Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Appearing here means an email is associated with flagged findings, not that the account holder did anything wrong; accounts can be compromised.
Ranked by how many findings our automated detection classified MALICIOUS or SUSPICIOUS, then by the worst score among them.
Only emails with at least one such finding are shown. Same domain:/keyword:/version:/age:<6h filters as the Threat Feed tab (they narrow which findings count toward each author's totals).
| Author email | Flagged malicious | Flagged suspicious | Total findings | Worst score | Email domains | Targeted | Lines | Users | Growth | Age |
|---|---|---|---|---|---|---|---|---|---|---|
| vladlearns@gmail.com | 1 | 0 | 1 | 160 | gmail.com | llama | 55,583 | 5,119 | ↑48.0/day | 107d |
| security@yandex-team.ru | 1 | 0 | 19 | 120 | yandex-team.ru | base, yandex | 363 | 137 | ↑0.1/day | 1293d |
| you@example.com | 0 | 52 | 575 | 95 | example.com | anthropic, aws, azure, base, chroma, claude, cohere, copilot, discord, gemini, google, huggingface, kraken, langchain, lint, llama, mistral, mistralai, ollama, openai, perplexity, replicate, stability, tron, ui, weaviate, workspace | 201,395 | 30,567,371 | ↑12507.8/day | 2444d |
| your.email@example.com | 0 | 23 | 108 | 95 | example.com | 31, amazon, aws, azure, base, binance, chroma, circle, claude, copilot, crewai, cursor, david, deepseek, discord, elevenlabs, eth, gcp, gemini, google, langchain, langgraph, lib, llama, llamaindex, matic, mcg, mistral, okta, ollama, openai, palimpsest, pinecone, sol, solana, text2mem, urls, vllm, workspace, xai | 79,834 | 101,004 | ↑97.2/day | 1039d |
| support@skydeck.ai | 0 | 7 | 53 | 95 | skydeck.ai | aws, azure, chroma, claude, crewai, discord, elevenlabs, gemini, google, langchain, langgraph, ledger, microsoft, mistral, mseep, openai, pinecone, qdrant, safe, shopify, weaviate, workspace | 111,803 | 835 | ↑1.7/day | 497d |
| author@example.com | 0 | 2 | 34 | 95 | example.com | amazon, auth0, aws, azure, base, frank, google, microsoft, okta, ollama, openai, polygon, shelbypackpack1234, shopify, stripe, syncer | 5,040 | 1,133 | ↑0.4/day | 2605d |
| 203918161+awslabs-mcp@users.noreply.github.com | 0 | 3 | 33 | 95 | users.noreply.github.com | amazon, aws | 327,656 | 2,162,939 | ↑4253.1/day | 509d |
| jacob@swarmauri.com | 0 | 1 | 21 | 95 | swarmauri.com | anthropic, aws, azure, base, cohere, deepseek, gemini, google, groq, mistral, okta, openai, perplexity, pinecone, qdrant, stripe | 14,876 | 3,832 | ↑6.3/day | 609d |
| vaquarkhan@gmail.com | 0 | 13 | 17 | 95 | gmail.com | anthropic, azure, cohere, crewai, deepseek, gemini, groq, huggingface, langchain, langgraph, llamaindex, mistral, ollama, openai, together, xai | 1,349 | 9,817 | ↑73.7/day | 133d |
| atoti-dev@activeviam.com | 0 | 7 | 16 | 95 | activeviam.com | amazon, aws, azure, gcp, openai | 634 | 13,642 | ↑18.1/day | 753d |
| danielalcalavalera@gmail.com | 0 | 6 | 16 | 95 | gmail.com | base, google, huggingface, microsoft, ollama | 7,495 | 1,918 | ↑2.6/day | 728d |
| husanhe@email.com | 0 | 1 | 16 | 95 | email.com | aws, boto3, claude, dataclass | 26,584 | 513 | ↑1.2/day | 443d |
| js@intelligent-intern.com | 0 | 14 | 14 | 95 | intelligent-intern.com | auth0, azure, cohere, google, huggingface, llama, mistral, ollama, openai, pinecone, qdrant, vllm, weaviate | 392 | 207 | ↑0.4/day | 512d |
| mcpbind@example.com | 0 | 9 | 10 | 95 | example.com | binance, chroma, google, mcpbind, microsoft, openai, stripe, workspace | 170 | 134 | ↑0.4/day | 356d |
| me@mathewmoon.net | 0 | 1 | 9 | 95 | mathewmoon.net | aws, okta | 4,173 | 323 | ↑0.2/day | 1726d |
| creder@cisco.com | 0 | 1 | 8 | 95 | cisco.com | aws, azure | 21,297 | 267 | ↑0.1/day | 3379d |
| f1470891079@gmail.com | 0 | 2 | 8 | 95 | gmail.com | azure, google, openai | 5,430 | 1,198 | ↑2.7/day | 442d |
| info@circlez.ai | 0 | 2 | 8 | 95 | circlez.ai | aws, google | 4,872 | 3,522 | ↑3.5/day | 1012d |
| your_email@example.com | 0 | 2 | 8 | 95 | example.com | gemini, jupiter, mistral, openai, uniswap, vshare | 1,760 | 289 | ↑0.4/day | 733d |
| agnuxo1@gmail.com | 0 | 2 | 7 | 95 | gmail.com | crewai, langchain, llama, llamaindex, openai | 1,085 | 108 | ↑0.9/day | 122d |
| bernhard.radermacher@netlink-consulting.com | 0 | 3 | 7 | 95 | netlink-consulting.com | alchemy, base | 1,641 | 111 | ↑0.1/day | 1505d |
| connor@luebbehusen.dev | 0 | 1 | 7 | 95 | luebbehusen.dev | anthropic, aws, azure, gcp, google, groq, openai | 15,629 | 19,814 | ↑136.5/day | 145d |
| fer1035@gmail.com | 0 | 1 | 7 | 95 | gmail.com | aws | 3,448 | 1,385 | ↑1.5/day | 945d |
| your-email@example.com | 0 | 1 | 7 | 95 | example.com | azure, claude, gemini, groq, langchain, ollama, web3 | 15,313 | 335 | ↑0.9/day | 390d |
| your@email.com | 0 | 1 | 7 | 95 | email.com | azure, claude, deepseek, discord, gemini, ollama, shopify | 14,321 | 152 | ↑0.2/day | 857d |