Author identity ('Enterprise Tools Team <[email protected]>') on the uploader-frontend npm packages. Now confirmed across THREE clusters in this campaign: Anduril-targeting PyPI packages, the Goldman Sachs gs-uitk-* npm wave, and this untargeted uploader-frontend npm pair. The third confirmed literal-identity reuse strengthens the high-confidence single-actor overlap across ecosystems and target types (defense, finance, and untargeted).
