Open-source atomic malware analysis

Analyze another

github.com-matthewtolman-urfave-cli-v2-v2.23.8.zip

ZIP
Verdict: BENIGN
Mal-ecule
O(Xe)H₅(Cm₂Db₂F₈OsPo₂)Md(Bk)
Size 3.4 MB download
First seen 4 days ago
Analyzed 3 days ago
Ecosystem go
Source googleusercontent.com
toml_command_test.go go
1 package altsrcBenign DLL side-loading context
12 func TestCommandTomFileTest(t *testing.T) {Go testing package
13 app := &cli.App{}
14 set := flag.NewFlagSet("test", 0)Source, test, repository, or workspace target
15 _ = ioutil.WriteFile("current.toml", []byte("test = 15"), 0666)Go output file writer
16 defer os.Remove("current.toml")Go file removal capability
17 test := []string{"test-cmd", "--load", "current.toml"}
18 _ = set.Parse(test)
42 func TestCommandTomlFileTestGlobalEnvVarWins(t *testing.T) {func Test prefix
43 app := &cli.App{}
76 func TestCommandTomlFileTestGlobalEnvVarWinsNested(t *testing.T) {func Test prefix
77 app := &cli.App{}
flag_test.go go
1 package cliBenign DLL side-loading context
16 var boolFlagTests = []struct {
17 name stringValidation vocabulary string
18 expected stringValidation vocabulary expected
19 }{
20 {"help", "--help\t(default: false)"},
31 func TestBoolFlagHelpOutput(t *testing.T) {Go test t.Error method
32 for _, test := range boolFlagTests {Source or test deletion target
33 fl := &BoolFlag{Name: test.name}
34 output := fl.String()
42 func TestBoolFlagApply_SetsAllNames(t *testing.T) {func Test prefix
43 v := false
53 func TestBoolFlagValueFromContext(t *testing.T) {func Test prefix
54 set := flag.NewFlagSet("test", 0)
55 set.Bool("trueflag", true, "doc")Regex component marker
56 set.Bool("falseflag", false, "doc")
57 ctx := NewContext(nil, set, nil)
221 for i, test := range flagTests {
222 defer resetEnv(os.Environ())os.Environ() all environment variables
223 os.Clearenv()
233 Flags: []Flag{test.flag},
234 Action: func(ctx *Context) error {
235 if !reflect.DeepEqual(ctx.Value(test.flag.Names()[0]), test.output) {Repeated Go reflection API usage
236 t.Errorf("ex:%01d expected %q to be parsed as %#v, instead was %#v", i, test.input, test.output
237 }
250 err := a.Run([]string{"run"})Container, K8s, or cloud-metadata context
2685 parts := strings.Split(value, ",")
2686 if len(parts) != 2 {
2687 return fmt.Errorf("invalid format")Validation vocabulary invalid
2688 }
2814 func TestFlagFromFile(t *testing.T) {
2815 temp, err := ioutil.TempFile("", "urfave_cli_test")Create temporary files (Go)
2816 if err != nil {
2817 t.Error(err)t.Error method call
2818 return
2819 }
2826 _ = temp.Close()
2827 defer func() {
2828 _ = os.Remove(temp.Name())Go file removal capability
2829 }()
3109 ts, err := time.Parse(time.RFC3339, "2005-01-02T15:04:05Z")
3110 if err != nil {
3111 t.Fatal(err)t.Fatal method call
3112 }
3113 cases := []*flagDefaultTestCaseWithEnv{
build.go go
11 "log"
12 "math"
13 "net/http"net/http package import
14 "net/url"
15 "os"
49 return os.Getwd()Working directory manipulation
50 }()
51 if err != nil {
169 func sh(exe string, args ...string) (string, error) {
170 cmd := exec.Command(exe, args...)C2 communication backend
171 cmd.Stdin = os.StdinShell command execution capability detected
172 cmd.Stderr = os.Stderr
179 func topRunAction(arg string, args ...string) cli.ActionFunc {
180 return func(cCtx *cli.Context) error {
181 os.Chdir(cCtx.Path("top"))os.Chdir working directory change
198 func downloadFile(src, dest string, dirPerm, perm os.FileMode) error {
199 req, err := http.NewRequest(http.MethodGet, src, nil)Creates a new HTTP request
200 if err != nil {
201 return err
202 }
204 resp, err := http.DefaultClient.Do(req)Executes an HTTP request in
205 if err != nil {
206 return err
215 if err := os.MkdirAll(filepath.Dir(dest), dirPerm); err != nil {Create directory tree via os.MkdirAll
216 return err
217 }
219 out, err := os.Create(dest)Create file via os.Create
220 if err != nil {
221 return err
222 }
224 if _, err := io.Copy(out, resp.Body); err != nil {Copy data via io.Copy
225 return err
226 }
232 return os.Chmod(dest, perm)Modify permissions via os.Chmod
233 }
278 lineBytes, err := os.ReadFile(filename)Read file contents via os.ReadFile
279 if err != nil {
280 return err
287 if err := os.Remove(filename); err != nil {Go file removal capability
288 return err
289 }
290 }
yaml_command_test.go go
1 package altsrcBenign DLL side-loading context
12 func TestCommandYamlFileTest(t *testing.T) {Go testing package
13 app := &cli.App{}
14 set := flag.NewFlagSet("test", 0)Source, test, repository, or workspace target
15 _ = ioutil.WriteFile("current.yaml", []byte("test: 15"), 0666)Go output file writer
16 defer os.Remove("current.yaml")Go file removal capability
17 test := []string{"test-cmd", "--load", "current.yaml"}
18 _ = set.Parse(test)
42 func TestCommandYamlFileTestGlobalEnvVarWins(t *testing.T) {func Test prefix
43 app := &cli.App{}
76 func TestCommandYamlFileTestGlobalEnvVarWinsNested(t *testing.T) {func Test prefix
77 app := &cli.App{}
cli.yml github-actions
1 name: Run TestsSource or test deletion target
2 on:
3 push:
85 - run: make set-mkdocs-remote
86 env:
87 MKDOCS_REMOTE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}Targets GitHub Actions environment
88 - run: make deploy-mkdocs
json_command_test.go go
1 package altsrcBenign DLL side-loading context
12 const (
13 fileName = "current.json"
14 simpleJSON = `{"test": 15, "testb": false}`Source or test deletion target
15 nestedJSON = `{"top": {"test": 15}}`
16 )
18 func TestCommandJSONFileTest(t *testing.T) {Go testing package
19 cleanup := writeTempFile(t, fileName, simpleJSON)
20 defer cleanup()
54 func TestCommandJSONFileTestGlobalEnvVarWins(t *testing.T) {func Test prefix
55 cleanup := writeTempFile(t, fileName, simpleJSON)
89 func TestCommandJSONFileTestGlobalEnvVarWinsNested(t *testing.T) {func Test prefix
90 cleanup := writeTempFile(t, fileName, nestedJSON)
320 func writeTempFile(t *testing.T, name string, content string) func() {
321 if err := ioutil.WriteFile(name, []byte(content), 0666); err != nil {Go output file writer
322 t.Fatalf("cannot write %q: %v", name, err)
323 }
324 return func() {
325 if err := os.Remove(name); err != nil {Go file removal capability
326 t.Errorf("cannot remove %q: %v", name, err)
327 }
yaml_file_loader.go go
4 "fmt"
5 "io/ioutil"
6 "net/http"net/http package import
7 "net/url"
8 "os"
65 switch u.Scheme {
66 case "http", "https":
67 res, err := http.Get(filePath)Go http.Get call
68 if err != nil {
69 return nil, err
77 return nil, fmt.Errorf("Cannot read from file: '%s' because it does not exist.", filePath)
78 }
79 return ioutil.ReadFile(filePath)Read file contents via ioutil.ReadFile
80 } else if runtime.GOOS == "windows" && strings.Contains(u.String(), "\\") {runtime.GOOS OS detection
81 // on Windows systems u.Path is always empty, so we need to check the string directly.
82 if _, notFoundFileErr := os.Stat(filePath); notFoundFileErr != nil {
flag.go go
36 var VersionFlag Flag = &BoolFlag{
37 Name: "version",
38 Aliases: []string{"v"},Validation vocabulary string
39 Usage: "print the version",
40 DisableDefaultText: true,
111 // RequiredFlag is an interface that allows us to mark flags as requiredValidation vocabulary required
112 // it allows flags required flags to be backwards compatible with the Flag interface
113 type RequiredFlag interface {
290 func withEnvHint(envVars []string, str string) string {
291 envText := ""
292 if runtime.GOOS != "windows" || os.Getenv("PSHOME") != "" {os.Getenv() environment variable
293 envText = defaultEnvFormat(envVars)
294 } else {
372 // Return the first value from a list of environment variables and files
373 // (which may or may not exist), a description of where the value was found,
374 // and a boolean which is true if a value was found.Validation vocabulary boolean
375 func flagFromEnvOrFile(envVars []string, filePath string) (value string, fromWhere string, found boo
376 for _, envVar := range envVars {
382 for _, fileVar := range strings.Split(filePath, ",") {
383 if fileVar != "" {
384 if data, err := ioutil.ReadFile(fileVar); err == nil {Read file contents via ioutil.ReadFile
385 return string(data), fmt.Sprintf("file %q", filePath), true
386 }
flag_string_slice.go go
39 if strings.HasPrefix(value, slPfx) {
40 // Deserializing assumes overwrite
41 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &s.slice)Go JSON unmarshal call
42 s.hasBeenSet = true
43 return nil
58 // Serialize allows StringSlice to fulfill Serializer
59 func (s *StringSlice) Serialize() string {
60 jsonBytes, _ := json.Marshal(s.slice)Go JSON marshal call
61 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
62 }
flag_float64_slice.go go
39 if strings.HasPrefix(value, slPfx) {
40 // Deserializing assumes overwrite
41 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &f.slice)Go JSON unmarshal call
42 f.hasBeenSet = true
43 return nil
67 // Serialize allows Float64Slice to fulfill Serializer
68 func (f *Float64Slice) Serialize() string {
69 jsonBytes, _ := json.Marshal(f.slice)Go JSON marshal call
70 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
71 }

Showing the top 10 files for legibility — 12 more files (64 results) hidden. Open a file directly to see its full context.

Well-known

Objectives

Micro-behaviors

notable severity, 80% confident.
fs/file/write Write file via os.WriteFile
notable severity, 90% confident.
process/create/shell PowerShell Invoke-Expression cmdlet
baseline severity, 88% confident.
os/service GitHub Actions GITHUB_TOKEN secret

Metadata

notable severity, 92% confident.
build actions/checkout workflow step

20 of 40 traits shown

Identity

SHA-256 f2f776f6ec332a6ebfb384b9fad320f0efdefd94be3dfa4b0e92f02342225074
Canonical SHA-256 00f5d0bf0a101b37773654185e190d4a23c24ed13d1bca8177b6348b4eb60dfa
Filename github.com-matthewtolman-urfave-cli-v2-v2.23.8.zip
Package github.com
Version v2.23.8

Origin

Source harvest
Feed pkg.go.dev
Ecosystem go
Domain googleusercontent.com

Timeline

First seen 11 Jun 2026 19:53 UTC
First analyzed 12 Jun 2026 07:58 UTC
Last analyzed 12 Jun 2026 07:58 UTC
Last updated 12 Jun 2026 07:58 UTC

Labeling

Label unknown
Label source harvest
Traits version e31a3