Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▲ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 40 | 513d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Mastra Clerk Auth integration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 513d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Mastra Auth0 Auth integration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 549d | — | — | — |
Unverified Signal
|
— | npm | latest | DevForth | — | 🪝 🌐 | |
|
Package purpose: AdminForth image generation adapter for OpenAI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 594d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Mastra OpenAI Realtime API integration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 597d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 707d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | e-inscricao | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 708d | — | — | — |
Unverified Signal
|
— | npm | latest | MemberJunction.com | memberjunction.com | 🪝 | |
|
Package purpose: Base Classes for MemberJunction Actions. This library is used on both server and network nodes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 730d | — | — | — |
Unverified Signal
|
— | npm | latest | InjectiveLabs | — | 🪝 🌐 | |
|
Package purpose: Ledger wallet strategy for use with @injectivelabs/wallet-core.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 737d | — | — | — |
Unverified Signal
|
— | npm | latest | Wolfram Sokollek | — | 🪝 | |
|
Package purpose: Nx plugin to generate, synthesize, deploy and destroy AWS CDK v2 applications inside an Nx workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 742d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 836d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 🔐 Telegram login widget integration for Nuxt
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 861d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Dynamic Labs, Inc. | — | 🪝 🌐 | |
|
Package purpose: A React SDK for implementing wallet web3 authentication and authorization to your website.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 883d | — | — | — |
Unverified Signal
|
— | npm | latest | Tiago Siebler | — | 🪝 🌐 | |
|
Package purpose: Complete Node.js & JavaScript SDK for Coinbase's Advanced Trade, App, Exchange, International, Prime & Commerce REST APIs and WebSockets, with TypeScript & strong end to end tests.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 892d | — | — | — |
Unverified Signal
|
— | npm | latest | LiveKit | — | 🪝 🌐 | |
|
Package purpose: ElevenLabs plugin for LiveKit Node Agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 937d | — | — | — |
Unverified Signal
|
— | pypi | 1.9.1 | — | — | 🪝 | |
|
Package purpose: An integration package connecting AWS and LangChain
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 941d | — | — | — |
Unverified Signal
|
— | pypi | 1.14.0.dev9 | — | — | 🪝 | |
|
Package purpose: A Python package with a built-in web application
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 974d | — | — | — |
Unverified Signal
|
— | npm | latest | MemberJunction.com | memberjunction.com | 🪝 🌐 | |
|
Package purpose: MemberJunction Wrapper for OpenAI AI Models
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 975d | — | — | — |
Unverified Signal
|
— | npm | latest | MemberJunction.com | memberjunction.com | 🪝 🌐 | |
|
Package purpose: MemberJunction Wrapper for Google Gemini AI Models
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1208d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: An extension to the Causa runtime SDK (`@causa/runtime`), providing Google-specific features.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1249d | — | — | — |
Unverified Signal
|
— | npm | latest | Hidetaka Okamoto | — | 🪝 🌐 | |
|
Package purpose: Framework-agnostic Stripe Payment Elements as Web Components
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1277d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1385d | — | — | — |
Unverified Signal
|
— | npm | latest | Exzeo | — | 🪝 🌐 | |
|
Package purpose: exframe-aws-client description
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1457d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 业务应用支撑平台-前端通用组件
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1527d | — | — | — |
Unverified Signal
|
— | pypi | 1.349.3 | Dynatrace | — | 🪝 | |
|
Package purpose: Dynatrace OpenTelemetry package for Google Cloud Functions
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 1598d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Ledger for @ardenthq/sdk
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1662d | — | — | — |
Unverified Signal
|
— | npm | latest | Massa Labs | — | 🪝 🌐 | |
|
Package purpose: massa's web3 sdk client
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1705d | — | — | — |
Unverified Signal
|
— | npm | latest | zanechua | — | 🪝 | |
|
Package purpose: List of EVM Chains
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1907d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2148d | — | — | — |
Unverified Signal
|
— | npm | latest | Amazon Web Services | — | 🪝 | |
|
Package purpose: Version 2 of the AWS Cloud Development Kit library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2149d | — | — | — |
Unverified Signal
|
— | pypi | 6.0.1 | — | — | 🪝 | |
|
Package purpose: ssh mitm server for security audits supporting publickey authentication, session hijacking and file manipulation
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 2158d | — | — | — |
Unverified Signal
|
— | npm | latest | Microsoft Corporation | — | 🪝 | |
|
Package purpose: Azure Pipelines Packaging Tasks Common
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2207d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A simple way to create a startup Discord bot.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2292d | — | — | — |
Unverified Signal
|
— | npm | latest | Tiago Siebler | — | 🪝 🌐 | |
|
Package purpose: Complete & robust Node.js SDK for Bybit's REST APIs and WebSockets, with TypeScript & strong end to end tests.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2305d | — | — | — |
Unverified Signal
|
— | npm | latest | Max Rohde | — | 🪝 | |
|
Package purpose: Easily deploy Terraform IaC with npm package scripts
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2312d | — | — | — |
Unverified Signal
|
— | npm | latest | Weaviate | — | 🪝 🌐 | |
|
Package purpose: JS/TS client for Weaviate
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2599d | — | — | — |
Unverified Signal
|
— | npm | latest | Auth0 | — | 🪝 🌐 | |
|
Package purpose: Auth0 Next.js SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2741d | — | — | — |
Unverified Signal
|
— | npm | latest | heartyoh | — | 🪝 🌐 | |
|
Package purpose: Server-side module for handling authentication.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2799d | — | — | — |
Unverified Signal
|
— | npm | latest | Victor Savkin | — | 🪝 | |
|
Package purpose: Smart Monorepos · Fast Builds
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2938d | — | — | — |
Unverified Signal
|
— | npm | latest | Microsoft | — | 🪝 | |
|
Package purpose: Azure Pipelines Task SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 3027d | — | — | — |
Unverified Signal
|
— | npm | latest | Formidable | — | 🪝 | |
|
Package purpose: Interactive Cursor Component for Victory
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 3065d | — | — | — |
Unverified Signal
|
— | pypi | 2.1.1 | OneLogin | — | 🪝 | |
|
Package purpose: Assume an AWS Role and get temporary credentials using OneLogin
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 3090d | — | — | — |
Unverified Signal
|
— | pypi | 38.9.0 | — | — | 🪝 | |
|
Package purpose: The Datadog Check Toolkit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 3091d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A simple way to create a startup Discord bot.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 3458d | — | — | — |
Unverified Signal
|
— | pypi | 5.9.0 | Certbot Project | — | 🪝 | |
|
Package purpose: Google Cloud DNS Authenticator plugin for Certbot
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 3668d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: SharePoint Framework support for building web parts
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 4187d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Styleable select elements built on Tether
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 45 | 2h | — | — | — |
Unverified Signal
|
— | pypi | 0.1.0a1 | — | — | 🪝 | |
|
Package purpose: Run a HypSwarm research swarm inside a governed-egress pod: a UID-scoped egress floor, an allowlisting TLS-intercepting proxy, vaulted credentials, hourly caps, a hash-chained audit — and an egress check from the swarm's own seat on every start.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 45 | 19h | — | — | — |
SUSPICIOUS
|
— | pypi | 0.2.0 | 元意识（重庆）人工智能科技有限公司 | — | 🪝 | |
|
Package purpose: 元意识知识资产引擎：把学说变成可被 AI / Agent 调用的结构化知识
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 45 | 21h | — | — | — |
SUSPICIOUS
|
— | pypi | 0.1.0 | 元意识（重庆）人工智能科技有限公司 | — | 🪝 | |
|
Package purpose: 元意识知识资产引擎：把学说变成可被 AI / Agent 调用的结构化知识
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 45 | 35h | — | — | — |
Unverified Signal
|
— | pypi | 0.8.1 | genzagents | — | 🪝 | |
|
Package purpose: Is your English rental ready for the landlord database (Register your rental property, Renters' Rights Act)? Region window and deadline, gas/EICR/EPC validity, the £65 fee, the upload checklist. Zero dependencies. Also an MCP server.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||