C01Published package
ClawHavoc: prerequisite lures at marketplace scale
Malicious skill listings used ordinary setup language to move the operator toward external malware.
Open evidence file →CASE ARCHIVE / PRIMARY EVIDENCE
Follow the case.
Keep the uncertainty.
Seven evidence files connecting published skill findings, a measurement study, and a controlled experiment to practical review questions.
Five published-package files are not five independent campaigns. Reports can overlap. A malicious artifact, a download, a controlled test, and a confirmed victim impact are different observations. This archive keeps them separate.
C02Published package
A Google-branded skill and a fabricated prerequisite
An apparently helpful integration redirected the human operator into a separate installation path.
Open evidence file →C03Published package
omnicogg: the file a convenient viewer did not show
A package inventory mismatch and a padded document made the scope of analysis more important than the badge.
Open evidence file →C04Published package
money-radar: when the recommendation itself is the target
A skill can distort advice and destinations without needing to resemble a conventional malware binary.
Open evidence file →C05Published package
TradingView-themed skills: a familiar lure with changed infrastructure
A previous delivery pattern can reappear behind a new listing, destination, and payload.
Open evidence file →C06Controlled experiment
SkillJack: persistence studied in a controlled setting
A research example of why removing an experience and revoking the skill derived from it are separate operations.
Open evidence file →C07Measurement
Confirmed malicious packages: a measurement study, not one breach
A study of verified package behavior helps explain why suspicious, vulnerable, and malicious are different labels.
Open evidence file →No evidence files match this search.
How a file earns its place here
- A primary report or publication is accessible and supports the stated observation.
- Dates distinguish publication, revision, and observation window.
- The file identifies the relevant skill surface and trust transition.
- Unknown victim impact, attribution, and overlap stay explicit.
- Practical controls are labeled as editorial review guidance.
The underlying packages were not installed or executed for this archive. Original reports remain linked; no active malware download or executable payload is reproduced here.