.nornir/assets/behavior-features.svg
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 880 440" font-family="-apple-system,Segoe UI,Roboto,sans-serif" font-size="14">
<defs>
<marker id="a" markerWidth="9" markerHeight="9" refX="7" refY="3" orient="auto">
<path d="M0,0 L7,3 L0,6 Z" fill="#555"/>
</marker>
</defs>
<text x="30" y="28" font-weight="700" font-size="16">A23 behaviour features — four front-ends, one folder → PackageBehavior → Finding[]</text>
<!-- npm source -->
<rect x="30" y="48" width="200" height="60" rx="8" fill="#eef3fb" stroke="#2b5fb3" stroke-width="1.5"/>
<text x="130" y="70" text-anchor="middle" font-weight="600">npm package.json</text>
<text x="130" y="88" text-anchor="middle" fill="#555" font-size="12">parse_npm_package</text>
<text x="130" y="103" text-anchor="middle" fill="#888" font-size="11">auto-run scripts: pre/post-install · prepare</text>
<!-- pypi setup.py source -->
<rect x="30" y="116" width="200" height="60" rx="8" fill="#eef3fb" stroke="#2b5fb3" stroke-width="1.5"/>
<text x="130" y="138" text-anchor="middle" font-weight="600">PyPI setup.py</text>
<text x="130" y="156" text-anchor="middle" fill="#555" font-size="12">parse_pypi_setup</text>
<text x="130" y="171" text-anchor="middle" fill="#888" font-size="11">whole file runs · cmdclass = hook</text>
<!-- pypi pyproject.toml source -->
<rect x="30" y="184" width="200" height="72" rx="8" fill="#eef3fb" stroke="#2b5fb3" stroke-width="1.5"/>
<text x="130" y="206" text-anchor="middle" font-weight="600">PyPI pyproject.toml</text>
<text x="130" y="224" text-anchor="middle" fill="#555" font-size="12">parse_pyproject_toml</text>
<text x="130" y="242" text-anchor="middle" fill="#2f8f4e" font-size="11">SECTION-AWARE TOML (no toml dep)</text>
<!-- setuptools setup.cfg source -->
<rect x="30" y="264" width="200" height="76" rx="8" fill="#eef3fb" stroke="#2b5fb3" stroke-width="1.5"/>
<text x="130" y="286" text-anchor="middle" font-weight="600">setuptools setup.cfg</text>
<text x="130" y="304" text-anchor="middle" fill="#555" font-size="12">parse_setup_cfg</text>
<text x="130" y="321" text-anchor="middle" fill="#2f8f4e" font-size="11">SECTION-AWARE INI (no ini dep)</text>
<text x="130" y="335" text-anchor="middle" fill="#888" font-size="11">cmdclass · dependency_links · skips [metadata]</text>
<!-- folder -->
<rect x="300" y="120" width="200" height="96" rx="8" fill="#eefaf0" stroke="#2f8f4e" stroke-width="1.5"/>
<text x="400" y="146" text-anchor="middle" font-weight="600">extract_from_install_text</text>
<text x="400" y="168" text-anchor="middle" fill="#555" font-size="12">ONE shared folder (L5)</text>
<text x="400" y="188" text-anchor="middle" fill="#c26a2b" font-size="12">reuses core::shannon_entropy</text>
<text x="400" y="206" text-anchor="middle" fill="#888" font-size="11">pure · offline · no code run</text>
<!-- features -->
<rect x="300" y="240" width="200" height="100" rx="8" fill="#f6eefb" stroke="#7a3fb3" stroke-width="1.5"/>
<text x="400" y="265" text-anchor="middle" font-weight="700">PackageBehavior</text>
<text x="400" y="287" text-anchor="middle" fill="#555" font-size="12">install_hooks · network_in_install</text>
<text x="400" y="305" text-anchor="middle" fill="#555" font-size="12">url_count · max_token_entropy</text>
<text x="400" y="323" text-anchor="middle" fill="#555" font-size="12">sensitive_apis {}</text>
<!-- findings -->
<rect x="560" y="70" width="290" height="220" rx="8" fill="#fdf2ec" stroke="#c26a2b" stroke-width="1.5"/>
<text x="705" y="96" text-anchor="middle" font-weight="600">findings() → Vec<Finding></text>
<text x="580" y="130" fill="#555" font-size="12">network_in_install</text>
<text x="838" y="130" text-anchor="end" fill="#a12" font-size="12" font-weight="700">High · NETWORK-IN-INSTALL</text>
<text x="580" y="160" fill="#555" font-size="12">sensitive_apis</text>
<text x="838" y="160" text-anchor="end" fill="#b3452b" font-size="12">Medium · SENSITIVE-API</text>
<text x="580" y="190" fill="#555" font-size="12">entropy ≥ 4.5</text>
<text x="838" y="190" text-anchor="end" fill="#b3452b" font-size="12">Medium · OBFUSCATION</text>
<text x="580" y="220" fill="#555" font-size="12">install_hooks</text>
<text x="838" y="220" text-anchor="end" fill="#7a6a2b" font-size="12">Low · INSTALL-HOOK</text>
<text x="705" y="254" text-anchor="middle" fill="#888" font-size="11">A23 malicious-package feature vector</text>
<text x="705" y="270" text-anchor="middle" fill="#888" font-size="11">dropper: install hook → fetch stage-2 → exec</text>
<!-- warehouse persist (feature warehouse) -->
<rect x="560" y="308" width="290" height="76" rx="8" fill="#eef7fb" stroke="#2b8fb3" stroke-width="1.5"/>
<text x="705" y="330" text-anchor="middle" font-weight="600">behavior_features table (feature: warehouse)</text>
<text x="705" y="350" text-anchor="middle" fill="#555" font-size="12">append_package_behavior / load_package_behaviors</text>
<text x="705" y="368" text-anchor="middle" fill="#2f8f4e" font-size="11">coords + vector + verdict · field-identical round-trip</text>
<text x="705" y="381" text-anchor="middle" fill="#888" font-size="11">CLI: behavior --warehouse → warehouse behavior-log</text>
<path d="M500,320 C528,332 534,340 560,344" fill="none" stroke="#2b8fb3" stroke-width="1.4" marker-end="url(#a)"/>
<path d="M230,78 C262,86 268,140 300,150" fill="none" stroke="#555" stroke-width="1.4" marker-end="url(#a)"/>
<path d="M230,146 C262,150 268,162 300,164" fill="none" stroke="#555" stroke-width="1.4" marker-end="url(#a)"/>
<path d="M230,220 C262,206 268,184 300,178" fill="none" stroke="#555" stroke-width="1.4" marker-end="url(#a)"/>
<path d="M230,302 C264,272 266,206 300,192" fill="none" stroke="#555" stroke-width="1.4" marker-end="url(#a)"/>
<path d="M400,216 L400,240" fill="none" stroke="#555" stroke-width="1.4" marker-end="url(#a)"/>
<path d="M500,262 C532,242 536,200 560,182" fill="none" stroke="#555" stroke-width="1.4" marker-end="url(#a)"/>
<text x="30" y="412" fill="#888" font-size="12">offline · metadata-only · same core::Finding model the verdict surface consumes — one folder, no per-ecosystem twin (L5)</text>
</svg>