Tessellate Labs · “The Toolkit Vendor”
The Toolkit Vendor
Profile
A grey-market vendor that sells the manipulation other apps deploy — turnkey confirmshaming, fake-urgency, and roach-motel kits, shipped as a 'conversion optimization' SDK. THE UNDERTOW has instrumented two of its distribution nodes; the kits are mobile, deniable, and indifferent to the downstream harm. Primary disruption target for the Field directorate.
Modus Operandi
Packages dark patterns as a turnkey SDK — confirmshaming dialogs, fake countdown timers, roach-motel cancellation flows, drip pricing — and sells them to any app under a 'conversion optimization' label, staying deniable as a neutral tooling provider while the harm lands downstream.
Documented Harms
- Sells turnkey manipulation kits — confirmshaming, fake urgency, roach-motel cancellation — to any app that pays
- Ships pre-built dark patterns documented to defeat consumer-protection law in three regions
- Operates a 'conversion optimization' storefront that is a dark-pattern catalogue in all but name
- Indifferent to the downstream harm; deniable by design as a 'neutral tooling' provider
Evidence & Indicators
- Identical confirmshaming strings across thousands of unrelated apps (Decode fingerprint)
- SDK calls matched to known fake-urgency and roach-motel patterns
- Storefront copy that is a dark-pattern catalogue in all but name
Known Incidents
Its cancellation-friction kit is implicated in two regulatory click-to-cancel actions; the vendor was never named because the SDK is deniable.
Linked Operations
Techniques Deployed
Handling & Rules of Engagement
- Counter at the distributed SDK — reaches every downstream app at once
- Preserve the SDK fingerprint as the cross-app evidence link
- Do not tip the vendor; instrumentation must stay covert
Standing Note
Counter at the SDK, not the storefront. Friction injected into the distributed kit reaches 6,000 apps at once; the storefront is just the shop window.