Garrett Grimm

{
    "slug": "top-ten-lists",
    "pattern": "obfuscated_payload_in_data_file",
    "kind": "builtin",
    "version": "1.1.1",
    "hit_count": 1,
    "first_hit": {
        "file": "bower_components/angular/angular.min.js.gzip",
        "line": 0,
        "snippet": "(PHP payload in data file \u2014 decoded via gzdecode)"
    },
    "explanation": "a non-PHP data file (`.dat`/`.gzs`/`.bin`/etc.) contains PHP source \u2014 either stored raw under a misleading extension or sealed behind base64/gzip \u2014 and/or matches a catalog IOC once decoded. This is the payload-hiding evasion the siteguarding burner fleet used to defeat PHP-only IOC greps: `wp-plugin-management`/`plugin.dat` (gzip+base64 \u2192 siteguarding_tools.php v1.7), `speedup-optimization`/`classes/tools.gzs` (base64 \u2192 v2.1), `bytedefense`/`core/scan_sigs_db.dat` (raw PHP disguised as a \"scan signatures database\", `include`d by a web-reachable `scan.php`). The scanner now decodes these blobs and matches PHP markers + content IOCs inside them."
}

{
    "committer": "noahkagan",
    "member_since": "2014-09-15",
    "plugins_joined": 7,
    "spread_days": 58,
    "earliest_join": "2015-05-07 19:53:05",
    "latest_join": "2015-07-05 15:51:40",
    "combined_installs": 74000,
    "sample_plugins": [
        {
            "slug": "underconstruction",
            "active_installs": 40000,
            "first_commit_at": "2015-07-05 15:51:40"
        },
        {
            "slug": "social-media-widget",
            "active_installs": 30000,
            "first_commit_at": "2015-06-10 04:22:35"
        },
        {
            "slug": "mail-subscribe-list",
            "active_installs": 3000,
            "first_commit_at": "2015-05-09 15:45:46"
        },
        {
            "slug": "simple-popup-plugin",
            "active_installs": 1000,
            "first_commit_at": "2015-05-08 22:58:45"
        },
        {
            "slug": "google-analyticator",
            "active_installs": 0,
            "first_commit_at": "2015-05-13 05:01:09"
        },
        {
            "slug": "social-popup",
            "active_installs": 0,
            "first_commit_at": "2015-05-07 19:53:05"
        },
        {
            "slug": "wp-google-fonts",
            "active_installs": 0,
            "first_commit_at": "2015-06-02 21:43:44"
        }
    ],
    "triage_note_2026_05_03": "Noah Kagan / AppSumo Sumo Group 2015 plugin acquisitions; underconstruction has since transferred again to @grimmdude. Historical handoff, no malicious code."
}

{
    "slug": "underconstruction",
    "committer_slug": "noahkagan",
    "committer_display_name": "noahkagan",
    "committer_employer": null,
    "committer_member_since": "2014-09-15",
    "committer_first_commit": "2015-07-05 15:51:40",
    "committer_commit_count": 2,
    "plugin_listed_author": "grimmdude",
    "earliest_plugin_commit": "2009-06-21 15:09:16",
    "plugin_age_at_join_days": 2205,
    "committer_age_at_join_days": 293,
    "active_installs": 40000
}