Detected presence of files containing domains used for intercepting and inspecting HTTP requests. (x9)

Detected presence of files containing URLs that link to raw files on GitHub. (x3)

Detected presence of files with behaviors similar to malicious packages published on PyPI. (x2)

Detected presence of malicious files through analyst-vetted file reputation. (x5)

Detected presence of known software supply chain attack artifacts. (x5)

Detected presence of files containing URLs that use non-standard ports. (x3)

Detected presence of placeholder credentials within network protocol strings. (x3)

Detected presence of commonly distributed sensitive data. (x3)