{"campaigns":[{"confidence_score":90,"events":[{"created_at":1780353071,"detail":{"examples":["agentcrew-ai@0.15.10","agentcrew-ai@0.15.11","agentcrew-ai@0.15.12","agentcrew-ai@0.15.9","aorta-sirius-dev@0.273","aorta-sirius@0.129","brickforge@0.1.0a10","brickforge@0.1.0a11","brickforge@0.1.0a12","brickforge@0.1.0a13"],"members":67,"previous_members":66},"event_kind":"expanded_campaign"},{"created_at":1780351971,"detail":{"examples":["agentcrew-ai@0.15.10","agentcrew-ai@0.15.11","agentcrew-ai@0.15.12","agentcrew-ai@0.15.9","aorta-sirius-dev@0.273","aorta-sirius@0.129","brickforge@0.1.0a10","brickforge@0.1.0a11","brickforge@0.1.0a12","brickforge@0.1.0a13"],"members":66,"previous_members":65},"event_kind":"expanded_campaign"},{"created_at":1780347148,"detail":{"examples":["agentcrew-ai@0.15.10","agentcrew-ai@0.15.11","agentcrew-ai@0.15.12","agentcrew-ai@0.15.9","aorta-sirius-dev@0.273","aorta-sirius@0.129","brickforge@0.1.0a10","brickforge@0.1.0a11","brickforge@0.1.0a12","brickforge@0.1.0a13"],"members":65,"previous_members":64},"event_kind":"expanded_campaign"},{"created_at":1780338147,"detail":{"examples":["agentcrew-ai@0.15.10","agentcrew-ai@0.15.11","agentcrew-ai@0.15.12","agentcrew-ai@0.15.9","aorta-sirius-dev@0.273","aorta-sirius@0.129","brickforge@0.1.0a10","brickforge@0.1.0a11","brickforge@0.1.0a12","brickforge@0.1.0a13"],"members":64,"previous_members":63},"event_kind":"expanded_campaign"}],"examples":["agentcrew-ai@0.15.10","agentcrew-ai@0.15.11","agentcrew-ai@0.15.12","agentcrew-ai@0.15.9","aorta-sirius-dev@0.273","aorta-sirius@0.129","brickforge@0.1.0a10","brickforge@0.1.0a11","brickforge@0.1.0a12","brickforge@0.1.0a13"],"first_seen":1780135945,"growth_per_day":23,"id":"ttp_detail-14b5a0bda4820a67","key":"py_install_time_network_call:network call (urllib/requests/httpx/http.client) at install or import time.","kind":"ttp_detail","last_seen":1780379637,"max_score":360,"members":67,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379573,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","abstract-hugpy@0.1.372","abstract-hugpy@0.1.373","abstract-hugpy@0.1.374","abstract-hugpy@0.1.375","abstractruntime@0.4.24","abstractruntime@0.4.25","abstractruntime@0.4.26","adclaw@1.0.27"],"members":1367,"previous_members":1366},"event_kind":"expanded_campaign"},{"created_at":1780377678,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","abstract-hugpy@0.1.372","abstract-hugpy@0.1.373","abstract-hugpy@0.1.374","abstract-hugpy@0.1.375","abstractruntime@0.4.24","abstractruntime@0.4.25","abstractruntime@0.4.26","adclaw@1.0.27"],"members":1366,"previous_members":1364},"event_kind":"expanded_campaign"},{"created_at":1780376421,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","abstract-hugpy@0.1.372","abstract-hugpy@0.1.373","abstract-hugpy@0.1.374","abstract-hugpy@0.1.375","abstractruntime@0.4.24","abstractruntime@0.4.25","abstractruntime@0.4.26","adclaw@1.0.27"],"members":1364,"previous_members":1363},"event_kind":"expanded_campaign"},{"created_at":1780376112,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","abstract-hugpy@0.1.372","abstract-hugpy@0.1.373","abstract-hugpy@0.1.374","abstract-hugpy@0.1.375","abstractruntime@0.4.24","abstractruntime@0.4.25","abstractruntime@0.4.26","adclaw@1.0.27"],"members":1363,"previous_members":1362},"event_kind":"expanded_campaign"}],"examples":["abstra@3.30.31","abstra@3.31.0","abstract-hugpy@0.1.372","abstract-hugpy@0.1.373","abstract-hugpy@0.1.374","abstract-hugpy@0.1.375","abstractruntime@0.4.24","abstractruntime@0.4.25","abstractruntime@0.4.26","adclaw@1.0.27"],"first_seen":1779812145,"growth_per_day":208,"id":"ttp_detail-e8894c2fd12542dd","key":"py_runtime_base64_decode:base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.","kind":"ttp_detail","last_seen":1780379637,"max_score":360,"members":1367,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780360383,"detail":{"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2","hol-guard@2.0.348","hol-guard@2.0.349","hol-guard@2.0.350","hol-guard@2.0.351","hol-guard@2.0.352","hol-guard@2.0.353","hol-guard@2.0.354"],"members":144,"previous_members":143},"event_kind":"expanded_campaign"},{"created_at":1780360382,"detail":{"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2","hol-guard@2.0.348","hol-guard@2.0.349","hol-guard@2.0.350","hol-guard@2.0.351","hol-guard@2.0.352","hol-guard@2.0.353","hol-guard@2.0.354"],"members":143,"previous_members":142},"event_kind":"expanded_campaign"},{"created_at":1780358191,"detail":{"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2","hol-guard@2.0.348","hol-guard@2.0.349","hol-guard@2.0.350","hol-guard@2.0.351","hol-guard@2.0.352","hol-guard@2.0.353","hol-guard@2.0.354"],"members":142,"previous_members":140},"event_kind":"expanded_campaign"},{"created_at":1780353715,"detail":{"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2","hol-guard@2.0.348","hol-guard@2.0.349","hol-guard@2.0.350","hol-guard@2.0.351","hol-guard@2.0.352","hol-guard@2.0.353","hol-guard@2.0.354"],"members":140,"previous_members":139},"event_kind":"expanded_campaign"}],"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2","hol-guard@2.0.348","hol-guard@2.0.349","hol-guard@2.0.350","hol-guard@2.0.351","hol-guard@2.0.352","hol-guard@2.0.353","hol-guard@2.0.354"],"first_seen":1779598734,"growth_per_day":15,"id":"ttp_detail-c35541b814455d2e","key":"credential_paths:matched \".npmrc\"","kind":"ttp_detail","last_seen":1780379637,"max_score":360,"members":144,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780378490,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","acdh-id-reconciler@0.8.0","affx@1.0.0","affx@1.1","agent-bom@0.88.5","agent-framework-devui@1.0.0b260528","agent-framework@1.7.0","aidev-wxbot@2.0.6","airalogy@0.11.0"],"members":585,"previous_members":584},"event_kind":"expanded_campaign"},{"created_at":1780378305,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","acdh-id-reconciler@0.8.0","affx@1.0.0","affx@1.1","agent-bom@0.88.5","agent-framework-devui@1.0.0b260528","agent-framework@1.7.0","aidev-wxbot@2.0.6","airalogy@0.11.0"],"members":584,"previous_members":583},"event_kind":"expanded_campaign"},{"created_at":1780378050,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","acdh-id-reconciler@0.8.0","affx@1.0.0","affx@1.1","agent-bom@0.88.5","agent-framework-devui@1.0.0b260528","agent-framework@1.7.0","aidev-wxbot@2.0.6","airalogy@0.11.0"],"members":583,"previous_members":582},"event_kind":"expanded_campaign"},{"created_at":1780375913,"detail":{"examples":["abstra@3.30.31","abstra@3.31.0","acdh-id-reconciler@0.8.0","affx@1.0.0","affx@1.1","agent-bom@0.88.5","agent-framework-devui@1.0.0b260528","agent-framework@1.7.0","aidev-wxbot@2.0.6","airalogy@0.11.0"],"members":582,"previous_members":581},"event_kind":"expanded_campaign"}],"examples":["abstra@3.30.31","abstra@3.31.0","acdh-id-reconciler@0.8.0","affx@1.0.0","affx@1.1","agent-bom@0.88.5","agent-framework-devui@1.0.0b260528","agent-framework@1.7.0","aidev-wxbot@2.0.6","airalogy@0.11.0"],"first_seen":1779859380,"growth_per_day":97,"id":"ttp_detail-44d777e449bbf08a","key":"py_import_time_network_call:network call (urllib/requests/httpx/http.client) at install or import time.","kind":"ttp_detail","last_seen":1780379637,"max_score":360,"members":585,"status":"active"},{"confidence_score":68,"events":[{"created_at":1780135946,"detail":{"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2"],"key":"Nous Research","kind":"publisher_high_risk","max_score":372,"members":3},"event_kind":"new_campaign"}],"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2"],"first_seen":1780135945,"growth_per_day":1,"id":"publisher_high_risk-ccd586d9826e42a3","key":"Nous Research","kind":"publisher_high_risk","last_seen":1780379637,"max_score":360,"members":3,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780152139,"detail":{"examples":["@0xff-ai/omnifs@0.2.0-dev.0","@0xff-ai/omnifs@0.2.0-dev.1","@0xff-ai/omnifs@0.2.0-dev.2","@agent-sh/agent-workspace-linux@0.1.0","@agent-sh/agent-workspace-linux@0.1.1","@ai-xuyan/km@0.2.1","@ai-xuyan/km@0.2.3","@aliyun-supabase/cli@1.0.4","@aliyun-supabase/cli@1.0.5","@amaster.ai/pi-computer-use@0.1.2-beta.10"],"members":668,"previous_members":666},"event_kind":"expanded_campaign"},{"created_at":1780135945,"detail":{"examples":["@0xff-ai/omnifs@0.2.0-dev.0","@0xff-ai/omnifs@0.2.0-dev.1","@0xff-ai/omnifs@0.2.0-dev.2","@actionbookdev/cli@1.5.1","@actionbookdev/cli@1.6.0","@agent-ops/synadia-agent-shim@1.0.0","@agent-ops/synadia-agent-shim@1.1.0","@agent-sh/agent-workspace-linux@0.1.0","@agent-sh/agent-workspace-linux@0.1.1","@ai-xuyan/km@0.2.1"],"max_score":372,"previous_score":320},"event_kind":"score_increased"},{"created_at":1780135945,"detail":{"examples":["@0xff-ai/omnifs@0.2.0-dev.0","@0xff-ai/omnifs@0.2.0-dev.1","@0xff-ai/omnifs@0.2.0-dev.2","@actionbookdev/cli@1.5.1","@actionbookdev/cli@1.6.0","@agent-ops/synadia-agent-shim@1.0.0","@agent-ops/synadia-agent-shim@1.1.0","@agent-sh/agent-workspace-linux@0.1.0","@agent-sh/agent-workspace-linux@0.1.1","@ai-xuyan/km@0.2.1"],"members":895,"previous_members":714},"event_kind":"expanded_campaign"},{"created_at":1779959206,"detail":{"examples":["@pzy560117/opensuper@0.2.6","ancoder-skill-cli@0.13.4","ancoder-skill-cli@0.13.3","@runflow-ai/cli@0.3.12","@runflow-ai/cli@0.3.11","@kaitranntt/ccs@8.1.0-dev.6","@kaitranntt/ccs@8.1.0-dev.5","agent-security-scanner-mcp@4.4.2","agent-security-scanner-mcp@4.4.1","@markdownai/core@1.0.0"],"members":714,"previous_members":712},"event_kind":"expanded_campaign"}],"examples":["@capibar.chat/ui-kit@99.5.7","@car-loans/applicaion-aff@99.99.99","@car-loans/application-aff@99.99.99","@car-loans/close-flow-module@99.99.99","@car-loans/deal-aff@99.99.99","@car-loans/deal@99.99.99","@car-loans/desktop-car-loans-application@99.99.99","@car-loans/feature-toggles-module@99.99.99","@car-loans/general-analytics@99.99.99","@car-loans/general-feature-toggles@99.99.99"],"first_seen":1779601417,"growth_per_day":32,"id":"ttp_detail-e82dda198c986cae","key":"install_lifecycle_remote_or_exec:postinstall=\"node scripts/postinstall.js\"","kind":"ttp_detail","last_seen":1780379637,"max_score":357,"members":295,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780174304,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh"],"members":5,"previous_members":4},"event_kind":"expanded_campaign"},{"created_at":1780166853,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6"],"members":4,"previous_members":3},"event_kind":"expanded_campaign"},{"created_at":1780164336,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6"],"members":3,"previous_members":2},"event_kind":"expanded_campaign"},{"created_at":1780164330,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6"],"key":"agentai2026","kind":"publisher_high_risk","max_score":333,"members":2},"event_kind":"new_campaign"}],"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh"],"first_seen":1780164330,"growth_per_day":2,"id":"publisher_high_risk-af6cf70ca8fe27b0","key":"agentai2026","kind":"publisher_high_risk","last_seen":1780379637,"max_score":333,"members":5,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780333439,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@blundergoat/gruff-ts@0.3.0","@orbit-software/sdk@1.94.1","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301305","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301504","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301603"],"members":37,"previous_members":36},"event_kind":"expanded_campaign"},{"created_at":1780311304,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@blundergoat/gruff-ts@0.3.0","@orbit-software/sdk@1.94.1","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301305","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301504","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301603"],"members":36,"previous_members":35},"event_kind":"expanded_campaign"},{"created_at":1780281870,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@blundergoat/gruff-ts@0.3.0","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301305","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301504","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301603","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301703"],"members":35,"previous_members":34},"event_kind":"expanded_campaign"},{"created_at":1780220855,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301305","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301504","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301603","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301703","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301803"],"members":34,"previous_members":33},"event_kind":"expanded_campaign"}],"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@blundergoat/gruff-ts@0.3.0","@orbit-software/sdk@1.94.1","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301305","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301504","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301603"],"first_seen":1779955840,"growth_per_day":7,"id":"ttp_detail-d401c2cec85cb892","key":"js_split_join_obfuscation:array-of-single-tokens joined to form a string — used to obscure module names like require([\"n\",\"o\",\"de\",\":\",\"cr\",\"yp\",\"to\"].join(\"\")), defeating static require() analysis.","kind":"ttp_detail","last_seen":1780379637,"max_score":333,"members":37,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379460,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":379,"previous_members":378},"event_kind":"expanded_campaign"},{"created_at":1780378989,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":378,"previous_members":377},"event_kind":"expanded_campaign"},{"created_at":1780377947,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":377,"previous_members":376},"event_kind":"expanded_campaign"},{"created_at":1780375924,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":376,"previous_members":375},"event_kind":"expanded_campaign"}],"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"first_seen":1779702416,"growth_per_day":48,"id":"ttp_detail-632a07269dc67de9","key":"webhook_exfil_endpoint:matched \"ngrok-free.app\"","kind":"ttp_detail","last_seen":1780379637,"max_score":333,"members":379,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379460,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":288,"previous_members":287},"event_kind":"expanded_campaign"},{"created_at":1780378989,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":287,"previous_members":286},"event_kind":"expanded_campaign"},{"created_at":1780377947,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":286,"previous_members":285},"event_kind":"expanded_campaign"},{"created_at":1780375924,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":285,"previous_members":284},"event_kind":"expanded_campaign"}],"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"first_seen":1779706898,"growth_per_day":36,"id":"ttp_detail-d6b26e137ead363e","key":"webhook_exfil_endpoint:matched \"ngrok.app\"","kind":"ttp_detail","last_seen":1780379637,"max_score":333,"members":288,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780378989,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":345,"previous_members":344},"event_kind":"expanded_campaign"},{"created_at":1780373712,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":344,"previous_members":343},"event_kind":"expanded_campaign"},{"created_at":1780373650,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":343,"previous_members":342},"event_kind":"expanded_campaign"},{"created_at":1780368352,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"members":342,"previous_members":341},"event_kind":"expanded_campaign"}],"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"first_seen":1779904553,"growth_per_day":62,"id":"ttp_detail-2ebe127163eddc41","key":"webhook_exfil_endpoint:matched \"api.telegram.org/bot\"","kind":"ttp_detail","last_seen":1780379637,"max_score":333,"members":345,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379573,"detail":{"examples":["agent-airlock@0.8.9","agentic-comms@0.9.10","agentic-comms@0.9.9","agentsociety2@2.5.2","agentsociety2@2.5.3","ai302@0.1.46","ai302@0.1.47","ai302@0.1.48","ai302@0.1.49","ai302@0.1.50"],"members":197,"previous_members":196},"event_kind":"expanded_campaign"},{"created_at":1780375147,"detail":{"examples":["agent-airlock@0.8.9","agentic-comms@0.9.10","agentic-comms@0.9.9","agentsociety2@2.5.2","agentsociety2@2.5.3","ai302@0.1.46","ai302@0.1.47","ai302@0.1.48","ai302@0.1.49","ai302@0.1.50"],"members":196,"previous_members":195},"event_kind":"expanded_campaign"},{"created_at":1780372858,"detail":{"examples":["agent-airlock@0.8.9","agentic-comms@0.9.10","agentic-comms@0.9.9","agentsociety2@2.5.2","agentsociety2@2.5.3","ai302@0.1.46","ai302@0.1.47","ai302@0.1.48","ai302@0.1.49","ai302@0.1.50"],"members":195,"previous_members":194},"event_kind":"expanded_campaign"},{"created_at":1780371496,"detail":{"examples":["agent-airlock@0.8.9","agentic-comms@0.9.10","agentic-comms@0.9.9","agentsociety2@2.5.2","agentsociety2@2.5.3","ai302@0.1.46","ai302@0.1.47","ai302@0.1.48","ai302@0.1.49","ai302@0.1.50"],"members":194,"previous_members":193},"event_kind":"expanded_campaign"}],"examples":["agent-airlock@0.8.9","agentic-comms@0.9.10","agentic-comms@0.9.9","agentsociety2@2.5.2","agentsociety2@2.5.3","ai302@0.1.46","ai302@0.1.47","ai302@0.1.48","ai302@0.1.49","ai302@0.1.50"],"first_seen":1779858759,"growth_per_day":32,"id":"ttp_detail-e667beae163169fa","key":"py_runtime_dynamic_dangerous_import:dynamic __import__('sys') — reflection bypass for static checks.","kind":"ttp_detail","last_seen":1780379637,"max_score":284,"members":197,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379573,"detail":{"examples":["agentci-aadi@0.2.0","agentci-aadi@0.2.1","agenticx@0.4.1","aibrain@1.8.7","aibrowser@1.1.0","aibrowser@1.1.1","alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20"],"members":506,"previous_members":505},"event_kind":"expanded_campaign"},{"created_at":1780376485,"detail":{"examples":["agentci-aadi@0.2.0","agentci-aadi@0.2.1","agenticx@0.4.1","aibrain@1.8.7","aibrowser@1.1.0","aibrowser@1.1.1","alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20"],"members":505,"previous_members":503},"event_kind":"expanded_campaign"},{"created_at":1780376112,"detail":{"examples":["agentci-aadi@0.2.0","agentci-aadi@0.2.1","agenticx@0.4.1","aibrain@1.8.7","aibrowser@1.1.0","aibrowser@1.1.1","alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20"],"members":503,"previous_members":502},"event_kind":"expanded_campaign"},{"created_at":1780375919,"detail":{"examples":["agentci-aadi@0.2.0","agentci-aadi@0.2.1","agenticx@0.4.1","aibrain@1.8.7","aibrowser@1.1.0","aibrowser@1.1.1","alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20"],"members":502,"previous_members":501},"event_kind":"expanded_campaign"}],"examples":["agentci-aadi@0.2.0","agentci-aadi@0.2.1","agenticx@0.4.1","aibrain@1.8.7","aibrowser@1.1.0","aibrowser@1.1.1","alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20"],"first_seen":1779823719,"growth_per_day":78,"id":"ttp_detail-292d9fba94ea087b","key":"py_runtime_dynamic_dangerous_import:dynamic __import__('os') — reflection bypass for static checks.","kind":"ttp_detail","last_seen":1780379637,"max_score":284,"members":506,"status":"active"},{"confidence_score":71,"events":[{"created_at":1780135946,"detail":{"examples":["mindfabric-agent@1.1.364","mindfabric-agent@1.1.365","mindfabric-agent@1.1.366"],"members":3,"previous_members":2},"event_kind":"expanded_campaign"},{"created_at":1779912082,"detail":{"examples":["mindfabric-agent@1.1.364","mindfabric-agent@1.1.365"],"key":"MindFabric Team","kind":"publisher_high_risk","max_score":370,"members":2},"event_kind":"new_campaign"}],"examples":["mindfabric-agent@1.1.364","mindfabric-agent@1.1.365","mindfabric-agent@1.1.366"],"first_seen":1779912082,"growth_per_day":1,"id":"publisher_high_risk-35f32126a036925d","key":"MindFabric Team","kind":"publisher_high_risk","last_seen":1780379637,"max_score":270,"members":3,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780369324,"detail":{"examples":["@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21","@goplus/agentguard@1.1.26","@goplus/agentguard@1.1.27","@lyrie/core@3.1.0","ansible-security-scanner@0.1.16"],"members":53,"previous_members":52},"event_kind":"expanded_campaign"},{"created_at":1780368901,"detail":{"examples":["@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21","@goplus/agentguard@1.1.26","@goplus/agentguard@1.1.27","@lyrie/core@3.1.0","ansible-security-scanner@0.1.16"],"members":52,"previous_members":51},"event_kind":"expanded_campaign"},{"created_at":1780363235,"detail":{"examples":["@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21","@goplus/agentguard@1.1.26","@goplus/agentguard@1.1.27","@lyrie/core@3.1.0","ansible-security-scanner@0.1.16"],"members":51,"previous_members":50},"event_kind":"expanded_campaign"},{"created_at":1780329529,"detail":{"examples":["@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21","@goplus/agentguard@1.1.26","@goplus/agentguard@1.1.27","@lyrie/core@3.1.0","ansible-security-scanner@0.1.16"],"members":50,"previous_members":49},"event_kind":"expanded_campaign"}],"examples":["@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21","@goplus/agentguard@1.1.26","@goplus/agentguard@1.1.27","@lyrie/core@3.1.0","ansible-security-scanner@0.1.16"],"first_seen":1779902943,"growth_per_day":9,"id":"ttp_detail-be39e9fd6d331e7d","key":"dns_or_oast_exfil:matched \"burpcollaborator.net\"","kind":"ttp_detail","last_seen":1780379637,"max_score":270,"members":53,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780376795,"detail":{"examples":["@aonunited/angular@99.0.1","@catamania/front-components@1.0.1","@catamania/front-components@1.0.2","@catamania/front-components@1.0.3","@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21"],"members":139,"previous_members":138},"event_kind":"expanded_campaign"},{"created_at":1780376112,"detail":{"examples":["@aonunited/angular@99.0.1","@catamania/front-components@1.0.1","@catamania/front-components@1.0.2","@catamania/front-components@1.0.3","@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21"],"members":138,"previous_members":137},"event_kind":"expanded_campaign"},{"created_at":1780375919,"detail":{"examples":["@aonunited/angular@99.0.1","@catamania/front-components@1.0.1","@catamania/front-components@1.0.2","@catamania/front-components@1.0.3","@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21"],"members":137,"previous_members":136},"event_kind":"expanded_campaign"},{"created_at":1780375717,"detail":{"examples":["@aonunited/angular@99.0.1","@catamania/front-components@1.0.1","@catamania/front-components@1.0.2","@catamania/front-components@1.0.3","@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21"],"members":136,"previous_members":135},"event_kind":"expanded_campaign"}],"examples":["@aonunited/angular@99.0.1","@catamania/front-components@1.0.1","@catamania/front-components@1.0.2","@catamania/front-components@1.0.3","@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21"],"first_seen":1779723276,"growth_per_day":18,"id":"ttp_detail-6e2f334930a2f849","key":"webhook_exfil_endpoint:matched \"webhook.site\"","kind":"ttp_detail","last_seen":1780379637,"max_score":253,"members":139,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780370446,"detail":{"examples":["@abacus-ai/cli@2.5.3-canary.0","@chainlink/cre-sdk@1.9.0","@circlesac/clova@26.5.0","@cloudflare/telescope@1.1.0","@codegraff/relay@0.2.0","@codeperfect/eslint-config@1.11.0","@codeperfect/eslint-plugin@2.1.0","@codeperfect/eslint-plugin@2.3.0","@codetreker/bf@0.1.0","@coinbase/coinbase-cli@0.0.1"],"members":107,"previous_members":106},"event_kind":"expanded_campaign"},{"created_at":1780370317,"detail":{"examples":["@abacus-ai/cli@2.5.3-canary.0","@chainlink/cre-sdk@1.9.0","@circlesac/clova@26.5.0","@cloudflare/telescope@1.1.0","@codegraff/relay@0.2.0","@codeperfect/eslint-config@1.11.0","@codeperfect/eslint-plugin@2.1.0","@codeperfect/eslint-plugin@2.3.0","@codetreker/bf@0.1.0","@coinbase/coinbase-cli@0.0.1"],"members":106,"previous_members":105},"event_kind":"expanded_campaign"},{"created_at":1780356669,"detail":{"examples":["@abacus-ai/cli@2.5.3-canary.0","@chainlink/cre-sdk@1.9.0","@circlesac/clova@26.5.0","@cloudflare/telescope@1.1.0","@codegraff/relay@0.2.0","@codeperfect/eslint-config@1.11.0","@codeperfect/eslint-plugin@2.1.0","@codeperfect/eslint-plugin@2.3.0","@codetreker/bf@0.1.0","@coinbase/coinbase-cli@0.0.1"],"members":105,"previous_members":104},"event_kind":"expanded_campaign"},{"created_at":1780341493,"detail":{"examples":["@abacus-ai/cli@2.5.3-canary.0","@chainlink/cre-sdk@1.9.0","@circlesac/clova@26.5.0","@cloudflare/telescope@1.1.0","@codegraff/relay@0.2.0","@codeperfect/eslint-config@1.11.0","@codeperfect/eslint-plugin@2.1.0","@codeperfect/eslint-plugin@2.3.0","@codetreker/bf@0.1.0","@coinbase/coinbase-cli@0.0.1"],"members":104,"previous_members":103},"event_kind":"expanded_campaign"}],"examples":["@abacus-ai/cli@2.5.3-canary.0","@chainlink/cre-sdk@1.9.0","@circlesac/clova@26.5.0","@cloudflare/telescope@1.1.0","@codegraff/relay@0.2.0","@codeperfect/eslint-config@1.11.0","@codeperfect/eslint-plugin@2.1.0","@codeperfect/eslint-plugin@2.3.0","@codetreker/bf@0.1.0","@coinbase/coinbase-cli@0.0.1"],"first_seen":1779598734,"growth_per_day":11,"id":"publisher_high_risk-e55796297e55523b","key":"GitHub Actions","kind":"publisher_high_risk","last_seen":1780379637,"max_score":218,"members":107,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780148637,"detail":{"examples":["alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20","alpi-agent@0.6.21","alpi-agent@0.6.22","alpi-agent@0.6.23","alpi-agent@0.6.24","alpi-agent@0.6.25","alpi-agent@0.6.26"],"members":15,"previous_members":14},"event_kind":"expanded_campaign"},{"created_at":1780135946,"detail":{"examples":["alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20","alpi-agent@0.6.21","alpi-agent@0.6.22","alpi-agent@0.6.23","alpi-agent@0.6.24","alpi-agent@0.6.25","alpi-agent@0.6.26"],"members":14,"previous_members":13},"event_kind":"expanded_campaign"},{"created_at":1779945701,"detail":{"examples":["alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20","alpi-agent@0.6.21","alpi-agent@0.6.22","alpi-agent@0.6.23","alpi-agent@0.6.24","alpi-agent@0.6.25","alpi-agent@0.6.26"],"max_score":245,"previous_score":229},"event_kind":"score_increased"},{"created_at":1779945701,"detail":{"examples":["alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20","alpi-agent@0.6.21","alpi-agent@0.6.22","alpi-agent@0.6.23","alpi-agent@0.6.24","alpi-agent@0.6.25","alpi-agent@0.6.26"],"members":13,"previous_members":12},"event_kind":"expanded_campaign"}],"examples":["alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20","alpi-agent@0.6.21","alpi-agent@0.6.22","alpi-agent@0.6.23","alpi-agent@0.6.24","alpi-agent@0.6.25","alpi-agent@0.6.26"],"first_seen":1779858450,"growth_per_day":2,"id":"publisher_high_risk-0ddeef2a5cdec363","key":"Satoshi Ltd.","kind":"publisher_high_risk","last_seen":1780379637,"max_score":215,"members":15,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780346115,"detail":{"examples":["arete-macros@0.1.3","bv-builder@0.1.37","bv-builder@0.1.38","calimero-server@0.10.1-rc.46","calimero-server@0.10.1-rc.47","foundry-local-sdk@1.2.0","foundry-local-sdk@1.2.0-rc1","graphium-ui@0.1.0-alpha.6","haqumei@0.6.8","hopsfs-native-object-store@1.1.1"],"members":66,"previous_members":65},"event_kind":"expanded_campaign"},{"created_at":1780341558,"detail":{"examples":["arete-macros@0.1.3","bv-builder@0.1.37","bv-builder@0.1.38","calimero-server@0.10.1-rc.46","calimero-server@0.10.1-rc.47","foundry-local-sdk@1.2.0","foundry-local-sdk@1.2.0-rc1","graphium-ui@0.1.0-alpha.6","haqumei@0.6.8","hopsfs-native-object-store@1.1.1"],"members":65,"previous_members":64},"event_kind":"expanded_campaign"},{"created_at":1780338479,"detail":{"examples":["arete-macros@0.1.3","bv-builder@0.1.37","bv-builder@0.1.38","calimero-server@0.10.1-rc.46","calimero-server@0.10.1-rc.47","foundry-local-sdk@1.2.0","foundry-local-sdk@1.2.0-rc1","graphium-ui@0.1.0-alpha.6","haqumei@0.6.8","hopsfs-native-object-store@1.1.1"],"members":64,"previous_members":63},"event_kind":"expanded_campaign"},{"created_at":1780333568,"detail":{"examples":["arete-macros@0.1.3","bv-builder@0.1.37","bv-builder@0.1.38","calimero-server@0.10.1-rc.46","calimero-server@0.10.1-rc.47","foundry-local-sdk@1.2.0","foundry-local-sdk@1.2.0-rc1","graphium-ui@0.1.0-alpha.6","haqumei@0.6.8","hopsfs-native-object-store@1.1.1"],"members":63,"previous_members":62},"event_kind":"expanded_campaign"}],"examples":["arete-macros@0.1.3","bv-builder@0.1.37","bv-builder@0.1.38","calimero-server@0.10.1-rc.46","calimero-server@0.10.1-rc.47","foundry-local-sdk@1.2.0","foundry-local-sdk@1.2.0-rc1","graphium-ui@0.1.0-alpha.6","haqumei@0.6.8","hopsfs-native-object-store@1.1.1"],"first_seen":1779956215,"growth_per_day":13,"id":"ttp_detail-929d88d253718521","key":"rs_build_time_network:http / tcp network call inside build.rs — downloads at compile time.","kind":"ttp_detail","last_seen":1780379637,"max_score":192,"members":66,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780361999,"detail":{"examples":["halfin@0.3.7","halfin@0.3.8","haqumei@0.6.8","ktstr@0.8.0","liteparse-pdfium-sys@1.1.0","pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3"],"members":22,"previous_members":21},"event_kind":"expanded_campaign"},{"created_at":1780324973,"detail":{"examples":["halfin@0.3.7","haqumei@0.6.8","ktstr@0.8.0","liteparse-pdfium-sys@1.1.0","pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3","pelagos@0.65.4"],"members":21,"previous_members":20},"event_kind":"expanded_campaign"},{"created_at":1780324911,"detail":{"examples":["halfin@0.3.7","ktstr@0.8.0","liteparse-pdfium-sys@1.1.0","pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3","pelagos@0.65.4","pelagos@0.65.5"],"members":20,"previous_members":19},"event_kind":"expanded_campaign"},{"created_at":1780289137,"detail":{"examples":["halfin@0.3.7","ktstr@0.8.0","liteparse-pdfium-sys@1.1.0","pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3","pelagos@0.65.4","pelagos@0.65.5"],"members":19,"previous_members":18},"event_kind":"expanded_campaign"}],"examples":["halfin@0.3.7","halfin@0.3.8","haqumei@0.6.8","ktstr@0.8.0","liteparse-pdfium-sys@1.1.0","pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3"],"first_seen":1780135945,"growth_per_day":7,"id":"ttp_detail-c2a55e213200d31f","key":"rs_build_time_command_combo:process spawn (std::process::command) paired with network / base64 / env-token read at build time.","kind":"ttp_detail","last_seen":1780379637,"max_score":192,"members":22,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780289137,"detail":{"examples":["pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3","pelagos@0.65.4","pelagos@0.65.5"],"members":7,"previous_members":6},"event_kind":"expanded_campaign"},{"created_at":1780286924,"detail":{"examples":["pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3","pelagos@0.65.4"],"members":6,"previous_members":5},"event_kind":"expanded_campaign"},{"created_at":1780280880,"detail":{"examples":["pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3"],"members":5,"previous_members":4},"event_kind":"expanded_campaign"},{"created_at":1780247463,"detail":{"examples":["pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2"],"members":4,"previous_members":3},"event_kind":"expanded_campaign"}],"examples":["pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3","pelagos@0.65.4","pelagos@0.65.5"],"first_seen":1780240017,"growth_per_day":4,"id":"publisher_high_risk-9aed07732e06776d","key":"Christopher Brown","kind":"publisher_high_risk","last_seen":1780379637,"max_score":192,"members":7,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780377155,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","billz/raspap-webgui@3.5.4","chiiya/passes@1.3.0","chiiya/passes@1.4.0","dashed/dashed-ecommerce-veloyd@v4.1.0","debugbundle/sdk-php@v0.1.10"],"members":65,"previous_members":64},"event_kind":"expanded_campaign"},{"created_at":1780373530,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","billz/raspap-webgui@3.5.4","chiiya/passes@1.3.0","chiiya/passes@1.4.0","dashed/dashed-ecommerce-veloyd@v4.1.0","debugbundle/sdk-php@v0.1.10"],"members":64,"previous_members":63},"event_kind":"expanded_campaign"},{"created_at":1780366255,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","billz/raspap-webgui@3.5.4","chiiya/passes@1.3.0","chiiya/passes@1.4.0","dashed/dashed-ecommerce-veloyd@v4.1.0","debugbundle/sdk-php@v0.1.10"],"members":63,"previous_members":62},"event_kind":"expanded_campaign"},{"created_at":1780351888,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","billz/raspap-webgui@3.5.4","chiiya/passes@1.3.0","chiiya/passes@1.4.0","dashed/dashed-ecommerce-veloyd@v4.1.0","debugbundle/sdk-php@v0.1.10"],"members":62,"previous_members":61},"event_kind":"expanded_campaign"}],"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","billz/raspap-webgui@3.5.4","chiiya/passes@1.3.0","chiiya/passes@1.4.0","dashed/dashed-ecommerce-veloyd@v4.1.0","debugbundle/sdk-php@v0.1.10"],"first_seen":1780135945,"growth_per_day":23,"id":"ttp_detail-bd3055b4bea441c0","key":"php_shell_with_decode:exec / system / shell_exec combined with base64/hex decode.","kind":"ttp_detail","last_seen":1780379637,"max_score":186,"members":65,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780377155,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","bekambeyene/telebirr@v1.0.1","bekambeyene/telebirr@v2","billz/raspap-webgui@3.5.4","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0"],"members":103,"previous_members":102},"event_kind":"expanded_campaign"},{"created_at":1780373530,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","bekambeyene/telebirr@v1.0.1","bekambeyene/telebirr@v2","billz/raspap-webgui@3.5.4","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0"],"members":102,"previous_members":101},"event_kind":"expanded_campaign"},{"created_at":1780366255,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","bekambeyene/telebirr@v1.0.1","bekambeyene/telebirr@v2","billz/raspap-webgui@3.5.4","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0"],"members":101,"previous_members":100},"event_kind":"expanded_campaign"},{"created_at":1780351888,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","bekambeyene/telebirr@v1.0.1","bekambeyene/telebirr@v2","billz/raspap-webgui@3.5.4","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0"],"members":100,"previous_members":99},"event_kind":"expanded_campaign"}],"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","bekambeyene/telebirr@v1.0.1","bekambeyene/telebirr@v2","billz/raspap-webgui@3.5.4","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0"],"first_seen":1780135945,"growth_per_day":36,"id":"ttp_detail-e54857fd87aac97b","key":"php_base64_eval_chain:base64/gz/hex decode combined with eval/exec/backticks — classic php obfuscated payload.","kind":"ttp_detail","last_seen":1780379637,"max_score":186,"members":103,"status":"active"},{"confidence_score":61,"events":[{"created_at":1780351888,"detail":{"examples":["sibidharan/zealphp@v0.3.5","sibidharan/zealphp@v0.3.7"],"key":"Sibidharan","kind":"publisher_high_risk","max_score":186,"members":2},"event_kind":"new_campaign"}],"examples":["sibidharan/zealphp@v0.3.5","sibidharan/zealphp@v0.3.7"],"first_seen":1780351888,"growth_per_day":6,"id":"publisher_high_risk-6134bb8df35a283a","key":"Sibidharan","kind":"publisher_high_risk","last_seen":1780379637,"max_score":186,"members":2,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780351888,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0","chiiya/passes@1.4.0","easeo/cms-core@v0.1.0-rc2","easeo/cms-core@v0.2.0-rc1","easeo/cms-core@v0.2.0-rc2","ephenyxdigital/quantumcore@2.3.7","forgeomni/superaicore@v1.0.0","forgeomni/superaicore@v1.0.1"],"members":50,"previous_members":49},"event_kind":"expanded_campaign"},{"created_at":1780340961,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0","chiiya/passes@1.4.0","easeo/cms-core@v0.1.0-rc2","easeo/cms-core@v0.2.0-rc1","easeo/cms-core@v0.2.0-rc2","ephenyxdigital/quantumcore@2.3.7","forgeomni/superaicore@v1.0.0","forgeomni/superaicore@v1.0.1"],"members":49,"previous_members":48},"event_kind":"expanded_campaign"},{"created_at":1780337347,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0","chiiya/passes@1.4.0","easeo/cms-core@v0.1.0-rc2","easeo/cms-core@v0.2.0-rc1","ephenyxdigital/quantumcore@2.3.7","forgeomni/superaicore@v1.0.0","forgeomni/superaicore@v1.0.1","forgeomni/superaicore@v1.0.2"],"members":48,"previous_members":47},"event_kind":"expanded_campaign"},{"created_at":1780312002,"detail":{"examples":["adminneo-org/adminneo@v5.4.0","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0","chiiya/passes@1.4.0","easeo/cms-core@v0.1.0-rc2","easeo/cms-core@v0.2.0-rc1","ephenyxdigital/quantumcore@2.3.7","forgeomni/superaicore@v1.0.0","forgeomni/superaicore@v1.0.1","forgeomni/superaicore@v1.0.2"],"members":47,"previous_members":45},"event_kind":"expanded_campaign"}],"examples":["adminneo-org/adminneo@v5.4.0","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0","chiiya/passes@1.4.0","easeo/cms-core@v0.1.0-rc2","easeo/cms-core@v0.2.0-rc1","easeo/cms-core@v0.2.0-rc2","ephenyxdigital/quantumcore@2.3.7","forgeomni/superaicore@v1.0.0","forgeomni/superaicore@v1.0.1"],"first_seen":1780135945,"growth_per_day":17,"id":"ttp_detail-339132693d3e0020","key":"php_backtick_with_decode:backtick shell-out combined with base64/hex decode.","kind":"ttp_detail","last_seen":1780379637,"max_score":186,"members":50,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379573,"detail":{"examples":["@hed-hog/cli@0.0.118","@hed-hog/cli@0.0.119","@jetbrains/junie@1668.43.0","@jetbrains/junie@1755.37.0","@jetbrains/junie@1755.50.0","@jetbrains/junie@1831.31.0","@kaitranntt/ccs@8.1.0-dev.10","@kaitranntt/ccs@8.1.0-dev.11","@kaitranntt/ccs@8.1.0-dev.12","@kaitranntt/ccs@8.1.0-dev.5"],"members":165,"previous_members":164},"event_kind":"expanded_campaign"},{"created_at":1780377917,"detail":{"examples":["@hed-hog/cli@0.0.118","@hed-hog/cli@0.0.119","@jetbrains/junie@1668.43.0","@jetbrains/junie@1755.37.0","@jetbrains/junie@1755.50.0","@jetbrains/junie@1831.31.0","@kaitranntt/ccs@8.1.0-dev.10","@kaitranntt/ccs@8.1.0-dev.11","@kaitranntt/ccs@8.1.0-dev.12","@kaitranntt/ccs@8.1.0-dev.5"],"members":164,"previous_members":163},"event_kind":"expanded_campaign"},{"created_at":1780376237,"detail":{"examples":["@hed-hog/cli@0.0.118","@hed-hog/cli@0.0.119","@jetbrains/junie@1668.43.0","@jetbrains/junie@1755.37.0","@jetbrains/junie@1755.50.0","@jetbrains/junie@1831.31.0","@kaitranntt/ccs@8.1.0-dev.10","@kaitranntt/ccs@8.1.0-dev.11","@kaitranntt/ccs@8.1.0-dev.12","@kaitranntt/ccs@8.1.0-dev.5"],"members":163,"previous_members":162},"event_kind":"expanded_campaign"},{"created_at":1780373650,"detail":{"examples":["@hed-hog/cli@0.0.118","@hed-hog/cli@0.0.119","@jetbrains/junie@1668.43.0","@jetbrains/junie@1755.37.0","@jetbrains/junie@1755.50.0","@jetbrains/junie@1831.31.0","@kaitranntt/ccs@8.1.0-dev.10","@kaitranntt/ccs@8.1.0-dev.11","@kaitranntt/ccs@8.1.0-dev.12","@kaitranntt/ccs@8.1.0-dev.5"],"members":162,"previous_members":161},"event_kind":"expanded_campaign"}],"examples":["@hed-hog/cli@0.0.118","@hed-hog/cli@0.0.119","@jetbrains/junie@1668.43.0","@jetbrains/junie@1755.37.0","@jetbrains/junie@1755.50.0","@jetbrains/junie@1831.31.0","@kaitranntt/ccs@8.1.0-dev.10","@kaitranntt/ccs@8.1.0-dev.11","@kaitranntt/ccs@8.1.0-dev.12","@kaitranntt/ccs@8.1.0-dev.5"],"first_seen":1780135945,"growth_per_day":58,"id":"ttp_detail-b3401e535bf2cb3a","key":"js_hidden_powershell:hidden / non-interactive powershell invocation in package code — `-windowstyle hidden`, `irm | iex`, `windowshide: true`, or equivalent — used to download-and-run payloads on windows installers.","kind":"ttp_detail","last_seen":1780379637,"max_score":186,"members":165,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780351888,"detail":{"examples":["bangsamu/master@v1.1.74","ceus-media/hymn@1.0.4","condoedge/utils@v0.2.300","condoedge/utils@v0.2.301","condoedge/utils@v0.2.303","condoedge/utils@v0.2.304","condoedge/utils@v0.2.306","ephenyxdigital/quantumcore@2.3.7","jtsternberg/buddy-cli@v1.6.1","phreesoft/bizuno@v7.4.0"],"members":13,"previous_members":12},"event_kind":"expanded_campaign"},{"created_at":1780135946,"detail":{"examples":["bangsamu/master@v1.1.74","ceus-media/hymn@1.0.4","condoedge/utils@v0.2.300","condoedge/utils@v0.2.301","condoedge/utils@v0.2.303","condoedge/utils@v0.2.304","condoedge/utils@v0.2.306","ephenyxdigital/quantumcore@2.3.7","jtsternberg/buddy-cli@v1.6.1","phreesoft/bizuno@v7.4.0"],"key":"php_remote_fetch_exec_combo:remote fetch (file_get_contents/curl) paired with eval/exec — fetch-and-run pattern.","kind":"ttp_detail","max_score":186,"members":12},"event_kind":"new_campaign"}],"examples":["bangsamu/master@v1.1.74","ceus-media/hymn@1.0.4","condoedge/utils@v0.2.300","condoedge/utils@v0.2.301","condoedge/utils@v0.2.303","condoedge/utils@v0.2.304","condoedge/utils@v0.2.306","ephenyxdigital/quantumcore@2.3.7","jtsternberg/buddy-cli@v1.6.1","phreesoft/bizuno@v7.4.0"],"first_seen":1780135945,"growth_per_day":4,"id":"ttp_detail-32dc6b822bf79b61","key":"php_remote_fetch_exec_combo:remote fetch (file_get_contents/curl) paired with eval/exec — fetch-and-run pattern.","kind":"ttp_detail","last_seen":1780379637,"max_score":186,"members":13,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780336217,"detail":{"examples":["agntspace@1.102.0","agntspace@1.102.1","agntspace@1.102.2","agntspace@1.103.0","agntspace@1.103.1","agntspace@1.104.0","agntspace@1.104.1","agntspace@1.105.0","agntspace@1.106.0","agntspace@1.107.0"],"members":43,"previous_members":42},"event_kind":"expanded_campaign"},{"created_at":1780316823,"detail":{"examples":["agntspace@1.102.0","agntspace@1.102.1","agntspace@1.102.2","agntspace@1.103.0","agntspace@1.103.1","agntspace@1.104.0","agntspace@1.104.1","agntspace@1.105.0","agntspace@1.106.0","agntspace@1.107.0"],"members":42,"previous_members":41},"event_kind":"expanded_campaign"},{"created_at":1780303054,"detail":{"examples":["agntspace@1.102.0","agntspace@1.102.1","agntspace@1.102.2","agntspace@1.103.0","agntspace@1.103.1","agntspace@1.104.0","agntspace@1.104.1","agntspace@1.105.0","agntspace@1.106.0","agntspace@1.107.0"],"members":41,"previous_members":40},"event_kind":"expanded_campaign"},{"created_at":1780302283,"detail":{"examples":["agntspace@1.102.0","agntspace@1.102.1","agntspace@1.102.2","agntspace@1.103.0","agntspace@1.103.1","agntspace@1.104.0","agntspace@1.104.1","agntspace@1.105.0","agntspace@1.106.0","agntspace@1.107.0"],"members":40,"previous_members":39},"event_kind":"expanded_campaign"}],"examples":["agntspace@1.102.0","agntspace@1.102.1","agntspace@1.102.2","agntspace@1.103.0","agntspace@1.103.1","agntspace@1.104.0","agntspace@1.104.1","agntspace@1.105.0","agntspace@1.106.0","agntspace@1.107.0"],"first_seen":1779886306,"growth_per_day":7,"id":"ttp_detail-ef25db1fd811e53d","key":"py_install_time_os_system:direct shell invocation via os.system / os.popen / os.exec*.","kind":"ttp_detail","last_seen":1780379637,"max_score":159,"members":43,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780340680,"detail":{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.558","@tscircuit/capacity-autorouter@0.0.559","@tscircuit/capacity-autorouter@0.0.560","@tscircuit/capacity-autorouter@0.0.565","@tscircuit/capacity-autorouter@0.0.566","@tscircuit/capacity-autorouter@0.0.567","@tscircuit/core@0.0.1275","@tscircuit/eval@0.0.872"],"members":11,"previous_members":10},"event_kind":"expanded_campaign"},{"created_at":1780335145,"detail":{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.558","@tscircuit/capacity-autorouter@0.0.559","@tscircuit/capacity-autorouter@0.0.560","@tscircuit/capacity-autorouter@0.0.565","@tscircuit/capacity-autorouter@0.0.566","@tscircuit/core@0.0.1275","@tscircuit/eval@0.0.872","@tscircuit/fake-snippets@0.0.215"],"members":10,"previous_members":8},"event_kind":"expanded_campaign"},{"created_at":1780289551,"detail":{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.558","@tscircuit/capacity-autorouter@0.0.559","@tscircuit/capacity-autorouter@0.0.560","@tscircuit/capacity-autorouter@0.0.565","@tscircuit/core@0.0.1275","@tscircuit/eval@0.0.872","@tscircuit/fake-snippets@0.0.215"],"members":9,"previous_members":8},"event_kind":"expanded_campaign"},{"created_at":1780135946,"detail":{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.558","@tscircuit/capacity-autorouter@0.0.559","@tscircuit/capacity-autorouter@0.0.560","@tscircuit/core@0.0.1275","@tscircuit/eval@0.0.872","@tscircuit/fake-snippets@0.0.211","@tscircuit/fake-snippets@0.0.212","@tscircuit/fake-snippets@0.0.213"],"members":12,"previous_members":9},"event_kind":"expanded_campaign"}],"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.558","@tscircuit/capacity-autorouter@0.0.559","@tscircuit/capacity-autorouter@0.0.560","@tscircuit/capacity-autorouter@0.0.565","@tscircuit/capacity-autorouter@0.0.566","@tscircuit/capacity-autorouter@0.0.567","@tscircuit/core@0.0.1275","@tscircuit/eval@0.0.872"],"first_seen":1779606460,"growth_per_day":1,"id":"publisher_high_risk-c3d17144b9b97908","key":"seveibar","kind":"publisher_high_risk","last_seen":1780379637,"max_score":151,"members":11,"status":"active"},{"confidence_score":84,"events":[{"created_at":1779621643,"detail":{"examples":["dev-env-bootstrapper@1.5.0","dev-env-bootstrapper@1.4.0","async-pipeline-builder@1.5.0","async-pipeline-builder@1.4.0","build-scripts-utils@1.5.0","build-scripts-utils@1.4.0","llm-context-compressor@1.5.0","llm-context-compressor@1.4.0","model-switch-router@1.5.0","model-switch-router@1.4.0"],"members":30,"previous_members":28},"event_kind":"expanded_campaign"},{"created_at":1779621578,"detail":{"examples":["dev-env-bootstrapper@1.5.0","dev-env-bootstrapper@1.4.0","async-pipeline-builder@1.5.0","async-pipeline-builder@1.4.0","build-scripts-utils@1.5.0","build-scripts-utils@1.4.0","llm-context-compressor@1.5.0","llm-context-compressor@1.4.0","model-switch-router@1.5.0","model-switch-router@1.4.0"],"members":28,"previous_members":22},"event_kind":"expanded_campaign"},{"created_at":1779621511,"detail":{"examples":["dev-env-bootstrapper@1.5.0","dev-env-bootstrapper@1.4.0","async-pipeline-builder@1.5.0","async-pipeline-builder@1.4.0","build-scripts-utils@1.5.0","build-scripts-utils@1.4.0","llm-context-compressor@1.5.0","llm-context-compressor@1.4.0","model-switch-router@1.5.0","model-switch-router@1.4.0"],"members":22,"previous_members":20},"event_kind":"expanded_campaign"},{"created_at":1779600792,"detail":{"examples":["dev-env-bootstrapper@1.5.0","dev-env-bootstrapper@1.4.0","async-pipeline-builder@1.5.0","async-pipeline-builder@1.4.0","build-scripts-utils@1.5.0","build-scripts-utils@1.4.0","llm-context-compressor@1.5.0","llm-context-compressor@1.4.0","model-switch-router@1.5.0","model-switch-router@1.4.0"],"key":"asdxzxc","kind":"publisher_high_risk","max_score":186,"members":20},"event_kind":"new_campaign"}],"examples":["async-pipeline-builder@1.4.0","async-pipeline-builder@1.5.0","async-pipeline-builder@1.5.1","build-scripts-utils@1.4.0","build-scripts-utils@1.5.0","build-scripts-utils@1.5.1","dev-env-bootstrapper@1.4.0","dev-env-bootstrapper@1.5.0","dev-env-bootstrapper@1.5.2","llm-context-compressor@1.4.0"],"first_seen":1779600792,"growth_per_day":3,"id":"publisher_high_risk-c9f873e2f5189429","key":"asdxzxc","kind":"publisher_high_risk","last_seen":1780379637,"max_score":149,"members":30,"status":"active"},{"confidence_score":81,"events":[{"created_at":1780369602,"detail":{"examples":["@aonunited/angular@99.0.0","@aonunited/angular@99.0.1","argus-ai-scanner@1.12.0","github.com/Method-Security/webscan@v0.0.239","github.com/Method-Security/webscan@v0.0.240","github.com/Method-Security/webscan@v0.0.241","github.com/method-security/webscan@v0.0.239","github.com/method-security/webscan@v0.0.240","github.com/method-security/webscan@v0.0.241","github.com/projectdiscovery/nuclei-templates@v10.4.4+incompatible"],"key":"dns_or_oast_exfil:matched \"oast.fun\"","kind":"ttp_detail","max_score":148,"members":30},"event_kind":"new_campaign"}],"examples":["@aonunited/angular@99.0.0","@aonunited/angular@99.0.1","argus-ai-scanner@1.12.0","github.com/Method-Security/webscan@v0.0.239","github.com/Method-Security/webscan@v0.0.240","github.com/Method-Security/webscan@v0.0.241","github.com/method-security/webscan@v0.0.239","github.com/method-security/webscan@v0.0.240","github.com/method-security/webscan@v0.0.241","github.com/projectdiscovery/nuclei-templates@v10.4.4+incompatible"],"first_seen":1780369602,"growth_per_day":258,"id":"ttp_detail-f87354af2373018b","key":"dns_or_oast_exfil:matched \"oast.fun\"","kind":"ttp_detail","last_seen":1780379637,"max_score":148,"members":30,"status":"active"},{"confidence_score":61,"events":[{"created_at":1780228857,"detail":{"examples":["attocode@0.2.24","attocode@0.2.25"],"key":"eren23","kind":"publisher_high_risk","max_score":148,"members":2},"event_kind":"new_campaign"}],"examples":["attocode@0.2.24","attocode@0.2.25"],"first_seen":1780228857,"growth_per_day":1,"id":"publisher_high_risk-d571307170de2166","key":"eren23","kind":"publisher_high_risk","last_seen":1780379637,"max_score":148,"members":2,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780372570,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@challenger6/vm-pattern-library@99.0.0","@easy-entry/landing-routes@99.9.5"],"members":136,"previous_members":135},"event_kind":"expanded_campaign"},{"created_at":1780368929,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@challenger6/vm-pattern-library@99.0.0","@easy-entry/landing-routes@99.9.5"],"members":135,"previous_members":134},"event_kind":"expanded_campaign"},{"created_at":1780357805,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@challenger6/vm-pattern-library@99.0.0","@easy-entry/landing-routes@99.9.5"],"members":134,"previous_members":133},"event_kind":"expanded_campaign"},{"created_at":1780357463,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@challenger6/vm-pattern-library@99.0.0","@easy-entry/landing-routes@99.9.5"],"members":133,"previous_members":132},"event_kind":"expanded_campaign"}],"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@challenger6/vm-pattern-library@99.0.0","@easy-entry/landing-routes@99.9.5"],"first_seen":1779620695,"growth_per_day":15,"id":"ttp_detail-f9fed90c9a35481e","key":"dns_or_oast_exfil:matched \"oastify.com\"","kind":"ttp_detail","last_seen":1780379637,"max_score":148,"members":136,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780346932,"detail":{"examples":["feral-ai@2026.5.42","feral-ai@2026.5.43","feral-ai@2026.5.44","feral-ai@2026.5.45","feral-ai@2026.5.46","feral-ai@2026.5.47","feral-ai@2026.5.48","feral-ai@2026.5.49","feral-ai@2026.6.1","feral-ai@2026.6.2"],"members":11,"previous_members":10},"event_kind":"expanded_campaign"},{"created_at":1780293739,"detail":{"examples":["feral-ai@2026.5.42","feral-ai@2026.5.43","feral-ai@2026.5.44","feral-ai@2026.5.45","feral-ai@2026.5.46","feral-ai@2026.5.47","feral-ai@2026.5.48","feral-ai@2026.5.49","feral-ai@2026.6.1","feral-ai@2026.6.2"],"members":10,"previous_members":9},"event_kind":"expanded_campaign"},{"created_at":1780265165,"detail":{"examples":["feral-ai@2026.5.42","feral-ai@2026.5.43","feral-ai@2026.5.44","feral-ai@2026.5.45","feral-ai@2026.5.46","feral-ai@2026.5.47","feral-ai@2026.5.48","feral-ai@2026.5.49","feral-ai@2026.6.1"],"members":9,"previous_members":8},"event_kind":"expanded_campaign"},{"created_at":1780135946,"detail":{"examples":["feral-ai@2026.5.42","feral-ai@2026.5.43","feral-ai@2026.5.44","feral-ai@2026.5.45","feral-ai@2026.5.46","feral-ai@2026.5.47","feral-ai@2026.5.48","feral-ai@2026.5.49"],"key":"Mahmoud Omar","kind":"publisher_high_risk","max_score":179,"members":8},"event_kind":"new_campaign"}],"examples":["feral-ai@2026.5.42","feral-ai@2026.5.43","feral-ai@2026.5.44","feral-ai@2026.5.45","feral-ai@2026.5.46","feral-ai@2026.5.47","feral-ai@2026.5.48","feral-ai@2026.5.49","feral-ai@2026.6.1","feral-ai@2026.6.2"],"first_seen":1780135945,"growth_per_day":3,"id":"publisher_high_risk-a8448bc130558fc9","key":"Mahmoud Omar","kind":"publisher_high_risk","last_seen":1780379637,"max_score":145,"members":11,"status":"active"},{"confidence_score":61,"events":[{"created_at":1780245025,"detail":{"examples":["binary-collections@2.0.12","binary-collections@2.0.13"],"key":"dimaslanjaka","kind":"publisher_high_risk","max_score":136,"members":2},"event_kind":"new_campaign"}],"examples":["binary-collections@2.0.12","binary-collections@2.0.13"],"first_seen":1780245025,"growth_per_day":1,"id":"publisher_high_risk-b2eb0113bc56f880","key":"dimaslanjaka","kind":"publisher_high_risk","last_seen":1780379637,"max_score":136,"members":2,"status":"active"},{"confidence_score":84,"events":[{"created_at":1780379573,"detail":{"examples":["pdd-cli@0.0.252","pdd-cli@0.0.253","pdd-cli@0.0.254","pdd-cli@0.0.255","pdd-cli@0.0.256","pdd-cli@0.0.257","pdd-cli@0.0.260"],"members":7,"previous_members":6},"event_kind":"expanded_campaign"},{"created_at":1780295982,"detail":{"examples":["pdd-cli@0.0.252","pdd-cli@0.0.253","pdd-cli@0.0.254","pdd-cli@0.0.255","pdd-cli@0.0.256","pdd-cli@0.0.257"],"members":6,"previous_members":5},"event_kind":"expanded_campaign"},{"created_at":1780209924,"detail":{"examples":["pdd-cli@0.0.252","pdd-cli@0.0.253","pdd-cli@0.0.254","pdd-cli@0.0.255","pdd-cli@0.0.256"],"members":5,"previous_members":4},"event_kind":"expanded_campaign"},{"created_at":1780135946,"detail":{"examples":["pdd-cli@0.0.252","pdd-cli@0.0.253","pdd-cli@0.0.254","pdd-cli@0.0.255"],"members":4,"previous_members":2},"event_kind":"expanded_campaign"}],"examples":["pdd-cli@0.0.252","pdd-cli@0.0.253","pdd-cli@0.0.254","pdd-cli@0.0.255","pdd-cli@0.0.256","pdd-cli@0.0.257","pdd-cli@0.0.260"],"first_seen":1779951686,"growth_per_day":1,"id":"publisher_high_risk-4eaecca300bfe484","key":"Greg Tanaka","kind":"publisher_high_risk","last_seen":1780379637,"max_score":125,"members":7,"status":"active"},{"confidence_score":77,"events":[{"created_at":1780297562,"detail":{"examples":["yrodevgit/ctrx@v2.3.1","yrodevgit/ctrx@v2.3.2","yrodevgit/ctrx@v2.3.3"],"members":3,"previous_members":2},"event_kind":"expanded_campaign"},{"created_at":1780283050,"detail":{"examples":["yrodevgit/ctrx@v2.3.1","yrodevgit/ctrx@v2.3.2"],"key":"Tyrone","kind":"publisher_high_risk","max_score":122,"members":2},"event_kind":"reactivated_campaign"},{"created_at":1780161283,"detail":{"min_size":2,"reason":"cluster no longer meets campaign threshold"},"event_kind":"stale_campaign"},{"created_at":1780135946,"detail":{"examples":["yrodevgit/ctrx@v1.9.3","yrodevgit/ctrx@v1.9.5","yrodevgit/ctrx@v1.9.6","yrodevgit/ctrx@v1.9.8","yrodevgit/ctrx@v2.0","yrodevgit/ctrx@v2.2.3"],"members":6,"previous_members":4},"event_kind":"expanded_campaign"}],"examples":["yrodevgit/ctrx@v2.3.1","yrodevgit/ctrx@v2.3.2","yrodevgit/ctrx@v2.3.3"],"first_seen":1779936595,"growth_per_day":1,"id":"publisher_high_risk-a8ab5afe54d22ed4","key":"Tyrone","kind":"publisher_high_risk","last_seen":1780379637,"max_score":122,"members":3,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379244,"detail":{"examples":["agent-working@1.0.0","agentsview@0.31.0","agentsview@0.31.1","agnt@0.13.10","agnt@0.13.11","agnt@0.13.12","agnt@0.13.13","agnt@0.13.14","agora-python-server-sdk@2.4.6","aipass@2.4.0"],"members":88,"previous_members":87},"event_kind":"expanded_campaign"},{"created_at":1780378935,"detail":{"examples":["agent-working@1.0.0","agentsview@0.31.0","agentsview@0.31.1","agnt@0.13.10","agnt@0.13.11","agnt@0.13.12","agnt@0.13.13","agnt@0.13.14","agora-python-server-sdk@2.4.6","aipass@2.4.0"],"members":87,"previous_members":86},"event_kind":"expanded_campaign"},{"created_at":1780375147,"detail":{"examples":["agent-working@1.0.0","agentsview@0.31.0","agentsview@0.31.1","agnt@0.13.10","agnt@0.13.11","agnt@0.13.12","agnt@0.13.13","agnt@0.13.14","agora-python-server-sdk@2.4.6","aipass@2.4.0"],"members":86,"previous_members":85},"event_kind":"expanded_campaign"},{"created_at":1780373881,"detail":{"examples":["agent-working@1.0.0","agentsview@0.31.0","agentsview@0.31.1","agnt@0.13.10","agnt@0.13.11","agnt@0.13.12","agnt@0.13.13","agnt@0.13.14","agora-python-server-sdk@2.4.6","aipass@2.4.0"],"members":85,"previous_members":84},"event_kind":"expanded_campaign"}],"examples":["agent-working@1.0.0","agentsview@0.31.0","agentsview@0.31.1","agnt@0.13.10","agnt@0.13.11","agnt@0.13.12","agnt@0.13.13","agnt@0.13.14","agora-python-server-sdk@2.4.6","aipass@2.4.0"],"first_seen":1779907770,"growth_per_day":16,"id":"ttp_detail-ac98ec800cd3b079","key":"py_import_time_os_system:direct shell invocation via os.system / os.popen / os.exec*.","kind":"ttp_detail","last_seen":1780379637,"max_score":112,"members":88,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780379601,"detail":{"examples":["@aiden6791/aiboengine@1.0.2","@aiden6791/aiboengine@1.0.3","@archvisioninc/canvas@3.3.11","@archvisioninc/canvas@3.4.0","@archvisioninc/canvas@3.4.1","@asaleh37/ui-base@26.2.16","@asaleh37/ui-base@27.5.26","@axiom-lattice/agent-eval@2.1.57","@axiom-lattice/agent-eval@2.1.58","@axiom-lattice/agent-eval@2.1.59"],"members":274,"previous_members":273},"event_kind":"expanded_campaign"},{"created_at":1780379132,"detail":{"examples":["@aiden6791/aiboengine@1.0.2","@aiden6791/aiboengine@1.0.3","@archvisioninc/canvas@3.3.11","@archvisioninc/canvas@3.4.0","@archvisioninc/canvas@3.4.1","@asaleh37/ui-base@26.2.16","@asaleh37/ui-base@27.5.26","@axiom-lattice/agent-eval@2.1.57","@axiom-lattice/agent-eval@2.1.58","@axiom-lattice/agent-eval@2.1.59"],"members":273,"previous_members":272},"event_kind":"expanded_campaign"},{"created_at":1780378108,"detail":{"examples":["@aiden6791/aiboengine@1.0.2","@aiden6791/aiboengine@1.0.3","@archvisioninc/canvas@3.3.11","@archvisioninc/canvas@3.4.0","@archvisioninc/canvas@3.4.1","@asaleh37/ui-base@26.2.16","@asaleh37/ui-base@27.5.26","@axiom-lattice/agent-eval@2.1.57","@axiom-lattice/agent-eval@2.1.58","@axiom-lattice/agent-eval@2.1.59"],"members":272,"previous_members":271},"event_kind":"expanded_campaign"},{"created_at":1780373610,"detail":{"examples":["@aiden6791/aiboengine@1.0.2","@aiden6791/aiboengine@1.0.3","@archvisioninc/canvas@3.3.11","@archvisioninc/canvas@3.4.0","@archvisioninc/canvas@3.4.1","@asaleh37/ui-base@26.2.16","@asaleh37/ui-base@27.5.26","@axiom-lattice/agent-eval@2.1.57","@axiom-lattice/agent-eval@2.1.58","@axiom-lattice/agent-eval@2.1.59"],"members":271,"previous_members":270},"event_kind":"expanded_campaign"}],"examples":["@aiden6791/aiboengine@1.0.2","@aiden6791/aiboengine@1.0.3","@archvisioninc/canvas@3.3.11","@archvisioninc/canvas@3.4.0","@archvisioninc/canvas@3.4.1","@asaleh37/ui-base@26.2.16","@asaleh37/ui-base@27.5.26","@axiom-lattice/agent-eval@2.1.57","@axiom-lattice/agent-eval@2.1.58","@axiom-lattice/agent-eval@2.1.59"],"first_seen":1779602453,"growth_per_day":30,"id":"ttp_detail-91eab791080d9e30","key":"credential_file_packaged:package/.env","kind":"ttp_detail","last_seen":1780379637,"max_score":109,"members":274,"status":"active"},{"confidence_score":61,"events":[{"created_at":1780369602,"detail":{"examples":["@aonunited/angular@99.0.0","@aonunited/angular@99.0.1"],"key":"friederichvilaseca","kind":"publisher_high_risk","max_score":107,"members":2},"event_kind":"new_campaign"}],"examples":["@aonunited/angular@99.0.0","@aonunited/angular@99.0.1"],"first_seen":1780369602,"growth_per_day":17,"id":"publisher_high_risk-c636cbf37de37a2c","key":"friederichvilaseca","kind":"publisher_high_risk","last_seen":1780379637,"max_score":107,"members":2,"status":"active"},{"confidence_score":84,"events":[{"created_at":1779637999,"detail":{"examples":["power-apps@2.0.3","power-apps@2.0.4","cdk-sagemaker-notebook-workflow@2.0.4","cdk-sagemaker-notebook-workflow@1.0.3","cdk-sagemaker-notebook-workflow@2.0.5","power-platform-playwright-toolkit@1.0.4"],"members":6,"previous_members":5},"event_kind":"expanded_campaign"},{"created_at":1779623879,"detail":{"examples":["power-apps@2.0.3","power-apps@2.0.4","cdk-sagemaker-notebook-workflow@2.0.4","cdk-sagemaker-notebook-workflow@1.0.3","cdk-sagemaker-notebook-workflow@2.0.5"],"members":5,"previous_members":4},"event_kind":"expanded_campaign"},{"created_at":1779623325,"detail":{"examples":["power-apps@2.0.3","power-apps@2.0.4","cdk-sagemaker-notebook-workflow@2.0.4","cdk-sagemaker-notebook-workflow@1.0.3"],"max_score":130,"previous_score":90},"event_kind":"score_increased"},{"created_at":1779623325,"detail":{"examples":["power-apps@2.0.3","power-apps@2.0.4","cdk-sagemaker-notebook-workflow@2.0.4","cdk-sagemaker-notebook-workflow@1.0.3"],"members":4,"previous_members":2},"event_kind":"expanded_campaign"}],"examples":["cdk-sagemaker-notebook-workflow@1.0.3","cdk-sagemaker-notebook-workflow@2.0.4","cdk-sagemaker-notebook-workflow@2.0.5","power-apps@2.0.3","power-apps@2.0.4","power-platform-playwright-toolkit@1.0.4"],"first_seen":1779621045,"growth_per_day":1,"id":"publisher_high_risk-57e773a817f692dd","key":"l0bo","kind":"publisher_high_risk","last_seen":1780379637,"max_score":105,"members":6,"status":"active"},{"confidence_score":84,"events":[{"created_at":1779812783,"detail":{"examples":["claude-channel-imessage@2.0.4","verify-mycommand@2.0.4","skills-detector@2.0.4","skills-detector@2.0.5","testing-on-npmjs@2.0.6","testing-on-npmjs@2.0.5","shop-minis@2.0.5"],"members":7,"previous_members":6},"event_kind":"expanded_campaign"},{"created_at":1779766205,"detail":{"examples":["claude-channel-imessage@2.0.4","verify-mycommand@2.0.4","skills-detector@2.0.4","skills-detector@2.0.5","testing-on-npmjs@2.0.6","testing-on-npmjs@2.0.5"],"members":6,"previous_members":4},"event_kind":"expanded_campaign"},{"created_at":1779764080,"detail":{"examples":["claude-channel-imessage@2.0.4","verify-mycommand@2.0.4","skills-detector@2.0.4","skills-detector@2.0.5"],"members":4,"previous_members":3},"event_kind":"expanded_campaign"},{"created_at":1779738028,"detail":{"examples":["claude-channel-imessage@2.0.4","verify-mycommand@2.0.4","skills-detector@2.0.4"],"members":3,"previous_members":2},"event_kind":"expanded_campaign"}],"examples":["claude-channel-imessage@2.0.4","shop-minis@2.0.5","skills-detector@2.0.4","skills-detector@2.0.5","testing-on-npmjs@2.0.5","testing-on-npmjs@2.0.6","verify-mycommand@2.0.4"],"first_seen":1779734440,"growth_per_day":1,"id":"publisher_high_risk-df423d6fafaf7cbf","key":"lobo_hunt","kind":"publisher_high_risk","last_seen":1780379637,"max_score":105,"members":7,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780148568,"detail":{"examples":["@arthurxyzstudios/baileys@1.0.7","@badzz88/baileys@8.2.0","@badzz88/baileys@8.3.0","@budetzz/baileys@2.0.18","@budetzz/baileys@2.0.19","@dnuzi/baileys@0.0.6","@dnuzi/baileys@0.0.7","@epinkenedy/siiu@2.0.3","@itsliaaa/baileys@0.3.11","@itsliaaa/baileys@0.3.12"],"members":72,"previous_members":71},"event_kind":"expanded_campaign"},{"created_at":1780135945,"detail":{"examples":["@arthurxyzstudios/baileys@1.0.7","@badzz88/baileys@8.2.0","@badzz88/baileys@8.3.0","@budetzz/baileys@2.0.18","@budetzz/baileys@2.0.19","@dnuzi/baileys@0.0.6","@dnuzi/baileys@0.0.7","@epinkenedy/siiu@2.0.3","@itsliaaa/baileys@0.3.11","@itsliaaa/baileys@0.3.12"],"members":94,"previous_members":72},"event_kind":"expanded_campaign"},{"created_at":1779948796,"detail":{"examples":["alya-baileys@1.9.46","alya-baileys@1.9.45","shikimori-baikeys@1.0.0","queenruva-sockets@5.8.16","queenruva-sockets@5.8.13","shikimori-baileys@1.0.0","eatmyd-baileys@1.0.0","@yudzxml/baileys@7.3.7","@yudzxml/baileys@7.3.6","@twsxtd/baileys@7.0.0-rc13.commit.2717e5e1c978"],"members":72,"previous_members":71},"event_kind":"expanded_campaign"},{"created_at":1779948451,"detail":{"examples":["alya-baileys@1.9.46","alya-baileys@1.9.45","shikimori-baikeys@1.0.0","queenruva-sockets@5.8.16","queenruva-sockets@5.8.13","shikimori-baileys@1.0.0","eatmyd-baileys@1.0.0","@yudzxml/baileys@7.3.7","@yudzxml/baileys@7.3.6","@twsxtd/baileys@7.0.0-rc13.commit.2717e5e1c978"],"members":71,"previous_members":69},"event_kind":"expanded_campaign"}],"examples":["@neodevxsadmd/baileys@1.1.4","@neodevxsadmd/baileys@1.2.0","@neodevxsadmd/baileys@1.2.1","@neodevxsadmd/baileys@1.2.2","@nuisockets/baileys@7.0.0","@nuisockets/baileys@7.2.1","@nuisockets/baileys@7.2.7","@nuisockets/baileys@7.2.8","@pontaproject/baileys@0.1.2","@srlczinn/new-baileys@7.0.0-rc.9-patch.1"],"first_seen":1779602261,"growth_per_day":1,"id":"ttp_detail-a606ca0f80b17c3f","key":"install_lifecycle_remote_or_exec:preinstall=\"node ./engine-requirements.js\"","kind":"ttp_detail","last_seen":1780379637,"max_score":105,"members":12,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780135945,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@achuthvp/postinstall-poc@1.0.0","@altairalabs/packc@1.4.11","@altairalabs/packc@1.4.12"],"members":379,"previous_members":241},"event_kind":"expanded_campaign"},{"created_at":1779957937,"detail":{"examples":["@meta-quest/hzdb@1.2.1","@meta-quest/hzdb@1.2.0","@btcmaster1000/peermesh-provider@1.0.72","@btcmaster1000/peermesh-provider@1.0.71","mxcad-app@1.0.66","mxcad-app@1.0.65","power-apps@2.0.3","power-apps@2.0.4","local-mcp@3.0.217","local-mcp@3.0.216"],"members":241,"previous_members":240},"event_kind":"expanded_campaign"},{"created_at":1779957742,"detail":{"examples":["@meta-quest/hzdb@1.2.1","@meta-quest/hzdb@1.2.0","@btcmaster1000/peermesh-provider@1.0.72","@btcmaster1000/peermesh-provider@1.0.71","mxcad-app@1.0.66","mxcad-app@1.0.65","power-apps@2.0.3","power-apps@2.0.4","local-mcp@3.0.217","local-mcp@3.0.216"],"members":240,"previous_members":238},"event_kind":"expanded_campaign"},{"created_at":1779957714,"detail":{"examples":["@meta-quest/hzdb@1.2.1","@meta-quest/hzdb@1.2.0","@btcmaster1000/peermesh-provider@1.0.72","@btcmaster1000/peermesh-provider@1.0.71","mxcad-app@1.0.66","mxcad-app@1.0.65","power-apps@2.0.3","power-apps@2.0.4","local-mcp@3.0.217","local-mcp@3.0.216"],"members":238,"previous_members":236},"event_kind":"expanded_campaign"}],"examples":["@flexspec/cli-darwin-arm64@0.3.0","@flexspec/cli-darwin-arm64@0.3.1-dev.26612027722","@flexspec/cli-darwin-x64@0.3.0","@flexspec/cli-darwin-x64@0.3.1-dev.26612027722","@flexspec/cli-linux-x64@0.3.0","@flexspec/cli-linux-x64@0.3.1-dev.26612027722","@flexspec/cli-windows-x64@0.3.0","@flexspec/cli-windows-x64@0.3.1-dev.26612027722","@flexspec/http-darwin-arm64@0.3.0","@flexspec/http-darwin-arm64@0.3.1-dev.26612027722"],"first_seen":1779600030,"growth_per_day":5,"id":"ttp_detail-c20fda8d86b87f38","key":"install_lifecycle_remote_or_exec:postinstall=\"node postinstall.js\"","kind":"ttp_detail","last_seen":1780379637,"max_score":105,"members":46,"status":"active"},{"confidence_score":90,"events":[{"created_at":1780337773,"detail":{"examples":["@epambot/epam-videoportal-client@3.1.10","@lyrie/core@3.1.0","@neodevxsadmd/baileys@1.1.2","@neodevxsadmd/baileys@1.1.3","@neodevxsadmd/baileys@1.1.5","@neodevxsadmd/baileys@1.3.3","@neodevxsadmd/baileys@1.3.4","@thomlecter1122/lab-helper-test@0.0.15","@thomlecter1122/lab-helper-test@0.0.16","authcascade@1.5.25"],"members":14,"previous_members":13},"event_kind":"expanded_campaign"},{"created_at":1780156696,"detail":{"examples":["@epambot/epam-videoportal-client@3.1.10","@lyrie/core@3.1.0","@neodevxsadmd/baileys@1.1.2","@neodevxsadmd/baileys@1.1.3","@neodevxsadmd/baileys@1.1.5","@neodevxsadmd/baileys@1.3.3","@neodevxsadmd/baileys@1.3.4","@thomlecter1122/lab-helper-test@0.0.15","@thomlecter1122/lab-helper-test@0.0.16","authcascade@1.5.25"],"members":13,"previous_members":12},"event_kind":"expanded_campaign"},{"created_at":1780156481,"detail":{"examples":["@lyrie/core@3.1.0","@neodevxsadmd/baileys@1.1.2","@neodevxsadmd/baileys@1.1.3","@neodevxsadmd/baileys@1.1.5","@neodevxsadmd/baileys@1.3.3","@neodevxsadmd/baileys@1.3.4","@thomlecter1122/lab-helper-test@0.0.15","@thomlecter1122/lab-helper-test@0.0.16","authcascade@1.5.25","authcascade@1.5.26"],"members":12,"previous_members":11},"event_kind":"expanded_campaign"},{"created_at":1780154698,"detail":{"examples":["@lyrie/core@3.1.0","@neodevxsadmd/baileys@1.1.2","@neodevxsadmd/baileys@1.1.5","@neodevxsadmd/baileys@1.3.3","@neodevxsadmd/baileys@1.3.4","@thomlecter1122/lab-helper-test@0.0.15","@thomlecter1122/lab-helper-test@0.0.16","authcascade@1.5.25","authcascade@1.5.26","path-addon@1.0.5"],"key":"js_decode_then_exec:base64 / atob / fromcharcode decode adjacent to eval / new function — canonical obfuscated-loader pattern.","kind":"ttp_detail","max_score":102,"members":11},"event_kind":"new_campaign"}],"examples":["@epambot/epam-videoportal-client@3.1.10","@lyrie/core@3.1.0","@neodevxsadmd/baileys@1.1.2","@neodevxsadmd/baileys@1.1.3","@neodevxsadmd/baileys@1.1.5","@neodevxsadmd/baileys@1.3.3","@neodevxsadmd/baileys@1.3.4","@thomlecter1122/lab-helper-test@0.0.15","@thomlecter1122/lab-helper-test@0.0.16","authcascade@1.5.25"],"first_seen":1780154698,"growth_per_day":5,"id":"ttp_detail-11ee0e7e04824b8a","key":"js_decode_then_exec:base64 / atob / fromcharcode decode adjacent to eval / new function — canonical obfuscated-loader pattern.","kind":"ttp_detail","last_seen":1780379637,"max_score":102,"members":14,"status":"active"},{"confidence_score":77,"events":[{"created_at":1779905553,"detail":{"examples":["remsg@2.0.1","remsg@2.0.0"],"key":"https://pkg.pr.new/changesets/changesets/@changesets/cli@bd27256","kind":"remote_url","max_score":100,"members":2},"event_kind":"new_campaign"}],"examples":["remsg@2.0.0","remsg@2.0.1"],"first_seen":1779905553,"growth_per_day":1,"id":"remote_url-225967d675d12f23","key":"https://pkg.pr.new/changesets/changesets/@changesets/cli@bd27256","kind":"remote_url","last_seen":1780379637,"max_score":100,"members":2,"status":"active"},{"confidence_score":82,"events":[{"created_at":1779905553,"detail":{"examples":["remsg@2.0.1","remsg@2.0.0"],"key":"43010cfe83f290afd5b2898f02e48fb0162717168a61d2d9445b6c8ea95c2e9c","kind":"remote_sha256","max_score":100,"members":2},"event_kind":"new_campaign"}],"examples":["remsg@2.0.0","remsg@2.0.1"],"first_seen":1779905553,"growth_per_day":1,"id":"remote_sha256-2a237b56f798cd94","key":"43010cfe83f290afd5b2898f02e48fb0162717168a61d2d9445b6c8ea95c2e9c","kind":"remote_sha256","last_seen":1780379637,"max_score":100,"members":2,"status":"active"},{"confidence_score":83,"events":[{"created_at":1780332662,"detail":{"examples":["nepsnowplow@9999.0.0","picnic-decoder-generator@9999.0.0","picnic-react-mise-en-place@9999.0.0","picnic-store-basket-miniapp@9999.0.0","picnic-store-delivery-miniapp@9999.0.0","picnic-store-design-system@9999.0.0","picnic-store-page-platform@9999.0.0","picnic-work-app-terms-of-use-de@9999.0.0","picnic-work-app-terms-of-use-fr@9999.0.0","picnic-work-app-terms-of-use-nl@9999.0.0"],"members":10,"previous_members":9},"event_kind":"expanded_campaign"},{"created_at":1780332655,"detail":{"examples":["nepsnowplow@9999.0.0","picnic-decoder-generator@9999.0.0","picnic-react-mise-en-place@9999.0.0","picnic-store-basket-miniapp@9999.0.0","picnic-store-delivery-miniapp@9999.0.0","picnic-store-page-platform@9999.0.0","picnic-work-app-terms-of-use-de@9999.0.0","picnic-work-app-terms-of-use-fr@9999.0.0","picnic-work-app-terms-of-use-nl@9999.0.0"],"members":9,"previous_members":7},"event_kind":"expanded_campaign"},{"created_at":1780332406,"detail":{"examples":["nepsnowplow@9999.0.0","picnic-decoder-generator@9999.0.0","picnic-react-mise-en-place@9999.0.0","picnic-store-page-platform@9999.0.0","picnic-work-app-terms-of-use-de@9999.0.0","picnic-work-app-terms-of-use-fr@9999.0.0","picnic-work-app-terms-of-use-nl@9999.0.0"],"members":7,"previous_members":6},"event_kind":"expanded_campaign"},{"created_at":1780332122,"detail":{"examples":["nepsnowplow@9999.0.0","picnic-decoder-generator@9999.0.0","picnic-store-page-platform@9999.0.0","picnic-work-app-terms-of-use-de@9999.0.0","picnic-work-app-terms-of-use-fr@9999.0.0","picnic-work-app-terms-of-use-nl@9999.0.0"],"members":6,"previous_members":5},"event_kind":"expanded_campaign"}],"examples":["nepsnowplow@9999.0.0","picnic-decoder-generator@9999.0.0","picnic-react-mise-en-place@9999.0.0","picnic-store-basket-miniapp@9999.0.0","picnic-store-delivery-miniapp@9999.0.0","picnic-store-design-system@9999.0.0","picnic-store-page-platform@9999.0.0","picnic-work-app-terms-of-use-de@9999.0.0","picnic-work-app-terms-of-use-fr@9999.0.0","picnic-work-app-terms-of-use-nl@9999.0.0"],"first_seen":1780331015,"growth_per_day":17,"id":"publisher_high_risk-291c9e23578bcc79","key":"hurik","kind":"publisher_high_risk","last_seen":1780379637,"max_score":95,"members":10,"status":"active"},{"confidence_score":60,"events":[{"created_at":1779742914,"detail":{"examples":["@izumiswap/sdk@3.0.5","@izumiswap/sdk@3.0.4"],"key":"iziswap","kind":"publisher_high_risk","max_score":95,"members":2},"event_kind":"new_campaign"}],"examples":["@izumiswap/sdk@3.0.4","@izumiswap/sdk@3.0.5"],"first_seen":1779742914,"growth_per_day":1,"id":"publisher_high_risk-e5d1232a84f11298","key":"iziswap","kind":"publisher_high_risk","last_seen":1780379637,"max_score":95,"members":2,"status":"active"},{"confidence_score":88,"events":[{"created_at":1780364958,"detail":{"examples":["@nextsparkjs/ai-workflow@0.1.0-beta.153","@nextsparkjs/ai-workflow@0.1.0-beta.154","@nextsparkjs/ai-workflow@0.1.0-beta.155","@nextsparkjs/ai-workflow@0.1.0-beta.156","@nextsparkjs/ai-workflow@0.1.0-beta.157","@nextsparkjs/ai-workflow@0.1.0-beta.158","@nextsparkjs/core@0.1.0-beta.153","@nextsparkjs/core@0.1.0-beta.154","@nextsparkjs/core@0.1.0-beta.155","@nextsparkjs/core@0.1.0-beta.156"],"members":106,"previous_members":105},"event_kind":"expanded_campaign"},{"created_at":1780364763,"detail":{"examples":["@nextsparkjs/ai-workflow@0.1.0-beta.153","@nextsparkjs/ai-workflow@0.1.0-beta.154","@nextsparkjs/ai-workflow@0.1.0-beta.155","@nextsparkjs/ai-workflow@0.1.0-beta.156","@nextsparkjs/ai-workflow@0.1.0-beta.157","@nextsparkjs/ai-workflow@0.1.0-beta.158","@nextsparkjs/core@0.1.0-beta.153","@nextsparkjs/core@0.1.0-beta.154","@nextsparkjs/core@0.1.0-beta.155","@nextsparkjs/core@0.1.0-beta.156"],"members":105,"previous_members":104},"event_kind":"expanded_campaign"},{"created_at":1780364658,"detail":{"examples":["@nextsparkjs/ai-workflow@0.1.0-beta.153","@nextsparkjs/ai-workflow@0.1.0-beta.154","@nextsparkjs/ai-workflow@0.1.0-beta.155","@nextsparkjs/ai-workflow@0.1.0-beta.156","@nextsparkjs/ai-workflow@0.1.0-beta.157","@nextsparkjs/ai-workflow@0.1.0-beta.158","@nextsparkjs/core@0.1.0-beta.153","@nextsparkjs/core@0.1.0-beta.154","@nextsparkjs/core@0.1.0-beta.155","@nextsparkjs/core@0.1.0-beta.156"],"members":104,"previous_members":102},"event_kind":"expanded_campaign"},{"created_at":1780364421,"detail":{"examples":["@nextsparkjs/ai-workflow@0.1.0-beta.153","@nextsparkjs/ai-workflow@0.1.0-beta.154","@nextsparkjs/ai-workflow@0.1.0-beta.155","@nextsparkjs/ai-workflow@0.1.0-beta.156","@nextsparkjs/ai-workflow@0.1.0-beta.157","@nextsparkjs/ai-workflow@0.1.0-beta.158","@nextsparkjs/core@0.1.0-beta.153","@nextsparkjs/core@0.1.0-beta.154","@nextsparkjs/core@0.1.0-beta.155","@nextsparkjs/core@0.1.0-beta.156"],"members":102,"previous_members":101},"event_kind":"expanded_campaign"}],"examples":["@nextsparkjs/ai-workflow@0.1.0-beta.153","@nextsparkjs/ai-workflow@0.1.0-beta.154","@nextsparkjs/ai-workflow@0.1.0-beta.155","@nextsparkjs/ai-workflow@0.1.0-beta.156","@nextsparkjs/ai-workflow@0.1.0-beta.157","@nextsparkjs/ai-workflow@0.1.0-beta.158","@nextsparkjs/core@0.1.0-beta.153","@nextsparkjs/core@0.1.0-beta.154","@nextsparkjs/core@0.1.0-beta.155","@nextsparkjs/core@0.1.0-beta.156"],"first_seen":1779600030,"growth_per_day":11,"id":"ttp_detail-6cfa74e378d6854c","key":"install_lifecycle_suppresses_failure:postinstall=\"node scripts/postinstall.mjs || true\"","kind":"ttp_detail","last_seen":1780379637,"max_score":92,"members":106,"status":"active"}],"cluster_limit":100,"cluster_total":97,"clusters":[{"examples":["abstra@3.30.31","abstra@3.31.0","abstract-hugpy@0.1.372","abstract-hugpy@0.1.373","abstract-hugpy@0.1.374","abstract-hugpy@0.1.375","abstractruntime@0.4.24","abstractruntime@0.4.25","abstractruntime@0.4.26","adclaw@1.0.27"],"key":"py_runtime_base64_decode:base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.","kind":"ttp_detail","max_score":360,"members":1367},{"examples":["abstra@3.30.31","abstra@3.31.0","acdh-id-reconciler@0.8.0","affx@1.0.0","affx@1.1","agent-bom@0.88.5","agent-framework-devui@1.0.0b260528","agent-framework@1.7.0","aidev-wxbot@2.0.6","airalogy@0.11.0"],"key":"py_import_time_network_call:network call (urllib/requests/httpx/http.client) at install or import time.","kind":"ttp_detail","max_score":360,"members":585},{"examples":["agentci-aadi@0.2.0","agentci-aadi@0.2.1","agenticx@0.4.1","aibrain@1.8.7","aibrowser@1.1.0","aibrowser@1.1.1","alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20"],"key":"py_runtime_dynamic_dangerous_import:dynamic __import__('os') — reflection bypass for static checks.","kind":"ttp_detail","max_score":284,"members":506},{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"key":"webhook_exfil_endpoint:matched \"ngrok-free.app\"","kind":"ttp_detail","max_score":333,"members":379},{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"key":"webhook_exfil_endpoint:matched \"api.telegram.org/bot\"","kind":"ttp_detail","max_score":333,"members":345},{"examples":["@capibar.chat/ui-kit@99.5.7","@car-loans/applicaion-aff@99.99.99","@car-loans/application-aff@99.99.99","@car-loans/close-flow-module@99.99.99","@car-loans/deal-aff@99.99.99","@car-loans/deal@99.99.99","@car-loans/desktop-car-loans-application@99.99.99","@car-loans/feature-toggles-module@99.99.99","@car-loans/general-analytics@99.99.99","@car-loans/general-feature-toggles@99.99.99"],"key":"install_lifecycle_remote_or_exec:postinstall=\"node scripts/postinstall.js\"","kind":"ttp_detail","max_score":357,"members":295},{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentai2027/openclaw-zh@2026.5.20-zh","@agentai2027/openclaw-zh@2026.5.22-zh","@agentai2027/openclaw-zh@2026.5.26-zh","@agentai2027/openclaw-zh@2026.5.27-zh","@agentai2027/openclaw-zh@2026.5.28-zh"],"key":"webhook_exfil_endpoint:matched \"ngrok.app\"","kind":"ttp_detail","max_score":333,"members":288},{"examples":["@aiden6791/aiboengine@1.0.2","@aiden6791/aiboengine@1.0.3","@archvisioninc/canvas@3.3.11","@archvisioninc/canvas@3.4.0","@archvisioninc/canvas@3.4.1","@asaleh37/ui-base@26.2.16","@asaleh37/ui-base@27.5.26","@axiom-lattice/agent-eval@2.1.57","@axiom-lattice/agent-eval@2.1.58","@axiom-lattice/agent-eval@2.1.59"],"key":"credential_file_packaged:package/.env","kind":"ttp_detail","max_score":109,"members":274},{"examples":["agent-airlock@0.8.9","agentic-comms@0.9.10","agentic-comms@0.9.9","agentsociety2@2.5.2","agentsociety2@2.5.3","ai302@0.1.46","ai302@0.1.47","ai302@0.1.48","ai302@0.1.49","ai302@0.1.50"],"key":"py_runtime_dynamic_dangerous_import:dynamic __import__('sys') — reflection bypass for static checks.","kind":"ttp_detail","max_score":284,"members":197},{"examples":["@hed-hog/cli@0.0.118","@hed-hog/cli@0.0.119","@jetbrains/junie@1668.43.0","@jetbrains/junie@1755.37.0","@jetbrains/junie@1755.50.0","@jetbrains/junie@1831.31.0","@kaitranntt/ccs@8.1.0-dev.10","@kaitranntt/ccs@8.1.0-dev.11","@kaitranntt/ccs@8.1.0-dev.12","@kaitranntt/ccs@8.1.0-dev.5"],"key":"js_hidden_powershell:hidden / non-interactive powershell invocation in package code — `-windowstyle hidden`, `irm | iex`, `windowshide: true`, or equivalent — used to download-and-run payloads on windows installers.","kind":"ttp_detail","max_score":186,"members":165},{"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2","hol-guard@2.0.348","hol-guard@2.0.349","hol-guard@2.0.350","hol-guard@2.0.351","hol-guard@2.0.352","hol-guard@2.0.353","hol-guard@2.0.354"],"key":"credential_paths:matched \".npmrc\"","kind":"ttp_detail","max_score":360,"members":144},{"examples":["@aonunited/angular@99.0.1","@catamania/front-components@1.0.1","@catamania/front-components@1.0.2","@catamania/front-components@1.0.3","@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21"],"key":"webhook_exfil_endpoint:matched \"webhook.site\"","kind":"ttp_detail","max_score":253,"members":139},{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@challenger6/vm-pattern-library@99.0.0","@easy-entry/landing-routes@99.9.5"],"key":"dns_or_oast_exfil:matched \"oastify.com\"","kind":"ttp_detail","max_score":148,"members":136},{"examples":["@abacus-ai/cli@2.5.3-canary.0","@chainlink/cre-sdk@1.9.0","@circlesac/clova@26.5.0","@cloudflare/telescope@1.1.0","@codegraff/relay@0.2.0","@codeperfect/eslint-config@1.11.0","@codeperfect/eslint-plugin@2.1.0","@codeperfect/eslint-plugin@2.3.0","@codetreker/bf@0.1.0","@coinbase/coinbase-cli@0.0.1"],"key":"GitHub Actions","kind":"publisher_high_risk","max_score":218,"members":107},{"examples":["@nextsparkjs/ai-workflow@0.1.0-beta.153","@nextsparkjs/ai-workflow@0.1.0-beta.154","@nextsparkjs/ai-workflow@0.1.0-beta.155","@nextsparkjs/ai-workflow@0.1.0-beta.156","@nextsparkjs/ai-workflow@0.1.0-beta.157","@nextsparkjs/ai-workflow@0.1.0-beta.158","@nextsparkjs/core@0.1.0-beta.153","@nextsparkjs/core@0.1.0-beta.154","@nextsparkjs/core@0.1.0-beta.155","@nextsparkjs/core@0.1.0-beta.156"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node scripts/postinstall.mjs || true\"","kind":"ttp_detail","max_score":92,"members":106},{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","bekambeyene/telebirr@v1.0.1","bekambeyene/telebirr@v2","billz/raspap-webgui@3.5.4","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0"],"key":"php_base64_eval_chain:base64/gz/hex decode combined with eval/exec/backticks — classic php obfuscated payload.","kind":"ttp_detail","max_score":186,"members":103},{"examples":["agent-working@1.0.0","agentsview@0.31.0","agentsview@0.31.1","agnt@0.13.10","agnt@0.13.11","agnt@0.13.12","agnt@0.13.13","agnt@0.13.14","agora-python-server-sdk@2.4.6","aipass@2.4.0"],"key":"py_import_time_os_system:direct shell invocation via os.system / os.popen / os.exec*.","kind":"ttp_detail","max_score":112,"members":88},{"examples":["@nordsym/apiclaw@2.8.4","@nordsym/apiclaw@2.8.5","@soledgic/sdk@0.4.3","bikky@0.4.5","borgmcp@0.9.15","borgmcp@0.9.16","borgmcp@0.9.17","borgmcp@0.9.18","borgmcp@0.9.19","borgmcp@0.9.20"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node dist/postinstall.js || true\"","kind":"ttp_detail","max_score":70,"members":86},{"examples":["agentcrew-ai@0.15.10","agentcrew-ai@0.15.11","agentcrew-ai@0.15.12","agentcrew-ai@0.15.9","aorta-sirius-dev@0.273","aorta-sirius@0.129","brickforge@0.1.0a10","brickforge@0.1.0a11","brickforge@0.1.0a12","brickforge@0.1.0a13"],"key":"py_install_time_network_call:network call (urllib/requests/httpx/http.client) at install or import time.","kind":"ttp_detail","max_score":360,"members":67},{"examples":["arete-macros@0.1.3","bv-builder@0.1.37","bv-builder@0.1.38","calimero-server@0.10.1-rc.46","calimero-server@0.10.1-rc.47","foundry-local-sdk@1.2.0","foundry-local-sdk@1.2.0-rc1","graphium-ui@0.1.0-alpha.6","haqumei@0.6.8","hopsfs-native-object-store@1.1.1"],"key":"rs_build_time_network:http / tcp network call inside build.rs — downloads at compile time.","kind":"ttp_detail","max_score":192,"members":66},{"examples":["adminneo-org/adminneo@v5.4.0","apex/app@2.2.16","b7s/catraca@v1.0.50","b7s/catraca@v1.0.70","bangsamu/master@v1.1.74","billz/raspap-webgui@3.5.4","chiiya/passes@1.3.0","chiiya/passes@1.4.0","dashed/dashed-ecommerce-veloyd@v4.1.0","debugbundle/sdk-php@v0.1.10"],"key":"php_shell_with_decode:exec / system / shell_exec combined with base64/hex decode.","kind":"ttp_detail","max_score":186,"members":65},{"examples":["@integrity-labs/agt-cli@0.24.2","@integrity-labs/agt-cli@0.24.3","@integrity-labs/agt-cli@0.24.4","@integrity-labs/agt-cli@0.24.5","@integrity-labs/agt-cli@0.24.6","@integrity-labs/agt-cli@0.24.7","@integrity-labs/agt-cli@0.24.8","@integrity-labs/agt-cli@0.24.9","@integrity-labs/agt-cli@0.25.0","@integrity-labs/agt-cli@0.25.1"],"key":"webhook_exfil_endpoint:matched \"pipedream.net\"","kind":"ttp_detail","max_score":55,"members":65},{"examples":["@goplus/agentguard@1.1.14","@goplus/agentguard@1.1.15","@goplus/agentguard@1.1.16","@goplus/agentguard@1.1.18","@goplus/agentguard@1.1.20","@goplus/agentguard@1.1.21","@goplus/agentguard@1.1.26","@goplus/agentguard@1.1.27","@lyrie/core@3.1.0","ansible-security-scanner@0.1.16"],"key":"dns_or_oast_exfil:matched \"burpcollaborator.net\"","kind":"ttp_detail","max_score":270,"members":53},{"examples":["adminneo-org/adminneo@v5.4.0","bootgly/bootgly@0.16.0-beta","chiiya/passes@1.3.0","chiiya/passes@1.4.0","easeo/cms-core@v0.1.0-rc2","easeo/cms-core@v0.2.0-rc1","easeo/cms-core@v0.2.0-rc2","ephenyxdigital/quantumcore@2.3.7","forgeomni/superaicore@v1.0.0","forgeomni/superaicore@v1.0.1"],"key":"php_backtick_with_decode:backtick shell-out combined with base64/hex decode.","kind":"ttp_detail","max_score":186,"members":50},{"examples":["@gblin-protocol/mcp-server@0.1.10","@gblin-protocol/mcp-server@0.1.11","@gblin-protocol/mcp-server@0.1.12","@gblin-protocol/mcp-server@0.1.4","@gblin-protocol/mcp-server@0.1.5","@gblin-protocol/mcp-server@0.1.6","@gblin-protocol/mcp-server@0.1.7","@gblin-protocol/mcp-server@0.1.8","@gblin-protocol/mcp-server@0.1.9","@nexra-ai/agent-cli@0.5.6"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node scripts/postinstall.cjs || true\"","kind":"ttp_detail","max_score":65,"members":49},{"examples":["@apholdings/jensen-web-ui@1.0.6","@apholdings/jensen-web-ui@1.0.7","@betomorrow/sync-wording@1.2.7","@bike4mind/cli@0.0.0-changeset-release-main-20260529083827","@bike4mind/cli@0.0.0-changeset-release-main-20260529084320","@bike4mind/cli@0.0.0-changeset-release-main-20260529100806","@bike4mind/cli@0.0.0-changeset-release-main-20260529102344","@bike4mind/cli@0.0.0-changeset-release-main-20260601063637","@bike4mind/cli@0.0.0-changeset-release-main-20260601081939","@bike4mind/cli@0.0.0-chore-upgrade-deps-safe-20260525102436"],"key":"remote_dependency_spec:dependencies.xlsx=\"https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz\"","kind":"ttp_detail","max_score":52,"members":49},{"examples":["@flexspec/cli-darwin-arm64@0.3.0","@flexspec/cli-darwin-arm64@0.3.1-dev.26612027722","@flexspec/cli-darwin-x64@0.3.0","@flexspec/cli-darwin-x64@0.3.1-dev.26612027722","@flexspec/cli-linux-x64@0.3.0","@flexspec/cli-linux-x64@0.3.1-dev.26612027722","@flexspec/cli-windows-x64@0.3.0","@flexspec/cli-windows-x64@0.3.1-dev.26612027722","@flexspec/http-darwin-arm64@0.3.0","@flexspec/http-darwin-arm64@0.3.1-dev.26612027722"],"key":"install_lifecycle_remote_or_exec:postinstall=\"node postinstall.js\"","kind":"ttp_detail","max_score":105,"members":46},{"examples":["aiohomematic@2026.5.10","aiohomematic@2026.5.11","aiscat@0.68.12","arthexis@0.7.0","arthexis@0.8.0","cuttledb@0.6.0","cuttledb@0.7.0","e2c-client@0.2.0","e2c-client@0.2.1","e2c-client@0.2.2"],"key":"py_import_time_raw_socket:raw socket creation at install or import time.","kind":"ttp_detail","max_score":86,"members":46},{"examples":["agntspace@1.102.0","agntspace@1.102.1","agntspace@1.102.2","agntspace@1.103.0","agntspace@1.103.1","agntspace@1.104.0","agntspace@1.104.1","agntspace@1.105.0","agntspace@1.106.0","agntspace@1.107.0"],"key":"py_install_time_os_system:direct shell invocation via os.system / os.popen / os.exec*.","kind":"ttp_detail","max_score":159,"members":43},{"examples":["ai3@0.3.5","aonote@0.11.1","arjson@0.1.4","arnext-arkb@0.0.2","arnext@0.1.5","atomic-notes@0.5.3","create-arnext-app@0.0.10","cwao-tools@0.3.1","cwao-units@0.8.3","cwao@0.5.6"],"key":"asteroiddao","kind":"publisher_high_risk","max_score":90,"members":38},{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@blundergoat/gruff-ts@0.3.0","@orbit-software/sdk@1.94.1","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301305","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301504","@qingchencloud/openclaw-zh@2026.5.27-nightly.202605301603"],"key":"js_split_join_obfuscation:array-of-single-tokens joined to form a string — used to obscure module names like require([\"n\",\"o\",\"de\",\":\",\"cr\",\"yp\",\"to\"].join(\"\")), defeating static require() analysis.","kind":"ttp_detail","max_score":333,"members":37},{"examples":["acellera-htmd@2.8.2","acellera-htmd@2.8.3","acellera-htmd@2.8.4","aegis-harness@0.11.0","agent-borg@3.3.15","cellprofiler-nightly@5.0.0.dev625","cellprofiler-nightly@5.0.0.dev627","ciris-edge@0.13.0","ciris-edge@0.13.1","ciris-edge@0.14.2"],"key":"py_import_time_compile_exec:python exec(compile(...)) — typical obfuscated loader pattern.","kind":"ttp_detail","max_score":84,"members":37},{"examples":["@0dai-dev/cli@4.2.0","@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@frihet/mcp-server@1.12.0-beta.1","@frihet/mcp-server@1.9.0-beta.1","@telora/mcp-products@0.22.30","@telora/mcp-products@0.22.32","@telora/mcp-products@0.22.33","@telora/mcp-products@0.22.34","@telora/mcp-products@0.22.37"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node scripts/postinstall.js || true\"","kind":"ttp_detail","max_score":50,"members":35},{"examples":["async-pipeline-builder@1.4.0","async-pipeline-builder@1.5.0","async-pipeline-builder@1.5.1","build-scripts-utils@1.4.0","build-scripts-utils@1.5.0","build-scripts-utils@1.5.1","dev-env-bootstrapper@1.4.0","dev-env-bootstrapper@1.5.0","dev-env-bootstrapper@1.5.2","llm-context-compressor@1.4.0"],"key":"asdxzxc","kind":"publisher_high_risk","max_score":149,"members":30},{"examples":["@aonunited/angular@99.0.0","@aonunited/angular@99.0.1","argus-ai-scanner@1.12.0","github.com/Method-Security/webscan@v0.0.239","github.com/Method-Security/webscan@v0.0.240","github.com/Method-Security/webscan@v0.0.241","github.com/method-security/webscan@v0.0.239","github.com/method-security/webscan@v0.0.240","github.com/method-security/webscan@v0.0.241","github.com/projectdiscovery/nuclei-templates@v10.4.4+incompatible"],"key":"dns_or_oast_exfil:matched \"oast.fun\"","kind":"ttp_detail","max_score":148,"members":30},{"examples":["@deppon/create-deppon-app@2.5.10","@deppon/create-deppon-app@2.5.11","@deppon/create-deppon-app@2.5.12","@deppon/create-deppon-app@2.5.6","@deppon/create-deppon-app@2.5.7","@deppon/create-deppon-app@2.5.8","@deppon/create-deppon-app@2.5.9","@firenova-studio/react-native-boilerplate@1.0.0","@firenova-studio/react-native-boilerplate@1.0.1","@firenova-studio/react-native-boilerplate@4.11.1"],"key":"credential_file_packaged:package/template/.env","kind":"ttp_detail","max_score":50,"members":28},{"examples":["car0001@2.0.0","hospital-app@2.0.0","hospital-managements@2.0.0","hospital0001@1.0.0","hospital_system@1.0.0","mutoni-hospital@1.0.11","mutoni-hotel@1.0.0","niyonkuru-senga-amani@1.0.0","niyonkuru-senga-amani@2.0.0","parking0001@1.0.0"],"key":"credential_file_packaged:package/backend/.env","kind":"ttp_detail","max_score":67,"members":26},{"examples":["crack-it@3.0.0","create-bruno-app1@1.0.0","create-bruno-app@1.0.0","create-exam-cli@1.0.15","expresso-app@0.1.4","expresso-app@0.1.5","expresso-app@0.1.6","expresso-app@0.1.7","expresso-app@0.1.8","expresso-app@0.1.85"],"key":"credential_file_packaged:package/templates/backend/.env","kind":"ttp_detail","max_score":59,"members":23},{"examples":["halfin@0.3.7","halfin@0.3.8","haqumei@0.6.8","ktstr@0.8.0","liteparse-pdfium-sys@1.1.0","pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3"],"key":"rs_build_time_command_combo:process spawn (std::process::command) paired with network / base64 / env-token read at build time.","kind":"ttp_detail","max_score":192,"members":22},{"examples":["annick_shima_national_practical_exam_2026@1.0.0","betty-backend@1.0.0","create-dollar-app@1.0.2","create-kc@1.0.0","create-kc@1.0.1","create-kc@1.0.2","create-kc@1.0.3","create-kc@1.0.4","fristprincia@1.0.0","kirenga-app@1.0.0"],"key":"credential_file_packaged:package/backend-project/.env","kind":"ttp_detail","max_score":70,"members":20},{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.549","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.551","@tscircuit/capacity-autorouter@0.0.552","@tscircuit/capacity-autorouter@0.0.553","@tscircuit/capacity-autorouter@0.0.554","@tscircuit/capacity-autorouter@0.0.555","@tscircuit/capacity-autorouter@0.0.556","@tscircuit/capacity-autorouter@0.0.557"],"key":"https://codeload.github.com/tscircuit/high-density-repair02/tar.gz/2afc0cbba3bf2f7eb6b9cd33615d21e9ad9352d4","kind":"remote_url","max_score":58,"members":20},{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.549","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.551","@tscircuit/capacity-autorouter@0.0.552","@tscircuit/capacity-autorouter@0.0.553","@tscircuit/capacity-autorouter@0.0.554","@tscircuit/capacity-autorouter@0.0.555","@tscircuit/capacity-autorouter@0.0.556","@tscircuit/capacity-autorouter@0.0.557"],"key":"34c8037ee971d7964c0ea6cce15442224368fb3b0935789e00e9f8d9b571070b","kind":"remote_sha256","max_score":58,"members":20},{"examples":["coevopy@0.4","conservation-regime@0.1.0","langchain-nomad@0.1.0","pocketvault-client@0.1.0","pocketvault-client@0.1.1","velvet-report@2.0.7","velvet-report@2.0.8","velvet-report@2.0.9","yanleafadmin@2.0.0","yanleafadmin@2.0.1"],"key":"py_install_time_dynamic_dangerous_import:dynamic __import__('os') — reflection bypass for static checks.","kind":"ttp_detail","max_score":80,"members":18},{"examples":["@lowdefy/server-e2e@0.0.0-experimental-20260514082957","@lowdefy/server-e2e@0.0.0-experimental-20260525131701","@lowdefy/server-e2e@0.0.0-experimental-20260526123919","@lowdefy/server-e2e@0.0.0-experimental-20260601102156","@pb-it/ark-cms-selenium-test-helper@0.1.32-beta","@sapudex/web-components@2.38.0","@sapudex/web-components@2.39.0","@superblocksteam/cli@2.0.119","@superblocksteam/cli@2.0.119-next.0","@superblocksteam/cli@2.0.119-next.1"],"key":"credential_file_packaged:package/.npmrc","kind":"ttp_detail","max_score":35,"members":18},{"examples":["alpi-agent@0.6.17","alpi-agent@0.6.18","alpi-agent@0.6.19","alpi-agent@0.6.20","alpi-agent@0.6.21","alpi-agent@0.6.22","alpi-agent@0.6.23","alpi-agent@0.6.24","alpi-agent@0.6.25","alpi-agent@0.6.26"],"key":"Satoshi Ltd.","kind":"publisher_high_risk","max_score":215,"members":15},{"examples":["@epambot/epam-videoportal-client@3.1.10","@lyrie/core@3.1.0","@neodevxsadmd/baileys@1.1.2","@neodevxsadmd/baileys@1.1.3","@neodevxsadmd/baileys@1.1.5","@neodevxsadmd/baileys@1.3.3","@neodevxsadmd/baileys@1.3.4","@thomlecter1122/lab-helper-test@0.0.15","@thomlecter1122/lab-helper-test@0.0.16","authcascade@1.5.25"],"key":"js_decode_then_exec:base64 / atob / fromcharcode decode adjacent to eval / new function — canonical obfuscated-loader pattern.","kind":"ttp_detail","max_score":102,"members":14},{"examples":["bangsamu/master@v1.1.74","ceus-media/hymn@1.0.4","condoedge/utils@v0.2.300","condoedge/utils@v0.2.301","condoedge/utils@v0.2.303","condoedge/utils@v0.2.304","condoedge/utils@v0.2.306","ephenyxdigital/quantumcore@2.3.7","jtsternberg/buddy-cli@v1.6.1","phreesoft/bizuno@v7.4.0"],"key":"php_remote_fetch_exec_combo:remote fetch (file_get_contents/curl) paired with eval/exec — fetch-and-run pattern.","kind":"ttp_detail","max_score":186,"members":13},{"examples":["@neodevxsadmd/baileys@1.1.4","@neodevxsadmd/baileys@1.2.0","@neodevxsadmd/baileys@1.2.1","@neodevxsadmd/baileys@1.2.2","@nuisockets/baileys@7.0.0","@nuisockets/baileys@7.2.1","@nuisockets/baileys@7.2.7","@nuisockets/baileys@7.2.8","@pontaproject/baileys@0.1.2","@srlczinn/new-baileys@7.0.0-rc.9-patch.1"],"key":"install_lifecycle_remote_or_exec:preinstall=\"node ./engine-requirements.js\"","kind":"ttp_detail","max_score":105,"members":12},{"examples":["@electric-ax/agents-runtime@0.3.2","@electric-ax/agents-runtime@0.3.4","@electric-ax/agents-runtime@0.3.5","@electric-ax/agents-server-conformance-tests@0.1.7","@electric-ax/agents-server-conformance-tests@0.1.8","@electric-ax/agents-server@0.4.11","@electric-ax/agents-server@0.4.12","@electric-ax/agents-server@0.4.7","@electric-ax/agents-server@0.4.9","electric-ax@0.2.6"],"key":"https://pkg.pr.new/durable-streams/durable-streams/@durable-streams/client@5d5c217","kind":"remote_url","max_score":8,"members":12},{"examples":["@electric-ax/agents-runtime@0.3.2","@electric-ax/agents-runtime@0.3.4","@electric-ax/agents-runtime@0.3.5","@electric-ax/agents-server-conformance-tests@0.1.7","@electric-ax/agents-server-conformance-tests@0.1.8","@electric-ax/agents-server@0.4.11","@electric-ax/agents-server@0.4.12","@electric-ax/agents-server@0.4.7","@electric-ax/agents-server@0.4.9","electric-ax@0.2.6"],"key":"16112cba1108a0739deadbd7ff7c295cfff5fb4bd18d735892f22b9b1570a67c","kind":"remote_sha256","max_score":8,"members":12},{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.558","@tscircuit/capacity-autorouter@0.0.559","@tscircuit/capacity-autorouter@0.0.560","@tscircuit/capacity-autorouter@0.0.565","@tscircuit/capacity-autorouter@0.0.566","@tscircuit/capacity-autorouter@0.0.567","@tscircuit/core@0.0.1275","@tscircuit/eval@0.0.872"],"key":"seveibar","kind":"publisher_high_risk","max_score":151,"members":11},{"examples":["feral-ai@2026.5.42","feral-ai@2026.5.43","feral-ai@2026.5.44","feral-ai@2026.5.45","feral-ai@2026.5.46","feral-ai@2026.5.47","feral-ai@2026.5.48","feral-ai@2026.5.49","feral-ai@2026.6.1","feral-ai@2026.6.2"],"key":"Mahmoud Omar","kind":"publisher_high_risk","max_score":145,"members":11},{"examples":["intl-ad-routing@99.0.1","intl-ad-routing@99.0.2","intl-ads@99.0.1","intl-ads@99.0.2","platform-tempo@99.0.1","tempo-layout@99.0.1","tempo-layout@99.0.2","tempo-modules@99.0.1","walmart-shared-modules@99.0.1","wml-components@99.0.1"],"key":"fais071","kind":"publisher_high_risk","max_score":85,"members":11},{"examples":["@imagekit/api-mcp@7.6.2","@imagekit/api-mcp@7.6.3","@mux/mcp@14.1.0","@papr/memory-mcp@2.6.0","@papr/memory-mcp@2.7.0","@stigg/typescript-mcp@0.1.0-beta.13","dodopayments-mcp@2.32.2","dodopayments-mcp@2.33.0","dodopayments-mcp@2.34.0","firefly-mcp@0.1.0"],"key":"remote_dependency_spec:dependencies.jq-web=\"https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz\"","kind":"ttp_detail","max_score":47,"members":11},{"examples":["nepsnowplow@9999.0.0","picnic-decoder-generator@9999.0.0","picnic-react-mise-en-place@9999.0.0","picnic-store-basket-miniapp@9999.0.0","picnic-store-delivery-miniapp@9999.0.0","picnic-store-design-system@9999.0.0","picnic-store-page-platform@9999.0.0","picnic-work-app-terms-of-use-de@9999.0.0","picnic-work-app-terms-of-use-fr@9999.0.0","picnic-work-app-terms-of-use-nl@9999.0.0"],"key":"hurik","kind":"publisher_high_risk","max_score":95,"members":10},{"examples":["@electric-ax/agents-runtime@0.3.2","@electric-ax/agents-runtime@0.3.4","@electric-ax/agents-runtime@0.3.5","@electric-ax/agents-server@0.4.11","@electric-ax/agents-server@0.4.12","@electric-ax/agents-server@0.4.7","@electric-ax/agents-server@0.4.9","electric-ax@0.2.6","electric-ax@0.2.8","electric-ax@0.2.9"],"key":"https://pkg.pr.new/durable-streams/durable-streams/@durable-streams/state@5d5c217","kind":"remote_url","max_score":20,"members":10},{"examples":["@electric-ax/agents-runtime@0.3.2","@electric-ax/agents-runtime@0.3.4","@electric-ax/agents-runtime@0.3.5","@electric-ax/agents-server@0.4.11","@electric-ax/agents-server@0.4.12","@electric-ax/agents-server@0.4.7","@electric-ax/agents-server@0.4.9","electric-ax@0.2.6","electric-ax@0.2.8","electric-ax@0.2.9"],"key":"5a4ab6b51464a78a24ab25526c1da9337282b037b0f8e167cfae705396767cbd","kind":"remote_sha256","max_score":20,"members":10},{"examples":["@airasia-phoenix/react-native@999.9.3","@easy-entry/landing-routes@99.9.5","@easy-entry/outside-registration-fop-navigator@99.9.5","@easy-entry/routes@99.9.5","@open-banking/cabinet-providers@999.9.5","@open-banking/cabinet-routes@999.9.2","@shell-cabinet/routes@99.9.5","@shell-landing/routes@99.9.5"],"key":"scream3gg_bughunter","kind":"publisher_high_risk","max_score":65,"members":8},{"examples":["@qds.dev/base@0.15.0","@qds.dev/base@0.15.1","@qds.dev/code@0.15.0","@qds.dev/code@0.15.1","@qds.dev/motion@0.15.0","@qds.dev/motion@0.15.1","@qds.dev/ui@0.15.0","@qds.dev/ui@0.15.1"],"key":"https://pkg.pr.new/QwikDev/qwik/@qwik.dev/core@9d4d163","kind":"remote_url","max_score":20,"members":8},{"examples":["@qds.dev/base@0.15.0","@qds.dev/base@0.15.1","@qds.dev/code@0.15.0","@qds.dev/code@0.15.1","@qds.dev/motion@0.15.0","@qds.dev/motion@0.15.1","@qds.dev/ui@0.15.0","@qds.dev/ui@0.15.1"],"key":"0a7839db9c4d8cb620dcfd9dc873a9036d0dd8971337d12108a4ae38db56bbe0","kind":"remote_sha256","max_score":20,"members":8},{"examples":["pelagos@0.63.0","pelagos@0.65.0","pelagos@0.65.1","pelagos@0.65.2","pelagos@0.65.3","pelagos@0.65.4","pelagos@0.65.5"],"key":"Christopher Brown","kind":"publisher_high_risk","max_score":192,"members":7},{"examples":["pdd-cli@0.0.252","pdd-cli@0.0.253","pdd-cli@0.0.254","pdd-cli@0.0.255","pdd-cli@0.0.256","pdd-cli@0.0.257","pdd-cli@0.0.260"],"key":"Greg Tanaka","kind":"publisher_high_risk","max_score":125,"members":7},{"examples":["claude-channel-imessage@2.0.4","shop-minis@2.0.5","skills-detector@2.0.4","skills-detector@2.0.5","testing-on-npmjs@2.0.5","testing-on-npmjs@2.0.6","verify-mycommand@2.0.4"],"key":"lobo_hunt","kind":"publisher_high_risk","max_score":105,"members":7},{"examples":["spree_cm_commissioner@2.8.1.pre.pre.4","spree_cm_commissioner@2.8.2","spree_cm_commissioner@2.8.2.pre.pre.1","spree_cm_commissioner@2.8.2.pre.pre.2","spree_cm_commissioner@2.8.2.pre.pre.3","spree_cm_commissioner@2.8.2.pre.pre.4","spree_cm_commissioner@2.8.2.pre.pre.5"],"key":"You","kind":"publisher_high_risk","max_score":75,"members":7},{"examples":["@electric-ax/agents-runtime@0.3.2","@electric-ax/agents-runtime@0.3.4","@electric-ax/agents-runtime@0.3.5","@electric-ax/agents-server@0.4.11","@electric-ax/agents-server@0.4.12","@electric-ax/agents-server@0.4.7","@electric-ax/agents-server@0.4.9"],"key":"https://pkg.pr.new/durable-streams/durable-streams/@durable-streams/server@eac712f","kind":"remote_url","max_score":32,"members":7},{"examples":["@electric-ax/agents-runtime@0.3.2","@electric-ax/agents-runtime@0.3.4","@electric-ax/agents-runtime@0.3.5","@electric-ax/agents-server@0.4.11","@electric-ax/agents-server@0.4.12","@electric-ax/agents-server@0.4.7","@electric-ax/agents-server@0.4.9"],"key":"e0b9c99e19e6720e223ce1f389607ebf8969bc96a8dfdca927d6f8a1f4ec0c99","kind":"remote_sha256","max_score":32,"members":7},{"examples":["cdk-sagemaker-notebook-workflow@1.0.3","cdk-sagemaker-notebook-workflow@2.0.4","cdk-sagemaker-notebook-workflow@2.0.5","power-apps@2.0.3","power-apps@2.0.4","power-platform-playwright-toolkit@1.0.4"],"key":"l0bo","kind":"publisher_high_risk","max_score":105,"members":6},{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh"],"key":"agentai2026","kind":"publisher_high_risk","max_score":333,"members":5},{"examples":["@strada.sh/sdk@0.4.0","@strada.sh/sdk@0.4.1","@strada.sh/sdk@0.4.2","@strada.sh/sdk@0.4.3"],"key":"https://pkg.pr.new/better-auth@9489","kind":"remote_url","max_score":84,"members":4},{"examples":["@strada.sh/sdk@0.4.0","@strada.sh/sdk@0.4.1","@strada.sh/sdk@0.4.2","@strada.sh/sdk@0.4.3"],"key":"ce157240e912af8c2fa670aba551f42617a04cc387a40f11ad209748491cbbcf","kind":"remote_sha256","max_score":84,"members":4},{"examples":["@shyakatv/backend@1.0.1","@shyakatv/smartpark-backend@1.0.1","shyakatv-sales@1.0.10","shyakatv-sales@1.0.9"],"key":"shyakatv","kind":"publisher_high_risk","max_score":75,"members":4},{"examples":["@webda-features/dashboard@99.9.1","sorenson-webfonts@99.9.1","unleash-js@99.9.1","wm-mapper@99.9.1"],"key":"ltdwh8","kind":"publisher_high_risk","max_score":67,"members":4},{"examples":["@zenon-red/probe@1.3.10","@zenon-red/probe@1.3.7","@zenon-red/probe@1.3.8","@zenon-red/probe@1.3.9"],"key":"https://codeload.github.com/PlasmaKing/znn-typescript-sdk/tar.gz/865bc8866d798893ed364f6db4f14162efe0b396","kind":"remote_url","max_score":62,"members":4},{"examples":["@zenon-red/probe@1.3.10","@zenon-red/probe@1.3.7","@zenon-red/probe@1.3.8","@zenon-red/probe@1.3.9"],"key":"ce2412ec996775461c554cee22e54142c96c1fb18b9b7641cb8dafcee31c9c97","kind":"remote_sha256","max_score":62,"members":4},{"examples":["farseer-cli@1.8.0","farseer-cli@1.8.1","farseer-cli@1.8.2","farseer-cli@1.8.3"],"key":"https://storage.googleapis.com/farseer-remote-jobs-results/farseer-client/release-1.8.12.tar","kind":"remote_url","max_score":12,"members":4},{"examples":["farseer-cli@1.8.0","farseer-cli@1.8.1","farseer-cli@1.8.2","farseer-cli@1.8.3"],"key":"62e3cb1abef12e4bcb9d6a56400cef5a21be7448c9bad95e0e68c1ee0dc533c0","kind":"remote_sha256","max_score":12,"members":4},{"examples":["hermes-agent@0.15.0","hermes-agent@0.15.1","hermes-agent@0.15.2"],"key":"Nous Research","kind":"publisher_high_risk","max_score":360,"members":3},{"examples":["mindfabric-agent@1.1.364","mindfabric-agent@1.1.365","mindfabric-agent@1.1.366"],"key":"MindFabric Team","kind":"publisher_high_risk","max_score":270,"members":3},{"examples":["yrodevgit/ctrx@v2.3.1","yrodevgit/ctrx@v2.3.2","yrodevgit/ctrx@v2.3.3"],"key":"Tyrone","kind":"publisher_high_risk","max_score":122,"members":3},{"examples":["xlsynth-sys@0.51.0","xlsynth-sys@0.52.0","xlsynth-sys@0.52.1"],"key":"Chris Leary","kind":"publisher_high_risk","max_score":81,"members":3},{"examples":["sibidharan/zealphp@v0.3.5","sibidharan/zealphp@v0.3.7"],"key":"Sibidharan","kind":"publisher_high_risk","max_score":186,"members":2},{"examples":["attocode@0.2.24","attocode@0.2.25"],"key":"eren23","kind":"publisher_high_risk","max_score":148,"members":2},{"examples":["binary-collections@2.0.12","binary-collections@2.0.13"],"key":"dimaslanjaka","kind":"publisher_high_risk","max_score":136,"members":2},{"examples":["@aonunited/angular@99.0.0","@aonunited/angular@99.0.1"],"key":"friederichvilaseca","kind":"publisher_high_risk","max_score":107,"members":2},{"examples":["remsg@2.0.0","remsg@2.0.1"],"key":"https://pkg.pr.new/changesets/changesets/@changesets/cli@bd27256","kind":"remote_url","max_score":100,"members":2},{"examples":["remsg@2.0.0","remsg@2.0.1"],"key":"43010cfe83f290afd5b2898f02e48fb0162717168a61d2d9445b6c8ea95c2e9c","kind":"remote_sha256","max_score":100,"members":2},{"examples":["@izumiswap/sdk@3.0.4","@izumiswap/sdk@3.0.5"],"key":"iziswap","kind":"publisher_high_risk","max_score":95,"members":2},{"examples":["gregium@2.1.0","gregium@2.1.1"],"key":"LavaTigerUnicrn","kind":"publisher_high_risk","max_score":75,"members":2},{"examples":["@druids/ui@99.9.1","@mc-xp/mc-monolith-js-src-package@99.9.1"],"key":"ltdwh9","kind":"publisher_high_risk","max_score":67,"members":2},{"examples":["@dcl/scene-explorer-tests@1.0.0-20240119191744.commit-84cbba8","@dcl/scene-explorer-tests@1.0.0-20240430222335.commit-2b82e41"],"key":"https://sdk-team-cdn.decentraland.org/@dcl/js-sdk-toolchain/branch/psquad/test-framework-tool/dcl-sdk-7.3.36-7291127796.commit-b299b0d.tgz","kind":"remote_url","max_score":60,"members":2},{"examples":["@dcl/scene-explorer-tests@1.0.0-20240119191744.commit-84cbba8","@dcl/scene-explorer-tests@1.0.0-20240430222335.commit-2b82e41"],"key":"f3eb9e865970c4663a2e3f10b5ff7b515d13c817999e74ed58e7b085076b80a3","kind":"remote_sha256","max_score":60,"members":2},{"examples":["@wanlingsdk/avatar-sdk@0.1.16","@wanlingsdk/avatar-sdk@0.1.18"],"key":"https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz","kind":"remote_url","max_score":35,"members":2},{"examples":["@wanlingsdk/avatar-sdk@0.1.16","@wanlingsdk/avatar-sdk@0.1.18"],"key":"0f60f3d3dc5efa299e3464d29b6a7dc51d1dff665fe7b036aa95021ce6fd827a","kind":"remote_sha256","max_score":35,"members":2},{"examples":["remsg@2.0.0","remsg@2.0.1"],"key":"https://pkg.pr.new/changesets/changesets/@changesets/changelog-github@bd27256","kind":"remote_url","max_score":32,"members":2},{"examples":["remsg@2.0.0","remsg@2.0.1"],"key":"d97bd447ec58643cece5490c2b3e89ca1b80289104df20f6b68f6edee6bd92b4","kind":"remote_sha256","max_score":32,"members":2},{"examples":["@aleph-alpha/ds-components-vue@2.0.0","@aleph-alpha/ds-components-vue@2.1.0"],"key":"https://pkg.pr.new/vuejs/language-tools/vue-tsc@3fb59af","kind":"remote_url","max_score":12,"members":2},{"examples":["@aleph-alpha/ds-components-vue@2.0.0","@aleph-alpha/ds-components-vue@2.1.0"],"key":"7c1633377a9d57b62aec4156c607ac2dfcb6284625badf342fb62ae40c4aa268","kind":"remote_sha256","max_score":12,"members":2}]}