# E10. Repository-ownership reassessment

## Initial classification

An earlier analysis described `lautaro19/rekt-db` as victim-owned because it used a personal namespace and was an independent copy rather than a platform fork. The later record withdraws that classification. Namespace style and fork metadata cannot determine whether a repository belongs to a candidate or an operator. [S1]

## Revised observations

The analysis note reports platform timestamps placing creation of that repository at 04:03:05 on 25 May 2026 and creation of a related `forge-4626-invariants` repository at 04:03:40, thirty-five seconds later. The record reports matching payload structure and a common cache-marker set, including `cleanup-paths`, `one-shot`, `use-extension-pipeline`, `vsix-rel` and `ws-hops`. Another related repository was created later that morning. [S1]

Timing proximity and matching artifacts make coordinated staging a plausible explanation. They do not make an independent clone impossible. The correct result is an ownership hypothesis requiring provider-side registration and access records, rather than an unconditional reversal from confirmed victim to confirmed operator.

## Published-indicator comparison

Review of the complete published indicator table supplied repository paths and brand-domain mappings missing from an earlier summary. The record distinguishes exact task/settings hashes from structural selectors: a byte hash covers identical files only, while renamed or modified deployments require broader comparison. These are recorded comparison results; no public source or repository status was rechecked for this document. [S1]

## Limits

The original repository snapshots and platform API responses supporting the ownership comparison are not retained with these exhibits. The quoted correspondence and analytical records document the reassessment, rather than independently reproducing its underlying observations.

Payload-bearing forks on established accounts remain exposure leads, but even a fork followed by later commits does not establish task execution, extension installation or compromise. Current availability cannot be inferred from July responses. The correction concerns attribution of repository ownership and the precision of incident communication, not a new count of infected developers.

Personal account details and the full historical sender roster are excluded. The retained repository identifiers are limited to explaining the specific reassessment cited by the preprint.