🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▲ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
25 1205d — — —
Very Risky
— pypi 4.0.1 — — 🪝
Package purpose: Model Serving Made Easy
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in xinference-4.0.1/build_backend.py:95
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xinference-4.0.1/build_backend.py:142
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in xinference-4.0.1/build_web.py:62
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xinference-4.0.1/build_web.py:43
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in xinference-4.0.1/scripts/check_install.py:70
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xinference-4.0.1/scripts/check_install.py:25
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in xinference-4.0.1/scripts/check_install.py:94
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in xinference-4.0.1/scripts/manage_install.py:26

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
25 1496d — — —
Possible Squatted Stub
— npm latest Planet's Lightning Arrester — 🪝
Package purpose: Parse Brazilian brokerage notes PDFs (Rico, Clear, and Inter holders available)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'npx husky'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
25 1810d — — —
Possible Squatted Stub
— npm latest — — 🌐
Package purpose: Amazon plugin for 'Telemetry.js' library
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/esm/auth.js:21 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
25 2478d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Base project for Ex Libris Cloud Apps
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
25 2965d — — —
Possible Squatted Stub
— npm latest Syncfusion Inc. — 🪝
Package purpose: A common package of Essential JS 2 base Angular libraries, methods and class definitions
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node ./postinstall.js'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
25 3599d — — —
Possible Squatted Stub
— npm latest Trey Tacon — 🪝
Package purpose: Installs and starts the AWS XRay daemon
Static code signals:
  • LIFECYCLE_SCRIPT: 'install' -> 'install-files source'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
27 102d 16 0 ↑0.2/day
Possible Squatted Stub
priceless pypi 0.1.0 Pricing UK Red pricing-uk-red@prima.it prima.it
Package purpose: Priceless integration providing point utility for Primapy
Claimed homepage: https://pypi.org/project/primapy-priceless-point-of-sale-underwriting/
Matched naming pattern: primapy-priceless-point
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 102
Registry downloads: 16/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • INFOPublisher email domain '@prima.it' matches package identifier token 'prima', verifying identifiable third-party organization ownership.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHPackage registered recently (94 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 107d 36 20 ↑0.3/day
Possible Squatted Stub
langchain pypi 0.1.1 — hello@baponi.ai baponi.ai
Package purpose: Baponi sandbox provider for LangChain Deep Agents
Claimed homepage: https://pypi.org/project/langchain-baponi/
Matched naming pattern: python-langchain-baponi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 107
Registry downloads: 36/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 20 lines, 887 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-baponi' matches AI hallucination template [python] + [langchain] + [baponi].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • INFOPublisher email domain '@baponi.ai' matches package identifier token 'baponi', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (99 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (20 LOC, 1 file(s), 887 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 120d 9 0 ↑0.1/day
Possible Squatted Stub
llamaindex pypi 0.1.0 — reachout@tealtiger.ai tealtiger.ai
Package purpose: TealTiger governance callback handler for LlamaIndex — deterministic policy enforcement, cost tracking, and audit for RAG pipelines
Claimed homepage: https://pypi.org/project/llamaindex-tealtiger/
Matched naming pattern: python-llamaindex-tealtiger
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 120
Registry downloads: 9/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 7 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'llamaindex-tealtiger' matches AI hallucination template [python] + [llamaindex] + [tealtiger].
  • HIGHClaims critical enterprise brand identity ('LLAMAINDEX').
  • INFOPublisher email domain '@tealtiger.ai' matches package identifier token 'tealtiger', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (93 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 7 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 178d 3 4 ↑0.0/day
Possible Squatted Stub
okx pypi 0.1.0 — marcel@tribulnation.com tribulnation.com
Package purpose: An SDK to connect Okx with the Tribulnation ecosystem.
Claimed homepage: https://pypi.org/project/tribulnation-okx/
Matched naming pattern: python-okx-tribulnation
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 178
Registry downloads: 3/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4 lines, 96 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'tribulnation-okx' matches AI hallucination template [python] + [okx] + [tribulnation].
  • HIGHClaims critical enterprise brand identity ('OKX').
  • INFOPublisher email domain '@tribulnation.com' matches package identifier token 'tribulnation', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (147 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (4 LOC, 1 file(s), 96 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 178d 0 4 ↑0.0/day
Possible Squatted Stub
gemini pypi 0.1.0 — marcel@tribulnation.com tribulnation.com
Package purpose: An SDK to connect Gemini with the Tribulnation ecosystem.
Claimed homepage: https://pypi.org/project/tribulnation-gemini/
Matched naming pattern: python-gemini-tribulnation
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 178
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4 lines, 102 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'tribulnation-gemini' matches AI hallucination template [python] + [gemini] + [tribulnation].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPublisher email domain '@tribulnation.com' matches package identifier token 'tribulnation', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (146 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (4 LOC, 1 file(s), 102 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 178d 6 4 ↑0.0/day
Possible Squatted Stub
cryptocom pypi 0.1.0 — marcel@tribulnation.com tribulnation.com
Package purpose: An SDK to connect Cryptocom with the Tribulnation ecosystem.
Claimed homepage: https://pypi.org/project/tribulnation-cryptocom/
Matched naming pattern: python-cryptocom-tribulnation
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 178
Registry downloads: 6/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4 lines, 108 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'tribulnation-cryptocom' matches AI hallucination template [python] + [cryptocom] + [tribulnation].
  • HIGHClaims critical enterprise brand identity ('CRYPTOCOM').
  • INFOPublisher email domain '@tribulnation.com' matches package identifier token 'tribulnation', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (147 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (4 LOC, 1 file(s), 108 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 178d 6 4 ↑0.0/day
Possible Squatted Stub
bitfinex pypi 0.1.0 — marcel@tribulnation.com tribulnation.com
Package purpose: An SDK to connect Bitfinex with the Tribulnation ecosystem.
Claimed homepage: https://pypi.org/project/tribulnation-bitfinex/
Matched naming pattern: python-bitfinex-tribulnation
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 178
Registry downloads: 6/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4 lines, 106 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'tribulnation-bitfinex' matches AI hallucination template [python] + [bitfinex] + [tribulnation].
  • HIGHClaims critical enterprise brand identity ('BITFINEX').
  • INFOPublisher email domain '@tribulnation.com' matches package identifier token 'tribulnation', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (161 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (4 LOC, 1 file(s), 106 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 199d 10 2 ↑0.1/day
Possible Squatted Stub
langchain pypi 0.0.1 — ceo@karonlabs.net karonlabs.net
Package purpose: Karon Web Unblocker — Reserved package. See https://karonlabs.net/api/
Claimed homepage: https://pypi.org/project/karon-langchain/
Matched naming pattern: python-langchain-karon
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 199
Registry downloads: 10/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 82 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'karon-langchain' matches AI hallucination template [python] + [langchain] + [karon].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • INFOPublisher email domain '@karonlabs.net' matches package identifier token 'karonlabs', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (172 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 82 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 256d 46 14 ↑0.2/day
Possible Squatted Stub
addon pypi 18.0.1.0.0.3 Binhex, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org
Package purpose: Add Cloudflare Turnstile captcha to login form
Claimed homepage: https://github.com/OCA/website
Matched naming pattern: odoo-addon-website
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 256
Registry downloads: 46/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 602 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • INFOPublisher email domain '@odoo-community.org' matches package identifier token 'odoo-community', verifying identifiable third-party organization ownership.
  • MEDIUMPackage registered 229 days ago within the 1-year AI tool proliferation window.
  • HIGHPackage registered with suspiciously high major version (v18.0.1.0.0.3, major 18) despite recent registration (229 days ago, 2 release(s)), indicating potential dependency confusion attack to shadow internal organization builds.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (14 LOC, 2 file(s), 602 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 360d 0 16 ↑0.0/day
Possible Squatted Stub
addon pypi 16.0.1.0.0.3 Coop IT Easy SC, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org
Package purpose: Load new partner data during a POS sale
Claimed homepage: https://github.com/OCA/pos
Matched naming pattern: odoo-addon-pos
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 360
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 16 lines, 716 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • INFOPublisher email domain '@odoo-community.org' matches package identifier token 'odoo-community', verifying identifiable third-party organization ownership.
  • MEDIUMPackage registered 333 days ago within the 1-year AI tool proliferation window.
  • HIGHPackage registered with suspiciously high major version (v16.0.1.0.0.3, major 16) despite recent registration (333 days ago, 2 release(s)), indicating potential dependency confusion attack to shadow internal organization builds.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (16 LOC, 2 file(s), 716 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
27 366d 56 22 ↑0.2/day
Possible Squatted Stub
base pypi 18.0.1.0.0.4 =?utf-8?q?Heligr=C3=A0fics_Fotogrametr=C3=ADa_S=2EL=2E=2C_Odoo_Community_Association_=28OCA=29?= support@odoo-community.org odoo-community.org
Package purpose: Integration between base_fontawesome and web_editor for FontAwesome >= 6.7.2 support.
Claimed homepage: https://github.com/OCA/server-tools
Matched naming pattern: odoo-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 366
Registry downloads: 56/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 22 lines, 948 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • INFOPublisher email domain '@odoo-community.org' matches package identifier token 'odoo-community', verifying identifiable third-party organization ownership.
  • MEDIUMPackage registered 338 days ago within the 1-year AI tool proliferation window.
  • HIGHPackage registered with suspiciously high major version (v18.0.1.0.0.4, major 18) despite recent registration (338 days ago, 5 release(s)), indicating potential dependency confusion attack to shadow internal organization builds.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (22 LOC, 2 file(s), 948 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
30 54h — — —
Possible Squatted Stub
— npm latest Looper — 🪝
Package purpose: Looper Agent SDK: drive the Looper agent (the looper CLI) from Node.js — streaming events, tool approvals, sessions shared with the Looper app.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/binary.js:42 (+3 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 54h — — —
Possible Squatted Stub
— npm latest Charles Samborski — 🪝
Package purpose: Native module for Eternaltwin
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/install.mjs:66

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 54h — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: The client for the ebitex Content Delivery API: typed endpoints, React rendering, sitemaps, live preview and locale addressing, so a site does not maintain its own.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli/apply-main.js:25 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 4d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: ContextShrink Code for Claude Code: trims what Claude Code resends on every turn, compressed on your own computer.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/codetab.js:298 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 8d — — —
Very Risky
— pypi 0.3.4 LuminariSoftwares — 🪝
Package purpose: Is this codebase safe to run, will it work, and is it complete? Deterministic Safe, Works and Complete scores with an A-F grade, from static analysis only, plus a verify loop for AI-assisted changes: baseline, repair plan, before/after diff. The code is never run.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in code_guardian_mcp-0.3.4/code_guardian/baseline.py:97
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in code_guardian_mcp-0.3.4/code_guardian/baseline.py:97
  • ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in code_guardian_mcp-0.3.4/code_guardian/catalogue.py:65
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in code_guardian_mcp-0.3.4/code_guardian/complete.py:55
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in code_guardian_mcp-0.3.4/code_guardian/explain.py:85
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in code_guardian_mcp-0.3.4/code_guardian/history.py:76
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in code_guardian_mcp-0.3.4/code_guardian/history.py:48
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in code_guardian_mcp-0.3.4/code_guardian/history.py:48

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
30 15d — — —
Possible Squatted Stub
— npm latest Venus — 🪝
Package purpose: Vue-native <DataTable> on TanStack Table and TanStack Virtual: sorting, filtering, pagination, selection, pinning, inline editing, and adaptive row virtualization. The Vue port of @coldsmirk/ledger-mantine.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.cjs:1 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 17d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Authenticated UserReason onboarding and management CLI
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/bin.js:151 (+4 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 17d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Champion Trade Design System — shadcn/ui components with Tailwind CSS v4
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.cjs:589 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Servidor MCP da DS9: expõe skills e subagentes oficiais para qualquer IDE/LLM com suporte a MCP
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/src/content.js:37

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Lingo.dev for TanStack Start and TanStack Router: locale rewrite, bare-path redirect, message catalog, request context, head tags and a language switcher over @lingo.dev/locale-router.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.cjs:53 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Workser's coding engine for the 'loop in our service' mode: OpenCode's agent contract (its prompts, tool schemas and edit semantics, vendored from v1.18.23) running on Node, with every file and shell action going through a Place — so the machine can be a
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/src/place/local.js:43

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Scaffold a new Grain project
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/index.mjs:218

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest BLACKLINE CONSULTING d.o.o. d.o.o 🪝
Package purpose: Official TypeScript SDK for the FAST platform - Skill Challenge engine for sportsbook operators
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cjs/client.js:14 (+11 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Seithr v6 Compiler - AST reactivity transform and Vite HMR plugin
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/bundle.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Seithr v6 CLI - Zero-ceremony scaffolding CLI engine for next-generation reactive applications
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:2 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: The connection string for a MongoDB database, credentials included, and which database in it to use.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: An API key for OpenAI, or for any OpenAI-compatible gateway named by a base URL.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: A connection string for Redis: a shared table every instance of a deployment can see.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: A bucket and a key pair for any S3-compatible store: AWS, Cloudflare R2, Backblaze, MinIO, Tigris.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: A Supabase project's URL, its service-role key and the Postgres connection string behind it.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: What every @extraorbital resource shares: the error it raises and the status it reports.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:29

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: The AuthLocker client behind email codes, SMS codes and Google or GitHub sign-in, and the ways in a deployment offers.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: The secret Better Auth signs sessions with, and the public origin the app serves them from.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: Which Photon instance to search addresses against. No key: the public instance is the default.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:3

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Severin MARCOMBES — 🪝
Package purpose: A TURN relay for the peers that cannot reach each other directly. Optional: without it, connections use STUN alone.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/read.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Optional native Sherpa speech engine and explicit model preparation for assistant voice.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/cli.js:31

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Redis-backed read-through cache with tag invalidation for the Quark framework (published as raw TS sources; consumers run tsx)
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.ts:22

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 18d — — —
Possible Squatted Stub
— npm latest Yarlis LLC — 🪝
Package purpose: Stateless HTTP rule server for Rule Cascade: serves manifests and evaluates operations. Run as many replicas as you need.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/main.js:7

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 19d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: Native PowerPoint rendering for Gum.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/image.ts:8

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 19d — — —
Possible Squatted Stub
— npm latest — — 🪝
Package purpose: The Heysegment command line: your account's businesses, senders, Google, domains, notifications and websites, from a terminal. Runs on Bun.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli.js:33
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shell Profile Backdoor Injection' found in package/dist/cli.js:68

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 19d — — —
Possible Squatted Stub
— npm latest — — 🪝
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist-lib/integrations/supabase/auth-middleware.js:6 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 19d — — —
Possible Squatted Stub
— npm latest StackOne — 🪝
Package purpose: Cloud-agnostic object storage for S3, S3-compatible stores such as MinIO, and GCS
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.cjs:1 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
30 19d — — —
Possible Squatted Stub
— npm latest mert yaltı — 🪝
Package purpose: Agentia Headless plugin that keeps Markdown/MDX documentation synchronized with source code and publishes approved documentation to Copado AI Knowledge
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/lib/adapters/agentia.js:324 (+9 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD