pattern distribution
Each caught package can match multiple static-analysis patterns. This view groups every match by the credential surface it targets — cloud accounts, browser stores, password managers, AI tooling, wallets, and so on. It tells you which exfiltration targets attackers are actually going after this cycle, not which ones the threat-modeling slides say they should.
469 total pattern hits across 10 categories
Publisher accounts whose recent catches span multiple distinct package names — the shape we see when one attacker pumps several different impersonating packages from one handle. Sorted by combined weekly downloads (the actual blast radius), not recency.
What is being stolen — the headline answer.
How the exfiltration works — execution, network, staging.
