{"campaigns":[{"confidence_score":90,"events":[{"created_at":1784375170,"detail":{"examples":["@achuthvp/postinstall-poc@1.0.2","@achuthvp/postinstall-poc@1.0.3","@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@aonunited/angular@99.0.1","@asterworks/agent-audit@0.2.0","@asterworks/agent-console@0.1.0","@asterworks/agent-console@0.1.1"],"members":697,"previous_members":696},"event_kind":"expanded_campaign"},{"created_at":1784375141,"detail":{"examples":["@achuthvp/postinstall-poc@1.0.2","@achuthvp/postinstall-poc@1.0.3","@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@aonunited/angular@99.0.1","@asterworks/agent-audit@0.2.0","@asterworks/agent-console@0.1.0","@asterworks/agent-console@0.1.1"],"members":697,"previous_members":696},"event_kind":"expanded_campaign"},{"created_at":1784349010,"detail":{"examples":["@achuthvp/postinstall-poc@1.0.2","@achuthvp/postinstall-poc@1.0.3","@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@aonunited/angular@99.0.1","@asterworks/agent-audit@0.2.0","@asterworks/agent-console@0.1.0","@asterworks/agent-console@0.1.1"],"members":696,"previous_members":695},"event_kind":"expanded_campaign"},{"created_at":1784348980,"detail":{"examples":["@achuthvp/postinstall-poc@1.0.2","@achuthvp/postinstall-poc@1.0.3","@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@aonunited/angular@99.0.1","@asterworks/agent-audit@0.2.0","@asterworks/agent-console@0.1.0","@asterworks/agent-console@0.1.1"],"members":696,"previous_members":695},"event_kind":"expanded_campaign"}],"examples":["@achuthvp/postinstall-poc@1.0.2","@achuthvp/postinstall-poc@1.0.3","@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@aonunited/angular@99.0.1","@asterworks/agent-audit@0.2.0","@asterworks/agent-console@0.1.0","@asterworks/agent-console@0.1.1"],"first_seen":1779723276,"growth_per_day":12,"id":"ttp_detail-6e2f334930a2f849","key":"webhook_exfil_endpoint","kind":"ttp_detail","last_seen":1784379081,"max_score":545,"members":697,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784378239,"detail":{"examples":["@evalguard/core@1.4.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7","@hawon/nexus@0.6.0","@roxy-agent/agents@0.5.0","@roxy-agent/agents@0.5.1","@roxy-agent/agents@0.5.2","@roxy-agent/agents@0.5.4","@roxy-agent/agents@0.5.5","@roxy-agent/agents@0.5.6"],"members":514,"previous_members":513},"event_kind":"expanded_campaign"},{"created_at":1784378210,"detail":{"examples":["@evalguard/core@1.4.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7","@hawon/nexus@0.6.0","@roxy-agent/agents@0.5.0","@roxy-agent/agents@0.5.1","@roxy-agent/agents@0.5.2","@roxy-agent/agents@0.5.4","@roxy-agent/agents@0.5.5","@roxy-agent/agents@0.5.6"],"members":514,"previous_members":513},"event_kind":"expanded_campaign"},{"created_at":1784373063,"detail":{"examples":["@evalguard/core@1.4.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7","@hawon/nexus@0.6.0","@roxy-agent/agents@0.5.0","@roxy-agent/agents@0.5.1","@roxy-agent/agents@0.5.2","@roxy-agent/agents@0.5.4","@roxy-agent/agents@0.5.5","@roxy-agent/agents@0.5.6"],"members":513,"previous_members":512},"event_kind":"expanded_campaign"},{"created_at":1784373049,"detail":{"examples":["@evalguard/core@1.4.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7","@hawon/nexus@0.6.0","@roxy-agent/agents@0.5.0","@roxy-agent/agents@0.5.1","@roxy-agent/agents@0.5.2","@roxy-agent/agents@0.5.4","@roxy-agent/agents@0.5.5","@roxy-agent/agents@0.5.6"],"members":513,"previous_members":512},"event_kind":"expanded_campaign"}],"examples":["@evalguard/core@1.4.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7","@hawon/nexus@0.6.0","@roxy-agent/agents@0.5.0","@roxy-agent/agents@0.5.1","@roxy-agent/agents@0.5.2","@roxy-agent/agents@0.5.4","@roxy-agent/agents@0.5.5","@roxy-agent/agents@0.5.6"],"first_seen":1782001138,"growth_per_day":18,"id":"ttp_detail-5a7d451966a6ab29","key":"reverse_shell","kind":"ttp_detail","last_seen":1784379081,"max_score":545,"members":514,"status":"active"},{"confidence_score":84,"events":[{"created_at":1784277469,"detail":{"examples":["@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7"],"max_score":545,"previous_score":508},"event_kind":"score_increased"},{"created_at":1784277469,"detail":{"examples":["@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7"],"members":4,"previous_members":3},"event_kind":"expanded_campaign"},{"created_at":1784277446,"detail":{"examples":["@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7"],"max_score":545,"previous_score":508},"event_kind":"score_increased"},{"created_at":1784277446,"detail":{"examples":["@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7"],"members":4,"previous_members":3},"event_kind":"expanded_campaign"}],"examples":["@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7"],"first_seen":1781940508,"growth_per_day":1,"id":"publisher_high_risk-df6efd287770e878","key":"barathkumargopi","kind":"publisher_high_risk","last_seen":1784379081,"max_score":545,"members":4,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784377660,"detail":{"examples":["@403name/electron-buidler@1.0.0","@403name/electron-buidler@1.0.1","@403name/ether-js@1.0.0","@403name/ether-js@1.0.1","@403name/fsevent@1.0.0","@403name/fsevent@1.0.1","@a2bugfix/orchestrator@0.1.4","@a2bugfix/orchestrator@0.1.5","@a2bugfix/orchestrator@0.1.6","@aerovato/container@3.4.4"],"members":1778,"previous_members":1775},"event_kind":"expanded_campaign"},{"created_at":1784377641,"detail":{"examples":["@403name/electron-buidler@1.0.0","@403name/electron-buidler@1.0.1","@403name/ether-js@1.0.0","@403name/ether-js@1.0.1","@403name/fsevent@1.0.0","@403name/fsevent@1.0.1","@a2bugfix/orchestrator@0.1.4","@a2bugfix/orchestrator@0.1.5","@a2bugfix/orchestrator@0.1.6","@aerovato/container@3.4.4"],"members":1778,"previous_members":1775},"event_kind":"expanded_campaign"},{"created_at":1784377598,"detail":{"examples":["@403name/electron-buidler@1.0.0","@403name/electron-buidler@1.0.1","@403name/ether-js@1.0.0","@403name/ether-js@1.0.1","@403name/fsevent@1.0.0","@403name/fsevent@1.0.1","@a2bugfix/orchestrator@0.1.4","@a2bugfix/orchestrator@0.1.5","@a2bugfix/orchestrator@0.1.6","@aerovato/container@3.4.4"],"members":1778,"previous_members":1775},"event_kind":"expanded_campaign"},{"created_at":1784377331,"detail":{"examples":["@403name/electron-buidler@1.0.0","@403name/electron-buidler@1.0.1","@403name/ether-js@1.0.0","@403name/ether-js@1.0.1","@403name/fsevent@1.0.0","@403name/fsevent@1.0.1","@a2bugfix/orchestrator@0.1.4","@a2bugfix/orchestrator@0.1.5","@a2bugfix/orchestrator@0.1.6","@aerovato/container@3.4.4"],"members":1775,"previous_members":1774},"event_kind":"expanded_campaign"}],"examples":["@403name/electron-buidler@1.0.0","@403name/electron-buidler@1.0.1","@403name/ether-js@1.0.0","@403name/ether-js@1.0.1","@403name/fsevent@1.0.0","@403name/fsevent@1.0.1","@a2bugfix/orchestrator@0.1.4","@a2bugfix/orchestrator@0.1.5","@a2bugfix/orchestrator@0.1.6","@aerovato/container@3.4.4"],"first_seen":1782957915,"growth_per_day":108,"id":"ttp_detail-edbef9819add2f28","key":"remote_shell_cradle","kind":"ttp_detail","last_seen":1784379081,"max_score":545,"members":1778,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784375335,"detail":{"examples":["@blundergoat/gruff-ts@0.3.0","@blundergoat/gruff-ts@0.3.1","@blundergoat/gruff-ts@0.3.2","@blundergoat/gruff-ts@0.4.0","@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.1.0","@evalguard/core@1.2.0","@evalguard/core@1.3.0","@evalguard/core@1.4.0"],"members":280,"previous_members":279},"event_kind":"expanded_campaign"},{"created_at":1784375298,"detail":{"examples":["@blundergoat/gruff-ts@0.3.0","@blundergoat/gruff-ts@0.3.1","@blundergoat/gruff-ts@0.3.2","@blundergoat/gruff-ts@0.4.0","@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.1.0","@evalguard/core@1.2.0","@evalguard/core@1.3.0","@evalguard/core@1.4.0"],"members":280,"previous_members":279},"event_kind":"expanded_campaign"},{"created_at":1784375288,"detail":{"examples":["@blundergoat/gruff-ts@0.3.0","@blundergoat/gruff-ts@0.3.1","@blundergoat/gruff-ts@0.3.2","@blundergoat/gruff-ts@0.4.0","@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.1.0","@evalguard/core@1.2.0","@evalguard/core@1.3.0","@evalguard/core@1.4.0"],"members":280,"previous_members":279},"event_kind":"expanded_campaign"},{"created_at":1784331630,"detail":{"examples":["@blundergoat/gruff-ts@0.3.0","@blundergoat/gruff-ts@0.3.1","@blundergoat/gruff-ts@0.3.2","@blundergoat/gruff-ts@0.4.0","@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.1.0","@evalguard/core@1.2.0","@evalguard/core@1.3.0","@evalguard/core@1.4.0"],"members":279,"previous_members":278},"event_kind":"expanded_campaign"}],"examples":["@blundergoat/gruff-ts@0.3.0","@blundergoat/gruff-ts@0.3.1","@blundergoat/gruff-ts@0.3.2","@blundergoat/gruff-ts@0.4.0","@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.1.0","@evalguard/core@1.2.0","@evalguard/core@1.3.0","@evalguard/core@1.4.0"],"first_seen":1780135945,"growth_per_day":5,"id":"ttp_detail-6ce80d2020616b60","key":"webhook_exfil_endpoint","kind":"ttp_detail","last_seen":1784379081,"max_score":545,"members":280,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364990,"detail":{"examples":["@adhdev/daemon-core@0.9.82-rc.144","@adhdev/daemon-core@0.9.82-rc.145","@adhdev/daemon-core@0.9.82-rc.146","@adhdev/daemon-core@0.9.82-rc.147","@adhdev/daemon-core@0.9.82-rc.149","@adhdev/daemon-core@0.9.82-rc.151","@adhdev/daemon-core@0.9.82-rc.152","@adhdev/daemon-core@0.9.82-rc.153","@adhdev/daemon-core@0.9.82-rc.154","@adhdev/daemon-core@0.9.82-rc.155"],"members":445,"previous_members":437},"event_kind":"expanded_campaign"},{"created_at":1784364957,"detail":{"examples":["@adhdev/daemon-core@0.9.82-rc.144","@adhdev/daemon-core@0.9.82-rc.145","@adhdev/daemon-core@0.9.82-rc.146","@adhdev/daemon-core@0.9.82-rc.147","@adhdev/daemon-core@0.9.82-rc.149","@adhdev/daemon-core@0.9.82-rc.151","@adhdev/daemon-core@0.9.82-rc.152","@adhdev/daemon-core@0.9.82-rc.153","@adhdev/daemon-core@0.9.82-rc.154","@adhdev/daemon-core@0.9.82-rc.155"],"members":445,"previous_members":437},"event_kind":"expanded_campaign"},{"created_at":1784364919,"detail":{"examples":["@adhdev/daemon-core@0.9.82-rc.144","@adhdev/daemon-core@0.9.82-rc.145","@adhdev/daemon-core@0.9.82-rc.146","@adhdev/daemon-core@0.9.82-rc.147","@adhdev/daemon-core@0.9.82-rc.149","@adhdev/daemon-core@0.9.82-rc.151","@adhdev/daemon-core@0.9.82-rc.152","@adhdev/daemon-core@0.9.82-rc.153","@adhdev/daemon-core@0.9.82-rc.154","@adhdev/daemon-core@0.9.82-rc.155"],"members":445,"previous_members":437},"event_kind":"expanded_campaign"},{"created_at":1784278564,"detail":{"examples":["@adhdev/daemon-core@0.9.82-rc.144","@adhdev/daemon-core@0.9.82-rc.145","@adhdev/daemon-core@0.9.82-rc.146","@adhdev/daemon-core@0.9.82-rc.147","@adhdev/daemon-core@0.9.82-rc.149","@adhdev/daemon-core@0.9.82-rc.151","@adhdev/daemon-core@0.9.82-rc.152","@adhdev/daemon-core@0.9.82-rc.153","@adhdev/daemon-core@0.9.82-rc.154","@adhdev/daemon-core@0.9.82-rc.155"],"members":437,"previous_members":419},"event_kind":"expanded_campaign"}],"examples":["@adhdev/daemon-core@0.9.82-rc.144","@adhdev/daemon-core@0.9.82-rc.145","@adhdev/daemon-core@0.9.82-rc.146","@adhdev/daemon-core@0.9.82-rc.147","@adhdev/daemon-core@0.9.82-rc.149","@adhdev/daemon-core@0.9.82-rc.151","@adhdev/daemon-core@0.9.82-rc.152","@adhdev/daemon-core@0.9.82-rc.153","@adhdev/daemon-core@0.9.82-rc.154","@adhdev/daemon-core@0.9.82-rc.155"],"first_seen":1780154698,"growth_per_day":9,"id":"ttp_detail-11ee0e7e04824b8a","key":"js_decode_then_exec","kind":"ttp_detail","last_seen":1784379081,"max_score":545,"members":445,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784378239,"detail":{"examples":["@authensor/aegis@0.0.1","@authensor/aegis@0.1.0","@cerberus-ai/core@1.2.1","@cerberus-ai/core@1.3.0","@cerberus-ai/core@1.4.0","@cerberus-ai/core@3.0.0","@cerberus-ai/core@3.0.1","@cerberus-ai/core@3.0.2","@cerberus-ai/core@3.1.0","@goplus/agentguard@1.1.14"],"members":190,"previous_members":189},"event_kind":"expanded_campaign"},{"created_at":1784378210,"detail":{"examples":["@authensor/aegis@0.0.1","@authensor/aegis@0.1.0","@cerberus-ai/core@1.2.1","@cerberus-ai/core@1.3.0","@cerberus-ai/core@1.4.0","@cerberus-ai/core@3.0.0","@cerberus-ai/core@3.0.1","@cerberus-ai/core@3.0.2","@cerberus-ai/core@3.1.0","@goplus/agentguard@1.1.14"],"members":190,"previous_members":189},"event_kind":"expanded_campaign"},{"created_at":1784373064,"detail":{"examples":["@authensor/aegis@0.0.1","@authensor/aegis@0.1.0","@cerberus-ai/core@1.2.1","@cerberus-ai/core@1.3.0","@cerberus-ai/core@1.4.0","@cerberus-ai/core@3.0.0","@cerberus-ai/core@3.0.1","@cerberus-ai/core@3.0.2","@cerberus-ai/core@3.1.0","@goplus/agentguard@1.1.14"],"members":189,"previous_members":188},"event_kind":"expanded_campaign"},{"created_at":1784373049,"detail":{"examples":["@authensor/aegis@0.0.1","@authensor/aegis@0.1.0","@cerberus-ai/core@1.2.1","@cerberus-ai/core@1.3.0","@cerberus-ai/core@1.4.0","@cerberus-ai/core@3.0.0","@cerberus-ai/core@3.0.1","@cerberus-ai/core@3.0.2","@cerberus-ai/core@3.1.0","@goplus/agentguard@1.1.14"],"members":189,"previous_members":188},"event_kind":"expanded_campaign"}],"examples":["@authensor/aegis@0.0.1","@authensor/aegis@0.1.0","@cerberus-ai/core@1.2.1","@cerberus-ai/core@1.3.0","@cerberus-ai/core@1.4.0","@cerberus-ai/core@3.0.0","@cerberus-ai/core@3.0.1","@cerberus-ai/core@3.0.2","@cerberus-ai/core@3.1.0","@goplus/agentguard@1.1.14"],"first_seen":1779902943,"growth_per_day":3,"id":"ttp_detail-be39e9fd6d331e7d","key":"dns_or_oast_exfil","kind":"ttp_detail","last_seen":1784379081,"max_score":496,"members":190,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784378239,"detail":{"examples":["airkey-mfa-react@29.1.1","airkey-mfa-react@35.1.1","airkey-mfa-react@36.1.1","ap3-components-ui@9.999.0","bingo-ai@3.2.57","bingo-ai@3.2.58","bingo-ai@3.2.59","bingo-ai@3.2.60","bingo-ai@3.2.61","bingo-ai@3.2.62"],"members":243,"previous_members":242},"event_kind":"expanded_campaign"},{"created_at":1784378210,"detail":{"examples":["airkey-mfa-react@29.1.1","airkey-mfa-react@35.1.1","airkey-mfa-react@36.1.1","ap3-components-ui@9.999.0","bingo-ai@3.2.57","bingo-ai@3.2.58","bingo-ai@3.2.59","bingo-ai@3.2.60","bingo-ai@3.2.61","bingo-ai@3.2.62"],"members":243,"previous_members":242},"event_kind":"expanded_campaign"},{"created_at":1784373064,"detail":{"examples":["airkey-mfa-react@29.1.1","airkey-mfa-react@35.1.1","airkey-mfa-react@36.1.1","ap3-components-ui@9.999.0","bingo-ai@3.2.57","bingo-ai@3.2.58","bingo-ai@3.2.59","bingo-ai@3.2.60","bingo-ai@3.2.61","bingo-ai@3.2.62"],"members":242,"previous_members":241},"event_kind":"expanded_campaign"},{"created_at":1784373049,"detail":{"examples":["airkey-mfa-react@29.1.1","airkey-mfa-react@35.1.1","airkey-mfa-react@36.1.1","ap3-components-ui@9.999.0","bingo-ai@3.2.57","bingo-ai@3.2.58","bingo-ai@3.2.59","bingo-ai@3.2.60","bingo-ai@3.2.61","bingo-ai@3.2.62"],"members":242,"previous_members":241},"event_kind":"expanded_campaign"}],"examples":["airkey-mfa-react@29.1.1","airkey-mfa-react@35.1.1","airkey-mfa-react@36.1.1","ap3-components-ui@9.999.0","bingo-ai@3.2.57","bingo-ai@3.2.58","bingo-ai@3.2.59","bingo-ai@3.2.60","bingo-ai@3.2.61","bingo-ai@3.2.62"],"first_seen":1783595062,"growth_per_day":26,"id":"ttp_detail-bfcff7661f9c1982","key":"dns_or_oast_exfil","kind":"ttp_detail","last_seen":1784379081,"max_score":496,"members":243,"status":"active"},{"confidence_score":84,"events":[{"created_at":1784378404,"detail":{"examples":["@4o3f/lapis@0.2.0","@851-labs/tokenmaxxing@0.4.18-alpha.4","@851-labs/tokenmaxxing@0.4.20","@888aaen/jira-cli-win32-x64@1.3.4","@888aaen/jira-cli-win32-x64@1.4.0","@abacus-ai/cli@2.5.3-canary.0","@across-protocol/sdk@4.4.0-alpha.1","@adamlangepl/tc-proxy@1.0.3","@adbayb/stack@2.39.0-next-00b7c69","@adbayb/stack@2.40.0"],"members":6007,"previous_members":6006},"event_kind":"expanded_campaign"},{"created_at":1784378366,"detail":{"examples":["@4o3f/lapis@0.2.0","@851-labs/tokenmaxxing@0.4.18-alpha.4","@851-labs/tokenmaxxing@0.4.20","@888aaen/jira-cli-win32-x64@1.3.4","@888aaen/jira-cli-win32-x64@1.4.0","@abacus-ai/cli@2.5.3-canary.0","@across-protocol/sdk@4.4.0-alpha.1","@adamlangepl/tc-proxy@1.0.3","@adbayb/stack@2.39.0-next-00b7c69","@adbayb/stack@2.40.0"],"members":6007,"previous_members":6006},"event_kind":"expanded_campaign"},{"created_at":1784377314,"detail":{"examples":["@4o3f/lapis@0.2.0","@851-labs/tokenmaxxing@0.4.18-alpha.4","@851-labs/tokenmaxxing@0.4.20","@888aaen/jira-cli-win32-x64@1.3.4","@888aaen/jira-cli-win32-x64@1.4.0","@abacus-ai/cli@2.5.3-canary.0","@across-protocol/sdk@4.4.0-alpha.1","@adamlangepl/tc-proxy@1.0.3","@adbayb/stack@2.39.0-next-00b7c69","@adbayb/stack@2.40.0"],"members":6006,"previous_members":6005},"event_kind":"expanded_campaign"},{"created_at":1784377313,"detail":{"examples":["@4o3f/lapis@0.2.0","@851-labs/tokenmaxxing@0.4.18-alpha.4","@851-labs/tokenmaxxing@0.4.20","@888aaen/jira-cli-win32-x64@1.3.4","@888aaen/jira-cli-win32-x64@1.4.0","@abacus-ai/cli@2.5.3-canary.0","@across-protocol/sdk@4.4.0-alpha.1","@adamlangepl/tc-proxy@1.0.3","@adbayb/stack@2.39.0-next-00b7c69","@adbayb/stack@2.40.0"],"members":6006,"previous_members":6005},"event_kind":"expanded_campaign"}],"examples":["@4o3f/lapis@0.2.0","@851-labs/tokenmaxxing@0.4.18-alpha.4","@851-labs/tokenmaxxing@0.4.20","@888aaen/jira-cli-win32-x64@1.3.4","@888aaen/jira-cli-win32-x64@1.4.0","@abacus-ai/cli@2.5.3-canary.0","@across-protocol/sdk@4.4.0-alpha.1","@adamlangepl/tc-proxy@1.0.3","@adbayb/stack@2.39.0-next-00b7c69","@adbayb/stack@2.40.0"],"first_seen":1779598734,"growth_per_day":108,"id":"publisher_high_risk-e55796297e55523b","key":"GitHub Actions","kind":"publisher_high_risk","last_seen":1784379081,"max_score":452,"members":6007,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784377256,"detail":{"examples":["@amazon-sp-api-release/sp-api-dev-mcp@1.0.1","@amazon-sp-api-release/sp-api-dev-mcp@1.0.2","@amazon-sp-api-release/sp-api-dev-mcp@1.0.3","@amazon-sp-api-release/sp-api-dev-mcp@1.0.4","@beamnetwork/eco-prime-trust-api@1.0.17","@beamnetwork/eco-prime-trust-api@1.0.18","@beamnetwork/eco-prime-trust-api@1.0.19","@beamnetwork/eco-prime-trust-api@1.0.20","@fiale-plus/pi-rogue@0.3.19","@fiale-plus/pi-rogue@0.3.20"],"members":1210,"previous_members":1209},"event_kind":"expanded_campaign"},{"created_at":1784377207,"detail":{"examples":["@amazon-sp-api-release/sp-api-dev-mcp@1.0.1","@amazon-sp-api-release/sp-api-dev-mcp@1.0.2","@amazon-sp-api-release/sp-api-dev-mcp@1.0.3","@amazon-sp-api-release/sp-api-dev-mcp@1.0.4","@beamnetwork/eco-prime-trust-api@1.0.17","@beamnetwork/eco-prime-trust-api@1.0.18","@beamnetwork/eco-prime-trust-api@1.0.19","@beamnetwork/eco-prime-trust-api@1.0.20","@fiale-plus/pi-rogue@0.3.19","@fiale-plus/pi-rogue@0.3.20"],"members":1210,"previous_members":1209},"event_kind":"expanded_campaign"},{"created_at":1784376483,"detail":{"examples":["@amazon-sp-api-release/sp-api-dev-mcp@1.0.1","@amazon-sp-api-release/sp-api-dev-mcp@1.0.2","@amazon-sp-api-release/sp-api-dev-mcp@1.0.3","@amazon-sp-api-release/sp-api-dev-mcp@1.0.4","@beamnetwork/eco-prime-trust-api@1.0.17","@beamnetwork/eco-prime-trust-api@1.0.18","@beamnetwork/eco-prime-trust-api@1.0.19","@beamnetwork/eco-prime-trust-api@1.0.20","@fiale-plus/pi-rogue@0.3.19","@fiale-plus/pi-rogue@0.3.20"],"members":1209,"previous_members":1208},"event_kind":"expanded_campaign"},{"created_at":1784376469,"detail":{"examples":["@amazon-sp-api-release/sp-api-dev-mcp@1.0.1","@amazon-sp-api-release/sp-api-dev-mcp@1.0.2","@amazon-sp-api-release/sp-api-dev-mcp@1.0.3","@amazon-sp-api-release/sp-api-dev-mcp@1.0.4","@beamnetwork/eco-prime-trust-api@1.0.17","@beamnetwork/eco-prime-trust-api@1.0.18","@beamnetwork/eco-prime-trust-api@1.0.19","@beamnetwork/eco-prime-trust-api@1.0.20","@fiale-plus/pi-rogue@0.3.19","@fiale-plus/pi-rogue@0.3.20"],"members":1209,"previous_members":1208},"event_kind":"expanded_campaign"}],"examples":["@amazon-sp-api-release/sp-api-dev-mcp@1.0.1","@amazon-sp-api-release/sp-api-dev-mcp@1.0.2","@amazon-sp-api-release/sp-api-dev-mcp@1.0.3","@amazon-sp-api-release/sp-api-dev-mcp@1.0.4","@beamnetwork/eco-prime-trust-api@1.0.17","@beamnetwork/eco-prime-trust-api@1.0.18","@beamnetwork/eco-prime-trust-api@1.0.19","@beamnetwork/eco-prime-trust-api@1.0.20","@fiale-plus/pi-rogue@0.3.19","@fiale-plus/pi-rogue@0.3.20"],"first_seen":1782317466,"growth_per_day":50,"id":"ttp_detail-705d5a6b531706a6","key":"shipped_live_secret","kind":"ttp_detail","last_seen":1784379081,"max_score":424,"members":1210,"status":"active"},{"confidence_score":84,"events":[{"created_at":1783846556,"detail":{"examples":["@mneme-ai/core@2.43.0","@mneme-ai/core@2.44.0","@mneme-ai/core@2.45.0","@mneme-ai/core@2.48.0","@mneme-ai/core@2.49.0","@mneme-ai/core@2.50.0","@mneme-ai/core@3.10.0","@mneme-ai/core@3.100.0","@mneme-ai/core@3.101.0","@mneme-ai/core@3.103.0"],"members":159,"previous_members":148},"event_kind":"expanded_campaign"},{"created_at":1783846490,"detail":{"examples":["@mneme-ai/core@2.43.0","@mneme-ai/core@2.44.0","@mneme-ai/core@2.45.0","@mneme-ai/core@2.48.0","@mneme-ai/core@2.49.0","@mneme-ai/core@2.50.0","@mneme-ai/core@3.10.0","@mneme-ai/core@3.100.0","@mneme-ai/core@3.101.0","@mneme-ai/core@3.103.0"],"members":159,"previous_members":148},"event_kind":"expanded_campaign"},{"created_at":1783759986,"detail":{"examples":["@mneme-ai/core@2.43.0","@mneme-ai/core@2.44.0","@mneme-ai/core@2.45.0","@mneme-ai/core@2.48.0","@mneme-ai/core@2.49.0","@mneme-ai/core@2.50.0","@mneme-ai/core@3.10.0","@mneme-ai/core@3.103.0","@mneme-ai/core@3.104.0","@mneme-ai/core@3.105.0"],"members":148,"previous_members":139},"event_kind":"expanded_campaign"},{"created_at":1783759898,"detail":{"examples":["@mneme-ai/core@2.43.0","@mneme-ai/core@2.44.0","@mneme-ai/core@2.45.0","@mneme-ai/core@2.48.0","@mneme-ai/core@2.49.0","@mneme-ai/core@2.50.0","@mneme-ai/core@3.10.0","@mneme-ai/core@3.103.0","@mneme-ai/core@3.104.0","@mneme-ai/core@3.105.0"],"members":148,"previous_members":139},"event_kind":"expanded_campaign"}],"examples":["@mneme-ai/core@2.43.0","@mneme-ai/core@2.44.0","@mneme-ai/core@2.45.0","@mneme-ai/core@2.48.0","@mneme-ai/core@2.49.0","@mneme-ai/core@2.50.0","@mneme-ai/core@3.10.0","@mneme-ai/core@3.100.0","@mneme-ai/core@3.101.0","@mneme-ai/core@3.103.0"],"first_seen":1779672974,"growth_per_day":2,"id":"publisher_high_risk-0db57b5a954e8dcf","key":"mneme_npm","kind":"publisher_high_risk","last_seen":1784379081,"max_score":372,"members":159,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364806,"detail":{"examples":["@agengine/runtime@1.0.8","@allons-y/agent-skills@0.0.0","@checkstack/logstream-backend@0.1.0","@checkstack/logstream-backend@0.2.0","@checkstack/logstream-backend@0.3.0","@checkstack/logstream-backend@0.4.0","@dev-aemni/ezpi@1.0.1","@dev-aemni/ezpi@1.0.2","@digital-ai/devops-page-object-release@0.0.0-snapshot-20260626093854","@dotss/ui@0.0.6"],"members":873,"previous_members":872},"event_kind":"expanded_campaign"},{"created_at":1784364780,"detail":{"examples":["@agengine/runtime@1.0.8","@allons-y/agent-skills@0.0.0","@checkstack/logstream-backend@0.1.0","@checkstack/logstream-backend@0.2.0","@checkstack/logstream-backend@0.3.0","@checkstack/logstream-backend@0.4.0","@dev-aemni/ezpi@1.0.1","@dev-aemni/ezpi@1.0.2","@digital-ai/devops-page-object-release@0.0.0-snapshot-20260626093854","@dotss/ui@0.0.6"],"members":873,"previous_members":872},"event_kind":"expanded_campaign"},{"created_at":1784364544,"detail":{"examples":["@agengine/runtime@1.0.8","@allons-y/agent-skills@0.0.0","@checkstack/logstream-backend@0.1.0","@checkstack/logstream-backend@0.2.0","@checkstack/logstream-backend@0.3.0","@checkstack/logstream-backend@0.4.0","@dev-aemni/ezpi@1.0.1","@dev-aemni/ezpi@1.0.2","@digital-ai/devops-page-object-release@0.0.0-snapshot-20260626093854","@dotss/ui@0.0.6"],"members":872,"previous_members":871},"event_kind":"expanded_campaign"},{"created_at":1784364523,"detail":{"examples":["@agengine/runtime@1.0.8","@allons-y/agent-skills@0.0.0","@checkstack/logstream-backend@0.1.0","@checkstack/logstream-backend@0.2.0","@checkstack/logstream-backend@0.3.0","@checkstack/logstream-backend@0.4.0","@dev-aemni/ezpi@1.0.1","@dev-aemni/ezpi@1.0.2","@digital-ai/devops-page-object-release@0.0.0-snapshot-20260626093854","@dotss/ui@0.0.6"],"members":872,"previous_members":871},"event_kind":"expanded_campaign"}],"examples":["@agengine/runtime@1.0.8","@allons-y/agent-skills@0.0.0","@checkstack/logstream-backend@0.1.0","@checkstack/logstream-backend@0.2.0","@checkstack/logstream-backend@0.3.0","@checkstack/logstream-backend@0.4.0","@dev-aemni/ezpi@1.0.1","@dev-aemni/ezpi@1.0.2","@digital-ai/devops-page-object-release@0.0.0-snapshot-20260626093854","@dotss/ui@0.0.6"],"first_seen":1782317466,"growth_per_day":36,"id":"ttp_detail-48ebe6096f95264e","key":"shipped_live_secret","kind":"ttp_detail","last_seen":1784379081,"max_score":372,"members":873,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364976,"detail":{"examples":["cache-compat-utils@0.1.0","codex-lb-cinamon@1.19.0","coeus-agent@0.16.1","faker@40.22.0","helixagentai@0.1.11","holix@0.1.36","nwave-ai@3.16.0","pytensorkittt@0.1.0","semgrep@1.166.0","yt-dlp@2026.6.9"],"max_score":411,"previous_score":349},"event_kind":"score_increased"},{"created_at":1784364943,"detail":{"examples":["cache-compat-utils@0.1.0","codex-lb-cinamon@1.19.0","coeus-agent@0.16.1","faker@40.22.0","helixagentai@0.1.11","holix@0.1.36","nwave-ai@3.16.0","pytensorkittt@0.1.0","semgrep@1.166.0","yt-dlp@2026.6.9"],"max_score":411,"previous_score":349},"event_kind":"score_increased"},{"created_at":1783673547,"detail":{"examples":["cache-compat-utils@0.1.0","codex-lb-cinamon@1.19.0","coeus-agent@0.16.1","faker@40.22.0","helixagentai@0.1.11","holix@0.1.36","nwave-ai@3.16.0","pytensorkittt@0.1.0","semgrep@1.166.0","yt-dlp@2026.6.9"],"key":"python_bun_js_exec:python file references the bun javascript runtime — cross-language execution","kind":"ttp_detail","max_score":411,"members":11},"event_kind":"reactivated_campaign"},{"created_at":1783673498,"detail":{"min_size":2,"reason":"cluster no longer meets campaign threshold"},"event_kind":"stale_campaign"}],"examples":["cache-compat-utils@0.1.0","codex-lb-cinamon@1.19.0","coeus-agent@0.16.1","faker@40.22.0","helixagentai@0.1.11","holix@0.1.36","nwave-ai@3.16.0","pytensorkittt@0.1.0","semgrep@1.166.0","yt-dlp@2026.6.9"],"first_seen":1781001719,"growth_per_day":1,"id":"ttp_detail-aae6dd2c27ee6822","key":"python_bun_js_exec","kind":"ttp_detail","last_seen":1784379081,"max_score":349,"members":11,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364990,"detail":{"examples":["abseil-py@0.1.0","adcc@0.17.1","adcc@0.18.0","anthropickit@999.9.9","aop-launcher@1.0.0","aorta-sirius-dev@0.273","aorta-sirius-dev@0.274","aorta-sirius-dev@0.275","aorta-sirius-dev@0.276","aorta-sirius-dev@0.277"],"members":139,"previous_members":138},"event_kind":"expanded_campaign"},{"created_at":1784364975,"detail":{"examples":["abseil-py@0.1.0","adcc@0.17.1","adcc@0.18.0","anthropickit@999.9.9","aop-launcher@1.0.0","aorta-sirius-dev@0.273","aorta-sirius-dev@0.274","aorta-sirius-dev@0.275","aorta-sirius-dev@0.276","aorta-sirius-dev@0.277"],"max_score":411,"previous_score":349},"event_kind":"score_increased"},{"created_at":1784364957,"detail":{"examples":["abseil-py@0.1.0","adcc@0.17.1","adcc@0.18.0","anthropickit@999.9.9","aop-launcher@1.0.0","aorta-sirius-dev@0.273","aorta-sirius-dev@0.274","aorta-sirius-dev@0.275","aorta-sirius-dev@0.276","aorta-sirius-dev@0.277"],"members":139,"previous_members":138},"event_kind":"expanded_campaign"},{"created_at":1784364942,"detail":{"examples":["abseil-py@0.1.0","adcc@0.17.1","adcc@0.18.0","anthropickit@999.9.9","aop-launcher@1.0.0","aorta-sirius-dev@0.273","aorta-sirius-dev@0.274","aorta-sirius-dev@0.275","aorta-sirius-dev@0.276","aorta-sirius-dev@0.277"],"max_score":411,"previous_score":349},"event_kind":"score_increased"}],"examples":["abseil-py@0.1.0","adcc@0.17.1","adcc@0.18.0","anthropickit@999.9.9","aop-launcher@1.0.0","aorta-sirius-dev@0.273","aorta-sirius-dev@0.274","aorta-sirius-dev@0.275","aorta-sirius-dev@0.276","aorta-sirius-dev@0.277"],"first_seen":1780135945,"growth_per_day":2,"id":"ttp_detail-14b5a0bda4820a67","key":"py_install_time_network_call","kind":"ttp_detail","last_seen":1784379081,"max_score":349,"members":139,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364990,"detail":{"examples":["abraia@0.27.0","abraia@0.27.1","affx@1.0.0","affx@1.1","aperturedb@0.4.60","bfit@4.22.5","bioregistry@0.13.59","bioregistry@0.13.60","bioregistry@0.13.61","bioregistry@0.13.62"],"members":166,"previous_members":156},"event_kind":"expanded_campaign"},{"created_at":1784364975,"detail":{"examples":["abraia@0.27.0","abraia@0.27.1","affx@1.0.0","affx@1.1","aperturedb@0.4.60","bfit@4.22.5","bioregistry@0.13.59","bioregistry@0.13.60","bioregistry@0.13.61","bioregistry@0.13.62"],"max_score":411,"previous_score":349},"event_kind":"score_increased"},{"created_at":1784364957,"detail":{"examples":["abraia@0.27.0","abraia@0.27.1","affx@1.0.0","affx@1.1","aperturedb@0.4.60","bfit@4.22.5","bioregistry@0.13.59","bioregistry@0.13.60","bioregistry@0.13.61","bioregistry@0.13.62"],"members":166,"previous_members":156},"event_kind":"expanded_campaign"},{"created_at":1784364942,"detail":{"examples":["abraia@0.27.0","abraia@0.27.1","affx@1.0.0","affx@1.1","aperturedb@0.4.60","bfit@4.22.5","bioregistry@0.13.59","bioregistry@0.13.60","bioregistry@0.13.61","bioregistry@0.13.62"],"max_score":411,"previous_score":349},"event_kind":"score_increased"}],"examples":["abraia@0.27.0","abraia@0.27.1","affx@1.0.0","affx@1.1","aperturedb@0.4.60","bfit@4.22.5","bioregistry@0.13.59","bioregistry@0.13.60","bioregistry@0.13.61","bioregistry@0.13.62"],"first_seen":1779859380,"growth_per_day":3,"id":"ttp_detail-44d777e449bbf08a","key":"py_import_time_network_call","kind":"ttp_detail","last_seen":1784379081,"max_score":349,"members":166,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364990,"detail":{"examples":["agilab@2026.5.29","agilab@2026.5.30","agilab@2026.5.30.post1","agilab@2026.5.31","agilab@2026.5.31.post1","agilab@2026.6.1","agilab@2026.6.12","agilab@2026.6.13","agilab@2026.6.13.1","agilab@2026.6.14.1"],"members":220,"previous_members":210},"event_kind":"expanded_campaign"},{"created_at":1784364975,"detail":{"examples":["agilab@2026.5.29","agilab@2026.5.30","agilab@2026.5.30.post1","agilab@2026.5.31","agilab@2026.5.31.post1","agilab@2026.6.1","agilab@2026.6.12","agilab@2026.6.13","agilab@2026.6.13.1","agilab@2026.6.14.1"],"max_score":411,"previous_score":349},"event_kind":"score_increased"},{"created_at":1784364957,"detail":{"examples":["agilab@2026.5.29","agilab@2026.5.30","agilab@2026.5.30.post1","agilab@2026.5.31","agilab@2026.5.31.post1","agilab@2026.6.1","agilab@2026.6.12","agilab@2026.6.13","agilab@2026.6.13.1","agilab@2026.6.14.1"],"members":220,"previous_members":210},"event_kind":"expanded_campaign"},{"created_at":1784364942,"detail":{"examples":["agilab@2026.5.29","agilab@2026.5.30","agilab@2026.5.30.post1","agilab@2026.5.31","agilab@2026.5.31.post1","agilab@2026.6.1","agilab@2026.6.12","agilab@2026.6.13","agilab@2026.6.13.1","agilab@2026.6.14.1"],"max_score":411,"previous_score":349},"event_kind":"score_increased"}],"examples":["agilab@2026.5.29","agilab@2026.5.30","agilab@2026.5.30.post1","agilab@2026.5.31","agilab@2026.5.31.post1","agilab@2026.6.1","agilab@2026.6.12","agilab@2026.6.13","agilab@2026.6.13.1","agilab@2026.6.14.1"],"first_seen":1779812145,"growth_per_day":4,"id":"ttp_detail-e8894c2fd12542dd","key":"py_runtime_base64_decode","kind":"ttp_detail","last_seen":1784379081,"max_score":349,"members":220,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364990,"detail":{"examples":["@2qp/linguist@0.0.1","@2qp/linguist@0.0.2","@agent-vm/agent-vm@0.0.80","@aperant/framework@0.8.4","@aperant/framework@0.8.6","@aperant/framework@0.8.7","@async/pipeline@0.4.1","@async/pipeline@0.4.2","@async/pipeline@0.4.3","@async/pipeline@0.4.4"],"members":372,"previous_members":368},"event_kind":"expanded_campaign"},{"created_at":1784364975,"detail":{"examples":["@2qp/linguist@0.0.1","@2qp/linguist@0.0.2","@agent-vm/agent-vm@0.0.80","@aperant/framework@0.8.4","@aperant/framework@0.8.6","@aperant/framework@0.8.7","@async/pipeline@0.4.1","@async/pipeline@0.4.2","@async/pipeline@0.4.3","@async/pipeline@0.4.4"],"max_score":411,"previous_score":349},"event_kind":"score_increased"},{"created_at":1784364957,"detail":{"examples":["@2qp/linguist@0.0.1","@2qp/linguist@0.0.2","@agent-vm/agent-vm@0.0.80","@aperant/framework@0.8.4","@aperant/framework@0.8.6","@aperant/framework@0.8.7","@async/pipeline@0.4.1","@async/pipeline@0.4.2","@async/pipeline@0.4.3","@async/pipeline@0.4.4"],"members":372,"previous_members":368},"event_kind":"expanded_campaign"},{"created_at":1784364942,"detail":{"examples":["@2qp/linguist@0.0.1","@2qp/linguist@0.0.2","@agent-vm/agent-vm@0.0.80","@aperant/framework@0.8.4","@aperant/framework@0.8.6","@aperant/framework@0.8.7","@async/pipeline@0.4.1","@async/pipeline@0.4.2","@async/pipeline@0.4.3","@async/pipeline@0.4.4"],"max_score":411,"previous_score":349},"event_kind":"score_increased"}],"examples":["@2qp/linguist@0.0.1","@2qp/linguist@0.0.2","@agent-vm/agent-vm@0.0.80","@aperant/framework@0.8.4","@aperant/framework@0.8.6","@aperant/framework@0.8.7","@async/pipeline@0.4.1","@async/pipeline@0.4.2","@async/pipeline@0.4.3","@async/pipeline@0.4.4"],"first_seen":1779598734,"growth_per_day":6,"id":"ttp_detail-c35541b814455d2e","key":"credential_paths","kind":"ttp_detail","last_seen":1784379081,"max_score":349,"members":372,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784355994,"detail":{"examples":["@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@0dai-dev/cli@4.3.6","@a5c-ai/babysitter-opencode@0.1.4","@ably/cli@1.2.0","@ably/cli@1.2.1","@actalk/inkos@1.6.1-canary.49.1","@adkit/cli@1.12.16","@adkit/cli@1.12.17","@adkit/cli@1.12.18"],"members":3843,"previous_members":3842},"event_kind":"expanded_campaign"},{"created_at":1784355973,"detail":{"examples":["@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@0dai-dev/cli@4.3.6","@a5c-ai/babysitter-opencode@0.1.4","@ably/cli@1.2.0","@ably/cli@1.2.1","@actalk/inkos@1.6.1-canary.49.1","@adkit/cli@1.12.16","@adkit/cli@1.12.17","@adkit/cli@1.12.18"],"members":3843,"previous_members":3842},"event_kind":"expanded_campaign"},{"created_at":1784355911,"detail":{"examples":["@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@0dai-dev/cli@4.3.6","@a5c-ai/babysitter-opencode@0.1.4","@ably/cli@1.2.0","@ably/cli@1.2.1","@actalk/inkos@1.6.1-canary.49.1","@adkit/cli@1.12.16","@adkit/cli@1.12.17","@adkit/cli@1.12.18"],"members":3843,"previous_members":3842},"event_kind":"expanded_campaign"},{"created_at":1784352357,"detail":{"examples":["@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@0dai-dev/cli@4.3.6","@a5c-ai/babysitter-opencode@0.1.4","@ably/cli@1.2.0","@ably/cli@1.2.1","@actalk/inkos@1.6.1-canary.49.1","@adkit/cli@1.12.16","@adkit/cli@1.12.17","@adkit/cli@1.12.18"],"members":3842,"previous_members":3841},"event_kind":"expanded_campaign"}],"examples":["@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@0dai-dev/cli@4.3.6","@a5c-ai/babysitter-opencode@0.1.4","@ably/cli@1.2.0","@ably/cli@1.2.1","@actalk/inkos@1.6.1-canary.49.1","@adkit/cli@1.12.16","@adkit/cli@1.12.17","@adkit/cli@1.12.18"],"first_seen":1782317466,"growth_per_day":161,"id":"ttp_detail-e0df8beba7429c82","key":"js_remote_npm_install","kind":"ttp_detail","last_seen":1784379081,"max_score":346,"members":3843,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784378489,"detail":{"examples":["000router@0.5.20","000router@0.5.21","2capsule@1.1.1","9remote@2.0.58","9remote@2.0.59","9remote@2.0.60","9remote@2.0.65","9remote@2.0.66","9remote@2.0.67","9remote@2.0.68"],"members":5226,"previous_members":5225},"event_kind":"expanded_campaign"},{"created_at":1784378465,"detail":{"examples":["000router@0.5.20","000router@0.5.21","2capsule@1.1.1","9remote@2.0.58","9remote@2.0.59","9remote@2.0.60","9remote@2.0.65","9remote@2.0.66","9remote@2.0.67","9remote@2.0.68"],"members":5226,"previous_members":5225},"event_kind":"expanded_campaign"},{"created_at":1784378404,"detail":{"examples":["000router@0.5.20","000router@0.5.21","2capsule@1.1.1","9remote@2.0.58","9remote@2.0.59","9remote@2.0.60","9remote@2.0.65","9remote@2.0.66","9remote@2.0.67","9remote@2.0.68"],"members":5226,"previous_members":5224},"event_kind":"expanded_campaign"},{"created_at":1784378366,"detail":{"examples":["000router@0.5.20","000router@0.5.21","2capsule@1.1.1","9remote@2.0.58","9remote@2.0.59","9remote@2.0.60","9remote@2.0.65","9remote@2.0.66","9remote@2.0.67","9remote@2.0.68"],"members":5225,"previous_members":5224},"event_kind":"expanded_campaign"}],"examples":["000router@0.5.20","000router@0.5.21","2capsule@1.1.1","9remote@2.0.58","9remote@2.0.59","9remote@2.0.60","9remote@2.0.65","9remote@2.0.66","9remote@2.0.67","9remote@2.0.68"],"first_seen":1780135945,"growth_per_day":106,"id":"ttp_detail-b3401e535bf2cb3a","key":"js_hidden_powershell","kind":"ttp_detail","last_seen":1784379081,"max_score":346,"members":5226,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784372359,"detail":{"examples":["@agent-earth/wiki@0.0.1","@agent-earth/wiki@0.0.2","@agent-earth/wiki@0.0.4","@aiyiran/myclaw@1.1.139","@aiyiran/myclaw@1.1.140","@aiyiran/myclaw@1.1.141","@aiyiran/myclaw@1.1.142","@aiyiran/myclaw@1.1.143","@aiyiran/myclaw@1.1.144","@aiyiran/myclaw@1.1.145"],"members":390,"previous_members":389},"event_kind":"expanded_campaign"},{"created_at":1784372328,"detail":{"examples":["@agent-earth/wiki@0.0.1","@agent-earth/wiki@0.0.2","@agent-earth/wiki@0.0.4","@aiyiran/myclaw@1.1.139","@aiyiran/myclaw@1.1.140","@aiyiran/myclaw@1.1.141","@aiyiran/myclaw@1.1.142","@aiyiran/myclaw@1.1.143","@aiyiran/myclaw@1.1.144","@aiyiran/myclaw@1.1.145"],"members":390,"previous_members":389},"event_kind":"expanded_campaign"},{"created_at":1784372314,"detail":{"examples":["@agent-earth/wiki@0.0.1","@agent-earth/wiki@0.0.2","@agent-earth/wiki@0.0.4","@aiyiran/myclaw@1.1.139","@aiyiran/myclaw@1.1.140","@aiyiran/myclaw@1.1.141","@aiyiran/myclaw@1.1.142","@aiyiran/myclaw@1.1.143","@aiyiran/myclaw@1.1.144","@aiyiran/myclaw@1.1.145"],"members":390,"previous_members":389},"event_kind":"expanded_campaign"},{"created_at":1784372298,"detail":{"examples":["@agent-earth/wiki@0.0.1","@agent-earth/wiki@0.0.2","@agent-earth/wiki@0.0.4","@aiyiran/myclaw@1.1.139","@aiyiran/myclaw@1.1.140","@aiyiran/myclaw@1.1.141","@aiyiran/myclaw@1.1.142","@aiyiran/myclaw@1.1.143","@aiyiran/myclaw@1.1.144","@aiyiran/myclaw@1.1.145"],"members":390,"previous_members":389},"event_kind":"expanded_campaign"}],"examples":["@agent-earth/wiki@0.0.1","@agent-earth/wiki@0.0.2","@agent-earth/wiki@0.0.4","@aiyiran/myclaw@1.1.139","@aiyiran/myclaw@1.1.140","@aiyiran/myclaw@1.1.141","@aiyiran/myclaw@1.1.142","@aiyiran/myclaw@1.1.143","@aiyiran/myclaw@1.1.144","@aiyiran/myclaw@1.1.145"],"first_seen":1782317466,"growth_per_day":16,"id":"ttp_detail-fc531580f26b9073","key":"shipped_live_secret","kind":"ttp_detail","last_seen":1784379081,"max_score":343,"members":390,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784371374,"detail":{"examples":["@1agh/maude@0.40.0","@1agh/maude@0.41.0","@1agh/maude@0.42.0","@1agh/maude@0.43.0","@1agh/maude@0.44.0","@1agh/maude@0.45.0","@1agh/maude@0.45.1","@1agh/maude@0.45.2","@1agh/maude@0.46.0","@aaroncql/pim-agent@0.0.1"],"members":1195,"previous_members":1194},"event_kind":"expanded_campaign"},{"created_at":1784371352,"detail":{"examples":["@1agh/maude@0.40.0","@1agh/maude@0.41.0","@1agh/maude@0.42.0","@1agh/maude@0.43.0","@1agh/maude@0.44.0","@1agh/maude@0.45.0","@1agh/maude@0.45.1","@1agh/maude@0.45.2","@1agh/maude@0.46.0","@aaroncql/pim-agent@0.0.1"],"members":1195,"previous_members":1194},"event_kind":"expanded_campaign"},{"created_at":1784371346,"detail":{"examples":["@1agh/maude@0.40.0","@1agh/maude@0.41.0","@1agh/maude@0.42.0","@1agh/maude@0.43.0","@1agh/maude@0.44.0","@1agh/maude@0.45.0","@1agh/maude@0.45.1","@1agh/maude@0.45.2","@1agh/maude@0.46.0","@aaroncql/pim-agent@0.0.1"],"members":1195,"previous_members":1194},"event_kind":"expanded_campaign"},{"created_at":1784371317,"detail":{"examples":["@1agh/maude@0.40.0","@1agh/maude@0.41.0","@1agh/maude@0.42.0","@1agh/maude@0.43.0","@1agh/maude@0.44.0","@1agh/maude@0.45.0","@1agh/maude@0.45.1","@1agh/maude@0.45.2","@1agh/maude@0.46.0","@aaroncql/pim-agent@0.0.1"],"members":1195,"previous_members":1194},"event_kind":"expanded_campaign"}],"examples":["@1agh/maude@0.40.0","@1agh/maude@0.41.0","@1agh/maude@0.42.0","@1agh/maude@0.43.0","@1agh/maude@0.44.0","@1agh/maude@0.45.0","@1agh/maude@0.45.1","@1agh/maude@0.45.2","@1agh/maude@0.46.0","@aaroncql/pim-agent@0.0.1"],"first_seen":1779955840,"growth_per_day":23,"id":"ttp_detail-d401c2cec85cb892","key":"js_split_join_obfuscation","kind":"ttp_detail","last_seen":1784379081,"max_score":311,"members":1195,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784353091,"detail":{"examples":["carousel-controller-mixin@999.0.0","eveee@1.0.0","eveee@1.0.1","eveee@1.0.7","eyee@1.0.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.1","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.2","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.3","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.4"],"members":130,"previous_members":129},"event_kind":"expanded_campaign"},{"created_at":1784353044,"detail":{"examples":["carousel-controller-mixin@999.0.0","eveee@1.0.0","eveee@1.0.1","eveee@1.0.7","eyee@1.0.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.1","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.2","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.3","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.4"],"members":130,"previous_members":129},"event_kind":"expanded_campaign"},{"created_at":1784280478,"detail":{"examples":["carousel-controller-mixin@999.0.0","eveee@1.0.0","eveee@1.0.1","eveee@1.0.7","eyee@1.0.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.1","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.2","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.3","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.4"],"members":129,"previous_members":128},"event_kind":"expanded_campaign"},{"created_at":1784280449,"detail":{"examples":["carousel-controller-mixin@999.0.0","eveee@1.0.0","eveee@1.0.1","eveee@1.0.7","eyee@1.0.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.1","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.2","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.3","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.4"],"members":129,"previous_members":128},"event_kind":"expanded_campaign"}],"examples":["carousel-controller-mixin@999.0.0","eveee@1.0.0","eveee@1.0.1","eveee@1.0.7","eyee@1.0.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.1","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.2","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.3","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.4"],"first_seen":1781137870,"growth_per_day":3,"id":"ttp_detail-e3c763dc5d91b570","key":"webhook_exfil_endpoint","kind":"ttp_detail","last_seen":1784379081,"max_score":311,"members":130,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784370760,"detail":{"examples":["@babylonjs/mcp-servers@9.16.2","@babylonjs/mcp-servers@9.17.0","@duckdb/duckdb-wasm@1.33.1-dev57.0","@duckdb/duckdb-wasm@1.33.1-dev58.0","@lavamoat/lavapack@8.0.2","@lavamoat/lavapack@8.0.5","@link-assistant/hive-mind@1.72.6","@link-assistant/hive-mind@1.73.1","@link-assistant/hive-mind@1.73.2","@link-assistant/hive-mind@1.73.3"],"members":357,"previous_members":356},"event_kind":"expanded_campaign"},{"created_at":1784370738,"detail":{"examples":["@babylonjs/mcp-servers@9.16.2","@babylonjs/mcp-servers@9.17.0","@duckdb/duckdb-wasm@1.33.1-dev57.0","@duckdb/duckdb-wasm@1.33.1-dev58.0","@lavamoat/lavapack@8.0.2","@lavamoat/lavapack@8.0.5","@link-assistant/hive-mind@1.72.6","@link-assistant/hive-mind@1.73.1","@link-assistant/hive-mind@1.73.2","@link-assistant/hive-mind@1.73.3"],"members":357,"previous_members":356},"event_kind":"expanded_campaign"},{"created_at":1784353423,"detail":{"examples":["@babylonjs/mcp-servers@9.16.2","@babylonjs/mcp-servers@9.17.0","@duckdb/duckdb-wasm@1.33.1-dev57.0","@duckdb/duckdb-wasm@1.33.1-dev58.0","@lavamoat/lavapack@8.0.2","@lavamoat/lavapack@8.0.5","@link-assistant/hive-mind@1.72.6","@link-assistant/hive-mind@1.73.1","@link-assistant/hive-mind@1.73.2","@link-assistant/hive-mind@1.73.3"],"members":356,"previous_members":355},"event_kind":"expanded_campaign"},{"created_at":1784353387,"detail":{"examples":["@babylonjs/mcp-servers@9.16.2","@babylonjs/mcp-servers@9.17.0","@duckdb/duckdb-wasm@1.33.1-dev57.0","@duckdb/duckdb-wasm@1.33.1-dev58.0","@lavamoat/lavapack@8.0.2","@lavamoat/lavapack@8.0.5","@link-assistant/hive-mind@1.72.6","@link-assistant/hive-mind@1.73.1","@link-assistant/hive-mind@1.73.2","@link-assistant/hive-mind@1.73.3"],"members":356,"previous_members":355},"event_kind":"expanded_campaign"}],"examples":["@babylonjs/mcp-servers@9.16.2","@babylonjs/mcp-servers@9.17.0","@duckdb/duckdb-wasm@1.33.1-dev57.0","@duckdb/duckdb-wasm@1.33.1-dev58.0","@lavamoat/lavapack@8.0.2","@lavamoat/lavapack@8.0.5","@link-assistant/hive-mind@1.72.6","@link-assistant/hive-mind@1.73.1","@link-assistant/hive-mind@1.73.2","@link-assistant/hive-mind@1.73.3"],"first_seen":1782317466,"growth_per_day":14,"id":"ttp_detail-918f186f8c45c34f","key":"js_fetch_dynamic_exec","kind":"ttp_detail","last_seen":1784379081,"max_score":311,"members":357,"status":"active"},{"confidence_score":84,"events":[{"created_at":1783163210,"detail":{"examples":["muaddib-scanner@1.0.7","muaddib-scanner@1.0.8","muaddib-scanner@1.0.9","muaddib-scanner@2.11.100","muaddib-scanner@2.11.101","muaddib-scanner@2.11.102","muaddib-scanner@2.11.103","muaddib-scanner@2.11.104","muaddib-scanner@2.11.109","muaddib-scanner@2.11.110"],"max_score":311,"previous_score":276},"event_kind":"score_increased"},{"created_at":1783163186,"detail":{"examples":["muaddib-scanner@1.0.7","muaddib-scanner@1.0.8","muaddib-scanner@1.0.9","muaddib-scanner@2.11.100","muaddib-scanner@2.11.101","muaddib-scanner@2.11.102","muaddib-scanner@2.11.103","muaddib-scanner@2.11.104","muaddib-scanner@2.11.109","muaddib-scanner@2.11.110"],"max_score":311,"previous_score":276},"event_kind":"score_increased"},{"created_at":1783163148,"detail":{"examples":["muaddib-scanner@1.0.7","muaddib-scanner@1.0.8","muaddib-scanner@1.0.9","muaddib-scanner@2.11.100","muaddib-scanner@2.11.101","muaddib-scanner@2.11.102","muaddib-scanner@2.11.103","muaddib-scanner@2.11.104","muaddib-scanner@2.11.109","muaddib-scanner@2.11.110"],"max_score":311,"previous_score":276},"event_kind":"score_increased"},{"created_at":1782997583,"detail":{"examples":["muaddib-scanner@1.0.7","muaddib-scanner@1.0.8","muaddib-scanner@1.0.9","muaddib-scanner@2.11.100","muaddib-scanner@2.11.101","muaddib-scanner@2.11.102","muaddib-scanner@2.11.103","muaddib-scanner@2.11.104","muaddib-scanner@2.11.109","muaddib-scanner@2.11.110"],"members":69,"previous_members":68},"event_kind":"expanded_campaign"}],"examples":["muaddib-scanner@1.0.7","muaddib-scanner@1.0.8","muaddib-scanner@1.0.9","muaddib-scanner@2.11.100","muaddib-scanner@2.11.101","muaddib-scanner@2.11.102","muaddib-scanner@2.11.103","muaddib-scanner@2.11.104","muaddib-scanner@2.11.109","muaddib-scanner@2.11.110"],"first_seen":1780942952,"growth_per_day":1,"id":"publisher_high_risk-9fa649056d8d3353","key":"dnszlsk","kind":"publisher_high_risk","last_seen":1784379081,"max_score":311,"members":69,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784330660,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@bancolonbia/menu-filter-widget-web@0.0.1","@challenger6/vm-pattern-library@99.0.0"],"members":257,"previous_members":256},"event_kind":"expanded_campaign"},{"created_at":1784330657,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@bancolonbia/menu-filter-widget-web@0.0.1","@challenger6/vm-pattern-library@99.0.0"],"members":257,"previous_members":256},"event_kind":"expanded_campaign"},{"created_at":1784330608,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@bancolonbia/menu-filter-widget-web@0.0.1","@challenger6/vm-pattern-library@99.0.0"],"members":257,"previous_members":256},"event_kind":"expanded_campaign"},{"created_at":1784280477,"detail":{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@bancolonbia/menu-filter-widget-web@0.0.1","@challenger6/vm-pattern-library@99.0.0"],"members":256,"previous_members":255},"event_kind":"expanded_campaign"}],"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@bancolonbia/menu-filter-widget-web@0.0.1","@challenger6/vm-pattern-library@99.0.0"],"first_seen":1779620695,"growth_per_day":4,"id":"ttp_detail-f9fed90c9a35481e","key":"dns_or_oast_exfil","kind":"ttp_detail","last_seen":1784379081,"max_score":311,"members":257,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784338404,"detail":{"examples":["@agent-chassis/agent-launch-cli@0.4.3","@agent-chassis/agent-launch-cli@0.5.0","@agent-chassis/agent-launch-cli@0.5.1","@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30"],"members":182,"previous_members":181},"event_kind":"expanded_campaign"},{"created_at":1784338366,"detail":{"examples":["@agent-chassis/agent-launch-cli@0.4.3","@agent-chassis/agent-launch-cli@0.5.0","@agent-chassis/agent-launch-cli@0.5.1","@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30"],"members":182,"previous_members":181},"event_kind":"expanded_campaign"},{"created_at":1784338343,"detail":{"examples":["@agent-chassis/agent-launch-cli@0.4.3","@agent-chassis/agent-launch-cli@0.5.0","@agent-chassis/agent-launch-cli@0.5.1","@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30"],"members":182,"previous_members":181},"event_kind":"expanded_campaign"},{"created_at":1784325406,"detail":{"examples":["@agent-chassis/agent-launch-cli@0.4.3","@agent-chassis/agent-launch-cli@0.5.0","@agent-chassis/agent-launch-cli@0.5.1","@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30"],"members":181,"previous_members":180},"event_kind":"expanded_campaign"}],"examples":["@agent-chassis/agent-launch-cli@0.4.3","@agent-chassis/agent-launch-cli@0.5.0","@agent-chassis/agent-launch-cli@0.5.1","@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30"],"first_seen":1783306150,"growth_per_day":14,"id":"ttp_detail-3efa71d0b8bf49c5","key":"js_concat_require_obfuscation","kind":"ttp_detail","last_seen":1784379081,"max_score":311,"members":182,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784377183,"detail":{"examples":["@celilo/e2e@0.7.16","@celilo/e2e@0.7.17","@celilo/e2e@0.8.0","@celilo/e2e@0.9.0","@celilo/e2e@0.9.1","@celilo/e2e@0.9.2","@celilo/e2e@0.9.2-alpha.0","@checkstack/backend-api@0.25.0","@checkstack/backend-api@0.26.0","@checkstack/backend-api@0.26.1"],"members":371,"previous_members":370},"event_kind":"expanded_campaign"},{"created_at":1784377134,"detail":{"examples":["@celilo/e2e@0.7.16","@celilo/e2e@0.7.17","@celilo/e2e@0.8.0","@celilo/e2e@0.9.0","@celilo/e2e@0.9.1","@celilo/e2e@0.9.2","@celilo/e2e@0.9.2-alpha.0","@checkstack/backend-api@0.25.0","@checkstack/backend-api@0.26.0","@checkstack/backend-api@0.26.1"],"members":371,"previous_members":370},"event_kind":"expanded_campaign"},{"created_at":1784377120,"detail":{"examples":["@celilo/e2e@0.7.16","@celilo/e2e@0.7.17","@celilo/e2e@0.8.0","@celilo/e2e@0.9.0","@celilo/e2e@0.9.1","@celilo/e2e@0.9.2","@celilo/e2e@0.9.2-alpha.0","@checkstack/backend-api@0.25.0","@checkstack/backend-api@0.26.0","@checkstack/backend-api@0.26.1"],"members":371,"previous_members":370},"event_kind":"expanded_campaign"},{"created_at":1784373664,"detail":{"examples":["@celilo/e2e@0.7.16","@celilo/e2e@0.7.17","@celilo/e2e@0.8.0","@celilo/e2e@0.9.0","@celilo/e2e@0.9.1","@celilo/e2e@0.9.2","@celilo/e2e@0.9.2-alpha.0","@checkstack/backend-api@0.25.0","@checkstack/backend-api@0.26.0","@checkstack/backend-api@0.26.1"],"members":370,"previous_members":369},"event_kind":"expanded_campaign"}],"examples":["@celilo/e2e@0.7.16","@celilo/e2e@0.7.17","@celilo/e2e@0.8.0","@celilo/e2e@0.9.0","@celilo/e2e@0.9.1","@celilo/e2e@0.9.2","@celilo/e2e@0.9.2-alpha.0","@checkstack/backend-api@0.25.0","@checkstack/backend-api@0.26.0","@checkstack/backend-api@0.26.1"],"first_seen":1782115904,"growth_per_day":14,"id":"ttp_detail-22c69b5f6a5fe645","key":"reverse_shell","kind":"ttp_detail","last_seen":1784379081,"max_score":297,"members":371,"status":"active"},{"confidence_score":84,"events":[{"created_at":1784345034,"detail":{"examples":["@fudrouter/fsrouter@0.6.100","@fudrouter/fsrouter@0.6.101","@fudrouter/fsrouter@0.6.102","@fudrouter/fsrouter@0.6.103","@fudrouter/fsrouter@0.6.104","@fudrouter/fsrouter@0.6.105","@fudrouter/fsrouter@0.6.106","@fudrouter/fsrouter@0.6.107","@fudrouter/fsrouter@0.6.108","@fudrouter/fsrouter@0.6.109"],"members":84,"previous_members":83},"event_kind":"expanded_campaign"},{"created_at":1784345014,"detail":{"examples":["@fudrouter/fsrouter@0.6.100","@fudrouter/fsrouter@0.6.101","@fudrouter/fsrouter@0.6.102","@fudrouter/fsrouter@0.6.103","@fudrouter/fsrouter@0.6.104","@fudrouter/fsrouter@0.6.105","@fudrouter/fsrouter@0.6.106","@fudrouter/fsrouter@0.6.107","@fudrouter/fsrouter@0.6.108","@fudrouter/fsrouter@0.6.109"],"members":84,"previous_members":83},"event_kind":"expanded_campaign"},{"created_at":1784344993,"detail":{"examples":["@fudrouter/fsrouter@0.6.100","@fudrouter/fsrouter@0.6.101","@fudrouter/fsrouter@0.6.102","@fudrouter/fsrouter@0.6.103","@fudrouter/fsrouter@0.6.104","@fudrouter/fsrouter@0.6.105","@fudrouter/fsrouter@0.6.106","@fudrouter/fsrouter@0.6.107","@fudrouter/fsrouter@0.6.108","@fudrouter/fsrouter@0.6.109"],"members":84,"previous_members":83},"event_kind":"expanded_campaign"},{"created_at":1784343288,"detail":{"examples":["@fudrouter/fsrouter@0.6.100","@fudrouter/fsrouter@0.6.101","@fudrouter/fsrouter@0.6.102","@fudrouter/fsrouter@0.6.103","@fudrouter/fsrouter@0.6.104","@fudrouter/fsrouter@0.6.105","@fudrouter/fsrouter@0.6.106","@fudrouter/fsrouter@0.6.107","@fudrouter/fsrouter@0.6.108","@fudrouter/fsrouter@0.6.109"],"members":83,"previous_members":82},"event_kind":"expanded_campaign"}],"examples":["@fudrouter/fsrouter@0.6.100","@fudrouter/fsrouter@0.6.101","@fudrouter/fsrouter@0.6.102","@fudrouter/fsrouter@0.6.103","@fudrouter/fsrouter@0.6.104","@fudrouter/fsrouter@0.6.105","@fudrouter/fsrouter@0.6.106","@fudrouter/fsrouter@0.6.107","@fudrouter/fsrouter@0.6.108","@fudrouter/fsrouter@0.6.109"],"first_seen":1784045260,"growth_per_day":21,"id":"publisher_high_risk-47ae3a4cf932bfd7","key":"fsrouter","kind":"publisher_high_risk","last_seen":1784379081,"max_score":286,"members":84,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784378489,"detail":{"examples":["@1mancompany/onemancompany@0.7.101","@1mancompany/onemancompany@0.7.73","@1mancompany/onemancompany@0.7.80","@1mancompany/onemancompany@0.7.83","@1mancompany/onemancompany@0.7.85","@1mancompany/onemancompany@0.7.86","@1mancompany/onemancompany@0.7.89","@1mancompany/onemancompany@0.7.92","@1mancompany/onemancompany@0.7.94","@1mancompany/onemancompany@0.7.95"],"members":3728,"previous_members":3727},"event_kind":"expanded_campaign"},{"created_at":1784378465,"detail":{"examples":["@1mancompany/onemancompany@0.7.101","@1mancompany/onemancompany@0.7.73","@1mancompany/onemancompany@0.7.80","@1mancompany/onemancompany@0.7.83","@1mancompany/onemancompany@0.7.85","@1mancompany/onemancompany@0.7.86","@1mancompany/onemancompany@0.7.89","@1mancompany/onemancompany@0.7.92","@1mancompany/onemancompany@0.7.94","@1mancompany/onemancompany@0.7.95"],"members":3728,"previous_members":3727},"event_kind":"expanded_campaign"},{"created_at":1784378404,"detail":{"examples":["@1mancompany/onemancompany@0.7.101","@1mancompany/onemancompany@0.7.73","@1mancompany/onemancompany@0.7.80","@1mancompany/onemancompany@0.7.83","@1mancompany/onemancompany@0.7.85","@1mancompany/onemancompany@0.7.86","@1mancompany/onemancompany@0.7.89","@1mancompany/onemancompany@0.7.92","@1mancompany/onemancompany@0.7.94","@1mancompany/onemancompany@0.7.95"],"members":3728,"previous_members":3726},"event_kind":"expanded_campaign"},{"created_at":1784378366,"detail":{"examples":["@1mancompany/onemancompany@0.7.101","@1mancompany/onemancompany@0.7.73","@1mancompany/onemancompany@0.7.80","@1mancompany/onemancompany@0.7.83","@1mancompany/onemancompany@0.7.85","@1mancompany/onemancompany@0.7.86","@1mancompany/onemancompany@0.7.89","@1mancompany/onemancompany@0.7.92","@1mancompany/onemancompany@0.7.94","@1mancompany/onemancompany@0.7.95"],"members":3727,"previous_members":3726},"event_kind":"expanded_campaign"}],"examples":["@1mancompany/onemancompany@0.7.101","@1mancompany/onemancompany@0.7.73","@1mancompany/onemancompany@0.7.80","@1mancompany/onemancompany@0.7.83","@1mancompany/onemancompany@0.7.85","@1mancompany/onemancompany@0.7.86","@1mancompany/onemancompany@0.7.89","@1mancompany/onemancompany@0.7.92","@1mancompany/onemancompany@0.7.94","@1mancompany/onemancompany@0.7.95"],"first_seen":1782317466,"growth_per_day":156,"id":"ttp_detail-ce16a009a7092dba","key":"js_remote_exe_exec","kind":"ttp_detail","last_seen":1784379081,"max_score":286,"members":3728,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784370441,"detail":{"examples":["@alexberardi/jarvis-admin@0.1.83","@alexberardi/jarvis-admin@0.1.84","@alexberardi/jarvis-admin@0.1.85","@alexberardi/jarvis-admin@0.1.86","@alexberardi/jarvis-admin@0.1.87","@alexberardi/jarvis-admin@0.1.88","@alexberardi/jarvis-admin@0.1.89","@amd-gaia/agent-ui@0.22.0","@arach/lattices@0.6.4","@bnomei/frigg@0.9.0"],"members":405,"previous_members":404},"event_kind":"expanded_campaign"},{"created_at":1784370417,"detail":{"examples":["@alexberardi/jarvis-admin@0.1.83","@alexberardi/jarvis-admin@0.1.84","@alexberardi/jarvis-admin@0.1.85","@alexberardi/jarvis-admin@0.1.86","@alexberardi/jarvis-admin@0.1.87","@alexberardi/jarvis-admin@0.1.88","@alexberardi/jarvis-admin@0.1.89","@amd-gaia/agent-ui@0.22.0","@arach/lattices@0.6.4","@bnomei/frigg@0.9.0"],"members":405,"previous_members":404},"event_kind":"expanded_campaign"},{"created_at":1784370380,"detail":{"examples":["@alexberardi/jarvis-admin@0.1.83","@alexberardi/jarvis-admin@0.1.84","@alexberardi/jarvis-admin@0.1.85","@alexberardi/jarvis-admin@0.1.86","@alexberardi/jarvis-admin@0.1.87","@alexberardi/jarvis-admin@0.1.88","@alexberardi/jarvis-admin@0.1.89","@amd-gaia/agent-ui@0.22.0","@arach/lattices@0.6.4","@bnomei/frigg@0.9.0"],"members":405,"previous_members":404},"event_kind":"expanded_campaign"},{"created_at":1784367642,"detail":{"examples":["@alexberardi/jarvis-admin@0.1.83","@alexberardi/jarvis-admin@0.1.84","@alexberardi/jarvis-admin@0.1.85","@alexberardi/jarvis-admin@0.1.86","@alexberardi/jarvis-admin@0.1.87","@alexberardi/jarvis-admin@0.1.88","@alexberardi/jarvis-admin@0.1.89","@amd-gaia/agent-ui@0.22.0","@arach/lattices@0.6.4","@bnomei/frigg@0.9.0"],"members":404,"previous_members":403},"event_kind":"expanded_campaign"}],"examples":["@alexberardi/jarvis-admin@0.1.83","@alexberardi/jarvis-admin@0.1.84","@alexberardi/jarvis-admin@0.1.85","@alexberardi/jarvis-admin@0.1.86","@alexberardi/jarvis-admin@0.1.87","@alexberardi/jarvis-admin@0.1.88","@alexberardi/jarvis-admin@0.1.89","@amd-gaia/agent-ui@0.22.0","@arach/lattices@0.6.4","@bnomei/frigg@0.9.0"],"first_seen":1783874141,"growth_per_day":69,"id":"ttp_detail-e70bb208b072a229","key":"js_download_chmod_exec","kind":"ttp_detail","last_seen":1784379081,"max_score":286,"members":405,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364712,"detail":{"examples":["100xprompt-cli@0.1.1","@100xprompt/cli-darwin-arm64@0.1.2","@100xprompt/cli-darwin-x64-baseline@0.1.3","@100xprompt/cli-darwin-x64@0.1.3","@adobehrjain/commerce-admin-management@0.0.25","@aduermael_/wb@0.1.4","@agxnte/reidx@2.0.5","@alosha/vue-select@4.0.4","@andy-toolforge/tts-generator@0.3.0","@artheras/aria-code@4.1.3"],"members":168,"previous_members":167},"event_kind":"expanded_campaign"},{"created_at":1784364672,"detail":{"examples":["100xprompt-cli@0.1.1","@100xprompt/cli-darwin-arm64@0.1.2","@100xprompt/cli-darwin-x64-baseline@0.1.3","@100xprompt/cli-darwin-x64@0.1.3","@adobehrjain/commerce-admin-management@0.0.25","@aduermael_/wb@0.1.4","@agxnte/reidx@2.0.5","@alosha/vue-select@4.0.4","@andy-toolforge/tts-generator@0.3.0","@artheras/aria-code@4.1.3"],"members":168,"previous_members":167},"event_kind":"expanded_campaign"},{"created_at":1784281244,"detail":{"examples":["100xprompt-cli@0.1.1","@100xprompt/cli-darwin-arm64@0.1.2","@100xprompt/cli-darwin-x64-baseline@0.1.3","@100xprompt/cli-darwin-x64@0.1.3","@adobehrjain/commerce-admin-management@0.0.25","@aduermael_/wb@0.1.4","@agxnte/reidx@2.0.5","@alosha/vue-select@4.0.4","@andy-toolforge/tts-generator@0.3.0","@artheras/aria-code@4.1.3"],"members":167,"previous_members":166},"event_kind":"expanded_campaign"},{"created_at":1784281188,"detail":{"examples":["100xprompt-cli@0.1.1","@100xprompt/cli-darwin-arm64@0.1.2","@100xprompt/cli-darwin-x64-baseline@0.1.3","@100xprompt/cli-darwin-x64@0.1.3","@adobehrjain/commerce-admin-management@0.0.25","@aduermael_/wb@0.1.4","@agxnte/reidx@2.0.5","@alosha/vue-select@4.0.4","@andy-toolforge/tts-generator@0.3.0","@artheras/aria-code@4.1.3"],"members":167,"previous_members":166},"event_kind":"expanded_campaign"}],"examples":["100xprompt-cli@0.1.1","@100xprompt/cli-darwin-arm64@0.1.2","@100xprompt/cli-darwin-x64-baseline@0.1.3","@100xprompt/cli-darwin-x64@0.1.3","@adobehrjain/commerce-admin-management@0.0.25","@aduermael_/wb@0.1.4","@agxnte/reidx@2.0.5","@alosha/vue-select@4.0.4","@andy-toolforge/tts-generator@0.3.0","@artheras/aria-code@4.1.3"],"first_seen":1780993178,"growth_per_day":4,"id":"ttp_detail-bd0293b1a600096e","key":"new_account_with_lifecycle_hook","kind":"ttp_detail","last_seen":1784379081,"max_score":283,"members":168,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784369253,"detail":{"examples":["@100xprompt/cli-darwin-arm64@0.1.3","@adnansiddiqui-dev/jssm-cli@1.9.12","@adnansiddiqui-dev/jssm-cli@1.9.13","@adobehrjain/commerce-admin-management@0.0.26","@aduermael_/wb@0.1.5","@agora-build/dialf@0.1.4","@agxnte/reidx@2.0.6","@aiaiaichain/agent@0.1.5","@andy-toolforge/tts-generator@0.4.0","@artheras/aria-code@4.1.4"],"members":180,"previous_members":179},"event_kind":"expanded_campaign"},{"created_at":1784369232,"detail":{"examples":["@100xprompt/cli-darwin-arm64@0.1.3","@adnansiddiqui-dev/jssm-cli@1.9.12","@adnansiddiqui-dev/jssm-cli@1.9.13","@adobehrjain/commerce-admin-management@0.0.26","@aduermael_/wb@0.1.5","@agora-build/dialf@0.1.4","@agxnte/reidx@2.0.6","@aiaiaichain/agent@0.1.5","@andy-toolforge/tts-generator@0.4.0","@artheras/aria-code@4.1.4"],"members":180,"previous_members":179},"event_kind":"expanded_campaign"},{"created_at":1784369199,"detail":{"examples":["@100xprompt/cli-darwin-arm64@0.1.3","@adnansiddiqui-dev/jssm-cli@1.9.12","@adnansiddiqui-dev/jssm-cli@1.9.13","@adobehrjain/commerce-admin-management@0.0.26","@aduermael_/wb@0.1.5","@agora-build/dialf@0.1.4","@agxnte/reidx@2.0.6","@aiaiaichain/agent@0.1.5","@andy-toolforge/tts-generator@0.4.0","@artheras/aria-code@4.1.4"],"members":180,"previous_members":179},"event_kind":"expanded_campaign"},{"created_at":1784369190,"detail":{"examples":["@100xprompt/cli-darwin-arm64@0.1.3","@adnansiddiqui-dev/jssm-cli@1.9.12","@adnansiddiqui-dev/jssm-cli@1.9.13","@adobehrjain/commerce-admin-management@0.0.26","@aduermael_/wb@0.1.5","@agora-build/dialf@0.1.4","@agxnte/reidx@2.0.6","@aiaiaichain/agent@0.1.5","@andy-toolforge/tts-generator@0.4.0","@artheras/aria-code@4.1.4"],"members":180,"previous_members":179},"event_kind":"expanded_campaign"}],"examples":["@100xprompt/cli-darwin-arm64@0.1.3","@adnansiddiqui-dev/jssm-cli@1.9.12","@adnansiddiqui-dev/jssm-cli@1.9.13","@adobehrjain/commerce-admin-management@0.0.26","@aduermael_/wb@0.1.5","@agora-build/dialf@0.1.4","@agxnte/reidx@2.0.6","@aiaiaichain/agent@0.1.5","@andy-toolforge/tts-generator@0.4.0","@artheras/aria-code@4.1.4"],"first_seen":1780996150,"growth_per_day":4,"id":"ttp_detail-a6b45fb1a2b78c14","key":"new_account_with_lifecycle_hook","kind":"ttp_detail","last_seen":1784379081,"max_score":283,"members":180,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784376732,"detail":{"examples":["000router@0.5.20","0x2ai-demo1@1.2.0","0x2ai-zoe@0.2.0","0x2ai-zoe@1.2.0","1688-claw@0.1.0","9router-cldb@0.5.8","9router-ray@0.5.15","@0x1labs/vyer@0.1.0","@0xpaarth/deck@0.1.0","@1interface/chat-core@0.1.0"],"members":1833,"previous_members":1832},"event_kind":"expanded_campaign"},{"created_at":1784376705,"detail":{"examples":["000router@0.5.20","0x2ai-demo1@1.2.0","0x2ai-zoe@0.2.0","0x2ai-zoe@1.2.0","1688-claw@0.1.0","9router-cldb@0.5.8","9router-ray@0.5.15","@0x1labs/vyer@0.1.0","@0xpaarth/deck@0.1.0","@1interface/chat-core@0.1.0"],"members":1833,"previous_members":1832},"event_kind":"expanded_campaign"},{"created_at":1784376675,"detail":{"examples":["000router@0.5.20","0x2ai-demo1@1.2.0","0x2ai-zoe@0.2.0","0x2ai-zoe@1.2.0","1688-claw@0.1.0","9router-cldb@0.5.8","9router-ray@0.5.15","@0x1labs/vyer@0.1.0","@0xpaarth/deck@0.1.0","@1interface/chat-core@0.1.0"],"members":1833,"previous_members":1832},"event_kind":"expanded_campaign"},{"created_at":1784374257,"detail":{"examples":["000router@0.5.20","0x2ai-demo1@1.2.0","0x2ai-zoe@0.2.0","0x2ai-zoe@1.2.0","1688-claw@0.1.0","9router-cldb@0.5.8","9router-ray@0.5.15","@0x1labs/vyer@0.1.0","@0xpaarth/deck@0.1.0","@1interface/chat-core@0.1.0"],"members":1832,"previous_members":1831},"event_kind":"expanded_campaign"}],"examples":["000router@0.5.20","0x2ai-demo1@1.2.0","0x2ai-zoe@0.2.0","0x2ai-zoe@1.2.0","1688-claw@0.1.0","9router-cldb@0.5.8","9router-ray@0.5.15","@0x1labs/vyer@0.1.0","@0xpaarth/deck@0.1.0","@1interface/chat-core@0.1.0"],"first_seen":1780914314,"growth_per_day":45,"id":"ttp_detail-3a7819c9820b7158","key":"new_account_with_lifecycle_hook","kind":"ttp_detail","last_seen":1784379081,"max_score":283,"members":1833,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784375240,"detail":{"examples":["@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30","@agentworkforce/cli@4.1.31","@agentworkforce/cli@4.1.32","@agentworkforce/runtime@4.1.24"],"members":1746,"previous_members":1745},"event_kind":"expanded_campaign"},{"created_at":1784375206,"detail":{"examples":["@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30","@agentworkforce/cli@4.1.31","@agentworkforce/cli@4.1.32","@agentworkforce/runtime@4.1.24"],"members":1746,"previous_members":1745},"event_kind":"expanded_campaign"},{"created_at":1784375170,"detail":{"examples":["@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30","@agentworkforce/cli@4.1.31","@agentworkforce/cli@4.1.32","@agentworkforce/runtime@4.1.24"],"members":1746,"previous_members":1745},"event_kind":"expanded_campaign"},{"created_at":1784371481,"detail":{"examples":["@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30","@agentworkforce/cli@4.1.31","@agentworkforce/cli@4.1.32","@agentworkforce/runtime@4.1.24"],"members":1745,"previous_members":1744},"event_kind":"expanded_campaign"}],"examples":["@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30","@agentworkforce/cli@4.1.31","@agentworkforce/cli@4.1.32","@agentworkforce/runtime@4.1.24"],"first_seen":1782317466,"growth_per_day":73,"id":"ttp_detail-f41056a074943c78","key":"shipped_live_secret","kind":"ttp_detail","last_seen":1784379081,"max_score":281,"members":1746,"status":"active"},{"confidence_score":70,"events":[{"created_at":1784244835,"detail":{"examples":["octarine-core@0.3.0-beta.5","octarine-core@0.3.0-beta.6"],"key":"Josh Hall","kind":"publisher_high_risk","max_score":281,"members":2},"event_kind":"reactivated_campaign"},{"created_at":1784244818,"detail":{"min_size":2,"reason":"cluster no longer meets campaign threshold"},"event_kind":"stale_campaign"},{"created_at":1784244803,"detail":{"examples":["octarine-core@0.3.0-beta.5","octarine-core@0.3.0-beta.6"],"key":"Josh Hall","kind":"publisher_high_risk","max_score":281,"members":2},"event_kind":"reactivated_campaign"},{"created_at":1784244788,"detail":{"min_size":2,"reason":"cluster no longer meets campaign threshold"},"event_kind":"stale_campaign"}],"examples":["octarine-core@0.3.0-beta.5","octarine-core@0.3.0-beta.6"],"first_seen":1784244785,"growth_per_day":1,"id":"publisher_high_risk-8d63b1fc4bade0ee","key":"Josh Hall","kind":"publisher_high_risk","last_seen":1784379081,"max_score":281,"members":2,"status":"active"},{"confidence_score":84,"events":[{"created_at":1784298776,"detail":{"examples":["easyway2@1.0.0","easyway2@1.0.1","easyway2@1.0.10","easyway2@1.0.11","easyway2@1.0.2","easyway2@1.0.3","easyway2@1.0.5","easyway2@1.0.8","easyway2@1.0.9"],"members":9,"previous_members":8},"event_kind":"expanded_campaign"},{"created_at":1784298755,"detail":{"examples":["easyway2@1.0.0","easyway2@1.0.1","easyway2@1.0.10","easyway2@1.0.11","easyway2@1.0.2","easyway2@1.0.3","easyway2@1.0.5","easyway2@1.0.8","easyway2@1.0.9"],"members":9,"previous_members":8},"event_kind":"expanded_campaign"},{"created_at":1784298489,"detail":{"examples":["easyway2@1.0.0","easyway2@1.0.1","easyway2@1.0.10","easyway2@1.0.2","easyway2@1.0.3","easyway2@1.0.5","easyway2@1.0.8","easyway2@1.0.9"],"members":8,"previous_members":7},"event_kind":"expanded_campaign"},{"created_at":1784298467,"detail":{"examples":["easyway2@1.0.0","easyway2@1.0.1","easyway2@1.0.10","easyway2@1.0.2","easyway2@1.0.3","easyway2@1.0.5","easyway2@1.0.8","easyway2@1.0.9"],"members":8,"previous_members":7},"event_kind":"expanded_campaign"}],"examples":["easyway2@1.0.0","easyway2@1.0.1","easyway2@1.0.10","easyway2@1.0.11","easyway2@1.0.2","easyway2@1.0.3","easyway2@1.0.5","easyway2@1.0.8","easyway2@1.0.9"],"first_seen":1784289862,"growth_per_day":8,"id":"publisher_high_risk-2581a492aafe3a7b","key":"advvvice","kind":"publisher_high_risk","last_seen":1784379081,"max_score":270,"members":9,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784379043,"detail":{"examples":["100xprompt-cli@0.0.0-dev-202607020347","100xprompt-cli@0.0.0-dev-full1","100xprompt-cli@0.0.0-dev-scoped1","@0x1labs/vyer@0.1.1","@0x1labs/vyer@0.1.2","@adnansiddiqui-dev/jssm-cli@1.9.11","@adobehrjain/commerce-admin-management@0.0.20","@adobesign/as-dev-tools@99.9.11","@advergic-ads/react-native-sdk@1.0.2","@agentrhq/webcmd@0.2.0"],"members":576,"previous_members":575},"event_kind":"expanded_campaign"},{"created_at":1784374663,"detail":{"examples":["100xprompt-cli@0.0.0-dev-202607020347","100xprompt-cli@0.0.0-dev-full1","100xprompt-cli@0.0.0-dev-scoped1","@0x1labs/vyer@0.1.1","@0x1labs/vyer@0.1.2","@adnansiddiqui-dev/jssm-cli@1.9.11","@adobehrjain/commerce-admin-management@0.0.20","@adobesign/as-dev-tools@99.9.11","@advergic-ads/react-native-sdk@1.0.2","@agentrhq/webcmd@0.2.0"],"members":575,"previous_members":574},"event_kind":"expanded_campaign"},{"created_at":1784374636,"detail":{"examples":["100xprompt-cli@0.0.0-dev-202607020347","100xprompt-cli@0.0.0-dev-full1","100xprompt-cli@0.0.0-dev-scoped1","@0x1labs/vyer@0.1.1","@0x1labs/vyer@0.1.2","@adnansiddiqui-dev/jssm-cli@1.9.11","@adobehrjain/commerce-admin-management@0.0.20","@adobesign/as-dev-tools@99.9.11","@advergic-ads/react-native-sdk@1.0.2","@agentrhq/webcmd@0.2.0"],"members":575,"previous_members":574},"event_kind":"expanded_campaign"},{"created_at":1784330059,"detail":{"examples":["100xprompt-cli@0.0.0-dev-202607020347","100xprompt-cli@0.0.0-dev-full1","100xprompt-cli@0.0.0-dev-scoped1","@0x1labs/vyer@0.1.1","@0x1labs/vyer@0.1.2","@adnansiddiqui-dev/jssm-cli@1.9.11","@adobehrjain/commerce-admin-management@0.0.20","@adobesign/as-dev-tools@99.9.11","@advergic-ads/react-native-sdk@1.0.2","@agentrhq/webcmd@0.2.0"],"members":574,"previous_members":573},"event_kind":"expanded_campaign"}],"examples":["100xprompt-cli@0.0.0-dev-202607020347","100xprompt-cli@0.0.0-dev-full1","100xprompt-cli@0.0.0-dev-scoped1","@0x1labs/vyer@0.1.1","@0x1labs/vyer@0.1.2","@adnansiddiqui-dev/jssm-cli@1.9.11","@adobehrjain/commerce-admin-management@0.0.20","@adobesign/as-dev-tools@99.9.11","@advergic-ads/react-native-sdk@1.0.2","@agentrhq/webcmd@0.2.0"],"first_seen":1780938786,"growth_per_day":14,"id":"ttp_detail-cb8dd99aa4e5f4a3","key":"new_account_with_lifecycle_hook","kind":"ttp_detail","last_seen":1784379081,"max_score":270,"members":575,"status":"active"},{"confidence_score":84,"events":[{"created_at":1784192289,"detail":{"examples":["@clawpump/claw-agent@0.1.0","@clawpump/claw-agent@0.1.1","@clawpump/claw-agent@0.1.11","@clawpump/claw-agent@0.1.12","@clawpump/claw-agent@0.1.13","@clawpump/claw-agent@0.1.14","@clawpump/claw-agent@0.1.15","@clawpump/claw-agent@0.1.16","@clawpump/claw-agent@0.1.17","@clawpump/claw-agent@0.1.18"],"members":17,"previous_members":14},"event_kind":"expanded_campaign"},{"created_at":1784192246,"detail":{"examples":["@clawpump/claw-agent@0.1.0","@clawpump/claw-agent@0.1.1","@clawpump/claw-agent@0.1.11","@clawpump/claw-agent@0.1.12","@clawpump/claw-agent@0.1.13","@clawpump/claw-agent@0.1.14","@clawpump/claw-agent@0.1.15","@clawpump/claw-agent@0.1.16","@clawpump/claw-agent@0.1.17","@clawpump/claw-agent@0.1.18"],"members":17,"previous_members":14},"event_kind":"expanded_campaign"},{"created_at":1784192183,"detail":{"examples":["@clawpump/claw-agent@0.1.0","@clawpump/claw-agent@0.1.1","@clawpump/claw-agent@0.1.11","@clawpump/claw-agent@0.1.12","@clawpump/claw-agent@0.1.13","@clawpump/claw-agent@0.1.14","@clawpump/claw-agent@0.1.15","@clawpump/claw-agent@0.1.16","@clawpump/claw-agent@0.1.17","@clawpump/claw-agent@0.1.18"],"members":17,"previous_members":14},"event_kind":"expanded_campaign"},{"created_at":1783299790,"detail":{"examples":["@clawpump/claw-agent@0.1.0","@clawpump/claw-agent@0.1.1","@clawpump/claw-agent@0.1.11","@clawpump/claw-agent@0.1.12","@clawpump/claw-agent@0.1.13","@clawpump/claw-agent@0.1.14","@clawpump/claw-agent@0.1.15","@clawpump/claw-agent@0.1.16","@clawpump/claw-agent@0.1.17","@clawpump/claw-agent@0.1.18"],"members":14,"previous_members":13},"event_kind":"expanded_campaign"}],"examples":["@clawpump/claw-agent@0.1.0","@clawpump/claw-agent@0.1.1","@clawpump/claw-agent@0.1.11","@clawpump/claw-agent@0.1.12","@clawpump/claw-agent@0.1.13","@clawpump/claw-agent@0.1.14","@clawpump/claw-agent@0.1.15","@clawpump/claw-agent@0.1.16","@clawpump/claw-agent@0.1.17","@clawpump/claw-agent@0.1.18"],"first_seen":1782515992,"growth_per_day":1,"id":"publisher_high_risk-bce70dde630c05c9","key":"tomi204","kind":"publisher_high_risk","last_seen":1784379081,"max_score":264,"members":17,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784347568,"detail":{"examples":["1edtech_lti_ap@1.2.1","1edtech_lti_dev@1.2.4","1edtech_ltiap@1.2.1","1edtech_ltijs@1.2.5","1edtech_ltijs_ap@1.2.5","1edtechltiap@1.2.1","@actagent/voice-call@2026.6.2","@actagent/voice-call@2026.6.3","@actagent/voice-call@2026.6.4","@agentai2026/openclaw-zh@2026.5.27-zh"],"members":514,"previous_members":513},"event_kind":"expanded_campaign"},{"created_at":1784337013,"detail":{"examples":["1edtech_lti_ap@1.2.1","1edtech_lti_dev@1.2.4","1edtech_ltiap@1.2.1","1edtech_ltijs@1.2.5","1edtech_ltijs_ap@1.2.5","1edtechltiap@1.2.1","@actagent/voice-call@2026.6.2","@actagent/voice-call@2026.6.3","@actagent/voice-call@2026.6.4","@agentai2026/openclaw-zh@2026.5.27-zh"],"members":513,"previous_members":512},"event_kind":"expanded_campaign"},{"created_at":1784336969,"detail":{"examples":["1edtech_lti_ap@1.2.1","1edtech_lti_dev@1.2.4","1edtech_ltiap@1.2.1","1edtech_ltijs@1.2.5","1edtech_ltijs_ap@1.2.5","1edtechltiap@1.2.1","@actagent/voice-call@2026.6.2","@actagent/voice-call@2026.6.3","@actagent/voice-call@2026.6.4","@agentai2026/openclaw-zh@2026.5.27-zh"],"members":513,"previous_members":512},"event_kind":"expanded_campaign"},{"created_at":1784336960,"detail":{"examples":["1edtech_lti_ap@1.2.1","1edtech_lti_dev@1.2.4","1edtech_ltiap@1.2.1","1edtech_ltijs@1.2.5","1edtech_ltijs_ap@1.2.5","1edtechltiap@1.2.1","@actagent/voice-call@2026.6.2","@actagent/voice-call@2026.6.3","@actagent/voice-call@2026.6.4","@agentai2026/openclaw-zh@2026.5.27-zh"],"members":513,"previous_members":512},"event_kind":"expanded_campaign"}],"examples":["1edtech_lti_ap@1.2.1","1edtech_lti_dev@1.2.4","1edtech_ltiap@1.2.1","1edtech_ltijs@1.2.5","1edtech_ltijs_ap@1.2.5","1edtechltiap@1.2.1","@actagent/voice-call@2026.6.2","@actagent/voice-call@2026.6.3","@actagent/voice-call@2026.6.4","@agentai2026/openclaw-zh@2026.5.27-zh"],"first_seen":1779702416,"growth_per_day":9,"id":"ttp_detail-632a07269dc67de9","key":"webhook_exfil_endpoint","kind":"ttp_detail","last_seen":1784379081,"max_score":251,"members":514,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784149075,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@bitplanet/genie-openclaw@2026.5.28","@coinflowlabs/angular@1.10.0","@coinflowlabs/angular@1.11.0","@coinflowlabs/angular@1.12.0","@coinflowlabs/angular@1.9.0"],"members":121,"previous_members":119},"event_kind":"expanded_campaign"},{"created_at":1784149056,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@bitplanet/genie-openclaw@2026.5.28","@coinflowlabs/angular@1.10.0","@coinflowlabs/angular@1.11.0","@coinflowlabs/angular@1.12.0","@coinflowlabs/angular@1.9.0"],"members":121,"previous_members":119},"event_kind":"expanded_campaign"},{"created_at":1784149023,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@bitplanet/genie-openclaw@2026.5.28","@coinflowlabs/angular@1.10.0","@coinflowlabs/angular@1.11.0","@coinflowlabs/angular@1.12.0","@coinflowlabs/angular@1.9.0"],"members":121,"previous_members":119},"event_kind":"expanded_campaign"},{"created_at":1784120259,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@bitplanet/genie-openclaw@2026.5.28","@coinflowlabs/angular@1.10.0","@coinflowlabs/angular@1.11.0","@coinflowlabs/angular@1.9.0","@coinflowlabs/vue@1.13.0"],"members":119,"previous_members":118},"event_kind":"expanded_campaign"}],"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@bitplanet/genie-openclaw@2026.5.28","@coinflowlabs/angular@1.10.0","@coinflowlabs/angular@1.11.0","@coinflowlabs/angular@1.12.0","@coinflowlabs/angular@1.9.0"],"first_seen":1779706898,"growth_per_day":2,"id":"ttp_detail-d6b26e137ead363e","key":"webhook_exfil_endpoint","kind":"ttp_detail","last_seen":1784379081,"max_score":251,"members":121,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784374740,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentium/core@2.3.1","@agentium/core@2.3.2","@agentium/core@2.4.0","@agentium/core@2.5.0","@agentium/core@2.6.0"],"members":1364,"previous_members":1363},"event_kind":"expanded_campaign"},{"created_at":1784374723,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentium/core@2.3.1","@agentium/core@2.3.2","@agentium/core@2.4.0","@agentium/core@2.5.0","@agentium/core@2.6.0"],"members":1364,"previous_members":1363},"event_kind":"expanded_campaign"},{"created_at":1784374713,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentium/core@2.3.1","@agentium/core@2.3.2","@agentium/core@2.4.0","@agentium/core@2.5.0","@agentium/core@2.6.0"],"members":1364,"previous_members":1363},"event_kind":"expanded_campaign"},{"created_at":1784374676,"detail":{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentium/core@2.3.1","@agentium/core@2.3.2","@agentium/core@2.4.0","@agentium/core@2.5.0","@agentium/core@2.6.0"],"members":1364,"previous_members":1363},"event_kind":"expanded_campaign"}],"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentium/core@2.3.1","@agentium/core@2.3.2","@agentium/core@2.4.0","@agentium/core@2.5.0","@agentium/core@2.6.0"],"first_seen":1779904553,"growth_per_day":26,"id":"ttp_detail-2ebe127163eddc41","key":"webhook_exfil_endpoint","kind":"ttp_detail","last_seen":1784379081,"max_score":251,"members":1364,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784364029,"detail":{"examples":["aiops-ml@1.0.0","codex-cli-usage@0.1.8","dagster-cloud-cli@1.13.11","dagster-cloud-cli@1.13.12","dagster-cloud-cli@1.13.13","dagster-cloud-cli@1.13.14","dagster-cloud-cli@1.13.7","dagster-pipes@1.13.11","dagster-pipes@1.13.12","dagster-pipes@1.13.13"],"members":148,"previous_members":147},"event_kind":"expanded_campaign"},{"created_at":1784364015,"detail":{"examples":["aiops-ml@1.0.0","codex-cli-usage@0.1.8","dagster-cloud-cli@1.13.11","dagster-cloud-cli@1.13.12","dagster-cloud-cli@1.13.13","dagster-cloud-cli@1.13.14","dagster-cloud-cli@1.13.7","dagster-pipes@1.13.11","dagster-pipes@1.13.12","dagster-pipes@1.13.13"],"members":148,"previous_members":147},"event_kind":"expanded_campaign"},{"created_at":1784310522,"detail":{"examples":["aiops-ml@1.0.0","codex-cli-usage@0.1.8","dagster-cloud-cli@1.13.11","dagster-cloud-cli@1.13.12","dagster-cloud-cli@1.13.13","dagster-cloud-cli@1.13.14","dagster-cloud-cli@1.13.7","dagster-pipes@1.13.11","dagster-pipes@1.13.12","dagster-pipes@1.13.13"],"members":147,"previous_members":146},"event_kind":"expanded_campaign"},{"created_at":1784310503,"detail":{"examples":["aiops-ml@1.0.0","codex-cli-usage@0.1.8","dagster-cloud-cli@1.13.11","dagster-cloud-cli@1.13.12","dagster-cloud-cli@1.13.13","dagster-cloud-cli@1.13.14","dagster-cloud-cli@1.13.7","dagster-pipes@1.13.11","dagster-pipes@1.13.12","dagster-pipes@1.13.13"],"members":147,"previous_members":146},"event_kind":"expanded_campaign"}],"examples":["aiops-ml@1.0.0","codex-cli-usage@0.1.8","dagster-cloud-cli@1.13.11","dagster-cloud-cli@1.13.12","dagster-cloud-cli@1.13.13","dagster-cloud-cli@1.13.14","dagster-cloud-cli@1.13.7","dagster-pipes@1.13.11","dagster-pipes@1.13.12","dagster-pipes@1.13.13"],"first_seen":1783067556,"growth_per_day":9,"id":"ttp_detail-e46ffffbfd76ac18","key":"py_import_time_base64_decode","kind":"ttp_detail","last_seen":1784379081,"max_score":250,"members":148,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784334255,"detail":{"examples":["@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@dreamlake/lakeshore@0.1.15","@dreamlake/lakeshore@0.1.16","@dreamlake/lakeshore@0.1.17","@dreamlake/lakeshore@0.2.0","@geravant/sinain@1.32.0","@geravant/sinain@1.33.0"],"members":124,"previous_members":122},"event_kind":"expanded_campaign"},{"created_at":1784334249,"detail":{"examples":["@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@dreamlake/lakeshore@0.1.15","@dreamlake/lakeshore@0.1.16","@dreamlake/lakeshore@0.1.17","@dreamlake/lakeshore@0.2.0","@geravant/sinain@1.32.0","@geravant/sinain@1.33.0"],"members":124,"previous_members":122},"event_kind":"expanded_campaign"},{"created_at":1784334209,"detail":{"examples":["@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@dreamlake/lakeshore@0.1.15","@dreamlake/lakeshore@0.1.16","@dreamlake/lakeshore@0.1.17","@dreamlake/lakeshore@0.2.0","@geravant/sinain@1.32.0","@geravant/sinain@1.33.0"],"members":124,"previous_members":122},"event_kind":"expanded_campaign"},{"created_at":1784205476,"detail":{"examples":["@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@dreamlake/lakeshore@0.1.16","@dreamlake/lakeshore@0.1.17","@geravant/sinain@1.32.0","@geravant/sinain@1.33.0","@geravant/sinain@1.34.0","@geravant/sinain@1.35.0"],"members":122,"previous_members":118},"event_kind":"expanded_campaign"}],"examples":["@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@dreamlake/lakeshore@0.1.15","@dreamlake/lakeshore@0.1.16","@dreamlake/lakeshore@0.1.17","@dreamlake/lakeshore@0.2.0","@geravant/sinain@1.32.0","@geravant/sinain@1.33.0"],"first_seen":1783430061,"growth_per_day":11,"id":"ttp_detail-ecc28014eebf230f","key":"install_hook_credential_exfil","kind":"ttp_detail","last_seen":1784379081,"max_score":245,"members":124,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784290085,"detail":{"examples":["@andyqiu/codeforge@0.8.11","@andyqiu/codeforge@0.8.12","@andyqiu/codeforge@0.8.13","@andyqiu/codeforge@0.8.14","@andyqiu/codeforge@0.8.15","@andyqiu/codeforge@0.8.16","@andyqiu/codeforge@0.8.17","@andyqiu/codeforge@0.8.18","@andyqiu/codeforge@0.8.19","@andyqiu/codeforge@0.8.20"],"members":167,"previous_members":166},"event_kind":"expanded_campaign"},{"created_at":1784290044,"detail":{"examples":["@andyqiu/codeforge@0.8.11","@andyqiu/codeforge@0.8.12","@andyqiu/codeforge@0.8.13","@andyqiu/codeforge@0.8.14","@andyqiu/codeforge@0.8.15","@andyqiu/codeforge@0.8.16","@andyqiu/codeforge@0.8.17","@andyqiu/codeforge@0.8.18","@andyqiu/codeforge@0.8.19","@andyqiu/codeforge@0.8.20"],"members":167,"previous_members":166},"event_kind":"expanded_campaign"},{"created_at":1784278564,"detail":{"examples":["@andyqiu/codeforge@0.8.11","@andyqiu/codeforge@0.8.12","@andyqiu/codeforge@0.8.13","@andyqiu/codeforge@0.8.14","@andyqiu/codeforge@0.8.15","@andyqiu/codeforge@0.8.16","@andyqiu/codeforge@0.8.17","@andyqiu/codeforge@0.8.18","@andyqiu/codeforge@0.8.19","@andyqiu/codeforge@0.8.20"],"members":166,"previous_members":164},"event_kind":"expanded_campaign"},{"created_at":1784278558,"detail":{"examples":["@andyqiu/codeforge@0.8.11","@andyqiu/codeforge@0.8.12","@andyqiu/codeforge@0.8.13","@andyqiu/codeforge@0.8.14","@andyqiu/codeforge@0.8.15","@andyqiu/codeforge@0.8.16","@andyqiu/codeforge@0.8.17","@andyqiu/codeforge@0.8.18","@andyqiu/codeforge@0.8.19","@andyqiu/codeforge@0.8.20"],"members":166,"previous_members":164},"event_kind":"expanded_campaign"}],"examples":["@andyqiu/codeforge@0.8.11","@andyqiu/codeforge@0.8.12","@andyqiu/codeforge@0.8.13","@andyqiu/codeforge@0.8.14","@andyqiu/codeforge@0.8.15","@andyqiu/codeforge@0.8.16","@andyqiu/codeforge@0.8.17","@andyqiu/codeforge@0.8.18","@andyqiu/codeforge@0.8.19","@andyqiu/codeforge@0.8.20"],"first_seen":1779598970,"growth_per_day":3,"id":"ttp_detail-e6b784e99ab53d03","key":"credential_paths","kind":"ttp_detail","last_seen":1784379081,"max_score":245,"members":167,"status":"active"},{"confidence_score":84,"events":[{"created_at":1783426541,"detail":{"examples":["paperclip-host-utils@1.0.0","paperclip-host-utils@1.0.2","paperclip-host-utils@1.0.3","paperclip-host-utils@1.0.4","paperclip-host-utils@1.0.5","paperclip-host-utils@1.0.6","paperclip-host-utils@1.0.7","paperclip2@1.0.0","vps-adapter-core@1.0.0","vps-adapter-core@1.0.1"],"members":18,"previous_members":17},"event_kind":"expanded_campaign"},{"created_at":1783426274,"detail":{"examples":["paperclip-host-utils@1.0.0","paperclip-host-utils@1.0.2","paperclip-host-utils@1.0.3","paperclip-host-utils@1.0.4","paperclip-host-utils@1.0.5","paperclip-host-utils@1.0.6","paperclip2@1.0.0","vps-adapter-core@1.0.0","vps-adapter-core@1.0.1","vps-maintenance-paperclip-adapter@0.1.1"],"max_score":245,"previous_score":217},"event_kind":"score_increased"},{"created_at":1783426274,"detail":{"examples":["paperclip-host-utils@1.0.0","paperclip-host-utils@1.0.2","paperclip-host-utils@1.0.3","paperclip-host-utils@1.0.4","paperclip-host-utils@1.0.5","paperclip-host-utils@1.0.6","paperclip2@1.0.0","vps-adapter-core@1.0.0","vps-adapter-core@1.0.1","vps-maintenance-paperclip-adapter@0.1.1"],"members":17,"previous_members":16},"event_kind":"expanded_campaign"},{"created_at":1783426070,"detail":{"examples":["paperclip-host-utils@1.0.0","paperclip-host-utils@1.0.2","paperclip-host-utils@1.0.3","paperclip-host-utils@1.0.4","paperclip-host-utils@1.0.5","paperclip2@1.0.0","vps-adapter-core@1.0.0","vps-adapter-core@1.0.1","vps-maintenance-paperclip-adapter@0.1.1","vps-maintenance-paperclip-adapter@0.1.2"],"max_score":217,"previous_score":155},"event_kind":"score_increased"}],"examples":["paperclip-host-utils@1.0.0","paperclip-host-utils@1.0.2","paperclip-host-utils@1.0.3","paperclip-host-utils@1.0.4","paperclip-host-utils@1.0.5","paperclip-host-utils@1.0.6","paperclip-host-utils@1.0.7","paperclip2@1.0.0","vps-adapter-core@1.0.0","vps-adapter-core@1.0.1"],"first_seen":1783167587,"growth_per_day":1,"id":"publisher_high_risk-7011e69c7aaf665c","key":"srm0rgan","kind":"publisher_high_risk","last_seen":1784379081,"max_score":245,"members":18,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784377525,"detail":{"examples":["@cdx-forge/cli@0.1.0-beta.4","@cdx-forge/cli@0.1.0-beta.5","@cdx-forge/cli@0.1.0-beta.6","@cdx-forge/cli@0.1.0-beta.7","@gretl/cli@1.0.12","@gretl/cli@1.0.13","@gretl/cli@1.0.14","@gretl/cli@1.1.0","@madcat-os/opencode-plugin@0.1.0","@madcat-os/opencode-plugin@0.1.1"],"members":819,"previous_members":818},"event_kind":"expanded_campaign"},{"created_at":1784377512,"detail":{"examples":["@cdx-forge/cli@0.1.0-beta.4","@cdx-forge/cli@0.1.0-beta.5","@cdx-forge/cli@0.1.0-beta.6","@cdx-forge/cli@0.1.0-beta.7","@gretl/cli@1.0.12","@gretl/cli@1.0.13","@gretl/cli@1.0.14","@gretl/cli@1.1.0","@madcat-os/opencode-plugin@0.1.0","@madcat-os/opencode-plugin@0.1.1"],"members":819,"previous_members":818},"event_kind":"expanded_campaign"},{"created_at":1784377470,"detail":{"examples":["@cdx-forge/cli@0.1.0-beta.4","@cdx-forge/cli@0.1.0-beta.5","@cdx-forge/cli@0.1.0-beta.6","@cdx-forge/cli@0.1.0-beta.7","@gretl/cli@1.0.12","@gretl/cli@1.0.13","@gretl/cli@1.0.14","@gretl/cli@1.1.0","@madcat-os/opencode-plugin@0.1.0","@madcat-os/opencode-plugin@0.1.1"],"members":819,"previous_members":818},"event_kind":"expanded_campaign"},{"created_at":1784376801,"detail":{"examples":["@cdx-forge/cli@0.1.0-beta.4","@cdx-forge/cli@0.1.0-beta.5","@cdx-forge/cli@0.1.0-beta.6","@cdx-forge/cli@0.1.0-beta.7","@gretl/cli@1.0.12","@gretl/cli@1.0.13","@gretl/cli@1.0.14","@gretl/cli@1.1.0","@madcat-os/opencode-plugin@0.1.0","@madcat-os/opencode-plugin@0.1.1"],"members":818,"previous_members":817},"event_kind":"expanded_campaign"}],"examples":["@cdx-forge/cli@0.1.0-beta.4","@cdx-forge/cli@0.1.0-beta.5","@cdx-forge/cli@0.1.0-beta.6","@cdx-forge/cli@0.1.0-beta.7","@gretl/cli@1.0.12","@gretl/cli@1.0.13","@gretl/cli@1.0.14","@gretl/cli@1.1.0","@madcat-os/opencode-plugin@0.1.0","@madcat-os/opencode-plugin@0.1.1"],"first_seen":1781152297,"growth_per_day":21,"id":"ttp_detail-8c1e446ce4a174b2","key":"credential_paths","kind":"ttp_detail","last_seen":1784379081,"max_score":245,"members":819,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784291221,"detail":{"examples":["@onescience/onecode@1.14.50-202607061826","@onescience/onecode@1.14.50-202607071729","@onescience/onecode@1.14.50-202607131011","@onescience/onecode@1.14.50-202607131556","@onescience/onecode@1.14.50-202607131742","@onescience/onecode@1.14.50-202607141602","@onescience/onecode@1.14.50-202607141643","@onescience/onecode@1.14.50-202607141712","@onescience/onecode@1.14.50-202607141744","@onescience/onecode@1.14.50-202607151040"],"members":115,"previous_members":114},"event_kind":"expanded_campaign"},{"created_at":1784291166,"detail":{"examples":["@onescience/onecode@1.14.50-202607061826","@onescience/onecode@1.14.50-202607071729","@onescience/onecode@1.14.50-202607131011","@onescience/onecode@1.14.50-202607131556","@onescience/onecode@1.14.50-202607131742","@onescience/onecode@1.14.50-202607141602","@onescience/onecode@1.14.50-202607141643","@onescience/onecode@1.14.50-202607141712","@onescience/onecode@1.14.50-202607141744","@onescience/onecode@1.14.50-202607151040"],"members":115,"previous_members":114},"event_kind":"expanded_campaign"},{"created_at":1784291163,"detail":{"examples":["@onescience/onecode@1.14.50-202607061826","@onescience/onecode@1.14.50-202607071729","@onescience/onecode@1.14.50-202607131011","@onescience/onecode@1.14.50-202607131556","@onescience/onecode@1.14.50-202607131742","@onescience/onecode@1.14.50-202607141602","@onescience/onecode@1.14.50-202607141643","@onescience/onecode@1.14.50-202607141712","@onescience/onecode@1.14.50-202607141744","@onescience/onecode@1.14.50-202607151040"],"members":115,"previous_members":114},"event_kind":"expanded_campaign"},{"created_at":1784284983,"detail":{"examples":["@onescience/onecode@1.14.50-202607061826","@onescience/onecode@1.14.50-202607071729","@onescience/onecode@1.14.50-202607131011","@onescience/onecode@1.14.50-202607131556","@onescience/onecode@1.14.50-202607131742","@onescience/onecode@1.14.50-202607141602","@onescience/onecode@1.14.50-202607141643","@onescience/onecode@1.14.50-202607141712","@onescience/onecode@1.14.50-202607141744","@onescience/onecode@1.14.50-202607151040"],"members":114,"previous_members":113},"event_kind":"expanded_campaign"}],"examples":["@onescience/onecode@1.14.50-202607061826","@onescience/onecode@1.14.50-202607071729","@onescience/onecode@1.14.50-202607131011","@onescience/onecode@1.14.50-202607131556","@onescience/onecode@1.14.50-202607131742","@onescience/onecode@1.14.50-202607141602","@onescience/onecode@1.14.50-202607141643","@onescience/onecode@1.14.50-202607141712","@onescience/onecode@1.14.50-202607141744","@onescience/onecode@1.14.50-202607151040"],"first_seen":1783568830,"growth_per_day":12,"id":"ttp_detail-b88e236daf008bf8","key":"install_hook_ip_c2","kind":"ttp_detail","last_seen":1784379081,"max_score":245,"members":115,"status":"active"},{"confidence_score":84,"events":[{"created_at":1784285234,"detail":{"examples":["zevairouter@1.0.0","zevairouter@1.0.1","zevairouter@1.0.10","zevairouter@1.0.11","zevairouter@1.0.12","zevairouter@1.0.13","zevairouter@1.0.14","zevairouter@1.0.15","zevairouter@1.0.16","zevairouter@1.0.17"],"members":78,"previous_members":77},"event_kind":"expanded_campaign"},{"created_at":1784285184,"detail":{"examples":["zevairouter@1.0.0","zevairouter@1.0.1","zevairouter@1.0.10","zevairouter@1.0.11","zevairouter@1.0.12","zevairouter@1.0.13","zevairouter@1.0.14","zevairouter@1.0.15","zevairouter@1.0.16","zevairouter@1.0.17"],"members":78,"previous_members":77},"event_kind":"expanded_campaign"},{"created_at":1784285171,"detail":{"examples":["zevairouter@1.0.0","zevairouter@1.0.1","zevairouter@1.0.10","zevairouter@1.0.11","zevairouter@1.0.12","zevairouter@1.0.13","zevairouter@1.0.14","zevairouter@1.0.15","zevairouter@1.0.16","zevairouter@1.0.17"],"members":78,"previous_members":77},"event_kind":"expanded_campaign"},{"created_at":1784284983,"detail":{"examples":["zevairouter@1.0.0","zevairouter@1.0.1","zevairouter@1.0.10","zevairouter@1.0.11","zevairouter@1.0.12","zevairouter@1.0.13","zevairouter@1.0.14","zevairouter@1.0.15","zevairouter@1.0.16","zevairouter@1.0.17"],"members":77,"previous_members":76},"event_kind":"expanded_campaign"}],"examples":["zevairouter@1.0.0","zevairouter@1.0.1","zevairouter@1.0.10","zevairouter@1.0.11","zevairouter@1.0.12","zevairouter@1.0.13","zevairouter@1.0.14","zevairouter@1.0.15","zevairouter@1.0.16","zevairouter@1.0.17"],"first_seen":1782367373,"growth_per_day":3,"id":"publisher_high_risk-c8f4ef31da7eac46","key":"malghz","kind":"publisher_high_risk","last_seen":1784379081,"max_score":240,"members":78,"status":"active"},{"confidence_score":84,"events":[{"created_at":1784105738,"detail":{"examples":["@panguard-ai/atr@1.5.1","@panguard-ai/atr@1.5.5","@panguard-ai/atr@1.5.6","@panguard-ai/panguard-guard@1.5.5","@panguard-ai/panguard-guard@1.5.6","@panguard-ai/panguard-guard@2.0.3","@panguard-ai/panguard-skill-auditor@1.7.0","@panguard-ai/panguard-skill-auditor@1.7.1","@panguard-ai/panguard-skill-auditor@1.7.2","@panguard-ai/panguard-skill-auditor@1.7.3"],"members":55,"previous_members":52},"event_kind":"expanded_campaign"},{"created_at":1784105721,"detail":{"examples":["@panguard-ai/atr@1.5.1","@panguard-ai/atr@1.5.5","@panguard-ai/atr@1.5.6","@panguard-ai/panguard-guard@1.5.5","@panguard-ai/panguard-guard@1.5.6","@panguard-ai/panguard-guard@2.0.3","@panguard-ai/panguard-skill-auditor@1.7.0","@panguard-ai/panguard-skill-auditor@1.7.1","@panguard-ai/panguard-skill-auditor@1.7.2","@panguard-ai/panguard-skill-auditor@1.7.3"],"members":55,"previous_members":52},"event_kind":"expanded_campaign"},{"created_at":1784055027,"detail":{"examples":["@panguard-ai/panguard-guard@1.5.5","@panguard-ai/panguard-guard@1.5.6","@panguard-ai/panguard-guard@2.0.3","@panguard-ai/panguard-skill-auditor@1.7.0","@panguard-ai/panguard-skill-auditor@1.7.1","@panguard-ai/panguard-skill-auditor@1.7.2","@panguard-ai/panguard-skill-auditor@1.7.3","@panguard-ai/panguard-skill-auditor@1.8.0","@panguard-ai/panguard-skill-auditor@1.8.10","@panguard-ai/panguard-skill-auditor@1.8.12"],"members":52,"previous_members":51},"event_kind":"expanded_campaign"},{"created_at":1784054959,"detail":{"examples":["@panguard-ai/panguard-guard@1.5.5","@panguard-ai/panguard-guard@1.5.6","@panguard-ai/panguard-guard@2.0.3","@panguard-ai/panguard-skill-auditor@1.7.0","@panguard-ai/panguard-skill-auditor@1.7.1","@panguard-ai/panguard-skill-auditor@1.7.2","@panguard-ai/panguard-skill-auditor@1.7.3","@panguard-ai/panguard-skill-auditor@1.8.0","@panguard-ai/panguard-skill-auditor@1.8.10","@panguard-ai/panguard-skill-auditor@1.8.12"],"members":52,"previous_members":51},"event_kind":"expanded_campaign"}],"examples":["@panguard-ai/atr@1.5.1","@panguard-ai/atr@1.5.5","@panguard-ai/atr@1.5.6","@panguard-ai/panguard-guard@1.5.5","@panguard-ai/panguard-guard@1.5.6","@panguard-ai/panguard-guard@2.0.3","@panguard-ai/panguard-skill-auditor@1.7.0","@panguard-ai/panguard-skill-auditor@1.7.1","@panguard-ai/panguard-skill-auditor@1.7.2","@panguard-ai/panguard-skill-auditor@1.7.3"],"first_seen":1781348453,"growth_per_day":1,"id":"publisher_high_risk-4caf6a48eb1555d2","key":"panguard0414","kind":"publisher_high_risk","last_seen":1784379081,"max_score":240,"members":55,"status":"active"},{"confidence_score":90,"events":[{"created_at":1784375001,"detail":{"examples":["@4pm/cli@0.2.0","@4pm/cli@0.2.1","@4pm/cli@0.2.2","@4pm/cli@0.3.0","@4pm/cli@0.3.1","@4pm/cli@0.3.2","@4pm/cli@0.3.3","@4pm/cli@0.4.0","@4pm/cli@0.4.1","@4pm/cli@0.4.2"],"members":656,"previous_members":655},"event_kind":"expanded_campaign"},{"created_at":1784374977,"detail":{"examples":["@4pm/cli@0.2.0","@4pm/cli@0.2.1","@4pm/cli@0.2.2","@4pm/cli@0.3.0","@4pm/cli@0.3.1","@4pm/cli@0.3.2","@4pm/cli@0.3.3","@4pm/cli@0.4.0","@4pm/cli@0.4.1","@4pm/cli@0.4.2"],"members":656,"previous_members":655},"event_kind":"expanded_campaign"},{"created_at":1784374942,"detail":{"examples":["@4pm/cli@0.2.0","@4pm/cli@0.2.1","@4pm/cli@0.2.2","@4pm/cli@0.3.0","@4pm/cli@0.3.1","@4pm/cli@0.3.2","@4pm/cli@0.3.3","@4pm/cli@0.4.0","@4pm/cli@0.4.1","@4pm/cli@0.4.2"],"members":656,"previous_members":655},"event_kind":"expanded_campaign"},{"created_at":1784365083,"detail":{"examples":["@4pm/cli@0.2.0","@4pm/cli@0.2.1","@4pm/cli@0.2.2","@4pm/cli@0.3.0","@4pm/cli@0.3.1","@4pm/cli@0.3.2","@4pm/cli@0.3.3","@4pm/cli@0.4.0","@4pm/cli@0.4.1","@4pm/cli@0.4.2"],"members":655,"previous_members":654},"event_kind":"expanded_campaign"}],"examples":["@4pm/cli@0.2.0","@4pm/cli@0.2.1","@4pm/cli@0.2.2","@4pm/cli@0.3.0","@4pm/cli@0.3.1","@4pm/cli@0.3.2","@4pm/cli@0.3.3","@4pm/cli@0.4.0","@4pm/cli@0.4.1","@4pm/cli@0.4.2"],"first_seen":1781938064,"growth_per_day":23,"id":"ttp_detail-91b0d496ea9ddc33","key":"js_obfuscated_fetch_exec","kind":"ttp_detail","last_seen":1784379081,"max_score":239,"members":656,"status":"active"}],"cluster_limit":100,"cluster_total":671,"clusters":[{"examples":["@4o3f/lapis@0.2.0","@851-labs/tokenmaxxing@0.4.18-alpha.4","@851-labs/tokenmaxxing@0.4.20","@888aaen/jira-cli-win32-x64@1.3.4","@888aaen/jira-cli-win32-x64@1.4.0","@abacus-ai/cli@2.5.3-canary.0","@across-protocol/sdk@4.4.0-alpha.1","@adamlangepl/tc-proxy@1.0.3","@adbayb/stack@2.39.0-next-00b7c69","@adbayb/stack@2.40.0"],"key":"GitHub Actions","kind":"publisher_high_risk","max_score":452,"members":6007},{"examples":["000router@0.5.20","000router@0.5.21","2capsule@1.1.1","9remote@2.0.58","9remote@2.0.59","9remote@2.0.60","9remote@2.0.65","9remote@2.0.66","9remote@2.0.67","9remote@2.0.68"],"key":"js_hidden_powershell:hidden / non-interactive powershell invocation in package code — `-windowstyle hidden`, `irm | iex`, `windowshide: true`, or equivalent — used to download-and-run payloads on windows installers.","kind":"ttp_detail","max_score":346,"members":5226},{"examples":["@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@0dai-dev/cli@4.3.6","@a5c-ai/babysitter-opencode@0.1.4","@ably/cli@1.2.0","@ably/cli@1.2.1","@actalk/inkos@1.6.1-canary.49.1","@adkit/cli@1.12.16","@adkit/cli@1.12.17","@adkit/cli@1.12.18"],"key":"js_remote_npm_install:shell-exec of `npm install` with a global flag, a url, or a concatenated (dynamic) target — installs a remote/attacker-controlled package at runtime (self-updating dropper / remote payload).","kind":"ttp_detail","max_score":346,"members":3843},{"examples":["@1mancompany/onemancompany@0.7.101","@1mancompany/onemancompany@0.7.73","@1mancompany/onemancompany@0.7.80","@1mancompany/onemancompany@0.7.83","@1mancompany/onemancompany@0.7.85","@1mancompany/onemancompany@0.7.86","@1mancompany/onemancompany@0.7.89","@1mancompany/onemancompany@0.7.92","@1mancompany/onemancompany@0.7.94","@1mancompany/onemancompany@0.7.95"],"key":"js_remote_exe_exec:downloads a windows executable (.exe/.msi/.scr/.dll/script) from a url and runs it via child_process — remote-payload dropper.","kind":"ttp_detail","max_score":286,"members":3728},{"examples":["@0codeai/zerocode@0.1.0","@0codeai/zerocode@0.1.1","@7x/jb-win32-arm64@1.0.2","@7x/jb-win32-arm64@1.0.3","@7x/jb-win32-arm64@1.0.4","@7x/jb-win32-x64@1.0.2","@7x/jb-win32-x64@1.0.3","@7x/jb-win32-x64@1.0.4","@851-labs/tokenmaxxing-windows-arm64@0.4.18-alpha.4","@851-labs/tokenmaxxing-windows-x64-baseline@0.4.18-alpha.4"],"key":"native_binary_main_entry:main/bin entry points to a compiled binary: bin entry","kind":"ttp_detail","max_score":105,"members":2814},{"examples":["000router@0.5.20","0x2ai-demo1@1.2.0","0x2ai-zoe@0.2.0","0x2ai-zoe@1.2.0","1688-claw@0.1.0","9router-cldb@0.5.8","9router-ray@0.5.15","@0x1labs/vyer@0.1.0","@0xpaarth/deck@0.1.0","@1interface/chat-core@0.1.0"],"key":"new_account_with_lifecycle_hook:package first published 0 day(s) ago, 1 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":283,"members":1833},{"examples":["@403name/electron-buidler@1.0.0","@403name/electron-buidler@1.0.1","@403name/ether-js@1.0.0","@403name/ether-js@1.0.1","@403name/fsevent@1.0.0","@403name/fsevent@1.0.1","@a2bugfix/orchestrator@0.1.4","@a2bugfix/orchestrator@0.1.5","@a2bugfix/orchestrator@0.1.6","@aerovato/container@3.4.4"],"key":"remote_shell_cradle:a shell download-and-run cradle (curl/wget piped to a shell, `bash <(curl…)`, or powershell iwr|iex) executed in a packaged code file — remote-code execution that fetches and runs an attacker-controlled payload.","kind":"ttp_detail","max_score":545,"members":1778},{"examples":["@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30","@agentworkforce/cli@4.1.31","@agentworkforce/cli@4.1.32","@agentworkforce/runtime@4.1.24"],"key":"shipped_live_secret:a live slack secret is hardcoded in a packaged file — a credential-grabber's exfil key or a leaked maintainer credential. legit code reads provider keys from env/config and never ships one.","kind":"ttp_detail","max_score":281,"members":1746},{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@agentium/core@2.3.1","@agentium/core@2.3.2","@agentium/core@2.4.0","@agentium/core@2.5.0","@agentium/core@2.6.0"],"key":"webhook_exfil_endpoint:matched \"api.telegram.org/bot\"","kind":"ttp_detail","max_score":251,"members":1364},{"examples":["000router@0.5.21","1688-claw@0.1.1","1cattunnel@0.1.2-b.2","9remote-beta@2.0.31","9remote-beta@2.0.32","9router-ray@0.5.16","@0codeai/zerocode@0.1.0","@0codeai/zerocode@0.1.1","@0xpaarth/deck@0.1.1","@100xprompt/cli-darwin-arm64@0.0.0-dev-full1"],"key":"new_account_with_lifecycle_hook:package first published 0 day(s) ago, 2 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":220,"members":1232},{"examples":["acdh-oeaw/acdh-repo@5.10.7","acdh-oeaw/acdh-repo@5.13.2","acdh-oeaw/arche-core@5.10.6","acdh-oeaw/arche-core@5.10.7","acdh-oeaw/arche-core@5.13.2","adminneo-org/adminneo@v5.4.0","adrianbj/tracy-debugger@5.0.35","adrianbj/tracy-debugger@5.0.37","adrianbj/tracy-debugger@5.0.39","adrianbj/tracy-debugger@5.0.40"],"key":"php_base64_eval_chain:base64/gz/hex decode combined with eval/exec/backticks — classic php obfuscated payload.","kind":"ttp_detail","max_score":224,"members":1217},{"examples":["@amazon-sp-api-release/sp-api-dev-mcp@1.0.1","@amazon-sp-api-release/sp-api-dev-mcp@1.0.2","@amazon-sp-api-release/sp-api-dev-mcp@1.0.3","@amazon-sp-api-release/sp-api-dev-mcp@1.0.4","@beamnetwork/eco-prime-trust-api@1.0.17","@beamnetwork/eco-prime-trust-api@1.0.18","@beamnetwork/eco-prime-trust-api@1.0.19","@beamnetwork/eco-prime-trust-api@1.0.20","@fiale-plus/pi-rogue@0.3.19","@fiale-plus/pi-rogue@0.3.20"],"key":"shipped_live_secret:a live aws access-key secret is hardcoded in a packaged file — a credential-grabber's exfil key or a leaked maintainer credential. legit code reads provider keys from env/config and never ships one.","kind":"ttp_detail","max_score":424,"members":1210},{"examples":["@1agh/maude@0.40.0","@1agh/maude@0.41.0","@1agh/maude@0.42.0","@1agh/maude@0.43.0","@1agh/maude@0.44.0","@1agh/maude@0.45.0","@1agh/maude@0.45.1","@1agh/maude@0.45.2","@1agh/maude@0.46.0","@aaroncql/pim-agent@0.0.1"],"key":"js_split_join_obfuscation:array-of-single-tokens joined to form a string — used to obscure module names like require([\"n\",\"o\",\"de\",\":\",\"cr\",\"yp\",\"to\"].join(\"\")), defeating static require() analysis.","kind":"ttp_detail","max_score":311,"members":1195},{"examples":["@vellumai/cli@0.10.0-dev.202606221106.1d9ff9a","@vellumai/cli@0.10.0-dev.202606221405.2fda286","@vellumai/cli@0.10.0-dev.202606221828.5af1324","@vellumai/cli@0.10.0-dev.202606222007.e9d01e2","@vellumai/cli@0.10.0-dev.202606222147.354e06a","@vellumai/cli@0.10.0-dev.202606222239.7186c51","@vellumai/cli@0.10.0-dev.202606222307.aa8d8c0","@vellumai/cli@0.10.0-dev.202606222336.91461f5","@vellumai/cli@0.10.0-dev.202606230105.081b3b9","@vellumai/cli@0.10.0-dev.202606230318.fd58ed1"],"key":"devops-vellum","kind":"publisher_high_risk","max_score":130,"members":1092},{"examples":["@acusti/uikit-docs@0.6.0","@acusti/uikit-docs@0.6.1","@acusti/uikit-docs@0.6.2","@acusti/uikit-docs@0.6.3","@agegr/pi-web@0.6.17","@agegr/pi-web@0.6.18","@agegr/pi-web@0.6.19","@agegr/pi-web@0.7.0","@agegr/pi-web@0.7.1","@agegr/pi-web@0.7.10"],"key":"reverse_shell:matched \"mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|node|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|podman|podman-compose|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh\" — reverse-shell shape","kind":"ttp_detail","max_score":145,"members":927},{"examples":["@agengine/runtime@1.0.8","@allons-y/agent-skills@0.0.0","@checkstack/logstream-backend@0.1.0","@checkstack/logstream-backend@0.2.0","@checkstack/logstream-backend@0.3.0","@checkstack/logstream-backend@0.4.0","@dev-aemni/ezpi@1.0.1","@dev-aemni/ezpi@1.0.2","@digital-ai/devops-page-object-release@0.0.0-snapshot-20260626093854","@dotss/ui@0.0.6"],"key":"shipped_live_secret:a live github secret is hardcoded in a packaged file — a credential-grabber's exfil key or a leaked maintainer credential. legit code reads provider keys from env/config and never ships one.","kind":"ttp_detail","max_score":372,"members":873},{"examples":["@cdx-forge/cli@0.1.0-beta.4","@cdx-forge/cli@0.1.0-beta.5","@cdx-forge/cli@0.1.0-beta.6","@cdx-forge/cli@0.1.0-beta.7","@gretl/cli@1.0.12","@gretl/cli@1.0.13","@gretl/cli@1.0.14","@gretl/cli@1.1.0","@madcat-os/opencode-plugin@0.1.0","@madcat-os/opencode-plugin@0.1.1"],"key":"credential_paths:matched \".ssh/\"","kind":"ttp_detail","max_score":245,"members":819},{"examples":["aeron-glide@0.1.0","aeron-glide@0.1.1","aeron-glide@0.1.2","aeron-glide@0.1.3","aic8800@0.1.0","aic8800@0.1.1","aic8800@0.2.0","aic8800@0.2.1","aic8800@0.2.2","aic8800@0.2.3"],"key":"rs_build_time_network:http / tcp network call inside build.rs — downloads at compile time.","kind":"ttp_detail","max_score":162,"members":789},{"examples":["acdh-oeaw/acdh-repo@5.10.7","acdh-oeaw/acdh-repo@5.13.2","acdh-oeaw/arche-core@5.10.6","acdh-oeaw/arche-core@5.10.7","acdh-oeaw/arche-core@5.13.2","adminneo-org/adminneo@v5.4.0","aghfatehi/laravel-zatca@v1.1.0","aghfatehi/laravel-zatca@v1.3.0","aghfatehi/laravel-zatca@v1.4.0","alexamiryan/stingle@3.4.11"],"key":"php_shell_with_decode:exec / system / shell_exec combined with base64/hex decode.","kind":"ttp_detail","max_score":224,"members":700},{"examples":["@achuthvp/postinstall-poc@1.0.2","@achuthvp/postinstall-poc@1.0.3","@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@aonunited/angular@99.0.1","@asterworks/agent-audit@0.2.0","@asterworks/agent-console@0.1.0","@asterworks/agent-console@0.1.1"],"key":"webhook_exfil_endpoint:matched \"webhook.site\"","kind":"ttp_detail","max_score":545,"members":697},{"examples":["@boardstate/broker@0.3.0","@boardstate/broker@0.3.2","@boardstate/broker@0.3.3","@boardstate/broker@0.3.4","@ci-lifecycle-test/postinstall-ping@1.0.0","@faskai/ui-commons@0.0.0-alpha.34","@faskai/ui-commons@0.0.0-alpha.35","@faskai/ui-commons@0.0.0-alpha.36","@faskai/ui-commons@0.0.0-alpha.37","@faskai/ui-commons@0.0.0-alpha.38"],"key":"webhook_exfil_endpoint:matched \"pipedream.net\"","kind":"ttp_detail","max_score":168,"members":663},{"examples":["@4pm/cli@0.2.0","@4pm/cli@0.2.1","@4pm/cli@0.2.2","@4pm/cli@0.3.0","@4pm/cli@0.3.1","@4pm/cli@0.3.2","@4pm/cli@0.3.3","@4pm/cli@0.4.0","@4pm/cli@0.4.1","@4pm/cli@0.4.2"],"key":"js_obfuscated_fetch_exec:hex-decoded literal + network fetch + child-process exec — staged obfuscated-loader / dropper (hides the c2 url from literal-url detection).","kind":"ttp_detail","max_score":239,"members":656},{"examples":["agent-working@1.0.0","agento-core@0.10.1","agento-core@0.10.2","agento-core@0.10.3","agento-core@0.11.0","agento-core@0.11.1","agento-core@0.12.0","agentsview@0.31.0","agentsview@0.31.1","agentsview@0.32.0"],"key":"py_import_time_os_system:direct shell invocation via os.system / os.popen / os.exec*.","kind":"ttp_detail","max_score":195,"members":655},{"examples":["adminneo-org/adminneo@v5.4.0","adrianbj/tracy-debugger@5.0.35","adrianbj/tracy-debugger@5.0.37","adrianbj/tracy-debugger@5.0.39","adrianbj/tracy-debugger@5.0.40","adrianbj/tracy-debugger@5.0.41","adrianbj/tracy-debugger@5.0.42","adrianbj/tracy-debugger@5.0.43","adrianbj/tracy-debugger@5.0.44","alleyinteractive/wp-curate@v3.2.1"],"key":"php_backtick_with_decode:backtick shell-out combined with base64/hex decode.","kind":"ttp_detail","max_score":169,"members":643},{"examples":["@0xmmo/crew@0.1.4","@0xmmo/crew@0.2.0","@0xmmo/crew@0.2.1","@0xmmo/crew@0.2.2","@0xmmo/crew@0.2.3","@0xmmo/crew@0.2.4","@0xmmo/crew@0.2.5","@creedspace/mcp-server@1.0.7","@creedspace/mcp-server@1.0.8","@creedspace/mcp-server@1.1.0"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node dist/postinstall.js || true\"","kind":"ttp_detail","max_score":205,"members":622},{"examples":["100xprompt-cli@0.0.0-dev-202607020347","100xprompt-cli@0.0.0-dev-full1","100xprompt-cli@0.0.0-dev-scoped1","@0x1labs/vyer@0.1.1","@0x1labs/vyer@0.1.2","@adnansiddiqui-dev/jssm-cli@1.9.11","@adobehrjain/commerce-admin-management@0.0.20","@adobesign/as-dev-tools@99.9.11","@advergic-ads/react-native-sdk@1.0.2","@agentrhq/webcmd@0.2.0"],"key":"new_account_with_lifecycle_hook:package first published 0 day(s) ago, 3 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":270,"members":575},{"examples":["@agenit/cli@3.2.3","@agenit/cli@4.0.1-beta.1","@ai-support-agent/cli@0.1.10","@ai-support-agent/cli@0.1.10-beta.0","@ai-support-agent/cli@0.1.11","@ai-support-agent/cli@0.1.11-beta.0","@ai-support-agent/cli@0.1.12","@ai-support-agent/cli@0.1.12-beta.0","@ai-support-agent/cli@0.1.9","@aws/ml-container-creator@0.10.0"],"key":"credential_paths:matched \"aws_access_key\"","kind":"ttp_detail","max_score":165,"members":536},{"examples":["9router@0.5.25","9router@0.5.29","9router@0.5.30","@afterquery/compute@0.1.0","@afterquery/compute@0.2.0","@ai-setting/agent-bounty@0.4.3","@ai-setting/agent-bounty@0.5.0","@ai-setting/agent-bounty@0.5.1","@alfe.ai/gateway@0.6.1","@alfe.ai/gateway@0.6.2"],"key":"js_socket_command_exec:a network socket (websocket/socket.io/net) with a message handler that runs commands via child_process — a remote command-execution agent / reverse shell that takes commands off the wire and executes them.","kind":"ttp_detail","max_score":205,"members":525},{"examples":["@evalguard/core@1.4.1","@evalguard/core@1.4.5","@evalguard/core@1.4.7","@hawon/nexus@0.6.0","@roxy-agent/agents@0.5.0","@roxy-agent/agents@0.5.1","@roxy-agent/agents@0.5.2","@roxy-agent/agents@0.5.4","@roxy-agent/agents@0.5.5","@roxy-agent/agents@0.5.6"],"key":"reverse_shell:matched \"bash -i >&\" — reverse-shell shape","kind":"ttp_detail","max_score":545,"members":514},{"examples":["1edtech_lti_ap@1.2.1","1edtech_lti_dev@1.2.4","1edtech_ltiap@1.2.1","1edtech_ltijs@1.2.5","1edtech_ltijs_ap@1.2.5","1edtechltiap@1.2.1","@actagent/voice-call@2026.6.2","@actagent/voice-call@2026.6.3","@actagent/voice-call@2026.6.4","@agentai2026/openclaw-zh@2026.5.27-zh"],"key":"webhook_exfil_endpoint:matched \"ngrok-free.app\"","kind":"ttp_detail","max_score":251,"members":514},{"examples":["@adhdev/daemon-core@0.9.82-rc.144","@adhdev/daemon-core@0.9.82-rc.145","@adhdev/daemon-core@0.9.82-rc.146","@adhdev/daemon-core@0.9.82-rc.147","@adhdev/daemon-core@0.9.82-rc.149","@adhdev/daemon-core@0.9.82-rc.151","@adhdev/daemon-core@0.9.82-rc.152","@adhdev/daemon-core@0.9.82-rc.153","@adhdev/daemon-core@0.9.82-rc.154","@adhdev/daemon-core@0.9.82-rc.155"],"key":"js_decode_then_exec:base64 / atob / fromcharcode decode adjacent to eval / new function — canonical obfuscated-loader pattern.","kind":"ttp_detail","max_score":545,"members":445},{"examples":["@alexberardi/jarvis-admin@0.1.83","@alexberardi/jarvis-admin@0.1.84","@alexberardi/jarvis-admin@0.1.85","@alexberardi/jarvis-admin@0.1.86","@alexberardi/jarvis-admin@0.1.87","@alexberardi/jarvis-admin@0.1.88","@alexberardi/jarvis-admin@0.1.89","@amd-gaia/agent-ui@0.22.0","@arach/lattices@0.6.4","@bnomei/frigg@0.9.0"],"key":"js_download_chmod_exec:downloads an http response to a file, marks it executable (chmod 0o7xx), and covertly runs it via a detached/output-discarding spawn — a covert binary dropper (the c2 url is often assembled from char-code fragments, so literal-url detection misses it).","kind":"ttp_detail","max_score":286,"members":405},{"examples":["@agent-earth/wiki@0.0.1","@agent-earth/wiki@0.0.2","@agent-earth/wiki@0.0.4","@aiyiran/myclaw@1.1.139","@aiyiran/myclaw@1.1.140","@aiyiran/myclaw@1.1.141","@aiyiran/myclaw@1.1.142","@aiyiran/myclaw@1.1.143","@aiyiran/myclaw@1.1.144","@aiyiran/myclaw@1.1.145"],"key":"shipped_live_secret:a live openai api secret is hardcoded in a packaged file — a credential-grabber's exfil key or a leaked maintainer credential. legit code reads provider keys from env/config and never ships one.","kind":"ttp_detail","max_score":343,"members":390},{"examples":["@2qp/linguist@0.0.1","@2qp/linguist@0.0.2","@agent-vm/agent-vm@0.0.80","@aperant/framework@0.8.4","@aperant/framework@0.8.6","@aperant/framework@0.8.7","@async/pipeline@0.4.1","@async/pipeline@0.4.2","@async/pipeline@0.4.3","@async/pipeline@0.4.4"],"key":"credential_paths:matched \".npmrc\"","kind":"ttp_detail","max_score":349,"members":372},{"examples":["@celilo/e2e@0.7.16","@celilo/e2e@0.7.17","@celilo/e2e@0.8.0","@celilo/e2e@0.9.0","@celilo/e2e@0.9.1","@celilo/e2e@0.9.2","@celilo/e2e@0.9.2-alpha.0","@checkstack/backend-api@0.25.0","@checkstack/backend-api@0.26.0","@checkstack/backend-api@0.26.1"],"key":"reverse_shell:matched \"3<>/dev/tcp/\" — reverse-shell shape","kind":"ttp_detail","max_score":297,"members":371},{"examples":["@adhdev/daemon-core@0.9.82-rc.144","@adhdev/daemon-core@0.9.82-rc.145","@adhdev/daemon-core@0.9.82-rc.146","@adhdev/daemon-core@0.9.82-rc.147","@adhdev/daemon-core@0.9.82-rc.149","@adhdev/daemon-core@0.9.82-rc.151","@adhdev/daemon-core@0.9.82-rc.152","@adhdev/daemon-core@0.9.82-rc.153","@adhdev/daemon-core@0.9.82-rc.154","@adhdev/daemon-core@0.9.82-rc.155"],"key":"vilmire","kind":"publisher_high_risk","max_score":85,"members":366},{"examples":["@a5c-ai/agent-mux-adapters@5.0.1-staging.04ca6ab00d21","@a5c-ai/agent-mux-adapters@5.0.1-staging.b436b3b3e611","@agenit/cli@3.2.3","@agent-native/core@0.22.43","@agent-native/core@0.22.44","@agent-vm/agent-vm@0.0.80","@allyseclabs/allysec-forge-darwin-arm64@0.1.198","@allyseclabs/allysec-forge-darwin-x64@0.1.198","@allyseclabs/allysec-forge@0.1.198","@anyi61/codex-claude-delegate-mcp@0.1.10"],"key":"credential_paths:matched \"github_token\"","kind":"ttp_detail","max_score":100,"members":365},{"examples":["9remote-beta@2.0.34","@0x1labs/vyer@0.1.3","@adamlangepl/tc-proxy@1.0.3","@adobesign/as-dev-tools@99.9.12","@advergic-ads/react-native-sdk@1.0.3","@agora-build/dialf@0.1.3","@aiaiaichain/agent@0.1.4","@apexfdn/apex@1.0.3","@ash-lang/cli@0.1.5","@atheory-ai/wasm-plugin-toolkit@0.0.4"],"key":"new_account_with_lifecycle_hook:package first published 0 day(s) ago, 4 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":152,"members":358},{"examples":["@babylonjs/mcp-servers@9.16.2","@babylonjs/mcp-servers@9.17.0","@duckdb/duckdb-wasm@1.33.1-dev57.0","@duckdb/duckdb-wasm@1.33.1-dev58.0","@lavamoat/lavapack@8.0.2","@lavamoat/lavapack@8.0.5","@link-assistant/hive-mind@1.72.6","@link-assistant/hive-mind@1.73.1","@link-assistant/hive-mind@1.73.2","@link-assistant/hive-mind@1.73.3"],"key":"js_fetch_dynamic_exec:network fetch feeding a dynamic-code sink (function.constructor / eval), or a fetch of a base64-hidden url feeding eval — runtime remote-code loader that fetches its payload and executes it, hiding the c2 url from literal-url detection.","kind":"ttp_detail","max_score":311,"members":357},{"examples":["codeam-cli@2.18.1","codeam-cli@2.18.2","codeam-cli@2.19.0","codeam-cli@2.20.0","codeam-cli@2.20.1","codeam-cli@2.20.2","codeam-cli@2.20.3","codeam-cli@2.21.0","codeam-cli@2.21.1","codeam-cli@2.21.2"],"key":"edgardurand","kind":"publisher_high_risk","max_score":205,"members":348},{"examples":["@kenyaemr/esm-billing-app@5.4.4-pre.419","@kenyaemr/esm-billing-app@5.4.4-pre.420","@kenyaemr/esm-billing-app@5.4.4-pre.424","@kenyaemr/esm-billing-app@5.4.4-pre.425","@kenyaemr/esm-billing-app@5.4.4-pre.426","@kenyaemr/esm-billing-app@5.4.4-pre.427","@kenyaemr/esm-billing-app@5.4.4-pre.428","@kenyaemr/esm-billing-app@5.4.4-pre.429","@kenyaemr/esm-billing-app@5.4.4-pre.430","@kenyaemr/esm-billing-app@5.4.4-pre.432"],"key":"reverse_shell:matched \"mkfifo|mktime|mod|mod_big_int|mod_float|mod_num|modf|mouse_pos|moveto|mul|mult_big_int|mult_int_big_int|mult_num|nan|narrow|nat_of_num|nativeint|neg|neg_infinity|new_block|new_channel|new_method|new_variable|next|nextkey|nice|nice|no_scan_tag|norm|norm2|not|npeek|nth|nth_dim|num_digits_big_int|num_dims|num_of_big_int|num_of_int|num_of_nat|num_of_ratio|num_of_string|o|obj|object_tag|ocaml_version|of_array|of_channel|of_float|of_int|of_int32|of_list|of_nativeint|of_string|one|opentk|open_box|open_connection|open_graph|open_hbox|open_hovbox|open_hvbox|open_in|open_in_bin|open_in_gen|open_out|open_out_bin|open_out_gen|open_process|open_process_full|open_process_in|open_process_out|open_subwindow|open_tag|open_tbox|open_temp_file|open_vbox|opendbm|opendir|openfile|or|os_type|out_channel_length|out_channel_of_descr|output|output_binary_int|output_buffer|output_byte|output_char|output_string|output_value|over_max_boxes|pack|params|parent_dir_name|parse|parse_argv|partition|pause|peek|pipe|pixels|place|plot|plots|point_color|polar|poll|pop|pos_in|pos_out|pow|power_big_int_positive_big_int|power_big_int_positive_int|power_int_positive_big_int|power_int_positive_int|power_num|pp_close_box|pp_close_tag|pp_close_tbox|pp_force_newline|pp_get_all_formatter_output_functions|pp_get_ellipsis_text|pp_get_formatter_output_functions|pp_get_formatter_tag_functions|pp_get_margin|pp_get_mark_tags|pp_get_max_boxes|pp_get_max_indent|pp_get_print_tags|pp_open_box|pp_open_hbox|pp_open_hovbox|pp_open_hvbox|pp_open_tag|pp_open_tbox|pp_open_vbox|pp_over_max_boxes|pp_print_as|pp_print_bool|pp_print_break|pp_print_char|pp_print_cut|pp_print_float|pp_print_flush|pp_print_if_newline|pp_print_int|pp_print_newline|pp_print_space|pp_print_string|pp_print_tab|pp_print_tbreak|pp_set_all_formatter_output_functions|pp_set_ellipsis_text|pp_set_formatter_out_channel|pp_set_formatter_output_functions|pp_set_formatter_tag_functions|pp_set_margin|pp_set_mark_tags|pp_set_max_boxes|pp_set_max_indent|pp_set_print_tags|pp_set_tab|pp_set_tags|pred|pred_big_int|pred_num|prerr_char|prerr_endline|prerr_float|prerr_int|prerr_newline|prerr_string|print|print_as|print_bool|print_break|print_char|print_cut|print_endline|print_float|print_flush|print_if_newline|print_int|print_newline|print_space|print_stat|print_string|print_tab|print_tbreak|printf|prohibit|public_method_label|push|putenv|quo_num|quomod_big_int|quote|raise|raise_window|ratio_of_num|rcontains_from|read|read_float|read_int|read_key|read_line|readdir|readdir|readlink|really_input|receive|recv|recvfrom|red|ref|regexp|regexp_case_fold|regexp_string|regexp_string_case_fold|register|register_exception|rem|remember_mode|remove|remove_assoc|remove_assq|rename|replace|replace_first|replace_matched|repr|reset|reshape|reshape_1|reshape_2|reshape_3|rev|rev_append|rev_map|rev_map2|rewinddir|rgb|rhs_end|rhs_end_pos|rhs_start|rhs_start_pos|rindex|rindex_from|rlineto|rmdir|rmoveto|round_num|run_initializers|run_initializers_opt|scanf|search_backward|search_forward|seek_in|seek_out|select|self|self_init|send|sendto|set|set_all_formatter_output_functions|set_approx_printing|set_binary_mode_in|set_binary_mode_out|set_close_on_exec|set_close_on_exec|set_color|set_ellipsis_text|set_error_when_null_denominator|set_field|set_floating_precision|set_font|set_formatter_out_channel|set_formatter_output_functions|set_formatter_tag_functions|set_line_width|set_margin|set_mark_tags|set_max_boxes|set_max_indent|set_method|set_nonblock|set_nonblock|set_normalize_ratio|set_normalize_ratio_when_printing|set_print_tags|set_signal|set_state|set_tab|set_tag|set_tags|set_text_size|set_window_title|setgid|setgid|setitimer|setitimer|setsid|setsid|setsockopt|setsockopt|setsockopt_float|setsockopt_float|setsockopt_int|setsockopt_int|setsockopt_optint|setsockopt_optint|setuid|setuid|sh\" — reverse-shell shape","kind":"ttp_detail","max_score":100,"members":339},{"examples":["@kenyaemr/esm-billing-app@5.4.4-pre.419","@kenyaemr/esm-billing-app@5.4.4-pre.420","@kenyaemr/esm-billing-app@5.4.4-pre.424","@kenyaemr/esm-billing-app@5.4.4-pre.425","@kenyaemr/esm-billing-app@5.4.4-pre.426","@kenyaemr/esm-billing-app@5.4.4-pre.427","@kenyaemr/esm-billing-app@5.4.4-pre.428","@kenyaemr/esm-billing-app@5.4.4-pre.429","@kenyaemr/esm-billing-app@5.4.4-pre.430","@kenyaemr/esm-billing-app@5.4.4-pre.432"],"key":"reverse_shell:matched \"mkfifo|posix_mknod|posix_setegid|posix_seteuid|posix_setgid|posix_setpgid|posix_setsid|posix_setuid|posix_strerror|posix_times|posix_ttyname|posix_uname|pow|preg_filter|preg_grep|preg_last_error|preg_match|preg_match_all|preg_quote|preg_replace|preg_replace_callback|preg_split|prev|print|print_r|printer_abort|printer_close|printer_create_brush|printer_create_dc|printer_create_font|printer_create_pen|printer_delete_brush|printer_delete_dc|printer_delete_font|printer_delete_pen|printer_draw_bmp|printer_draw_chord|printer_draw_elipse|printer_draw_line|printer_draw_pie|printer_draw_rectangle|printer_draw_roundrect|printer_draw_text|printer_end_doc|printer_end_page|printer_get_option|printer_list|printer_logical_fontheight|printer_open|printer_select_brush|printer_select_font|printer_select_pen|printer_set_option|printer_start_doc|printer_start_page|printer_write|printf|proc_close|proc_get_status|proc_nice|proc_open|proc_terminate|property_exists|ps_add_bookmark|ps_add_launchlink|ps_add_locallink|ps_add_note|ps_add_pdflink|ps_add_weblink|ps_arc|ps_arcn|ps_begin_page|ps_begin_pattern|ps_begin_template|ps_circle|ps_clip|ps_close|ps_close_image|ps_closepath|ps_closepath_stroke|ps_continue_text|ps_curveto|ps_delete|ps_end_page|ps_end_pattern|ps_end_template|ps_fill|ps_fill_stroke|ps_findfont|ps_get_buffer|ps_get_parameter|ps_get_value|ps_hyphenate|ps_include_file|ps_lineto|ps_makespotcolor|ps_moveto|ps_new|ps_open_file|ps_open_image|ps_open_image_file|ps_open_memory_image|ps_place_image|ps_rect|ps_restore|ps_rotate|ps_save|ps_scale|ps_set_border_color|ps_set_border_dash|ps_set_border_style|ps_set_info|ps_set_parameter|ps_set_text_pos|ps_set_value|ps_setcolor|ps_setdash|ps_setflat|ps_setfont|ps_setgray|ps_setlinecap|ps_setlinejoin|ps_setlinewidth|ps_setmiterlimit|ps_setoverprintmode|ps_setpolydash|ps_shading|ps_shading_pattern|ps_shfill|ps_show|ps_show2|ps_show_boxed|ps_show_xy|ps_show_xy2|ps_string_geometry|ps_stringwidth|ps_stroke|ps_symbol|ps_symbol_name|ps_symbol_width|ps_translate|pspell_add_to_personal|pspell_add_to_session|pspell_check|pspell_clear_session|pspell_config_create|pspell_config_data_dir|pspell_config_dict_dir|pspell_config_ignore|pspell_config_mode|pspell_config_personal|pspell_config_repl|pspell_config_runtogether|pspell_config_save_repl|pspell_new|pspell_new_config|pspell_new_personal|pspell_save_wordlist|pspell_store_replacement|pspell_suggest|putenv|px_close|px_create_fp|px_date2string|px_delete|px_delete_record|px_get_field|px_get_info|px_get_parameter|px_get_record|px_get_schema|px_get_value|px_insert_record|px_new|px_numfields|px_numrecords|px_open_fp|px_put_record|px_retrieve_record|px_set_blob_file|px_set_parameter|px_set_tablename|px_set_targetencoding|px_set_value|px_timestamp2string|px_update_record|qdom_error|qdom_tree|quoted_printable_decode|quoted_printable_encode|quotemeta|rad2deg|radius_acct_open|radius_add_server|radius_auth_open|radius_close|radius_config|radius_create_request|radius_cvt_addr|radius_cvt_int|radius_cvt_string|radius_demangle|radius_demangle_mppe_key|radius_get_attr|radius_get_vendor_attr|radius_put_addr|radius_put_attr|radius_put_int|radius_put_string|radius_put_vendor_addr|radius_put_vendor_attr|radius_put_vendor_int|radius_put_vendor_string|radius_request_authenticator|radius_send_request|radius_server_secret|radius_strerror|rand|range|rangeexception|rar_wrapper_cache_stats|rararchive|rarentry|rarexception|rawurldecode|rawurlencode|read_exif_data|readdir|readfile|readgzfile|readline|readline_add_history|readline_callback_handler_install|readline_callback_handler_remove|readline_callback_read_char|readline_clear_history|readline_completion_function|readline_info|readline_list_history|readline_on_new_line|readline_read_history|readline_redisplay|readline_write_history|readlink|realpath|realpath_cache_get|realpath_cache_size|recode|recode_file|recode_string|recursivearrayiterator|recursivecachingiterator|recursivecallbackfilteriterator|recursivedirectoryiterator|recursivefilteriterator|recursiveiterator|recursiveiteratoriterator|recursiveregexiterator|recursivetreeiterator|reflection|reflectionclass|reflectionexception|reflectionextension|reflectionfunction|reflectionfunctionabstract|reflectionmethod|reflectionobject|reflectionparameter|reflectionproperty|reflector|regexiterator|register_shutdown_function|register_tick_function|rename|rename_function|require|require_once|reset|resetvalue|resourcebundle|restore_error_handler|restore_exception_handler|restore_include_path|return|rewind|rewinddir|rmdir|round|rpm_close|rpm_get_tag|rpm_is_valid|rpm_open|rpm_version|rrd_create|rrd_error|rrd_fetch|rrd_first|rrd_graph|rrd_info|rrd_last|rrd_lastupdate|rrd_restore|rrd_tune|rrd_update|rrd_xport|rrdcreator|rrdgraph|rrdupdater|rsort|rtrim|runkit_class_adopt|runkit_class_emancipate|runkit_constant_add|runkit_constant_redefine|runkit_constant_remove|runkit_function_add|runkit_function_copy|runkit_function_redefine|runkit_function_remove|runkit_function_rename|runkit_import|runkit_lint|runkit_lint_file|runkit_method_add|runkit_method_copy|runkit_method_redefine|runkit_method_remove|runkit_method_rename|runkit_return_value_used|runkit_sandbox_output_handler|runkit_superglobals|runtimeexception|samconnection_commit|samconnection_connect|samconnection_constructor|samconnection_disconnect|samconnection_errno|samconnection_error|samconnection_isconnected|samconnection_peek|samconnection_peekall|samconnection_receive|samconnection_remove|samconnection_rollback|samconnection_send|samconnection_setdebug|samconnection_subscribe|samconnection_unsubscribe|sammessage_body|sammessage_constructor|sammessage_header|sca_createdataobject|sca_getservice|sca_localproxy_createdataobject|sca_soapproxy_createdataobject|scandir|sdo_das_changesummary_beginlogging|sdo_das_changesummary_endlogging|sdo_das_changesummary_getchangeddataobjects|sdo_das_changesummary_getchangetype|sdo_das_changesummary_getoldcontainer|sdo_das_changesummary_getoldvalues|sdo_das_changesummary_islogging|sdo_das_datafactory_addpropertytotype|sdo_das_datafactory_addtype|sdo_das_datafactory_getdatafactory|sdo_das_dataobject_getchangesummary|sdo_das_relational_applychanges|sdo_das_relational_construct|sdo_das_relational_createrootdataobject|sdo_das_relational_executepreparedquery|sdo_das_relational_executequery|sdo_das_setting_getlistindex|sdo_das_setting_getpropertyindex|sdo_das_setting_getpropertyname|sdo_das_setting_getvalue|sdo_das_setting_isset|sdo_das_xml_addtypes|sdo_das_xml_create|sdo_das_xml_createdataobject|sdo_das_xml_createdocument|sdo_das_xml_document_getrootdataobject|sdo_das_xml_document_getrootelementname|sdo_das_xml_document_getrootelementuri|sdo_das_xml_document_setencoding|sdo_das_xml_document_setxmldeclaration|sdo_das_xml_document_setxmlversion|sdo_das_xml_loadfile|sdo_das_xml_loadstring|sdo_das_xml_savefile|sdo_das_xml_savestring|sdo_datafactory_create|sdo_dataobject_clear|sdo_dataobject_createdataobject|sdo_dataobject_getcontainer|sdo_dataobject_getsequence|sdo_dataobject_gettypename|sdo_dataobject_gettypenamespaceuri|sdo_exception_getcause|sdo_list_insert|sdo_model_property_getcontainingtype|sdo_model_property_getdefault|sdo_model_property_getname|sdo_model_property_gettype|sdo_model_property_iscontainment|sdo_model_property_ismany|sdo_model_reflectiondataobject_construct|sdo_model_reflectiondataobject_export|sdo_model_reflectiondataobject_getcontainmentproperty|sdo_model_reflectiondataobject_getinstanceproperties|sdo_model_reflectiondataobject_gettype|sdo_model_type_getbasetype|sdo_model_type_getname|sdo_model_type_getnamespaceuri|sdo_model_type_getproperties|sdo_model_type_getproperty|sdo_model_type_isabstracttype|sdo_model_type_isdatatype|sdo_model_type_isinstance|sdo_model_type_isopentype|sdo_model_type_issequencedtype|sdo_sequence_getproperty|sdo_sequence_insert|sdo_sequence_move|seekableiterator|sem_acquire|sem_get|sem_release|sem_remove|serializable|serialize|session_cache_expire|session_cache_limiter|session_commit|session_decode|session_destroy|session_encode|session_get_cookie_params|session_id|session_is_registered|session_module_name|session_name|session_pgsql_add_error|session_pgsql_get_error|session_pgsql_get_field|session_pgsql_reset|session_pgsql_set_field|session_pgsql_status|session_regenerate_id|session_register|session_save_path|session_set_cookie_params|session_set_save_handler|session_start|session_unregister|session_unset|session_write_close|setcounterclass|set_error_handler|set_exception_handler|set_file_buffer|set_include_path|set_magic_quotes_runtime|set_socket_blocking|set_time_limit|setcookie|setlocale|setproctitle|setrawcookie|setstaticpropertyvalue|setthreadtitle|settype|sh\" — reverse-shell shape","kind":"ttp_detail","max_score":100,"members":336},{"examples":["blitzar-sys@1.115.2","blitzar-sys@1.115.3","codecpod@0.1.0","codecpod@0.1.1","codecpod@0.1.1-rc2","codecpod@0.1.1-rc3","codecpod@0.1.2","codecpod@0.2.0","codecpod@0.2.1","codecpod@0.2.2"],"key":"rs_build_time_command_combo:process spawn (std::process::command) paired with network / base64 / env-token read at build time.","kind":"ttp_detail","max_score":200,"members":335},{"examples":["@100xprompt/cli-darwin-x64-baseline@0.0.0-dev-full1","@100xprompt/cli-darwin-x64-baseline@0.1.1","@100xprompt/cli-darwin-x64@0.0.0-dev-full1","@100xprompt/cli-darwin-x64@0.1.1","@4o3f/lapis@0.2.0","@achuthanmukundan00/synax@0.3.0-beta","@achuthanmukundan00/synax@0.3.0-beta.1","@agent-chassis/core@0.4.2","@agents-npm-packages/supercompress@1.0.1","@agxnte/reidx@2.0.2"],"key":"new_account_with_lifecycle_hook:package first published 1 day(s) ago, 2 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":109,"members":308},{"examples":["@capibar.chat/ui-kit@99.5.7","@car-loans/applicaion-aff@99.99.99","@car-loans/application-aff@99.99.99","@car-loans/close-flow-module@99.99.99","@car-loans/deal-aff@99.99.99","@car-loans/deal@99.99.99","@car-loans/desktop-car-loans-application@99.99.99","@car-loans/feature-toggles-module@99.99.99","@car-loans/general-analytics@99.99.99","@car-loans/general-feature-toggles@99.99.99"],"key":"install_lifecycle_remote_or_exec:postinstall=\"node scripts/postinstall.js\"","kind":"ttp_detail","max_score":0,"members":296},{"examples":["@amodalai/runtime@0.3.93","@amodalai/runtime@0.3.94","@amodalai/runtime@0.3.95","@amodalai/runtime@0.3.96","@futdevpro/fsm-dynamo@1.16.11","@futdevpro/fsm-dynamo@1.16.12","@futdevpro/fsm-dynamo@1.16.13","@learning-with-court/cli@0.16.4","@learning-with-court/cli@0.16.5","@learning-with-court/cli@0.16.8"],"key":"shipped_live_secret:a live anthropic api secret is hardcoded in a packaged file — a credential-grabber's exfil key or a leaked maintainer credential. legit code reads provider keys from env/config and never ships one.","kind":"ttp_detail","max_score":135,"members":294},{"examples":["@0dai-dev/cli@4.2.0","@0dai-dev/cli@4.3.4","@0dai-dev/cli@4.3.5","@0dai-dev/cli@4.3.6","@0dai-dev/cli@4.3.7","@0dai-dev/cli@4.3.8","@0dai-dev/cli@4.3.9","@0dai-dev/cli@4.4.0","@0dai-dev/cli@4.4.1","@0dai-dev/cli@4.4.2"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node scripts/postinstall.js || true\"","kind":"ttp_detail","max_score":109,"members":290},{"examples":["@blundergoat/gruff-ts@0.3.0","@blundergoat/gruff-ts@0.3.1","@blundergoat/gruff-ts@0.3.2","@blundergoat/gruff-ts@0.4.0","@evalguard/core@1.0.0","@evalguard/core@1.0.1","@evalguard/core@1.1.0","@evalguard/core@1.2.0","@evalguard/core@1.3.0","@evalguard/core@1.4.0"],"key":"webhook_exfil_endpoint:matched \"hooks.slack.com/services/\"","kind":"ttp_detail","max_score":545,"members":280},{"examples":["@2qp/linguist@0.0.1","@2qp/linguist@0.0.2","@agent-vm/agent-vm@0.0.80","@ai-support-agent/cli@0.1.10","@ai-support-agent/cli@0.1.10-beta.0","@ai-support-agent/cli@0.1.11","@ai-support-agent/cli@0.1.11-beta.0","@ai-support-agent/cli@0.1.12","@ai-support-agent/cli@0.1.12-beta.0","@ai-support-agent/cli@0.1.9"],"key":"credential_paths:matched \".ssh\"","kind":"ttp_detail","max_score":1,"members":272},{"examples":["@0xlr/clerk-auth@999.0.0","@0xlr/prisma-client-js@999.0.0","@0xlr/sentry-web@999.0.0","@0xlr/stripe-checkout-js@999.0.0","@0xlr/stripe-frontend@999.0.0","@0xlr/supabase-db@999.0.0","@0xlr/vercel-analytics@999.0.0","@app-tray-ui/stencil-component@10.1.0","@bancolonbia/menu-filter-widget-web@0.0.1","@challenger6/vm-pattern-library@99.0.0"],"key":"dns_or_oast_exfil:matched \"oastify.com\"","kind":"ttp_detail","max_score":311,"members":257},{"examples":["acme-widget-layout-utils@0.0.1","acme-widget-layout-utils@0.0.2","acme-widget-layout-utils@0.0.3","agent-utilities@0.52.0","agent-utilities@0.53.0","agent-utilities@1.0.1","aiohomematic@2026.5.10","aiohomematic@2026.5.11","aiohomematic@2026.6.0","aiohomematic@2026.6.1"],"key":"py_import_time_raw_socket:raw socket creation at install or import time.","kind":"ttp_detail","max_score":152,"members":250},{"examples":["9remote-beta@2.0.35","9remote-beta@2.0.36","@0x1labs/vyer@0.1.4","@advergic-ads/react-native-sdk@1.0.4","@apexfdn/apex@1.0.4","@appfire-ux/audit-agent@0.20260702.0","@appfire-ux/audit-agent@0.20260702.1","@appfire-ux/audit-agent@0.20260702.2","@b12k/fluffering-flafamonia@0.1.0","@cc-claw/code@0.6.14"],"key":"new_account_with_lifecycle_hook:package first published 0 day(s) ago, 5 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":217,"members":246},{"examples":["airkey-mfa-react@29.1.1","airkey-mfa-react@35.1.1","airkey-mfa-react@36.1.1","ap3-components-ui@9.999.0","bingo-ai@3.2.57","bingo-ai@3.2.58","bingo-ai@3.2.59","bingo-ai@3.2.60","bingo-ai@3.2.61","bingo-ai@3.2.62"],"key":"dns_or_oast_exfil:matched \".oast.fun\"","kind":"ttp_detail","max_score":496,"members":243},{"examples":["@goyoon/weft@0.1.0","@goyoon/weft@0.1.1","@goyoon/weft@0.2.0","@hebbianvault/mcp@0.2.0","@nextsparkjs/ai-workflow@0.1.0-beta.153","@nextsparkjs/ai-workflow@0.1.0-beta.154","@nextsparkjs/ai-workflow@0.1.0-beta.155","@nextsparkjs/ai-workflow@0.1.0-beta.156","@nextsparkjs/ai-workflow@0.1.0-beta.157","@nextsparkjs/ai-workflow@0.1.0-beta.158"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node scripts/postinstall.mjs || true\"","kind":"ttp_detail","max_score":47,"members":236},{"examples":["drydock-agent@2.10.13","drydock-agent@2.10.14","drydock-agent@2.10.15","drydock-agent@2.10.16","drydock-agent@2.10.23","drydock-agent@2.10.28","drydock-agent@2.10.29","drydock-agent@2.10.30","drydock-agent@2.10.32","drydock-agent@2.10.33"],"key":"py_runtime_dynamic_dangerous_import:dynamic __import__('os') — reflection bypass for static checks.","kind":"ttp_detail","max_score":70,"members":234},{"examples":["@pentoshi/clai@1.1.3","@pentoshi/clai@1.1.4","@pentoshi/clai@1.2.0","@pentoshi/clai@1.2.1","@pentoshi/clai@1.2.2","@pentoshi/clai@1.2.3","@pentoshi/clai@1.2.4","@pentoshi/clai@1.2.5","@pentoshi/clai@1.2.6","@shriyanss/js-recon@1.1.0-beta.1"],"key":"credential_paths:matched \".aws/\"","kind":"ttp_detail","max_score":159,"members":231},{"examples":["agilab@2026.5.29","agilab@2026.5.30","agilab@2026.5.30.post1","agilab@2026.5.31","agilab@2026.5.31.post1","agilab@2026.6.1","agilab@2026.6.12","agilab@2026.6.13","agilab@2026.6.13.1","agilab@2026.6.14.1"],"key":"py_runtime_base64_decode:base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.","kind":"ttp_detail","max_score":349,"members":220},{"examples":["acellera-htmd@2.8.2","acellera-htmd@2.8.3","acellera-htmd@2.8.4","acellera-htmd@2.8.5","acellera-htmd@2.8.6","acellera-htmd@2.8.8","acellera-htmd@2.8.9","acellera-htmd@2.9.0","acellera-htmd@2.9.1","aegis-harness@0.11.0"],"key":"py_import_time_compile_exec:python exec(compile(...)) — typical obfuscated loader pattern.","kind":"ttp_detail","max_score":164,"members":206},{"examples":["aframeuz@0.1.0","aframeuz@0.1.1","aframeuz@0.1.2","aframeuz@0.1.3","agora-python-server-sdk@2.4.6","agora-python-server-sdk@2.4.7","agora-python-server-sdk@2.4.8","agora-python-server-sdk@2.4.9","airflow-dbt-winwin@0.6.1","airflow-dbt-winwin@0.6.2"],"key":"py_install_time_os_system:direct shell invocation via os.system / os.popen / os.exec*.","kind":"ttp_detail","max_score":143,"members":202},{"examples":["1cattunnel@0.1.2-b.3","9router-ray@0.5.18","@100xprompt/cli-darwin-arm64@0.1.1","@100xprompt/cli-darwin-x64-baseline@0.1.2","@100xprompt/cli-darwin-x64@0.1.2","@achuthanmukundan00/synax@0.3.0","@adobedjangir/commerce-admin-audit-log@0.1.3","@adobedjangir/commerce-admin-ims-access@0.1.2","@adobedjangir/commerce-admin-snapshots@0.1.2","@aduermael_/wb@0.1.3"],"key":"new_account_with_lifecycle_hook:package first published 1 day(s) ago, 3 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":128,"members":200},{"examples":["@authensor/aegis@0.0.1","@authensor/aegis@0.1.0","@cerberus-ai/core@1.2.1","@cerberus-ai/core@1.3.0","@cerberus-ai/core@1.4.0","@cerberus-ai/core@3.0.0","@cerberus-ai/core@3.0.1","@cerberus-ai/core@3.0.2","@cerberus-ai/core@3.1.0","@goplus/agentguard@1.1.14"],"key":"dns_or_oast_exfil:matched \"burpcollaborator.net\"","kind":"ttp_detail","max_score":496,"members":190},{"examples":["@adobe/nodegit@0.22.2-fork.0","@adobe/nodegit@0.22.2-fork.1","@brightsec/node-libcurl@5.0.14-0","@brightsec/node-libcurl@5.0.8","@brightsec/node-libcurl@5.1.0","@brightsec/node-libcurl@5.1.2-0","@immobiliarelabs/backstage-plugin-gitlab-backend@3.0.3","@immobiliarelabs/backstage-plugin-gitlab-backend@4.0.2","@immobiliarelabs/backstage-plugin-gitlab-backend@5.2.1","@immobiliarelabs/backstage-plugin-gitlab-backend@6.13.1"],"key":"native_addon_gyp_action:binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle)","kind":"ttp_detail","max_score":45,"members":183},{"examples":["@agent-chassis/agent-launch-cli@0.4.3","@agent-chassis/agent-launch-cli@0.5.0","@agent-chassis/agent-launch-cli@0.5.1","@agentworkforce/cli@4.1.23","@agentworkforce/cli@4.1.24","@agentworkforce/cli@4.1.25","@agentworkforce/cli@4.1.26","@agentworkforce/cli@4.1.27","@agentworkforce/cli@4.1.29","@agentworkforce/cli@4.1.30"],"key":"js_concat_require_obfuscation:require() of a sensitive builtin (child_process/crypto/http/net/fs) built by concatenating string literals (require('cry'+'pto')) — module-name obfuscation to defeat static import analysis; no legitimate use.","kind":"ttp_detail","max_score":311,"members":182},{"examples":["@100xprompt/cli-darwin-arm64@0.1.3","@adnansiddiqui-dev/jssm-cli@1.9.12","@adnansiddiqui-dev/jssm-cli@1.9.13","@adobehrjain/commerce-admin-management@0.0.26","@aduermael_/wb@0.1.5","@agora-build/dialf@0.1.4","@agxnte/reidx@2.0.6","@aiaiaichain/agent@0.1.5","@andy-toolforge/tts-generator@0.4.0","@artheras/aria-code@4.1.4"],"key":"new_account_with_lifecycle_hook:package first published 1 day(s) ago, 5 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":283,"members":180},{"examples":["confers-macros@0.4.0","confers-macros@0.4.1","dbnexus-macros@0.2.0","dbnexus-macros@0.3.0","dbnexus-macros@0.3.1","dbnexus-macros@0.3.2","dbnexus-macros@0.3.3","dbnexus-macros@0.3.4","dirge-agent@0.1.0","dirge-agent@0.10.0"],"key":"rs_build_time_fs_out_of_band:filesystem path outside the build out_dir / cargo cache (/etc, $home, ~/.ssh, /tmp/*.sh).","kind":"ttp_detail","max_score":200,"members":177},{"examples":["@a5c-ai/agent-mux-adapters@5.0.1-staging.04ca6ab00d21","@a5c-ai/agent-mux-adapters@5.0.1-staging.b436b3b3e611","@agent-native/core@0.22.43","@agent-native/core@0.22.44","@ai-support-agent/cli@0.1.10","@ai-support-agent/cli@0.1.10-beta.0","@ai-support-agent/cli@0.1.11","@ai-support-agent/cli@0.1.11-beta.0","@ai-support-agent/cli@0.1.12","@ai-support-agent/cli@0.1.12-beta.0"],"key":"credential_paths:matched \".aws\"","kind":"ttp_detail","max_score":1,"members":177},{"examples":["@grovetech/defender@0.2.1","@grovetech/defender@0.2.2","@grovetech/defender@0.2.3","@grovetech/defender@0.3.0","@mdxui/cockpit@7.0.7","@sanctum-key/react-native-sdk@1.0.28","@sanctum-key/react-native-sdk@1.0.29","@sanctum-key/react-native-sdk@1.0.30","@sanctum-key/react-native-sdk@1.0.31","@stridge/openapi@0.2.0"],"key":"shipped_live_secret:a live stripe live secret is hardcoded in a packaged file — a credential-grabber's exfil key or a leaked maintainer credential. legit code reads provider keys from env/config and never ships one.","kind":"ttp_detail","max_score":183,"members":175},{"examples":["@polderlabs/bizar-dash@3.10.0","@polderlabs/bizar-dash@3.11.0","@polderlabs/bizar-dash@3.12.0","@polderlabs/bizar-dash@3.12.1","@polderlabs/bizar-dash@3.12.2","@polderlabs/bizar-dash@3.12.3","@polderlabs/bizar-dash@3.12.4","@polderlabs/bizar-dash@3.13.0","@polderlabs/bizar-dash@3.14.0","@polderlabs/bizar-dash@3.15.0"],"key":"drb0rk","kind":"publisher_high_risk","max_score":184,"members":169},{"examples":["100xprompt-cli@0.1.1","@100xprompt/cli-darwin-arm64@0.1.2","@100xprompt/cli-darwin-x64-baseline@0.1.3","@100xprompt/cli-darwin-x64@0.1.3","@adobehrjain/commerce-admin-management@0.0.25","@aduermael_/wb@0.1.4","@agxnte/reidx@2.0.5","@alosha/vue-select@4.0.4","@andy-toolforge/tts-generator@0.3.0","@artheras/aria-code@4.1.3"],"key":"new_account_with_lifecycle_hook:package first published 1 day(s) ago, 4 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":283,"members":168},{"examples":["@autofleet/rabbit@3.2.17-beta-1","@autofleet/rabbit@3.2.20-beta-quorum","@beyonk/svelte-mapbox@12.1.2","@beyonk/svelte-mapbox@12.1.3","@dcl-regenesislabs/bevy-explorer-web@0.1.0-27223465980.commit-f8f7cac","@dcl-regenesislabs/bevy-explorer-web@0.1.0-27267316371.commit-409cd61","@dcl-regenesislabs/bevy-explorer-web@0.1.0-27294383055.commit-a76d454","@dcl-regenesislabs/bevy-explorer-web@0.1.0-27311931519.commit-85ce104","@dcl-regenesislabs/bevy-explorer-web@0.1.0-27366004667.commit-b53aa9b","@dcl-regenesislabs/bevy-explorer-web@0.1.0-27408899261.commit-093900c"],"key":"credential_file_packaged:package/.env","kind":"ttp_detail","max_score":110,"members":168},{"examples":["@andyqiu/codeforge@0.8.11","@andyqiu/codeforge@0.8.12","@andyqiu/codeforge@0.8.13","@andyqiu/codeforge@0.8.14","@andyqiu/codeforge@0.8.15","@andyqiu/codeforge@0.8.16","@andyqiu/codeforge@0.8.17","@andyqiu/codeforge@0.8.18","@andyqiu/codeforge@0.8.19","@andyqiu/codeforge@0.8.20"],"key":"credential_paths:matched \"id_rsa\"","kind":"ttp_detail","max_score":245,"members":167},{"examples":["abraia@0.27.0","abraia@0.27.1","affx@1.0.0","affx@1.1","aperturedb@0.4.60","bfit@4.22.5","bioregistry@0.13.59","bioregistry@0.13.60","bioregistry@0.13.61","bioregistry@0.13.62"],"key":"py_import_time_network_call:network call (urllib/requests/httpx/http.client) at install or import time.","kind":"ttp_detail","max_score":349,"members":166},{"examples":["@ajaysoni7832/lean-ids-components@1.7.1","@ajaysoni7832/lean-ids-components@1.7.2","@ajaysoni7832/lean-ids-components@1.7.3","@ajaysoni7832/lean-ids-components@1.7.4","@ajaysoni7832/lean-ids-components@1.7.5","@duongy96/gladcn@0.2.1","@duongy96/gladcn@0.2.10","@duongy96/gladcn@0.2.11","@duongy96/gladcn@0.2.12","@duongy96/gladcn@0.2.2"],"key":"install_lifecycle_suppresses_failure:postinstall=\"node scripts/postinstall.cjs || true\"","kind":"ttp_detail","max_score":70,"members":163},{"examples":["@mneme-ai/core@2.43.0","@mneme-ai/core@2.44.0","@mneme-ai/core@2.45.0","@mneme-ai/core@2.48.0","@mneme-ai/core@2.49.0","@mneme-ai/core@2.50.0","@mneme-ai/core@3.10.0","@mneme-ai/core@3.100.0","@mneme-ai/core@3.101.0","@mneme-ai/core@3.103.0"],"key":"mneme_npm","kind":"publisher_high_risk","max_score":372,"members":159},{"examples":["@adobe/openwhisk-probot-builder@1.0.63","@adobe/openwhisk-probot-builder@1.0.64","@adobe/openwhisk-probot-builder@1.0.65","@adobe/openwhisk-probot-builder@1.0.66","@backstage/cli-module-github@0.0.0-nightly-20260518032303","@backstage/cli-module-github@0.0.0-nightly-20260519032312","@backstage/cli-module-github@0.0.0-nightly-20260612032440","@backstage/cli-module-github@0.0.0-nightly-20260613032133","@backstage/cli-module-github@0.0.0-nightly-20260614032343","@backstage/cli-module-github@0.0.0-nightly-20260615032517"],"key":"webhook_exfil_endpoint:matched \"smee.io\"","kind":"ttp_detail","max_score":119,"members":157},{"examples":["@tscircuit/capacity-autorouter@0.0.548","@tscircuit/capacity-autorouter@0.0.549","@tscircuit/capacity-autorouter@0.0.550","@tscircuit/capacity-autorouter@0.0.551","@tscircuit/capacity-autorouter@0.0.552","@tscircuit/capacity-autorouter@0.0.553","@tscircuit/capacity-autorouter@0.0.554","@tscircuit/capacity-autorouter@0.0.555","@tscircuit/capacity-autorouter@0.0.556","@tscircuit/capacity-autorouter@0.0.557"],"key":"seveibar","kind":"publisher_high_risk","max_score":132,"members":155},{"examples":["@aihubmix/ai-vendor-specs@0.1.0","@aj-2000-test/goodlogs-mcp@0.1.0","@aj-2000-test/goodlogs-sdk@0.1.1","@aj-2000-test/goodlogs-sdk@0.1.10","@aj-2000-test/goodlogs-sdk@0.1.11","@aj-2000-test/goodlogs-sdk@0.1.2","@aj-2000-test/goodlogs-sdk@0.1.3","@aj-2000-test/goodlogs-sdk@0.1.4","@aj-2000-test/goodlogs-sdk@0.1.5","@aj-2000-test/goodlogs-sdk@0.1.6"],"key":"credential_paths:matched \".azure\"","kind":"ttp_detail","max_score":1,"members":150},{"examples":["aiops-ml@1.0.0","codex-cli-usage@0.1.8","dagster-cloud-cli@1.13.11","dagster-cloud-cli@1.13.12","dagster-cloud-cli@1.13.13","dagster-cloud-cli@1.13.14","dagster-cloud-cli@1.13.7","dagster-pipes@1.13.11","dagster-pipes@1.13.12","dagster-pipes@1.13.13"],"key":"py_import_time_base64_decode:base64/base85/hex/zlib decode combined with exec/subprocess — classic obfuscated payload pattern.","kind":"ttp_detail","max_score":250,"members":148},{"examples":["agentorch-core@1.0.1","awpl-loader@0.1.0","awpl-loader@0.2.0","botversion-sdk@1.1.6","botversion-sdk@1.1.7","coevopy@0.4","conservation-regime@0.1.0","cron-pipe@0.1.0","dfx-agentguard@0.2.1","dfx-agentguard@0.2.2"],"key":"py_install_time_dynamic_dangerous_import:dynamic __import__('os') of a dangerous stdlib module.","kind":"ttp_detail","max_score":65,"members":147},{"examples":["abseil-py@0.1.0","adcc@0.17.1","adcc@0.18.0","anthropickit@999.9.9","aop-launcher@1.0.0","aorta-sirius-dev@0.273","aorta-sirius-dev@0.274","aorta-sirius-dev@0.275","aorta-sirius-dev@0.276","aorta-sirius-dev@0.277"],"key":"py_install_time_network_call:network call (urllib/requests/httpx/http.client) at install or import time.","kind":"ttp_detail","max_score":349,"members":139},{"examples":["carousel-controller-mixin@999.0.0","eveee@1.0.0","eveee@1.0.1","eveee@1.0.7","eyee@1.0.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.1","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.2","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.3","gitea.lerkolabs.com/lerkolabs/uptop@v0.1.0-rc.4"],"key":"webhook_exfil_endpoint:matched \"discord.com/api/webhooks/\"","kind":"ttp_detail","max_score":311,"members":130},{"examples":["@across-toolkit/eslint-config@99.0.0","@across-toolkit/eslint-config@99.0.1","@across-toolkit/typescript-config@99.0.0","@across-toolkit/typescript-config@99.0.1","@dreamlake/lakeshore@0.1.15","@dreamlake/lakeshore@0.1.16","@dreamlake/lakeshore@0.1.17","@dreamlake/lakeshore@0.2.0","@geravant/sinain@1.32.0","@geravant/sinain@1.33.0"],"key":"install_hook_credential_exfil:an npm lifecycle-hook script (runs at install) reads a private credential/identity file (.ssh/.aws/.git-credentials/.gitconfig/keystore) and has an outbound network sink — install-time credential/recon stealer.","kind":"ttp_detail","max_score":245,"members":124},{"examples":["@agentai2026/openclaw-zh@2026.5.27-zh","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.4","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.5","@agentai2026/openclaw-zh@2026.5.27-zh.nightly.6","@agentai2026/openclaw-zh@2026.5.28-zh","@bitplanet/genie-openclaw@2026.5.28","@coinflowlabs/angular@1.10.0","@coinflowlabs/angular@1.11.0","@coinflowlabs/angular@1.12.0","@coinflowlabs/angular@1.9.0"],"key":"webhook_exfil_endpoint:matched \"ngrok.app\"","kind":"ttp_detail","max_score":251,"members":121},{"examples":["cicy-desktop@2.1.135","cicy-desktop@2.1.136","cicy-desktop@2.1.137","cicy-desktop@2.1.138","cicy-desktop@2.1.139","cicy-desktop@2.1.140","cicy-desktop@2.1.141","cicy-desktop@2.1.142","cicy-desktop@2.1.143","cicy-desktop@2.1.144"],"key":"cicybot","kind":"publisher_high_risk","max_score":141,"members":117},{"examples":["@onescience/onecode@1.14.50-202607061826","@onescience/onecode@1.14.50-202607071729","@onescience/onecode@1.14.50-202607131011","@onescience/onecode@1.14.50-202607131556","@onescience/onecode@1.14.50-202607131742","@onescience/onecode@1.14.50-202607141602","@onescience/onecode@1.14.50-202607141643","@onescience/onecode@1.14.50-202607141712","@onescience/onecode@1.14.50-202607141744","@onescience/onecode@1.14.50-202607151040"],"key":"install_hook_ip_c2:an npm lifecycle-hook script contacts a hardcoded public ip address (no domain) — an install-time c2 beacon / rat. legitimate install hooks address services by domain, not a bare ip.","kind":"ttp_detail","max_score":245,"members":115},{"examples":["@emcd-vue/auth@6.4.9","@ikyyofc/gemini-cli@5.0.0","@intentsolution/database-security-scanner@1.0.0","@invarn/cibuild@2.3.6","@invarn/cibuild@2.3.8","@miracleplus/mplus@0.6.0","@miracleplus/mplus@0.6.1","@miracleplus/mplus@0.6.2","@miracleplus/mplus@0.6.3","@mulerunai/cli@0.2.6"],"key":"js_obfuscator_packer:javascript-obfuscator string-array packer — 30+ hexadecimal-indexed decoder calls plus the tool's rc4 key or self-defending rotator iife; the obfuscated form used by npm dropper/exfil families to hide c2 urls and child-process exec from static analysis.","kind":"ttp_detail","max_score":155,"members":114},{"examples":["natureco-cli@4.4.0","natureco-cli@4.4.1","natureco-cli@4.5.0","natureco-cli@4.5.1","natureco-cli@4.5.2","natureco-cli@4.5.3","natureco-cli@4.6.0","natureco-cli@4.6.1","natureco-cli@4.6.2","natureco-cli@4.6.3"],"key":"natureco","kind":"publisher_high_risk","max_score":99,"members":113},{"examples":["andrevanzuydam/tina4php@3.13.0","andrevanzuydam/tina4php@3.13.13","andrevanzuydam/tina4php@3.13.14","andrevanzuydam/tina4php@3.13.18","andrevanzuydam/tina4php@3.13.19","andrevanzuydam/tina4php@3.13.2","andrevanzuydam/tina4php@3.13.23","andrevanzuydam/tina4php@3.13.24","andrevanzuydam/tina4php@3.13.31","andrevanzuydam/tina4php@3.13.32"],"key":"php_remote_fetch_exec_combo:remote fetch (file_get_contents/curl) paired with eval/exec — fetch-and-run pattern.","kind":"ttp_detail","max_score":160,"members":112},{"examples":["querysub@0.454.0","querysub@0.455.0","querysub@0.456.0","querysub@0.457.0","querysub@0.458.0","querysub@0.459.0","querysub@0.460.0","querysub@0.461.0","querysub@0.462.0","querysub@0.464.0"],"key":"sliftist","kind":"publisher_high_risk","max_score":42,"members":112},{"examples":["@100xprompt/cli-darwin-x64-baseline@0.1.4","@100xprompt/cli-darwin-x64@0.1.4","@adobedjangir/commerce-admin-management@0.0.7","@adobedjangir/commerce-admin-management@0.0.8","@archeaxon/axon-code@1.0.4","@benitbuhner/opengoal-darwin-arm64@0.1.1","@benitbuhner/opengoal-darwin-x64-baseline@0.1.1","@benitbuhner/opengoal-darwin-x64@0.1.1","@benitbuhner/opengoal-linux-arm64-musl@0.1.1","@benitbuhner/opengoal-linux-arm64@0.1.0"],"key":"new_account_with_lifecycle_hook:package first published 2 day(s) ago, 5 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":110,"members":105},{"examples":["active_storage-async_variants@0.6.0","active_storage-async_variants@0.7.0","active_storage-async_variants@0.8.0","allstak@0.2.1","allstak@0.3.0","allstak@0.3.1","brew-vulns@0.3.0","brew-vulns@0.4.0","brew-vulns@0.5.0","contentstack@0.9.0"],"key":"rb_install_time_network_call:network call (net::http / uri.open / httparty / faraday / restclient) at install time.","kind":"ttp_detail","max_score":136,"members":104},{"examples":["@hasna/access@0.1.0","@hasna/access@0.1.1","@hasna/actions@0.1.1","@hasna/actions@0.1.2","@hasna/actions@0.1.3","@hasna/actions@0.1.4","@hasna/assistants@1.1.141","@hasna/assistants@1.1.145","@hasna/assistants@1.1.146","@hasna/backup@0.1.0"],"key":"andreihasna2","kind":"publisher_high_risk","max_score":123,"members":99},{"examples":["@pulumi/akamai@11.4.0-alpha.1782196210","@pulumi/akamai@11.4.0-alpha.1782282426","@pulumi/akamai@11.4.0-alpha.1782369003","@pulumi/akamai@11.4.0-alpha.1782455414","@pulumi/alicloud@3.103.0","@pulumi/alicloud@3.104.0-alpha.1779604284","@pulumi/alicloud@3.104.0-alpha.1779691642","@pulumi/aws-native@1.67.0","@pulumi/aws-native@1.67.0-alpha.1779493833","@pulumi/aws-native@1.67.0-alpha.1779605306"],"key":"pulumi-bot","kind":"publisher_high_risk","max_score":16,"members":98},{"examples":["@aicraftalchemy/aca@0.0.3","@arieltoledo/codehive@0.1.2","@ashraf8928/section-schema-generator@2.1.0","@ashraf8928/section-schema-generator@2.1.1","@ashraf8928/section-schema-generator@2.2.1","@atscript/db-memory@0.1.115","@aziron/atlas@0.1.27","@beiguancyc/parse-server@9.10.0-ruixiang.2","@blacklake-tech-cn/hhzz-cli@1.1.0-beta.8","@blxzer/cursor-trellis@0.1.2"],"key":"new_account_with_lifecycle_hook:package first published 2 day(s) ago, 3 total version(s), has lifecycle hook","kind":"ttp_detail","max_score":128,"members":94},{"examples":["@wagni_bot/binance-sdk@1.0.0","@wagni_bot/binance-sdk@1.2.0","@wagni_bot/bsc-sdk@1.0.0","@wagni_bot/bsc-sdk@1.0.2","@wagni_bot/bsc-sdk@1.1.0","@wagni_bot/bsc-sdk@1.1.1","@wagni_bot/bsc-sdk@1.1.2","@wagni_bot/bsc-sdk@1.1.3","@wagni_bot/bsc-sdk@1.1.4","@wagni_bot/bsc-sdk@1.1.5"],"key":"wagni_bot","kind":"publisher_high_risk","max_score":175,"members":93},{"examples":["@aravindanve/rapidoc@9.1.1-beta-alt.0","@codefresh-io/cf-openapi@0.7.19","@codefresh-io/cf-openapi@0.7.20","@codefresh-io/cf-openapi@0.7.21","@codefresh-io/cf-openapi@0.7.22","@dilicorp/ui@0.0.18","@gravityforms/components@1.1.1","@pangtou/material-element-plus@1.1.13","@pangtou/material-element-plus@1.1.14","@pangtou/material-element-plus@1.1.15"],"key":"reverse_shell:matched \"mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh\" — reverse-shell shape","kind":"ttp_detail","max_score":98,"members":91},{"examples":["pinokiod@7.3.11","pinokiod@7.3.12","pinokiod@7.3.13","pinokiod@7.3.14","pinokiod@7.3.15","pinokiod@7.4.0","pinokiod@7.4.1","pinokiod@7.4.2","pinokiod@7.4.3","pinokiod@7.5.0"],"key":"cocktailpeanut","kind":"publisher_high_risk","max_score":77,"members":87},{"examples":["@broadpeak/smartlib-ad@24.1.10","@carvana.authentication-flows/shared@19.2.1","@comcastdevxplatforms/plugin-tenancyinformation@28.1.1","@devxdiscover/devhub-ui@24.1.4","@devxprotect/plugin-devxprotect-experience@22.2.1","@hoptrendy/hopcode-core@0.30.5","@iana-rzms/bff-sdk@1.0.0","@radivi-ui/react-dialog@1.1.3","@uisp/utils@99.0.0","@uisp/utils@99.0.1"],"key":"dns_or_oast_exfil:matched \".oastify.com\"","kind":"ttp_detail","max_score":200,"members":86},{"examples":["@fudrouter/fsrouter@0.6.100","@fudrouter/fsrouter@0.6.101","@fudrouter/fsrouter@0.6.102","@fudrouter/fsrouter@0.6.103","@fudrouter/fsrouter@0.6.104","@fudrouter/fsrouter@0.6.105","@fudrouter/fsrouter@0.6.106","@fudrouter/fsrouter@0.6.107","@fudrouter/fsrouter@0.6.108","@fudrouter/fsrouter@0.6.109"],"key":"fsrouter","kind":"publisher_high_risk","max_score":286,"members":84},{"examples":["appsignal@4.8.5","jwt-pq@0.6.1","karafka-rdkafka@0.28.0","parse-stack-next@5.1.0","parse-stack-next@5.2.0","parse-stack-next@5.2.1","parse-stack-next@5.3.0","parse-stack-next@5.4.0","parse-stack-next@5.4.1","parse-stack-next@5.5.0"],"key":"rb_install_time_system:direct shell invocation paired with eval/dynamic-require/network/deserialize.","kind":"ttp_detail","max_score":136,"members":84}]}