The complete artifact for reproducing the results presented in the paper is provided. The artifact comprises source code, detection-model notebooks, an eBPF-collected system call dataset, and infrastructure scripts to recreate the testbed. It enables the reader to: (i) reproduce all detection experiments (SVM, XGBoost, 1D-CNN, Transformer, GNN) across four feature types (syscall identities, return values, parameters, and combined) and four context window sizes (250, 500, 1000, 2000) reported in Table V; (ii) reproduce the exploratory data analysis in Figures 4, 5(a), and 5(b); (iii) inspect the source code of all 30 serverless functions (Table III), including four attack payloads derived from real PyPI malware; (iv) reuse the system call dataset (~1.9 M traces) for independent research; and (v) reproduce the full testbed and data collection pipeline from scratch.