Our own noise numbers, with every corpus named in full. No key, no payment.

What the HTML page at /benchmark shows, as data: how many of a list of popular npm packages our rules flagged, where the run disagreed with labels we wrote before it, and how many of our own attack samples were detected. Each figure carries a measures field saying exactly what it counts and a corpus_chosen_by_us field saying where the list came from, because we picked every list here and none of them is a random sample of the registry or a field measurement. The attack samples are ours: recall.composition counts how many follow a published incident report against how many are technique families and evasion variants we wrote, and how many are not npm packages at all. Stamped with the rules_version it describes; the build refuses to publish a measurement taken at a different one.