[
 {
  "value": "alduncanson.react",
  "type": "domain",
  "first_seen": "2026-08-24",
  "last_seen": "2026-08-24",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "77-evil-twin-open-vsx-extensions-harvest-developer-metadata-shar"
  ],
  "sources": [
   "https://cyberpress.org/open-vsx-malicious-extensions/"
  ],
  "reason": "Malicious domain in Open VSX evil-twin extension supply-chain attack harvesting developer metadata"
 },
 {
  "value": "magne-sjaastad.opm",
  "type": "domain",
  "first_seen": "2026-08-24",
  "last_seen": "2026-08-24",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "77-evil-twin-open-vsx-extensions-harvest-developer-metadata-shar"
  ],
  "sources": [
   "https://cyberpress.org/open-vsx-malicious-extensions/"
  ],
  "reason": "Malicious domain in Open VSX evil-twin extension supply-chain attack"
 },
 {
  "value": "rumbledb.jsoniq",
  "type": "domain",
  "first_seen": "2026-08-24",
  "last_seen": "2026-08-24",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "77-evil-twin-open-vsx-extensions-harvest-developer-metadata-shar"
  ],
  "sources": [
   "https://cyberpress.org/open-vsx-malicious-extensions/"
  ],
  "reason": "Malicious domain in Open VSX evil-twin extension supply-chain attack"
 }
]