Detected presence of files containing URLs that link to raw files on GitHub. (x11)

Detected presence of files with behaviors similar to malicious packages published on NPM. (x3)

Detected presence of web service access credentials. (x4)

Detected presence of files containing URLs that reside in regions with EU export restrictions. (x1)

Detected presence of files containing URLs that reside in regions with US export restrictions. (x1)

Detected presence of files containing URLs with suspicious path components. (x5)

Detected presence of files containing URLs that use suspicious top-level domains. (x1)

Detected presence of files containing URLs that use trusted domains as subdomains. (x1)

Detected presence of files that collect and exfiltrate user information. (x1)

Detected presence of plaintext credentials within network protocol strings. (x6)