39445 }, { "b": "arR^HEir9qB7DFdw/@GBaT?gIjS[SJzdLtpvru0)c$)gpmrq%EAaI{UdjDX*DJ", "ln": 1493, "addr": 39499 }, { "b": "arR^HarUYoBAIRwax9x5x(mMow].*blUG[GlVlHDc#-QnB7E{XBsq0gf\u003cMsMf/yEfi@", "n": [ { "c": 3, "d": "JavaScript hex escape decoder", "i": "micro-behaviors/data/decode/hex::js-hex-charcode-decoder", "o": 39562, "z": 38, "cf": 0.9 } ], "ln": 1494, "addr": 39549 }, { "b": "arR^HEir9qB7DFdw/@HkzGGPmC$-c{yJTO+y?mD{zGE0FclNwrw[szGBzk\u0026xpgn0JqE}F5wPI@wzEEx[djDx^", "ln": 1495, "addr": 39603 }, { "b": "arR^HarUlkBzk\u0026xoMa\u0026+B-o==wO(0@Bs}oBzE)\u0026Vr834ejS(a0cM\u003c]ZzEEx[as!MZj108", "n": [ { "c": 3, "d": "Assigns DOM innerHTML", "i": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "o": 39697, "z": 12, "cf": 0.8 } ], "ln": 1496, "addr": 39672 }, { "b": "arR^HarU\u0026oAV/EnCYU5\u003eaz2Cjx([R]z/oAlA7aOOzdNQbe{7VHBvf$:By/uii@", "ln": 1497, "addr": 39728 }, { "b": "arR^HarT9Fr7Q4Xmn)AdvqPNYauZ\u0026?wQ5qU", "ln": 1498, "addr": 39778 }, { "b": "arR^HarUYoBAIRwaARgtBuo", "ln": 1499, "addr": 39807 }, { "b": "arR^Rar@0Rfj]cvkvO5wjZ}\u0026CcsZ$kC%cm\u0026B.8{", "ln": 1529, "addr": 40615 }, { "b": "arR^Ras57LzE))0vq]^DzGGPmx\u003equlcVA=.cu9VXcl):\u003ev\u003eY$}aw==ncqXzrtY?.Rk}\u003cVnatkw\u003cmOcYRmlhMbzF%-pazb4@y\u0026%=f", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 40647, "z": 57, "cf": 0.9 } ], "ln": 1530, "addr": 40647 }, { "b": "arR^Rar@0RAa}EuBUCQsfKe-OgH\u00269\u0026aw==ntY?.Rk}(L^fF=0GcJ", "ln": 1531, "addr": 40728 }, { "b": "arR^HarR^HarUxgasI7HjS(y:c%FodCrf1Wdo*a-cTm\u003c3dLAz=CX7wkzE[6mdjDx^", "ln": 1725, "addr": 47833 }, { "b": "arR^HarR^HarR^Hx\u003ewFozcFY1e]k9pxlm/fjV$}JzE[6me]k9pxlm/fcmf\u003cOvrcEhtx1I4as!M?t{8o[jS(aocN*f+", "n": [ { "c": 2, "d": "Writing data to buffer at calculated offset", "i": "micro-behaviors/data/buffer::offset-write", "o": 47938, "z": 12, "cf": 0.7 } ], "ln": 1726, "addr": 47886 }, { "b": "arR^HarR^HarR^HarSr\u003cazb56BrC74B7D)BzF{UaBAzLqvS=^7aAg+fB7]J8az$+4wmYo", "ln": 1727, "addr": 47959 }, { "b": "arR^HarR^HarR^HarUxgasH[Qv@Dj3wO#PsaBs", "ln": 1789, "addr": 50582 }, { "b": "arR^HarR^HarR^HarR^HC42zlv@Dj3wO#PjjS[YLA==vPB8kM2wHIIoB1wCMdk2vNx(ksDcN?a", "n": [ { "c": 1, "d": "Array literal joined with empty string", "i": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast", "o": 50643, "z": 18, "cf": 0.82 } ], "ln": 1790, "addr": 50613 }, { "b": "arR^HarR^HarR^HarR^HxF9!kzeA\u003c4Bsm", "ln": 1791, "addr": 50673 }, { "b": "arR^HB98BBd)k15cP.", "ln": 1879, "addr": 53398 }, { "b": "arR^Hx\u003ewFoB8U@fBxrf)y^RSIBAIRndiJ%", "ln": 1880, "addr": 53413 }, { "b": "arR^HarUYoBAIRwaAITBe]$#Fx(\u003e+zwHPX", "n": [ { "c": 1, "d": "JavaScript split() method call", "i": "micro-behaviors/data/string/split::js-split-call", "o": 53454, "z": 9, "cf": 0.8 } ], "ln": 1881, "addr": 53441 }, { "b": "arR^HEir9qB7DFv", "ln": 1882, "addr": 53469 }, { "b": "arR^HarU\u0026oAV/sfA==vBjS)%mi@", "ln": 1883, "addr": 53482 }, { "b": "arR^HarU\u0026oAV/gbB97k%B09Q*fGP", "ln": 1884, "addr": 53504 }, { "b": "arR^HarU\u0026oAV/iX", "ln": 1885, "addr": 53527 }, { "b": "arR^HarU(wx(4u6c[5{PjS[=Re[Gosv\u003c(zuAW-BWaW4$hzGP=idiJ%", "n": [ { "c": 1, "d": "Shell execution wrapper", "i": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "o": 53540, "z": 26, "cf": 0.8 } ], "ln": 1886, "addr": 53540 }, { "b": "arR^HarR^HAa9^eB1RAOB7=$yBAf0PBZ/AlA+PA7c#rskBwM)%efF^Zx(mD)CQU76", "ln": 1887, "addr": 53584 }, { "b": "arR^HarR^HAa9^eB1RAOB7=$stqftii@", "ln": 1888, "addr": 53637 }, { "b": "arR^HarR^HarR^Hx\u003ewFoAa9^eB6AP?au.\u003eJasxu2diJ%WvSD3*yDAU!", "ln": 1987, "addr": 56893 }, { "b": "arR^HarR^HarV7PwO=B0azCBgc[(=ajS[YLA==wbA9U8gzE^s6pI81{B-hwkdjDx^", "n": [ { "c": 2, "d": "JavaScript substring search call", "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "o": 56973, "z": 8, "cf": 0.82 } ], "ln": 1988, "addr": 56938 }, { "b": "arR^HarR^HarR^HB76n\u0026B-hwkauZ\u0026?A=\u003e}P", "ln": 1989, "addr": 56991 }, { "b": "arR^HarR^HvS=o9jS[fxB.imvz!T8qcNQu8", "n": [ { "c": 1, "d": "Array literal joined with empty string", "i": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast", "o": 57207, "z": 9, "cf": 0.82 } ], "ln": 1996, "addr": 57193 }, { "b": "arR^HC42zlAuEy!B$Norvra.NwmX5Gc[)8i", "n": [ { "c": 1, "d": "charCodeAt call marker", "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-4", "o": 57574, "z": 12, "cf": 0.92 } ], "ln": 2013, "addr": 57562 }, { "b": "arR^HarR^HarUf5B7DFcBzU?Je[5\u003cEAaJl3rz(y}mP8Jxo*}/RcTw+", "ln": 2325, "addr": 69104 }, { "b": "arR^HarR^HarR^Hx\u003ewFoC42ifwGSrDaswxYau.\u003eJaA?gfB.9gnxKL{EBsn*(diJ%", "n": [ { "c": 1, "d": "charAt in loop pattern", "i": "objectives/anti-static/obfuscation/string/encoding::js-charat-loop", "o": 69181, "z": 12, "cf": 0.7 } ], "ln": 2326, "addr": 69148 }, { "b": "arR^HarR^HarR^HarU\u0026oy\u0026%qijS[]Ry\u0026%qwB9g@kBAh8kxdbF-j0kU0fcCpDzeTPeaARpdaz+Q$wnb{]aswxY", "ln": 2327, "addr": 69200 }, { "b": "arR^HA+funA=91rB-.OBBu%}/vr\u003cFuz!T8qcNQu8", "n": [ { "c": 1, "d": "Array literal joined with empty string", "i": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast", "o": 71781, "z": 16, "cf": 0.82 } ], "ln": 2396, "addr": 71770 }, { "b": "", "ln": 2430, "addr": 73292 }, { "b": "fe1Cwz/oYdzxJ$hB98Cpv@#B6zGu}sw/%DHygeGh", "ln": 2431, "addr": 73293 }, { "b": "fe1CYBzU?CB75%2Bzl5jAV/ExayP85z*9soz/M$wBA}XpzF5", "n": [ { "c": 1, "d": "Permission-grant action verb keyword", "i": "metadata/permission/capture::permission-grant-verb", "o": 73347, "z": 5, "cf": 0.86 } ], "ln": 2432, "addr": 73326 }, { "b": "xMO9cg+I6[r8MpOq^gR0iY.t7D2d4tt{8oMfGP", "ln": 2433, "addr": 73365 }, { "b": "xMO9cg+Ii\u003cmnliCr8W0GB98XzwHy+ajS(Bu", "ln": 2434, "addr": 73396 }, { "b": "", "ln": 2444, "addr": 73731 }, { "b": "x\u003ewFoBA}?pz!pbez!a0bwGScVjS(a{zE^r\u003cx(mG)cN*f+", "n": [ { "c": 2, "d": "Compares value against the undefined string", "i": "micro-behaviors/data/control-flow/analysis::js-undefined-string-compare", "o": 73751, "z": 14, "cf": 0.6 } ], "ln": 2445, "addr": 73732 }, { "b": "arR^HzeS%cy?kkgCYmOwBAnM/azt\u003ely*Rl(zFsibDsYe", "n": [ { "c": 1, "d": "JS module export syntax", "i": "metadata/lang/scripted::js-export-boundary", "o": 73773, "z": 14, "cf": 0.5 } ], "ln": 2446, "addr": 73769 }, { "b": "Ee", "ln": 2447, "addr": 73805 }, { "b": "", "ln": 2448, "addr": 73807 } ], "depth": 1, "facts": { "imp": [ [ "", "URI" ], [ "", "nullIfAbsent" ], [ "", "nullIfAbsent" ], [ "", "nullIfAbsent" ], [ "", "nullIfAbsent" ], [ "", "nullIfAbsent" ], [ "", "nullIfAbsent" ], [ "", "nullIfAbsent" ], [ "", "uri" ], [ "", "encodeIfExists2" ], [ "", "encodeIfExists2" ], [ "", "encodeIfExists" ], [ "", "port.toString" ], [ "", "encodeIfExists2" ], [ "", "encodeIfExists" ], [ "", "uri.setRawQuery" ], [ "", "query.replace" ], [ "", "uri.setAllParameters" ], [ "", "encodeURIComponent" ], [ "", "encodeURI.replace" ], [ "", "encodeURI" ], [ "", "ch.charCodeAt" ], [ "", "'0123456789ABCDEF'.charAt" ], [ "", "'0123456789ABCDEF'.charAt" ], [ "", "path.replace.replace" ], [ "", "path.replace" ], [ "", "PARENT_DIRECTORY_HANDLER" ], [ "", "PARENT_DIRECTORY_HANDLER_RE" ], [ "", "EXTRA_PARENT_PATHS_RE" ], [ "", "normPath" ], [ "", "p.replace" ], [ "", "absoluteUri" ], [ "", "baseUri.clone" ], [ "", "overridden" ], [ "", "relativeUri.hasScheme" ], [ "", "absoluteUri.setRawScheme" ], [ "", "relativeUri.getRawScheme" ], [ "", "overridden" ], [ "", "relativeUri.hasCredentials" ], [ "", "absoluteUri.setRawCredentials" ], [ "", "relativeUri.getRawCredentials" ], [ "", "overridden" ], [ "", "relativeUri.hasDomain" ], [ "", "absoluteUri.setRawDomain" ], [ "", "relativeUri.getRawDomain" ], [ "", "overridden" ], [ "", "relativeUri.hasPort" ], [ "", "rawPath" ], [ "", "relativeUri.getRawPath" ], [ "", "simplifiedPath" ], [ "", "collapse_dots" ], [ "", "absoluteUri.setPort" ], [ "", "relativeUri.getPort" ], [ "", "simplifiedPath" ], [ "", "simplifiedPath.replace" ], [ "", "overridden" ], [ "", "simplifiedPath.charCodeAt" ], [ "", "absRawPath" ], [ "", "collapse_dots.replace" ], [ "", "collapse_dots" ], [ "", "absoluteUri.getRawPath" ], [ "", "slash" ], [ "", "absRawPath.lastIndexOf" ], [ "", "simplifiedPath" ], [ "", "collapse_dots.replace" ], [ "", "collapse_dots" ], [ "", "absRawPath.substring" ], [ "", "collapse_dots" ], [ "", "simplifiedPath" ], [ "", "simplifiedPath.replace" ], [ "", "absoluteUri.setRawPath" ], [ "", "absoluteUri.setRawPath" ], [ "", "overridden" ], [ "", "relativeUri.hasQuery" ], [ "", "absoluteUri.setRawQuery" ], [ "", "relativeUri.getRawQuery" ], [ "", "overridden" ], [ "", "relativeUri.hasFragment" ], [ "", "absoluteUri.setRawFragment" ], [ "", "relativeUri.getRawFragment" ], [ "", "URI.prototype.toString" ], [ "", "out" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "out.join" ], [ "", "URI.prototype.clone" ], [ "", "URI.prototype.getScheme" ], [ "", "decodeURIComponent.toLowerCase" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.getRawScheme" ], [ "", "URI.prototype.setScheme" ], [ "", "encodeIfExists2" ], [ "", "URI.prototype.setRawScheme" ], [ "", "URI.prototype.hasScheme" ], [ "", "URI.prototype.getCredentials" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.getRawCredentials" ], [ "", "URI.prototype.setCredentials" ], [ "", "encodeIfExists2" ], [ "", "URI.prototype.setRawCredentials" ], [ "", "URI.prototype.hasCredentials" ], [ "", "URI.prototype.getDomain" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.getRawDomain" ], [ "", "URI.prototype.setDomain" ], [ "", "encodeURIComponent" ], [ "", "URI.prototype.setRawDomain" ], [ "", "URI.prototype.hasDomain" ], [ "", "URI.prototype.getPort" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.setPort" ], [ "", "newPort" ], [ "", "Number" ], [ "", "URI.prototype.hasPort" ], [ "", "URI.prototype.getPath" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.getRawPath" ], [ "", "URI.prototype.setPath" ], [ "", "encodeIfExists2" ], [ "", "URI.prototype.setRawPath" ], [ "", "newPath" ], [ "", "String" ], [ "", "URI.prototype.hasPath" ], [ "", "URI.prototype.getQuery" ], [ "", "decodeURIComponent.replace" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.getRawQuery" ], [ "", "URI.prototype.setQuery" ], [ "", "encodeIfExists" ], [ "", "URI.prototype.setRawQuery" ], [ "", "URI.prototype.hasQuery" ], [ "", "URI.prototype.setAllParameters" ], [ "", "Object.prototype.toString.call" ], [ "", "newParams" ], [ "", "params" ], [ "", "queryBuf" ], [ "", "separator" ], [ "", "queryBuf.push" ], [ "", "encodeURIComponent" ], [ "", "k.toString" ], [ "", "separator" ], [ "", "queryBuf.push" ], [ "", "encodeURIComponent" ], [ "", "v.toString" ], [ "", "queryBuf.join" ], [ "", "URI.prototype.checkParameterCache_" ], [ "", "cgiParams" ], [ "", "q.split" ], [ "", "out" ], [ "", "cgiParams.i.match" ], [ "", "decodeURIComponent.replace" ], [ "", "decodeURIComponent" ], [ "", "decodeURIComponent.replace" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.setParameterValues" ], [ "", "values" ], [ "", "newValueIndex" ], [ "", "pc" ], [ "", "params" ], [ "", "params.push" ], [ "", "params.push" ], [ "", "params.push" ], [ "", "URI.prototype.removeParameter" ], [ "", "URI.prototype.getAllParameters" ], [ "", "URI.prototype.getParameterValues" ], [ "", "values" ], [ "", "values.push" ], [ "", "URI.prototype.getParameterMap" ], [ "", "paramMap" ], [ "", "key" ], [ "", "value" ], [ "", "paramMap.key" ], [ "", "paramMap.key.push" ], [ "", "URI.prototype.getParameterValue" ], [ "", "URI.prototype.getFragment" ], [ "", "decodeURIComponent" ], [ "", "URI.prototype.getRawFragment" ], [ "", "URI.prototype.setFragment" ], [ "", "encodeURIComponent" ], [ "", "URI.prototype.setRawFragment" ], [ "", "URI.prototype.hasFragment" ], [ "", "URI_RE_" ], [ "", "URI_DISALLOWED_IN_SCHEME_OR_CREDENTIALS_" ], [ "", "URI_DISALLOWED_IN_PATH_" ], [ "", "URI.parse" ], [ "", "URI.create" ], [ "", "URI.resolve" ], [ "", "URI.collapse_dots" ], [ "", "URI.utils" ], [ "", "uriObj" ], [ "", "parse" ], [ "", "uriObj.getPath" ], [ "", "resolve.toString" ], [ "", "resolve" ], [ "", "parse" ], [ "", "parse" ], [ "", "html4" ], [ "", "html4.atype" ], [ "", "html4.atype" ], [ "", "html4.ATTRIBS" ], [ "", "html4.ATTRIBS" ], [ "", "html4.eflags" ], [ "", "html4.eflags" ], [ "", "html4.ELEMENTS" ], [ "", "html4.ELEMENTS" ], [ "", "html4.ELEMENT_DOM_INTERFACES" ], [ "", "html4.ELEMENT_DOM_INTERFACES" ], [ "", "html4.ueffects" ], [ "", "html4.ueffects" ], [ "", "html4.URIEFFECTS" ], [ "", "html4.URIEFFECTS" ], [ "", "html4.ltypes" ], [ "", "html4.ltypes" ], [ "", "html4.LOADERTYPES" ], [ "", "html4.LOADERTYPES" ], [ "", "'I'.toLowerCase" ], [ "", "html" ], [ "", "parseCssDeclarations" ], [ "", "sanitizeCssProperty" ], [ "", "cssSchema" ], [ "", "parseCssDeclarations" ], [ "", "sanitizeCssProperty" ], [ "", "cssSchema" ], [ "", "ENTITIES" ], [ "", "decimalEscapeRe" ], [ "", "hexEscapeRe" ], [ "", "safeEntityNameRe" ], [ "", "entityLookupElement" ], [ "", "window.document.createElement" ], [ "", "ENTITIES.hasOwnProperty" ], [ "", "name.match" ], [ "", "String.fromCharCode" ], [ "", "parseInt" ], [ "", "name.match" ], [ "", "String.fromCharCode" ], [ "", "parseInt" ], [ "", "safeEntityNameRe.test" ], [ "", "entityLookupElement.innerHTML" ], [ "", "text" ], [ "", "ENTITIES.name" ], [ "", "lookupEntity" ], [ "", "nulRe" ], [ "", "s.replace" ], [ "", "ENTITY_RE_1" ], [ "", "ENTITY_RE_2" ], [ "", "s.replace" ], [ "", "ampRe" ], [ "", "looseAmpRe" ], [ "", "ltRe" ], [ "", "gtRe" ], [ "", "quotRe" ], [ "", "rcdata.replace.replace.replace" ], [ "", "rcdata.replace.replace" ], [ "", "rcdata.replace" ], [ "", "ATTR_RE" ], [ "", "splitWillCapture" ], [ "", "'a,b'.split" ], [ "", "EFLAGS_TEXT" ], [ "", "hcopy" ], [ "", "parse" ], [ "", "continuationMarker" ], [ "", "tagName" ], [ "", "parts" ], [ "", "htmlSplit" ], [ "", "state" ], [ "", "parseCPS" ], [ "", "parseCPS" ], [ "", "h.startDoc" ], [ "", "tagName" ], [ "", "pos" ], [ "", "end" ], [ "", "current" ], [ "", "next" ], [ "", "ENTITY_RE_2.test" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "tagName" ], [ "", "h.endTag" ], [ "", "continuationMaker" ], [ "", "pos" ], [ "", "parseEndTag" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "tagName" ], [ "", "h.startTag" ], [ "", "continuationMaker" ], [ "", "eflags" ], [ "", "tag" ], [ "", "pos" ], [ "", "parseText" ], [ "", "pos" ], [ "", "parseStartTag" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "comment" ], [ "", "parts.slice.join" ], [ "", "parts.slice" ], [ "", "h.comment" ], [ "", "comment.substr" ], [ "", "continuationMaker" ], [ "", "pos" ], [ "", "state.noMoreEndComments" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "pos" ], [ "", "state.noMoreGT" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "pos" ], [ "", "state.noMoreGT" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "h.pcdata" ], [ "", "continuationMaker" ], [ "", "h.endDoc" ], [ "", "re" ], [ "", "str.split" ], [ "", "parts" ], [ "", "lastPos" ], [ "", "re.exec" ], [ "", "parts.push" ], [ "", "str.substring" ], [ "", "parts.push" ], [ "", "lastPos" ], [ "", "parts.push" ], [ "", "str.substring" ], [ "", "tag" ], [ "", "parseTagAndAttrs" ], [ "", "h.endTag" ], [ "", "continuationMaker" ], [ "", "tag" ], [ "", "parseTagAndAttrs" ], [ "", "h.startTag" ], [ "", "continuationMaker" ], [ "", "parseText" ], [ "", "endTagRe" ], [ "", "end" ], [ "", "endTagRe.hasOwnProperty" ], [ "", "endTagRe.tag.name" ], [ "", "re" ], [ "", "first" ], [ "", "re.test" ], [ "", "buf" ], [ "", "parts.slice.join" ], [ "", "parts.slice" ], [ "", "h.cdata" ], [ "", "continuationMaker" ], [ "", "h.rcdata" ], [ "", "normalizeRCData" ], [ "", "continuationMaker" ], [ "", "tag" ], [ "", "tag.name" ], [ "", "tag.eflags" ], [ "", "buf" ], [ "", "parts.pos.substr" ], [ "", "end" ], [ "", "attrs" ], [ "", "ATTR_RE.exec" ], [ "", "buf" ], [ "", "buf.replace" ], [ "", "quote" ], [ "", "sawQuote" ], [ "", "abuf" ], [ "", "parts.p.indexOf" ], [ "", "sawQuote" ], [ "", "abuf.push" ], [ "", "buf" ], [ "", "abuf.join" ], [ "", "aName" ], [ "", "aValue" ], [ "", "decodeValue" ], [ "", "attrs.push" ], [ "", "buf" ], [ "", "buf.substr" ], [ "", "tag.attrs" ], [ "", "tag.next" ], [ "", "v.charCodeAt" ], [ "", "v.substr" ], [ "", "unescapeEntities" ], [ "", "stripNULs" ], [ "", "stack" ], [ "", "ignoring" ], [ "", "emit" ], [ "", "out.push" ], [ "", "makeSaxParser" ], [ "", "stack" ], [ "", "ignoring" ], [ "", "html4.ELEMENTS.hasOwnProperty" ], [ "", "eflagsOrig" ], [ "", "decision" ], [ "", "tagPolicy" ], [ "", "ignoring" ], [ "", "attribs" ], [ "", "eflagsRep" ], [ "", "tagNameRep" ], [ "", "tagNameRep" ], [ "", "eflagsRep" ], [ "", "tagNameRep" ], [ "", "eflagsRep" ], [ "", "onStack" ], [ "", "out.push" ], [ "", "stack.push" ], [ "", "out.push" ], [ "", "attribName" ], [ "", "value" ], [ "", "out.push" ], [ "", "escapeAttrib" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "ignoring" ], [ "", "html4.ELEMENTS.hasOwnProperty" ], [ "", "eflags" ], [ "", "index" ], [ "", "index" ], [ "", "stackElOrigTag" ], [ "", "index" ], [ "", "stackElRepTag" ], [ "", "out.push" ], [ "", "tagName" ], [ "", "stack.length" ], [ "", "out.push" ], [ "", "out.push" ], [ "", "ALLOWED_URI_SCHEMES" ], [ "", "parsed" ], [ "", "URI.parse" ], [ "", "parsed.hasScheme" ], [ "", "ALLOWED_URI_SCHEMES.test" ], [ "", "parsed.getScheme" ], [ "", "safe" ], [ "", "naiveUriRewriter" ], [ "", "safe.toString" ], [ "", "logger" ], [ "", "changed" ], [ "", "changed" ], [ "", "changed" ], [ "", "logger" ], [ "", "attribKey" ], [ "", "attribKey" ], [ "", "map.hasOwnProperty" ], [ "", "attribKey" ], [ "", "map.hasOwnProperty" ], [ "", "lookupAttribute" ], [ "", "lookupAttribute" ], [ "", "lookupAttribute" ], [ "", "attribName" ], [ "", "value" ], [ "", "oldValue" ], [ "", "atype" ], [ "", "attribKey" ], [ "", "attribKey" ], [ "", "html4.ATTRIBS.hasOwnProperty" ], [ "", "attribKey" ], [ "", "html4.ATTRIBS.hasOwnProperty" ], [ "", "atype" ], [ "", "value" ], [ "", "log" ], [ "", "value" ], [ "", "log" ], [ "", "sanitizedDeclarations" ], [ "", "parseCssDeclarations" ], [ "", "normProp" ], [ "", "property.toLowerCase" ], [ "", "schema" ], [ "", "sanitizeCssProperty" ], [ "", "safeUri" ], [ "", "sanitizedDeclarations.push" ], [ "", "tokens.join" ], [ "", "value" ], [ "", "sanitizedDeclarations.join" ], [ "", "log" ], [ "", "value" ], [ "", "opt_nmTokenPolicy" ], [ "", "log" ], [ "", "value" ], [ "", "safeUri" ], [ "", "getUriEffect" ], [ "", "getLoaderType" ], [ "", "log" ], [ "", "value.charAt" ], [ "", "value" ], [ "", "value.substring" ], [ "", "value" ], [ "", "opt_nmTokenPolicy" ], [ "", "value" ], [ "", "value" ], [ "", "log" ], [ "", "value" ], [ "", "log" ], [ "", "value" ], [ "", "log" ], [ "", "sanitizeAttribs" ], [ "", "log" ], [ "", "outputArray" ], [ "", "makeHtmlSanitizer" ], [ "", "makeHtmlSanitizer" ], [ "", "outputArray.join" ], [ "", "tagPolicy" ], [ "", "makeTagPolicy" ], [ "", "sanitizeWithPolicy" ], [ "", "html" ], [ "", "html.escapeAttrib" ], [ "", "html.escapeAttrib" ], [ "", "html.makeHtmlSanitizer" ], [ "", "html.makeHtmlSanitizer" ], [ "", "html.makeSaxParser" ], [ "", "html.makeSaxParser" ], [ "", "html.makeTagPolicy" ], [ "", "html.makeTagPolicy" ], [ "", "html.normalizeRCData" ], [ "", "html.normalizeRCData" ], [ "", "html.sanitize" ], [ "", "html.sanitize" ], [ "", "html.sanitizeAttribs" ], [ "", "html.sanitizeAttribs" ], [ "", "html.sanitizeWithPolicy" ], [ "", "html.sanitizeWithPolicy" ], [ "", "html.unescapeEntities" ], [ "", "html.unescapeEntities" ], [ "", "html_sanitize" ], [ "", "html4.ATTRIBS.*::style" ], [ "", "html4.ELEMENTS.style" ], [ "", "html4.ATTRIBS.a::target" ], [ "", "html4.ELEMENTS.video" ], [ "", "html4.ATTRIBS.video::src" ], [ "", "html4.ATTRIBS.video::poster" ], [ "", "html4.ATTRIBS.video::controls" ], [ "", "html4.ELEMENTS.audio" ], [ "", "html4.ATTRIBS.audio::src" ], [ "", "html4.ATTRIBS.video::autoplay" ], [ "", "html4.ATTRIBS.video::controls" ], [ "", "module.exports" ] ], "mbr": [ "ALLOWED_URI_SCHEMES.test", "ATTR_RE.exec", "ENTITIES.hasOwnProperty", "ENTITY_RE_2.test", "Object.prototype", "Object.prototype.toString", "Object.prototype.toString.call", "String.fromCharCode", "URI.collapse_dots", "URI.create", "URI.parse", "URI.prototype", "URI.prototype.checkParameterCache_", "URI.prototype.clone", "URI.prototype.getAllParameters", "URI.prototype.getCredentials", "URI.prototype.getDomain", "URI.prototype.getFragment", "URI.prototype.getParameterMap", "URI.prototype.getParameterValue", "URI.prototype.getParameterValues", "URI.prototype.getPath", "URI.prototype.getPort", "URI.prototype.getQuery", "URI.prototype.getRawCredentials", "URI.prototype.getRawDomain", "URI.prototype.getRawFragment", "URI.prototype.getRawPath", "URI.prototype.getRawQuery", "URI.prototype.getRawScheme", "URI.prototype.getScheme", "URI.prototype.hasCredentials", "URI.prototype.hasDomain", "URI.prototype.hasFragment", "URI.prototype.hasPath", "URI.prototype.hasPort", "URI.prototype.hasQuery", "URI.prototype.hasScheme", "URI.prototype.removeParameter", "URI.prototype.setAllParameters", "URI.prototype.setCredentials", "URI.prototype.setDomain", "URI.prototype.setFragment", "URI.prototype.setParameterValues", "URI.prototype.setPath", "URI.prototype.setPort", "URI.prototype.setQuery", "URI.prototype.setRawCredentials", "URI.prototype.setRawDomain", "URI.prototype.setRawFragment", "URI.prototype.setRawPath", "URI.prototype.setRawQuery", "URI.prototype.setRawScheme", "URI.prototype.setScheme", "URI.prototype.toString", "URI.resolve", "URI.utils", "absRawPath.lastIndexOf", "absRawPath.substring", "absoluteUri.getRawPath", "absoluteUri.setPort", "absoluteUri.setRawCredentials", "absoluteUri.setRawDomain", "absoluteUri.setRawFragment", "absoluteUri.setRawPath", "absoluteUri.setRawQuery", "absoluteUri.setRawScheme", "abuf.join", "abuf.push", "attribs.length", "attrs.push", "baseUri.clone", "buf.replace", "buf.substr", "cgiParams.length", "ch.charCodeAt", "collapse_dots().replace", "comment.length", "comment.substr", "decision.attribs", "decision.tagName", "decodeURIComponent().replace", "decodeURIComponent().toLowerCase", "encodeURI().replace", "endTagRe.hasOwnProperty", "entityLookupElement.innerHTML", "entityLookupElement.textContent", "h.cdata", "h.comment", "h.endDoc", "h.endTag", "h.pcdata", "h.rcdata", "h.startDoc", "h.startTag", "handler.cdata", "handler.comment", "handler.endDoc", "handler.endTag", "handler.pcdata", "handler.rcdata", "handler.startDoc", "handler.startTag", "html.escapeAttrib", "html.makeHtmlSanitizer", "html.makeSaxParser", "html.makeTagPolicy", "html.normalizeRCData", "html.sanitize", "html.sanitizeAttribs", "html.sanitizeWithPolicy", "html.unescapeEntities", "html4.ATTRIBS", "html4.ATTRIBS.hasOwnProperty", "html4.ELEMENTS", "html4.ELEMENTS.audio", "html4.ELEMENTS.hasOwnProperty", "html4.ELEMENTS.style", "html4.ELEMENTS.video", "html4.ELEMENT_DOM_INTERFACES", "html4.LOADERTYPES", "html4.URIEFFECTS", "html4.atype", "html4.atype.CLASSES", "html4.atype.GLOBAL_NAME", "html4.atype.ID", "html4.atype.IDREF", "html4.atype.IDREFS", "html4.atype.LOCAL_NAME", "html4.atype.NONE", "html4.atype.SCRIPT", "html4.atype.STYLE", "html4.atype.URI", "html4.atype.URI_FRAGMENT", "html4.eflags", "html4.eflags.CDATA", "html4.eflags.EMPTY", "html4.eflags.FOLDABLE", "html4.eflags.OPTIONAL_ENDTAG", "html4.eflags.RCDATA", "html4.eflags.UNSAFE", "html4.ltypes", "html4.ltypes.SANDBOXED", "html4.ueffects", "html4.ueffects.SAME_DOCUMENT", "k.toString", "m.index", "map.hasOwnProperty", "matchPart.length", "module.exports", "name.match", "next.length", "onStack.orig", "onStack.rep", "out.join", "out.push", "outputArray.join", "p.replace", "params.length", "params.push", "parsed.getScheme", "parsed.hasScheme", "parts.length", "parts.push", "parts.slice", "parts.slice().join", "path.replace", "path.replace().replace", "pc.length", "port.toString", "property.toLowerCase", "q.split", "query.replace", "queryBuf.join", "queryBuf.push", "rcdata.replace", "rcdata.replace().replace", "rcdata.replace().replace().replace", "re.exec", "re.test", "relativeUri.getPort", "relativeUri.getRawCredentials", "relativeUri.getRawDomain", "relativeUri.getRawFragment", "relativeUri.getRawPath", "relativeUri.getRawQuery", "relativeUri.getRawScheme", "relativeUri.hasCredentials", "relativeUri.hasDomain", "relativeUri.hasFragment", "relativeUri.hasPort", "relativeUri.hasQuery", "relativeUri.hasScheme", "resolve().toString", "s.replace", "safe.toString", "safeEntityNameRe.test", "sanitizedDeclarations.join", "sanitizedDeclarations.length", "sanitizedDeclarations.push", "simplifiedPath.charCodeAt", "simplifiedPath.replace", "stack.length", "stack.push", "state.noMoreEndComments", "state.noMoreGT", "str.split", "str.substring", "tag.attrs", "tag.eflags", "tag.name", "tag.next", "tokens.join", "uri.setAllParameters", "uri.setRawQuery", "uriObj.getPath", "v.charCodeAt", "v.length", "v.substr", "v.toString", "value.charAt", "value.substring", "values.length", "values.push", "window.cssSchema", "window.document", "window.document.createElement", "window.parseCssDeclarations", "window.sanitizeCssProperty" ], "tgt": [ "ALLOWED_URI_SCHEMES.test", "ATTR_RE.exec", "ENTITIES.hasOwnProperty", "ENTITY_RE_2.test", "Error", "Number", "Object.prototype.toString.call", "RegExp", "String", "String.fromCharCode", "URI", "URI.parse", "absRawPath.lastIndexOf", "absRawPath.substring", "absoluteUri.getRawPath", "absoluteUri.setPort", "absoluteUri.setRawCredentials", "absoluteUri.setRawDomain", "absoluteUri.setRawFragment", "absoluteUri.setRawPath", "absoluteUri.setRawQuery", "absoluteUri.setRawScheme", "abuf.join", "abuf.push", "attrs.push", "baseUri.clone", "buf.replace", "buf.substr", "ch.charCodeAt", "collapse_dots", "collapse_dots().replace", "comment.substr", "continuationMaker", "decodeURIComponent", "decodeURIComponent().replace", "decodeURIComponent().toLowerCase", "decodeValue", "encodeIfExists", "encodeIfExists2", "encodeURI", "encodeURI().replace", "encodeURIComponent", "endTagRe.hasOwnProperty", "escapeAttrib", "getLoaderType", "getUriEffect", "h.cdata", "h.comment", "h.endDoc", "h.endTag", "h.pcdata", "h.rcdata", "h.startDoc", "h.startTag", "html4.ATTRIBS.hasOwnProperty", "html4.ELEMENTS.hasOwnProperty", "htmlSplit", "k.toString", "log", "logger", "lookupAttribute", "lookupEntity", "makeHtmlSanitizer", "makeHtmlSanitizer()", "makeSaxParser", "makeTagPolicy", "map.hasOwnProperty", "naiveUriRewriter", "name.match", "normPath", "normalizeRCData", "nullIfAbsent", "opt_nmTokenPolicy", "out.join", "out.push", "outputArray.join", "p.replace", "params.push", "parse", "parseCPS", "parseCssDeclarations", "parseEndTag", "parseInt", "parseStartTag", "parseTagAndAttrs", "parseText", "parsed.getScheme", "parsed.hasScheme", "parts.push", "parts.slice", "parts.slice().join", "path.replace", "path.replace().replace", "port.toString", "property.toLowerCase", "q.split", "query.replace", "queryBuf.join", "queryBuf.push", "rcdata.replace", "rcdata.replace().replace", "rcdata.replace().replace().replace", "re.exec", "re.test", "relativeUri.getPort", "relativeUri.getRawCredentials", "relativeUri.getRawDomain", "relativeUri.getRawFragment", "relativeUri.getRawPath", "relativeUri.getRawQuery", "relativeUri.getRawScheme", "relativeUri.hasCredentials", "relativeUri.hasDomain", "relativeUri.hasFragment", "relativeUri.hasPort", "relativeUri.hasQuery", "relativeUri.hasScheme", "resolve", "resolve().toString", "s.replace", "safe.toString", "safeEntityNameRe.test", "safeUri", "sanitizeAttribs", "sanitizeCssProperty", "sanitizeWithPolicy", "sanitizedDeclarations.join", "sanitizedDeclarations.push", "simplifiedPath.charCodeAt", "simplifiedPath.replace", "stack.push", "str.split", "str.substring", "stripNULs", "tagPolicy", "tokens.join", "unescapeEntities", "uri.setAllParameters", "uri.setRawQuery", "uriObj.getPath", "v.charCodeAt", "v.substr", "v.toString", "value.charAt", "value.substring", "values.push", "window.document.createElement" ], "metrics": { "ast": { "op.eq": 30.0, "op.ge": 2.0, "op.gt": 4.0, "op.le": 3.0, "op.lt": 23.0, "op.ne": 35.0, "op.add": 89.0, "op.bor": 2.0, "op.lor": 18.0, "op.shr": 1.0, "op.sub": 9.0, "op.band": 18.0, "op.land": 29.0, "op.lnot": 37.0, "max_depth": 35.0, "bind_count": 296.0, "call_count": 304.0, "node_count": 18063.0, "member_count": 229.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.bor": 0.0, "op_density.lor": 0.0, "op_density.shr": 0.0, "op_density.sub": 0.0, "sequence_count": 2.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 306.0, "member_depth_max": 4.0, "string_literal_count": 991.0, "array_literal_max_length": 2.0, "string_concat_chain_max_length": 20.0 }, "file": { "size": 73807.0, "entropy": 4.99, "size_bytes": 73807.0 }, "text": { "tab_count": 1.0, "digit_ratio": 0.03, "space_count": 16518.0, "total_lines": 2447.0, "char_entropy": 4.99, "mixed_indent": 1.0, "unique_chars": 96.0, "escape_density": 0.02, "string_density": 0.4, "avg_line_length": 29.16, "max_line_length": 106.0, "empty_line_ratio": 0.04, "hex_escape_count": 1.0, "last_line_length": 1.0, "whitespace_ratio": 0.26, "most_common_ratio": 0.06, "identifier_density": 0.92, "line_length_stddev": 21.59, "octal_escape_count": 5.0, "encoded_string_ratio": 0.02, "unicode_escape_count": 8.0, "normalized_string_count": 20.03, "repeated_char_sequences": 331.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.18, "max_inline_whitespace_run": 19.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 27.18 }, "binds": { "count": 296.0 }, "calls": { "count": 304.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 25600.0, "peak_region_entropy": 5.31 }, "source": { "function_count": 36.0 }, "members": { "count": 229.0 }, "strings": { "total": 991.0, "ip_count": 2.0, "avg_length": 8.68, "max_length": 49.0, "path_count": 1.0, "avg_entropy": 2.47, "empty_count": 26.0, "hex_strings": 2.0, "total_bytes": 8599.0, "entropy_stddev": 1.03, "base64_candidates": 22.0 }, "comments": { "chars": 15710.0, "lines": 424.0, "total": 132.0, "todo_count": 5.0, "fixme_count": 1.0, "to_code_ratio": 0.21, "empty_comments": 6.0, "url_in_comments": 6.0, "code_in_comments": 4.0, "base64_in_comments": 5.0, "high_entropy_comments": 19.0 }, "functions": { "count": 36.0, "anonymous": 57.0, "avg_params": 1.5, "max_params": 7.0, "length_stddev": 127.5, "over_100_lines": 5.0, "over_500_lines": 2.0, "avg_name_length": 11.35, "no_params_count": 26.0, "avg_length_lines": 32.39, "max_length_lines": 1016.0, "min_length_lines": 3.0, "nested_functions": 8.0, "avg_nesting_depth": 1.1, "max_nesting_depth": 3.0, "high_entropy_names": 5.0, "single_char_params": 11.0, "numeric_suffix_names": 1.0, "avg_param_name_length": 7.28, "density_per_100_lines": 3.84, "code_in_functions_ratio": 1.24 }, "identifiers": { "count": 306.0, "total": 2262.0, "avg_length": 8.98, "max_length": 40.0, "min_length": 1.0, "avg_entropy": 2.6, "reuse_ratio": 0.14, "unique_count": 306.0, "length_stddev": 5.11, "has_digit_ratio": 0.01, "sequential_names": 12.0, "base64_like_names": 1.0, "single_char_count": 13.0, "single_char_ratio": 0.04, "high_entropy_count": 20.0, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.38, "all_uppercase_ratio": 0.06, "numeric_suffix_count": 4.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "H₃(Db₃OsU)", "path": "sanitize-caja-0.1.4.tgz!!package/sanitizer-bundle.js", "pid": 0, "risk": 6, "sha": "36ddc752a3c5562bdcbd846c864893b97bf6ad0c2274e5ff97f7d4fa1dfc694d", "size": 73807, "traits": [ { "id": "micro-behaviors/data/source/syntax/keyword::js-keyword-decodeuricomponent", "conf": 0.7, "crit": 2, "desc": "decodeURIComponent function", "spans": [ [ 10030, 18 ] ] }, { "id": "metadata/lang/scripted::js-export-boundary", "crit": 1, "desc": "JS module export syntax", "spans": [ [ 73773, 14 ] ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-empty-join-call", "conf": 0.72, "crit": 1, "desc": "JavaScript array empty join call", "spans": [ [ 9649, 9 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/loader::decoded-property-constructor", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Decoded property constructor access", "spans": [ [ 14086, 17 ] ] }, { "id": "metadata/package/license::copyright-word", "conf": 0.6, "crit": 2, "desc": "Copyright notice", "spans": [ [ 4, 9 ] ] }, { "id": "micro-behaviors/data/encode/char-code::xor-operator", "conf": 0.6, "crit": 1, "desc": "Bitwise XOR operator", "spans": [ [ 2440, 1 ] ] }, { "id": "objectives/evasion/decoy/cloaking::adspect-action-router-cases--rx-11", "conf": 0.9, "crit": 1, "desc": "Repeated meta or form action labels", "spans": [ [ 30017, 4 ], [ 30406, 4 ] ] }, { "id": "micro-behaviors/data/buffer::offset-write", "conf": 0.7, "crit": 2, "desc": "Writing data to buffer at calculated offset", "spans": [ [ 47938, 12 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::size-prop--width", "conf": 1.0, "crit": 1, "desc": "DOM or CSS size property (width)", "spans": [ [ 24136, 5 ] ] }, { "id": "micro-behaviors/data/encode/tostring::tostring-token", "conf": 1.0, "crit": 1, "desc": "toString method token", "spans": [ [ 2232, 8 ] ] }, { "id": "metadata/lang/scripted::undefined-literal", "conf": 1.0, "crit": 1, "desc": "JavaScript undefined literal", "spans": [ [ 20237, 9 ] ] }, { "id": "metadata/permission/capture::permission-grant-verb", "conf": 0.86, "crit": 1, "desc": "Permission-grant action verb keyword", "spans": [ [ 73347, 5 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript basename", "spans": [ [ 0, 19 ] ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/session::extension-page-block", "conf": 0.9, "crit": 1, "desc": "innerHTML/location.href rewrite", "spans": [ [ 39698, 13 ] ] }, { "id": "metadata/library/structure::vscode-root-js-bundle", "conf": 0.95, "crit": 2, "desc": "VS Code root JavaScript bundle", "spans": [ [ 0, 19 ] ] }, { "id": "objectives/command-and-control/dropper/execution/browser::string-fromcharcode-symbol", "conf": 0.8, "crit": 1, "desc": "JavaScript uses String.fromCharCode", "spans": [ [ 39458, 19 ] ] }, { "id": "micro-behaviors/data/string/search::js-includes-indexof-call", "conf": 0.82, "crit": 2, "desc": "JavaScript substring search call", "spans": [ [ 56973, 8 ] ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 1, "desc": "charCodeAt() method call", "spans": [ [ 3332, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/string/encoding::js-charat-loop", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 1, "desc": "charAt in loop pattern", "spans": [ [ 3363, 25 ], [ 69181, 12 ] ] }, { "id": "metadata/file/metrics::js-readable-source-context", "conf": 0.9, "crit": 1, "desc": "Readable JavaScript source context", "spans": [ [ 0, 28 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-token-ff", "mbc": "B0032", "crit": 1, "desc": "0xff hex byte token", "spans": [ [ 11947, 4 ] ] }, { "id": "micro-behaviors/process/create/script/wsh::wsh-do-while-close", "conf": 0.8, "crit": 1, "desc": "Do-while close marker", "spans": [ [ 16280, 9 ] ] }, { "id": "metadata/file/profile/identity::documentation-page-term", "conf": 0.82, "crit": 1, "desc": "Documentation page terminology", "spans": [ [ 19420, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "spans": [ [ 56, 3 ] ] }, { "id": "objectives/anti-static/obfuscation/string/conceal::js-split-wrapper", "conf": 0.8, "crit": 1, "desc": "split() function wrapper", "spans": [ [ 53447, 21 ] ] }, { "id": "objectives/anti-static/obfuscation/string/encoding::js-array-join-symbol", "crit": 1, "desc": "Join using empty string delimiter", "spans": [ [ 9649, 9 ] ] }, { "id": "metadata/package/documentation::references-license-1", "conf": 0.7, "crit": 2, "desc": "Package references LICENSE/LICENCE", "spans": [ [ 22265, 7 ] ] }, { "id": "metadata/package/license::apache-license-text", "conf": 0.8, "crit": 2, "desc": "Apache License text", "spans": [ [ 60, 14 ] ] }, { "id": "objectives/impact/ui/manipulation/core::ai-chat-innerhtml-write", "atk": "T1491", "conf": 0.9, "crit": 1, "desc": "AI chat innerHTML write", "spans": [ [ 39697, 12 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "spans": [ [ 0, 19 ] ] }, { "id": "micro-behaviors/os/clipboard/access::browser-textarea-copy-staging", "atk": "T1115", "conf": 0.85, "crit": 3, "desc": "Browser stages text for clipboard copy", "spans": [ [ 38397, 24 ] ] }, { "id": "metadata/file/metrics::low-string-density-large-file", "conf": 0.9, "crit": 1, "desc": "Low string density in source", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "String.fromCharCode call", "spans": [ [ 39458, 19 ] ] }, { "id": "objectives/command-and-control/remote-command/control::command-json-field", "atk": "T1059.007", "mbc": "B0022", "conf": 0.78, "crit": 1, "desc": "Command JSON field", "spans": [ [ 24433, 8 ] ] }, { "id": "micro-behaviors/communications/url/encoded::percent-encoded-octet-context", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 1, "desc": "Percent-encoded octet context", "spans": [ [ 7855, 3 ] ] }, { "id": "objectives/supply-chain/hidden-payload/runtime::worker-host-serial-assessment--rx-13", "atk": "T1195.002, T1059.007", "conf": 0.94, "crit": 1, "desc": "WMI NAME field marker", "spans": [ [ 22546, 4 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-function-call-method", "conf": 0.84, "crit": 2, "desc": "Invokes function with .call()", "spans": [ [ 13965, 13 ] ] }, { "id": "metadata/permission/capture::capture-device-term", "conf": 0.86, "crit": 1, "desc": "Media capture device term keyword", "spans": [ [ 23744, 5 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.8, "crit": 1, "desc": "High-entropy region mass over 1KB", "spans": [ [ 0, 35 ] ] }, { "id": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast", "conf": 0.82, "crit": 1, "desc": "Array literal joined with empty string", "spans": [ [ 9646, 8 ], [ 14600, 13 ], [ 50643, 18 ], [ 57207, 9 ], [ 71781, 16 ] ] }, { "id": "metadata/file/metrics::single-char-params", "conf": 0.7, "crit": 1, "desc": "Many single-char function parameters", "spans": [ [ 0, 36 ] ] }, { "id": "objectives/supply-chain/hidden-payload/eval::byte-loop-fromcharcode-append", "atk": "T1195.002", "conf": 0.9, "crit": 1, "desc": "Loop appends decoded fromCharCode bytes", "spans": [ [ 16047, 42 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::size-prop--height", "conf": 1.0, "crit": 1, "desc": "DOM or CSS size property (height)", "spans": [ [ 24113, 6 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-undefined-string-compare", "conf": 0.6, "crit": 2, "desc": "Compares value against the undefined string", "spans": [ [ 73751, 14 ] ] }, { "id": "well-known/lib/blessed::blessed-unicode-helper-text", "conf": 0.9, "crit": 1, "desc": "Blessed unicode helper text", "spans": [ [ 39154, 7 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encoded::js-fromcharcode-decoder", "atk": "T1027", "conf": 0.8, "crit": 1, "desc": "String built from character codes", "spans": [ [ 39458, 19 ] ] }, { "id": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4", "conf": 0.84, "crit": 1, "desc": "path join artifact for package.json load", "spans": [ [ 9650, 5 ] ] }, { "id": "metadata/lang/scripted::length-prop", "conf": 1.0, "crit": 1, "desc": "JavaScript length property", "spans": [ [ 14355, 6 ] ] }, { "id": "metadata/package/documentation::has-jsdoc-type", "conf": 0.7, "crit": 2, "desc": "Code has JSDoc @type", "spans": [ [ 9015, 5 ] ] }, { "id": "well-known/tool/sysadmin/kubernetes/iac::kubernetes-manifest-kind", "conf": 0.86, "crit": 1, "desc": "Kubernetes kind field", "spans": [ [ 28816, 4 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::string-literal-equality-check", "conf": 0.92, "crit": 1, "desc": "String literal equality or membership check", "spans": [ [ 13838, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/loader::return-empty-join", "atk": "T1027", "mbc": "B0032", "conf": 0.86, "crit": 1, "desc": "Empty-join return value", "spans": [ [ 9639, 19 ] ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-url-line-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "JavaScript commented URL line context", "spans": [ [ 219, 15 ] ] }, { "id": "metadata/file/format::vocab-array", "conf": 0.97, "crit": 1, "desc": "String literal contains array word", "spans": [ [ 13992, 5 ] ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names", "spans": [ [ 0, 36 ] ] }, { "id": "objectives/command-and-control/remote-command/socketio-control::socketio-command-event-name", "atk": "T1059.007", "mbc": "B0022", "conf": 0.82, "crit": 1, "desc": "Socket.io command event name", "spans": [ [ 29767, 7 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 1, "desc": "String.fromCharCode call marker", "spans": [ [ 39458, 19 ] ] }, { "id": "micro-behaviors/ui/terminal::ansi-erase-op", "conf": 0.84, "crit": 1, "desc": "ANSI terminal erase operation", "spans": [ [ 14100, 2 ] ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-charcode-decoder", "conf": 0.9, "crit": 3, "desc": "JavaScript hex escape decoder", "spans": [ [ 39562, 38 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-4", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 1, "desc": "charCodeAt call marker", "spans": [ [ 3330, 13 ], [ 6633, 25 ], [ 57574, 12 ] ] }, { "id": "micro-behaviors/data/encode/hex::parseint-16", "conf": 1.0, "crit": 2, "desc": "parseInt with radix 16", "spans": [ [ 39582, 18 ] ] }, { "id": "micro-behaviors/data/encode/url::encodeuri-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURI", "spans": [ [ 3148, 9 ] ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "spans": [ [ 2645, 18 ] ] }, { "id": "objectives/command-and-control/dropper/execution/browser::dom-script-text-body-assign", "conf": 0.8, "crit": 1, "desc": "Assigns code body into DOM element text", "spans": [ [ 39697, 12 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::for-loop-content", "conf": 0.3, "crit": 2, "desc": "for loop (content)", "spans": [ [ 5099, 6 ] ] }, { "id": "micro-behaviors/data/encode/hex::loop-step-2", "conf": 1.0, "crit": 2, "desc": "Loop with step 2", "spans": [ [ 16047, 45 ] ] }, { "id": "objectives/credential-access/theft/keywords::cred-upper", "conf": 0.45, "crit": 1, "desc": "CRED credential label", "spans": [ [ 2076, 4 ] ] }, { "id": "objectives/command-and-control/infrastructure/tracking::command-field", "conf": 0.7, "crit": 1, "desc": "Command tasking field in schema", "spans": [ [ 29766, 10 ] ] }, { "id": "micro-behaviors/data/encode/tostring::tostring-call", "conf": 1.0, "crit": 1, "desc": ".toString() method call", "spans": [ [ 2231, 11 ] ] }, { "id": "metadata/lang/scripted::plain-js-identifier-assignment", "conf": 1.0, "crit": 1, "desc": "Plain JavaScript identifier assignment", "spans": [ [ 4784, 32 ] ] }, { "id": "metadata/lang/scripted::js-key-assignment-declaration", "conf": 1.0, "crit": 1, "desc": "var/let/const key-like assignment declaration", "spans": [ [ 17583, 9 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.9, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 1, "desc": "JavaScript split() method call", "spans": [ [ 14818, 7 ], [ 53454, 9 ] ] }, { "id": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "atk": "T1059", "conf": 0.8, "crit": 1, "desc": "Shell execution wrapper", "spans": [ [ 53540, 26 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-text-content-read", "conf": 0.82, "crit": 1, "desc": "Reads DOM text content", "spans": [ [ 39697, 10 ] ] }, { "id": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "atk": "T1027", "mbc": "B0032", "crit": 1, "desc": "Decoded property function alias", "spans": [ [ 14086, 17 ] ] }, { "id": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "conf": 0.96, "crit": 1, "desc": "main_* architecture payload name", "spans": [ [ 8882, 5 ] ] }, { "id": "objectives/anti-static/obfuscation/string/conceal::js-join-empty-assignment-tail", "conf": 0.97, "crit": 1, "desc": "Variable assigned join('') deobfuscation tail", "spans": [ [ 14591, 26 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-iframe-element", "conf": 0.78, "crit": 1, "desc": "Contains iframe text token", "spans": [ [ 25235, 6 ] ] }, { "id": "metadata/library/structure::js-dist-asset-bundle", "conf": 0.9, "crit": 2, "desc": "Generated dist JavaScript asset", "spans": [ [ 0, 19 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.8, "crit": 3, "desc": "Assigns DOM innerHTML", "spans": [ [ 39697, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/dynamic::export-iife-closure", "conf": 0.85, "crit": 1, "desc": "Trailing IIFE closure indicating auto-exec", "spans": [ [ 22204, 6 ] ] }, { "id": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "atk": "T1614", "mbc": "B0007.003", "conf": 0.6, "crit": 1, "desc": "Country code ID literal (repeated)", "spans": [ [ 22498, 4 ] ] }, { "id": "metadata/library/structure::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Any JS bundle or minified asset output", "spans": [ [ 0, 19 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL benign documentation or test context", "spans": [ [ 0, 19 ], [ 219, 15 ] ] }, { "id": "metadata/encoded-payload/unicode-escape", "conf": 0.9, "crit": 2, "desc": "Decoded unicode-escape content", "spans": [ [ 40647, 57 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "toNiqB.LV5ax9w\u003cBAIUgc$)ZAAc15[flpYmB-I4CBAg/kx(+\u003eox!BsAxd[agAai:gflpMtx([6nwI4z2yge-lzF8gyA:-\u0026}xGZivB97#ldp1unBAzE.fe4A/vrMvaeN@GEz/PFzzddx)z*i{RvqY!3x)Ktxv{%aXdf", "n": [ { "c": 3, "d": "Recognized domain reference marker", "i": "objectives/command-and-control/infrastructure/domain/tld::recognized-reference-marker", "o": 0, "z": 9, "cf": 0.9 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 130 }, { "b": "boR5ozFsibDsXWrvqoi", "ln": 3, "addr": 131 }, { "b": "", "ln": 4, "addr": 147 }, { "b": "", "ln": 23, "addr": 695 }, { "b": "u%)wSA@", "ln": 24, "addr": 696 }, { "b": "C42zlB75%2Bzl5jauZ\u0026/wPq\u003cbA+cTDB75%2Bzl5jeN@j7vj9G=", "n": [ { "c": 1, "d": "Node.js require call in non-code file", "i": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode", "o": 717, "z": 8, "cf": 0.9 } ], "ln": 25, "addr": 702 }, { "b": "", "ln": 26, "addr": 743 }, { "b": "wn+$2zdNQbe{ztIBy=\u003ewvqY!3x)KtswP?^7rDz.(nP5G\u0026BswU2", "ln": 27, "addr": 744 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 895.0, "entropy": 4.93, "size_bytes": 895.0 }, "text": { "digit_ratio": 0.0, "space_count": 80.0, "total_lines": 32.0, "char_entropy": 4.93, "unique_chars": 58.0, "avg_line_length": 26.97, "max_line_length": 129.0, "empty_line_ratio": 0.41, "last_line_length": 91.0, "long_token_count": 1.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.08, "line_length_stddev": 36.55, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 97.0 }, "binary": { "overall_entropy": 4.93, "peak_region_bytes": 895.0, "peak_region_entropy": 4.93 } } }, "id": 3, "path": "sanitize-caja-0.1.4.tgz!!package/README.md", "pid": 0, "sha": "cfe8e01528a23fd1c5680c9dd0ead22e9dd7bc058bf93383a5a70800ac22818d", "size": 895, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/identity::install-doc-basename", "conf": 0.85, "crit": 1, "desc": "Installation documentation basename", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode", "atk": "T1027.003", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Node.js require call in non-code file", "spans": [ [ 717, 8 ] ] }, { "id": "metadata/package/documentation::package-doc-reference-basename", "conf": 0.9, "crit": 1, "desc": "Package documentation basename", "spans": [ [ 0, 9 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 3, "d": "npm package has no runtime dependencies", "i": "objectives/supply-chain/impersonation/package/manifest::npm-no-runtime-dependencies", "o": 0, "z": 1, "cf": 0.65 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003eCvqPN1iV]R/vqY!3x)Ktxv{%aXa$J", "n": [ { "c": 2, "d": "npm package has name field", "i": "metadata/package/quality/empty::npm-has-name", "o": 4, "z": 13, "cf": 1.0 } ], "ln": 2, "addr": 2 }, { "b": "arR\u003eKwPz\u003caz/c:War\u0026G(f!Lpbec", "n": [ { "c": 2, "d": "Uses standard version format", "i": "metadata/package/versioning::conventional-version-base", "o": 31, "z": 5, "cf": 1.0 } ], "ln": 3, "addr": 29 }, { "b": "arR\u003eswPIv4x(Ffdz/c:War\u003e(nzFsibDsXjjBzU?pB-RnmxcpX)ygek[zE:(gwNPT#zEE0\u003cwGUA5B9htsBzkVhB0rd", "n": [ { "c": 2, "d": "Package has meaningful description", "i": "metadata/package/manifest/description::has-description", "o": 53, "z": 51, "cf": 0.75 } ], "ln": 4, "addr": 51 }, { "b": "arR\u003eBvqfQ6iV]RXzE^s6e]2CKec", "ln": 5, "addr": 123 }, { "b": "arR\u003eHv@=p5BAnS!aBs", "ln": 9, "addr": 188 }, { "b": "arR^Hb6myqBrS:*b6mmjwGV8aB965+e]2CK", "n": [ { "c": 1, "d": "package defines test script", "i": "metadata/package/scripts::has-test-script", "o": 207, "z": 14, "cf": 1.0 } ], "ln": 10, "addr": 203 }, { "b": "arV7-", "ln": 11, "addr": 232 }, { "b": "arR\u003ezwQeGrA+6kniV}S", "n": [ { "c": 1, "d": "Benign tiny package metadata context", "i": "metadata/package/manifest/freeform::pkg-skeleton-benign-context", "o": 239, "z": 16, "cf": 0.95 } ], "ln": 12, "addr": 237 }, { "b": "arR^Hb6dggx([6nwG\u0026V", "ln": 13, "addr": 253 }, { "b": "arR^Hb4#7ny:5", "ln": 14, "addr": 269 }, { "b": "arR\u003epB-.qnAW0K!b2\u0026F$awDoOs8@1/xMLBH", "ln": 16, "addr": 285 }, { "b": "arR\u003eAx\u003e7Z(B7DKRar\u003ccJl[HeClU{gNB7DKD", "ln": 17, "addr": 314 }, { "b": "arR\u003eswP*EMAaJ]$wO#0(wPG4RaBs", "n": [ { "c": 1, "d": "Benign npm metadata context", "i": "metadata/package/manifest/freeform::npm-metadata-benign-context", "o": 345, "z": 17, "cf": 1.0 } ], "ln": 18, "addr": 343 }, { "b": "arR^Hb6mmjwG\u003ceTb7qv3fFk46", "ln": 19, "addr": 366 }, { "b": "arV7-", "ln": 20, "addr": 387 }, { "b": "arR\u003eGwPhNex([olC{ko(DJ", "n": [ { "c": 2, "d": "Package has repository field", "i": "metadata/package/manifest/repository::has-repository-field", "o": 394, "z": 64, "cf": 0.9 } ], "ln": 21, "addr": 392 }, { "b": "arR^Hb6n9HwG\u003ceTb4\u003eRia$J", "ln": 22, "addr": 410 }, { "b": "arR^Hb6v{xb03?\u003cxk8DGfe3%LBzb/ae[n*pfkUcpvScGAB75%2Bzl5jeN@j7vj(hbBrQ", "n": [ { "c": 2, "d": "Repository uses common git host", "i": "metadata/package/manifest/repository::repo-url-git-host", "o": 433, "z": 41, "cf": 0.9 } ], "ln": 23, "addr": 429 }, { "b": "arV7", "ln": 24, "addr": 484 }, { "b": "Ee", "ln": 25, "addr": 488 } ], "depth": 1, "facts": { "imp": [ [ "~4.0.0", "tape" ] ], "metrics": { "file": { "size": 490.0, "entropy": 4.57, "size_bytes": 490.0 }, "binary": { "overall_entropy": 4.57, "peak_region_bytes": 490.0, "peak_region_entropy": 4.57 } } }, "id": 4, "path": "sanitize-caja-0.1.4.tgz!!package/package.json", "pid": 0, "refs": [ { "to": "git://github.com/mapbox/sanitize-caja.git", "off": 441, "kind": "repository" }, { "to": "index.js", "off": 134, "file": 5, "kind": "local" } ], "risk": 1, "sha": "b0500e4b11849de06a1ca525d1f7cfc7b9fdafe38f11a1238fe5a5f707e0bdd6", "size": 490, "traits": [ { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 1, "desc": "Filename is package.json", "spans": [ [ 0, 12 ] ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "npm package has version field", "spans": [ [ 31, 5 ] ] }, { "id": "metadata/package/manifest/name::npm-hyphenated-multiword-name", "conf": 0.7, "crit": 2, "desc": "npm hyphenated multiword name", "spans": [ [ 4, 13 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "Package has repository URL", "spans": [ [ 433, 41 ] ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "npm package has name field", "spans": [ [ 4, 13 ] ] }, { "id": "metadata/package/manifest/repository::repo-url-git-host", "conf": 0.9, "crit": 2, "desc": "Repository uses common git host", "spans": [ [ 433, 41 ] ] }, { "id": "metadata/package/dependencies::has-dev-deps", "conf": 0.8, "crit": 1, "desc": "Package has devDependencies", "spans": [ [ 345, 17 ] ] }, { "id": "metadata/package/scripts::has-test-script", "conf": 1.0, "crit": 1, "desc": "package defines test script", "spans": [ [ 207, 14 ] ] }, { "id": "metadata/package/versioning::conventional-version-base", "conf": 1.0, "crit": 2, "desc": "Uses standard version format", "spans": [ [ 31, 5 ] ] }, { "id": "metadata/package/keywords/identity::npm-keyword-html", "conf": 0.9, "crit": 1, "desc": "Package declares html keyword", "spans": [ [ 239, 16 ] ] }, { "id": "metadata/package/manifest/description::has-description", "conf": 0.75, "crit": 2, "desc": "Package has meaningful description", "spans": [ [ 53, 51 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "Package has repository field", "spans": [ [ 394, 64 ] ] }, { "id": "objectives/supply-chain/impersonation/npm-clone::repo-mismatch-indicator", "atk": "T1195.002", "mbc": "E1195.002", "crit": 1, "desc": "Repository URL may not match publisher", "spans": [ [ 433, 41 ] ] }, { "id": "metadata/package/quality/profile::has-tests", "crit": 2, "desc": "Embedded test-code markers present", "spans": [ [ 207, 14 ] ] }, { "id": "metadata/package/manifest/repository::has-repository-evidence", "conf": 0.85, "crit": 2, "desc": "Package has repository metadata", "spans": [ [ 394, 64 ], [ 433, 41 ] ] } ], "type": "package.json" }, { "ctx": [ { "b": "C42zlxMO9cuVPT[x([6nwGTbUA+flkx(W=kcOv5[vqY!3x)KuheN\u0026\u003cuwnC*fyi7:Ki@", "n": [ { "c": 2, "d": "Any script file", "i": "metadata/file/extension/identity::script-file", "o": 0, "z": 8, "cf": 1.0 }, { "c": 1, "d": "CommonJS require symbol", "i": "metadata/lang/scripted::require-symbol", "o": 20, "z": 7, "cf": 1.0 }, { "c": 1, "d": "JavaScript extension reference", "i": "micro-behaviors/fs/path/extension::js-reference", "o": 28, "z": 23, "cf": 0.7 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 54 }, { "b": "zeS%cy?kkgCYmOwBAnM/azb+lv@#B6zyw\u003cvaBs", "n": [ { "c": 2, "d": "JavaScript module exports", "i": "metadata/library/runtime::js-module-exports", "o": 55, "z": 25, "cf": 1.0 } ], "ln": 3, "addr": 55 }, { "b": "arR^Hx\u003ewFoaZVVvA+funA=90EcP.", "ln": 4, "addr": 86 }, { "b": "arR^HA+funA=91kBzU\u00263B75%2Bzl5jc%[IFv@bZ+zDgZ[efFCswNPEFwgoO", "ln": 5, "addr": 109 }, { "b": "Eld", "ln": 6, "addr": 157 }, { "b": "", "ln": 7, "addr": 160 }, { "b": "fe1CYBAzFyiXJc}B.u2my\u00260JjzeT-my\u00260Jjz/PFzB7/GouT!d\u003ce[nKdkwsT\u003egbQ{zfGe", "n": [ { "c": 1, "d": "Encoded URL benign documentation or test context", "i": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "o": 161, "z": 11, "cf": 0.95 } ], "ln": 8, "addr": 161 }, { "b": "w{503BzkVhay/k0vqY7=y::BDy:*GN", "ln": 9, "addr": 216 }, { "b": "arR^HcV%GwaAITBx\u003e8lji@", "n": [ { "c": 2, "d": "Minifier helper patterns", "i": "metadata/package/quality/source::terser-minifier-helpers", "o": 246, "z": 10, "cf": 1.0 } ], "ln": 10, "addr": 241 }, { "b": "arR^Hx\u003ewFofj5slBz#p=fd}uTB95*MA+)vvwPQ\u003cXxK#3(c[cO]aAz4nB-IvxB-IpJBz\u003e91A+PA7c[dj", "n": [ { "c": 1, "d": "Bitwise XOR operator", "i": "micro-behaviors/data/encode/char-code::xor-operator", "o": 268, "z": 1, "cf": 0.6 }, { "c": 1, "d": ".toString() method call", "i": "micro-behaviors/data/encode/tostring::tostring-call", "o": 310, "z": 11, "cf": 1.0 } ], "ln": 11, "addr": 259 }, { "b": "arR^Hx\u003ewFofj5H7x(4)fkqaThwPI@wB-IpJxjVf-v}YB\u003cwHF#RdiJUxBAIRwaA.Zve{82gBAh8kxdbh\u003c", "ln": 12, "addr": 323 }, { "b": "arR^Hx\u003ewFocUcUcvj9fXjS[(/y+xviBw(W.wO(0bdiG@:atm5nzdd6*fd}uTB95*MA+)vvwPQ:SBz96KdjDx^", "ln": 13, "addr": 388 } ], "depth": 1, "facts": { "imp": [ [ "", "html_sanitize" ], [ "", "require" ], [ "", "module.exports" ], [ "", "html_sanitize" ], [ "", "url.getScheme" ], [ "", "url.toString" ], [ "", "url.getScheme" ], [ "", "url.toString" ], [ "", "url.getScheme" ], [ "", "url.getPath" ], [ "", "url.toString" ], [ "", "./sanitizer-bundle.js" ] ], "mbr": [ "module.exports", "url.getPath", "url.getScheme", "url.toString" ], "tgt": [ "html_sanitize", "require", "url.getPath", "url.getScheme", "url.toString" ], "metrics": { "ast": { "op.eq": 1.0, "op.land": 1.0, "op.lnot": 1.0, "max_depth": 10.0, "bind_count": 2.0, "call_count": 12.0, "node_count": 215.0, "member_count": 4.0, "op_density.eq": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 13.0, "member_depth_max": 2.0, "string_literal_count": 4.0, "identity_function_count": 1.0 }, "file": { "size": 533.0, "entropy": 4.87, "size_bytes": 533.0 }, "text": { "digit_ratio": 0.02, "space_count": 70.0, "total_lines": 18.0, "char_entropy": 4.87, "unique_chars": 52.0, "string_density": 0.22, "avg_line_length": 28.61, "max_line_length": 68.0, "empty_line_ratio": 0.17, "last_line_length": 35.0, "whitespace_ratio": 0.17, "most_common_ratio": 0.08, "identifier_density": 1.78, "line_length_stddev": 23.91, "normalized_string_count": 0.94, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 116.0, "normalized_unique_identifiers": 3.12 }, "binds": { "count": 2.0 }, "calls": { "count": 12.0 }, "binary": { "overall_entropy": 4.87, "peak_region_bytes": 533.0, "peak_region_entropy": 4.87 }, "source": { "function_count": 2.0 }, "imports": { "count": 1.0, "relative_ratio": 1.0, "unique_modules": 1.0, "relative_imports": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "members": { "count": 4.0 }, "strings": { "total": 4.0, "avg_length": 8.75, "max_length": 21.0, "path_count": 1.0, "avg_entropy": 2.78, "empty_count": 1.0, "total_bytes": 35.0, "entropy_stddev": 0.99 }, "comments": { "chars": 52.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.06, "url_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "count": 2.0, "anonymous": 1.0, "avg_params": 1.0, "max_params": 1.0, "one_liners": 1.0, "length_stddev": 2.87, "avg_name_length": 7.5, "avg_length_lines": 4.33, "max_length_lines": 8.0, "min_length_lines": 1.0, "single_char_params": 1.0, "avg_param_name_length": 2.0, "density_per_100_lines": 16.67, "code_in_functions_ratio": 0.72 }, "identifiers": { "count": 13.0, "total": 32.0, "avg_length": 6.31, "max_length": 13.0, "min_length": 1.0, "avg_entropy": 2.2, "reuse_ratio": 0.41, "unique_count": 13.0, "length_stddev": 3.07, "single_char_count": 1.0, "single_char_ratio": 0.08, "all_lowercase_ratio": 0.62, "all_uppercase_ratio": 0.08, "underscore_prefix_count": 1.0 } } }, "id": 5, "path": "sanitize-caja-0.1.4.tgz!!package/index.js", "pid": 0, "refs": [ { "to": "./sanitizer-bundle.js", "off": 29, "file": 2, "kind": "local" } ], "risk": 1, "sha": "0a90e98b5ad57da131345d1a6715ca654976316dc90e328a584a45bfd036c74a", "size": 533, "traits": [ { "id": "metadata/lang/scripted::js-export-boundary", "crit": 1, "desc": "JS module export syntax", "spans": [ [ 55, 14 ] ] }, { "id": "micro-behaviors/data/encode/char-code::xor-operator", "conf": 0.6, "crit": 1, "desc": "Bitwise XOR operator", "spans": [ [ 268, 1 ] ] }, { "id": "micro-behaviors/data/encode/tostring::tostring-token", "conf": 1.0, "crit": 1, "desc": "toString method token", "spans": [ [ 311, 8 ] ] }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.95, "crit": 2, "desc": "JavaScript or TypeScript basename", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/build/minifier::use-strict-quote", "conf": 0.6, "crit": 1, "desc": "use strict directive string", "spans": [ [ 246, 10 ] ] }, { "id": "micro-behaviors/fs/path/extension::js-reference", "conf": 0.7, "crit": 1, "desc": "JavaScript extension reference", "spans": [ [ 28, 23 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/package/config::short-sidecar-file", "conf": 0.8, "crit": 1, "desc": "Short sidecar-sized source", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/library/runtime::js-module-exports", "conf": 1.0, "crit": 2, "desc": "JavaScript module exports", "spans": [ [ 55, 25 ] ] }, { "id": "metadata/lang/scripted::require-symbol", "conf": 1.0, "crit": 1, "desc": "CommonJS require symbol", "spans": [ [ 20, 7 ] ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-url-line-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "JavaScript commented URL line context", "spans": [ [ 161, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encoded::exported-decryptor", "conf": 0.8, "crit": 1, "desc": "Module exports decryption function", "spans": [ [ 55, 25 ] ] }, { "id": "metadata/lang/scripted::js-require-binding", "conf": 0.4, "crit": 1, "desc": "CommonJS require() binding declaration", "spans": [ [ 0, 28 ] ] }, { "id": "metadata/file/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/data/encode/tostring::tostring-call", "conf": 1.0, "crit": 1, "desc": ".toString() method call", "spans": [ [ 310, 11 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.9, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "spans": [ [ 0, 16 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL benign documentation or test context", "spans": [ [ 161, 11 ] ] } ], "type": "javascript" }, { "id": 6, "sha": "35ac3064fd897105431825c76f2d76fda501fde32f3f29ca5dbe48ac1892feec", "path": "sanitize-caja-0.1.4.tgz!!package/SEE_ALSO.md", "size": 449, "type": "markdown", "depth": 1 }, { "id": 7, "sha": "74d69f99fda7c786ede19bc9bf0474d97c18be0a6722d9a60ab3c542b54afa50", "path": "sanitize-caja-0.1.4.tgz!!package/CHANGELOG.md", "size": 337, "type": "markdown", "depth": 1 } ], "omitted_files": 2, "rev": "21efe", "v": "8" } }