# C01 threat-source fixtures
Synthetic fixture shapes derived from these pinned source schemas:
- OpenSSF malicious-packages at `1ea2762d5fb415aef003a244d5aa83c5fc48cc6e`
(`CC-BY-4.0`), source: https://github.com/ossf/malicious-packages
- Datadog malicious-software-packages-dataset at
`ef4a781d476cd6eb89c8517ff9adbb54a5cfa8cc` (`Apache-2.0`), source:
https://github.com/DataDog/malicious-software-packages-dataset
- ecosyste.ms typosquatting-dataset at
`fd0bde98d200efe5c282a07edc4c68fba13252c6` (`CC0-1.0`), source:
https://github.com/ecosyste-ms/typosquatting-dataset
Extraction date: 2026-08-08. Local modifications: package names, identifiers,
references, and version universes are synthetic and inert; field names and
null/array/event semantics match the pinned upstream documents.