At the evidence desk
A guide to keeping observed incidents, experiments, vendor findings, and editorial advice distinct.
Observed marketplace behavior
A measurement study with behaviorally confirmed malicious cases. Read the collection and verification method; do not infer live package availability from an old snapshot.
Read the catalog record →Vendor investigation
A vendor audit connects scanning with human-confirmed malicious findings. A flagged issue and a malicious payload are distinct labels.
Read the catalog record →Controlled experiment
Adversarial skills are used to examine a documentation-to-action mechanism. The evaluation begins after loading; produced code and executed actions remain different outcomes.
Read the catalog record →Benchmark construction
A curated test collection probes detection and cross-source generalization. Its class proportions do not describe the public skill ecosystem.
Read the catalog record →Architecture and synthesis
A revised taxonomy maps threats and documented incidents. An architectural possibility and a demonstrated case carry different evidence.
Read the catalog record →A compact claim ledger
| Record | What to preserve |
|---|---|
| Source | Stable identifier, version, author, original URL, check date. |
| Method | Collection, sample, model, host, permissions, scoring. |
| Observation | Suspicious text, attempted action, blocked action, or verified effect. |
| Interpretation | What follows from the evidence and what remains untested. |