The malicious packages dataset can be found here:
github.com/DataDog/mali...

Meanwhile, GuardDog findings are more like indicators of potentially suspicious or malicious package behavior rather than a conclusive determination. Review of the findings is crucial to how we produce a high-quality dataset for SCFW to consume.

Hi, I work on both projects. SCFW consults our dataset of human-reviewed malicious packages to determine when to block. Unlike GuardDog, it doesn't do any package scanning of its own.