{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The ChainDrop worm compromises the software supply chain by weaponizing developer tools; this hunt validates that no automated persistence or propagation is active on our contributors' machines."
      },
      "name": "ChainDrop Worm: Developer Tooling Persistence and Supply Chain Propagation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1546",
        "attack.t1102",
        "attack.t1534",
        "attack.t1574.006"
      ],
      "series": {
        "slug": "chaindrop-inside-a-self-propagating-npm-worm",
        "index": 2,
        "title": "ChainDrop: Inside a Self-Propagating npm Worm",
        "total": 2
      },
      "related": [
        {
          "hunt": "npm-supply-chain-compromise",
          "reason": "Initial infection via typosquatted packages is covered by the primary supply chain hunt; this hunt focuses on the worm's lifecycle.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "chaindrop-npm-worm-activity",
          "relation": "follows"
        }
      ],
      "targets": {
        "github": {
          "name": "github",
          "category": "siem",
          "huntbase": {
            "product": "github"
          }
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt pivots from IDE configuration files to blockchain-based network activity and then to GitHub package audit logs. A single detection rule cannot link these across multiple surfaces to confirm a self-propagating infection.",
      "coverage": [
        {
          "stage": "developer-tooling-persistence",
          "steps": [
            "detect-worm-hooks",
            "check-latent-persistence"
          ],
          "status": "covered"
        },
        {
          "stage": "blockchain-c2-routing",
          "steps": [
            "check-blockchain-c2"
          ],
          "status": "covered"
        },
        {
          "stage": "automated-package-propagation",
          "steps": [
            "check-npm-propagation"
          ],
          "status": "covered"
        },
        {
          "stage": "npm-supply-chain-compromise",
          "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "npm-lifecycle-hook-execution",
          "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "portable-runtime-dropper",
          "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-and-environment-sweep",
          "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "ci-runner-memory-access",
          "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Trojanized npm Package Installation",
            "slug": "npm-supply-chain-compromise",
            "tactic": "initial-access",
            "techniques": [
              "T1195.002"
            ],
            "observables": [
              "registry.npmjs.org",
              "keyv",
              "cacheable-request"
            ]
          },
          {
            "name": "NPM Preinstall Hook Execution",
            "slug": "npm-lifecycle-hook-execution",
            "tactic": "execution",
            "techniques": [
              "T1059.003"
            ],
            "observables": [
              "preinstall",
              "node setup.mjs"
            ]
          },
          {
            "name": "Bun Runtime Dropper and Payload Execution",
            "slug": "portable-runtime-dropper",
            "tactic": "execution",
            "techniques": [
              "T1105"
            ],
            "observables": [
              "setup.mjs",
              "math_init.js",
              "Bun 1.3.13",
              "Oven GitHub repository",
              "_NODE_RUNTIME_INIT=1"
            ]
          },
          {
            "name": "Filesystem and Environment Credential Harvest",
            "slug": "credential-and-environment-sweep",
            "tactic": "credential-access",
            "techniques": [
              "T1552.001",
              "T1555"
            ],
            "observables": [
              ".env",
              ".git-credentials",
              ".netrc",
              "SSH keys",
              "npm tokens",
              "GitHub tokens",
              "Kubernetes service-account tokens"
            ]
          },
          {
            "name": "CI Runner Process Memory Scraping",
            "slug": "ci-runner-memory-access",
            "tactic": "credential-access",
            "techniques": [
              "T1003.001"
            ],
            "observables": [
              "Runner.Worker",
              "/proc/pid/maps",
              "/proc/pid/mem",
              "OIDC tokens"
            ]
          },
          {
            "name": "Persistence via VS Code and Claude Code Hooks",
            "slug": "developer-tooling-persistence",
            "tactic": "persistence",
            "techniques": [
              "T1546"
            ],
            "observables": [
              ".vscode/tasks.json",
              ".claude/settings.json",
              "Environment Setup",
              "SessionStart",
              ".claude/math_init.js",
              "com.user.gh-token-monitor",
              "gh-token-monitor.service"
            ]
          },
          {
            "name": "Ethereum Smart Contract C2 Resolution",
            "slug": "blockchain-c2-routing",
            "tactic": "command-and-control",
            "techniques": [
              "T1102"
            ],
            "observables": [
              "Ethereum transaction",
              "blockchain-based C2 resolution"
            ]
          },
          {
            "name": "Worm Propagation via Package Republishing",
            "slug": "automated-package-propagation",
            "tactic": "lateral-movement",
            "techniques": [
              "T1534",
              "T1574.006"
            ],
            "observables": [
              "Shai-Hulud: Here We Go Again",
              ".github/workflows/codeql_analysis.yml",
              "npm:registry.npmjs.org",
              "release-drafter.yml",
              "/opensearch-js"
            ]
          }
        ],
        "summary": "ChainDrop is a self-propagating npm worm that infects developer environments via trojanized package lifecycle hooks to harvest cloud credentials, SSH keys, and CI runner secrets. It persists through cross-linked VS Code and AI tool configurations and uses Ethereum smart contracts for C2 routing to spread by republishing infected versions of legitimate packages."
      },
      "severity": "high",
      "rationale": "Focus on developer endpoints and CI/CD environments. Prioritize users with 'maintainer' or 'owner' roles in GitHub and npm repositories.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has compromised developer environments by injecting malicious hooks into IDE configuration files, using automated GitHub workflows to propagate an npm worm and resolve C2 via Ethereum smart contracts.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "scoping-result",
            "kind": "manual",
            "observed": "2026-08-06"
          },
          "type": "list[host]",
          "default": [],
          "description": "Limit analysis to specific hosts found in the initial scoping step."
        },
        "eth_gateways": {
          "from": {
            "ref": "chaindrop-analysis",
            "kind": "article",
            "observed": "2026-08-06"
          },
          "type": "list[domain]",
          "default": [
            "mainnet.infura.io",
            "api.etherscan.io",
            "cloudflare-eth.com",
            "eth-mainnet.g.alchemy.com"
          ],
          "description": "Ethereum API and gateway domains used for blockchain-based C2 resolution."
        },
        "lookback_days": {
          "from": {
            "ref": "default-retention",
            "kind": "manual",
            "observed": "2026-08-06"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "worm_artifacts": {
          "from": {
            "ref": "chaindrop-analysis",
            "kind": "article",
            "observed": "2026-08-06"
          },
          "type": "list[string]",
          "default": [
            "math_init.js",
            "setup.mjs"
          ],
          "description": "Unique filenames associated with the worm's hooks and droppers."
        },
        "scope_github_users": {
          "from": {
            "ref": "scoping-result",
            "kind": "manual",
            "observed": "2026-08-06"
          },
          "type": "list[string]",
          "default": [],
          "description": "GitHub identities (organizations or logins) associated with infected workstations."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/",
          "name": "ChainDrop: Inside a Self-Propagating npm Worm"
        }
      ],
      "blind_spots": [
        {
          "id": "no-endpoint-telemetry",
          "risk": "An infected workstation with no telemetry can re-infect the repository indefinitely.",
          "stage": "developer-tooling-persistence",
          "question": "whether the hook files exist on hosts not reporting file activity",
          "requires": "hb_file_activity coverage on all developer workstations"
        },
        {
          "id": "ephemeral-runners",
          "risk": "The DNS lookup may vanish before it is collected if the runner environment is destroyed immediately after the job.",
          "stage": "blockchain-c2-routing",
          "question": "whether the C2 resolution happened within a short-lived GitHub Actions job",
          "requires": "Real-time DNS logging for ephemeral CI runners"
        }
      ]
    },
    "name": "ChainDrop Worm: Developer Tooling Persistence and Supply Chain Propagation",
    "description": "ChainDrop is a self-propagating npm worm targeting workstations and CI/CD runners. This hunt focuses on identifying persistence within VS Code and Claude Code configurations, detecting latent system services, and uncovering blockchain-based C2 routing. It concludes by verifying whether the infected account has propagated the worm by republishing malicious npm packages. The workflow uses file telemetry to find hooks, DNS activity to find Ethereum resolution, and GitHub audit logs to confirm supply chain impact."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "chaindrop-inside-a-self-propagating-npm-worm",
          "index": 2,
          "title": "ChainDrop: Inside a Self-Propagating npm Worm",
          "total": 2
        },
        "coverage": [
          {
            "stage": "developer-tooling-persistence",
            "steps": [
              "detect-worm-hooks",
              "check-latent-persistence"
            ],
            "status": "covered"
          },
          {
            "stage": "blockchain-c2-routing",
            "steps": [
              "check-blockchain-c2"
            ],
            "status": "covered"
          },
          {
            "stage": "automated-package-propagation",
            "steps": [
              "check-npm-propagation"
            ],
            "status": "covered"
          },
          {
            "stage": "npm-supply-chain-compromise",
            "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "npm-lifecycle-hook-execution",
            "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "portable-runtime-dropper",
            "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-and-environment-sweep",
            "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "ci-runner-memory-access",
            "reason": "Belongs to another part of the 'ChainDrop: Inside a Self-Propagating npm Worm' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has compromised developer environments by injecting malicious hooks into IDE configuration files, using automated GitHub workflows to propagate an npm worm and resolve C2 via Ethereum smart contracts.",
        "blind_spots": [
          {
            "id": "no-endpoint-telemetry",
            "risk": "An infected workstation with no telemetry can re-infect the repository indefinitely.",
            "stage": "developer-tooling-persistence",
            "question": "whether the hook files exist on hosts not reporting file activity",
            "requires": "hb_file_activity coverage on all developer workstations"
          },
          {
            "id": "ephemeral-runners",
            "risk": "The DNS lookup may vanish before it is collected if the runner environment is destroyed immediately after the job.",
            "stage": "blockchain-c2-routing",
            "question": "whether the C2 resolution happened within a short-lived GitHub Actions job",
            "requires": "Real-time DNS logging for ephemeral CI runners"
          }
        ],
        "scoping_notes": "Focus on developer endpoints and CI/CD environments. Prioritize users with 'maintainer' or 'owner' roles in GitHub and npm repositories.",
        "beyond_detection": "This hunt pivots from IDE configuration files to blockchain-based network activity and then to GitHub package audit logs. A single detection rule cannot link these across multiple surfaces to confirm a self-propagating infection."
      }
    },
    {
      "id": "detect-worm-hooks",
      "type": "query",
      "label": "Detect IDE and Workflow Hooks",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE instr(',' || '{{worm_artifacts}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND (LOWER(file_path) LIKE '%\\.vscode\\%' OR LOWER(file_path) LIKE '%\\.claude\\%') AND activity_id IN (1, 3, 5) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Identify the creation of unique malicious hooks in VS Code and Claude Code directories that trigger the worm's dropper.",
        "expected_signal": "Rows indicating the creation of unique dropper or payload files in hidden developer directories like .vscode or .claude."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Detect IDE and Workflow Hooks",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "file_path",
          "file_name",
          "time",
          "activity_id"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE instr(',' || '{{worm_artifacts}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND (LOWER(file_path) LIKE '%\\.vscode\\%' OR LOWER(file_path) LIKE '%\\.claude\\%') AND activity_id IN (1, 3, 5) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows indicating the creation of unique dropper or payload files in hidden developer directories like .vscode or .claude.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "check-latent-persistence",
      "type": "query",
      "label": "Check for Latent OS Services",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, job_name, job_definition_path, time FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(job_name) LIKE '%gh-token-monitor%' OR LOWER(job_definition_path) LIKE '%gh-token-monitor%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_scheduled_job",
        "description": "Search for the installation of the macOS LaunchAgent or Linux systemd service described in the latent capability of the worm.",
        "expected_signal": "A LaunchAgent or systemd unit named gh-token-monitor; silence indicates the latent capability was not activated on the identified hosts."
      },
      "parents": [
        {
          "id": "detect-worm-hooks"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Check for Latent OS Services",
        "reads": [
          "device_hostname",
          "job_name",
          "job_definition_path",
          "time"
        ],
        "source": "hb_scheduled_job",
        "target": "endpoint",
        "content": "SELECT device_hostname, job_name, job_definition_path, time FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(job_name) LIKE '%gh-token-monitor%' OR LOWER(job_definition_path) LIKE '%gh-token-monitor%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A LaunchAgent or systemd unit named gh-token-monitor; silence indicates the latent capability was not activated on the identified hosts.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "check-blockchain-c2",
      "type": "query",
      "label": "Blockchain Gateway Resolution",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{eth_gateways}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name",
        "surface": "hb_dns_activity",
        "description": "Identify anomalous DNS requests to Ethereum gateways used by the worm to resolve its dynamic C2 infrastructure.",
        "expected_signal": "Rare resolution of Ethereum gateways from identified suspect hosts. Correlation with the worm's lead files increases confidence."
      },
      "parents": [
        {
          "id": "detect-worm-hooks"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Blockchain Gateway Resolution",
        "reads": [
          "device_hostname",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{eth_gateways}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare resolution of Ethereum gateways from identified suspect hosts. Correlation with the worm's lead files increases confidence.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "check-npm-propagation",
      "type": "query",
      "label": "Suspect npm Package Updates",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "github",
        "content": "SELECT name, organization, updated_at FROM github_package WHERE package_type = 'npm' AND ('{{scope_github_users}}' = '' OR instr(',' || '{{scope_github_users}}' || ',', ',' || organization || ',') > 0) AND updated_at >= datetime('now', '-{{lookback_days}} days')",
        "product": "github",
        "surface": "github_package",
        "extension": "github",
        "description": "Query GitHub package logs to find npm packages updated during the infection window for specific identities.",
        "expected_signal": "A list of recently published packages for manual correlation with infected workstations and identities."
      },
      "parents": [
        {
          "id": "detect-worm-hooks"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Suspect npm Package Updates",
        "reads": [
          "name",
          "organization",
          "updated_at"
        ],
        "source": "github_package",
        "target": "github",
        "content": "SELECT name, organization, updated_at FROM github_package WHERE package_type = 'npm' AND ('{{scope_github_users}}' = '' OR instr(',' || '{{scope_github_users}}' || ',', ',' || organization || ',') > 0) AND updated_at >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of recently published packages for manual correlation with infected workstations and identities.",
        "verified": "dry-run",
        "verified_at": "2026-09-20",
        "target_extension": "github"
      }
    },
    {
      "id": "triage-findings",
      "type": "analytic",
      "label": "Weigh Evidence per Host",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "github"
        ],
        "context": [
          "detect-worm-hooks",
          "check-latent-persistence",
          "check-blockchain-c2",
          "check-npm-propagation"
        ],
        "objective": "Determine if the observed IDE hooks and network resolution patterns indicate an active ChainDrop infection and if propagation has occurred.",
        "description": "Weigh file, persistence, and network evidence to determine if a host is a worm beachhead.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict that links the creation of hooks to blockchain C2 traffic.",
        "success_criteria": "A verdict of malicious for hosts exhibiting both hook files and blockchain activity, or suspicious for those with hook files only."
      },
      "parents": [
        {
          "id": "check-latent-persistence",
          "kind": "merge"
        },
        {
          "id": "check-blockchain-c2",
          "kind": "merge"
        },
        {
          "id": "check-npm-propagation",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on Infection Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "no-endpoint-telemetry",
        "confidence": "high",
        "description": "Automate the transition to containment if the agent finds high-confidence evidence of infection.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-findings"
        }
      ]
    },
    {
      "id": "contain-and-revoke",
      "type": "action",
      "label": "Contain and Revoke Secrets",
      "config": {
        "target": "endpoint",
        "description": "Stop the active spread of the worm and neutralize stolen credentials.",
        "instructions": "Isolate the host immediately. Revoke all GitHub and npm tokens associated with the identity found on the workstation. Delete the .vscode and .claude directories containing the hooks.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-review",
      "type": "task",
      "label": "Analyst Review of Propagation",
      "config": {
        "assignee": "analyst",
        "description": "Manually verify whether any npm packages were infected and published from the compromised environment.",
        "instructions": "Review the packages listed in the propagation step. Cross-reference their update time with the workstation infection window. Audit the package contents for the setup.mjs and preinstall hooks."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "contain-and-revoke"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt Close-out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and schedule tuning.",
        "instructions": "Record the impact on the software supply chain. Notify downstream consumers if infected packages were confirmed. Recommend standing detection for unique malicious filenames in IDE configuration paths."
      },
      "parents": [
        {
          "id": "manual-review"
        }
      ]
    }
  ]
}