google / google/magika

[Misdetection] BASE64 (text/plain) file misdetected as JS

Open
#1,145 1 comment 0 reactions 0 assignees View on GitHub
misdetection
Dominant language
Rust
Stars
18.6k
Forks
1.2k
Avg merge
3d 12h
Merged PRs (30d)
20

Description

**What should the file have been detected as? What has the file been misdetected as?**
This BASE64-encoded file is incorrectly detected by Magika as JavaScript, whereas it should be seen at least as text/plain (since BASE64 has no dedicated mimetype), or better with a label such as "BASE64-encoded file".

Note: the original file that was encoded in BASE64 is a binary file, not JS.

**Please link or attach the misdetected file below** (Do NOT upload PII!)
Source: https://bazaar.abuse.ch/sample/bab4d16295388afcc74448a5652a3cc5cbf124540715225effd1e5c2de09a2ee/
Sample (malware zipped with password "infected"):
[bab4d16295388afcc74448a5652a3cc5cbf124540715225effd1e5c2de09a2ee.zip](https://github.com/user-attachments/files/22623966/bab4d16295388afcc74448a5652a3cc5cbf124540715225effd1e5c2de09a2ee.zip)

**Additional context**
Magika output:
```
$ magika --version
magika 0.1.2 standard_v3_3
$ magika --json bab4d16295388afcc74448a5652a3cc5cbf124540715225effd1e5c2de09a2ee.base64.txt
[
{
"path": "bab4d16295388afcc74448a5652a3cc5cbf124540715225effd1e5c2de09a2ee.base64.txt",
"result": {
"status": "ok",
"value": {
"dl": {
"description": "JavaScript source",
"extensions": [
"js",
"mjs",
"cjs"
],
"group": "code",
"is_text": true,
"label": "javascript",
"mime_type": "application/javascript"
},
"output": {
"description": "JavaScript source",
"extensions": [
"js",
"mjs",
"cjs"
],
"group": "code",
"is_text": true,
"label": "javascript",
"mime_type": "application/javascript"
},
"score": 0.7070000171661377
}
}
}
]
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the report with the attached BASE64 sample and the shown `magika --json` command, confirming the JavaScript result. Trace the file-type classification path and determine how the sample should instead receive a text/plain or BASE64-specific label; done means the sample no longer receives the JavaScript label.

Written by the indexing model from the issue text.

Assessment

Domain
machine-learning
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.