Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 90 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Use Android phones running Horus like small Linux machines over USB: pair, ssh, exec on many phones, copy, and forward ports.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server that lets an AI assistant inspect running browsers over the Chrome DevTools Protocol: enumerate browser processes, capture console logs, network traffic, DOM, performance metrics, and save everything in one shot.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Know which AI agent wrote each line of your code, why, and what it cost — then undo just that agent's work. Works with Claude Code, Cursor, Codex and OpenCode, and speaks Agent Trace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | MrChen-hero | — | 🪝 🌐 | |
|
Package purpose: CLI + TUI manager for the mihomo proxy kernel (API-driven, with a guarded transactional config layer)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Connect Aivyro MCP to supported AI clients without editing configuration files by hand.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: eroq.ai in your terminal — generate images, video and speech, plus a built-in MCP server for Claude Code, Codex and any MCP client.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Guardrails for Claude Code that hold. A PreToolUse hook parses every command before it runs, the agent cannot switch it off, and `flowrail audit` replays your past sessions to show what it would have caught. Zero deps, no cloud, MIT.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A terminal UI that mimics the design of Claude Code — same colors, typography, layouts, mascot art and interaction patterns, extracted from the real binary (v2.1.229).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | 0 | 3,789 | ↑0.0/day |
Very Risky
|
mz | npm | 0.1.0-beta.14 | Pankaj Koirala | — | 🪝 📦 | |
|
Package purpose: MZ Dev binary, dashboard and companion packages for darwin-arm64. Installed automatically by mz-dev; do not install directly.
Matched naming pattern: npm-mz-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 7
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3789 lines, 4.6 MB across 124 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | OXVO | — | 🪝 🌐 | |
|
Package purpose: OXVO Insights for websites and web apps: product analytics, autocapture, feature flags, session replay, surveys and error tracking.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Point at your UI. Your agent understands it. Vite dev plugin + local bridge server.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A single Bun/OpenTUI CLI and dashboard for OpenSpec projects. The `opsx-schema` package bundles the custom schemas and host resources and is the only supported app/installer for schema, agent-skill, and MCP management.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Run Claude Code, Codex, and Cursor on your own machines from anywhere.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | HomeGuru World | — | 🪝 🌐 | |
|
Package purpose: NavDevDep-RUX — Secure deployment & monitoring CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | apsolut | — | 🪝 | |
|
Package purpose: MCP plugin: query DBeaver Community connections, including SSH-tunneled Postgres. Works with Grok, Claude Code, Codex, and Agy.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | RismanRJ | — | 🪝 | |
|
Package purpose: P2P encrypted .env sync for dev teams — LAN-first, offline-first, zero server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Shatadhru — built with NextLoad boilerplate
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: 어떤 AI 에이전트 도구를 쓰든 동일한 워크플로우로 프로젝트를 진행하게 해주는 CLI (aiw)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Run Pi and Claude Code as first-class external harnesses inside Codex Desktop.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Run Pi and Claude Code as first-class external harnesses inside Codex Desktop.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Use a secret without holding it: an encrypted vault whose values are injected into the commands an agent runs and redacted from everything that comes back.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | Lovely | — | 🪝 🌐 | |
|
Package purpose: WhatsApp API Modification By Lovely
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | Shervin Davarifard | — | 🪝 🌐 | |
|
Package purpose: A local dashboard for running and watching Claude Code agents across your git repos.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Write coordination for one shared tree: per-worker path claims, locks, version checks and the io_status tool.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Real-Chrome CDP driver, XHR/fetch capture, and OpenAPI 3.0 exporter. Extracted from extrApi.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: GitHub-style diff review in the browser, with a live notes column for humans and agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | yanshekki | — | 🪝 🌐 | |
|
Package purpose: YSK Omni — local models behind an OpenAI-compatible gateway, with Admin panel and CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Engram — agent memory substrate (descends from graphify): AI coding assistant skill (Claude Code, Codex, Gemini CLI, Kimi Code, GitHub Copilot CLI, Aider, OpenCode, OpenClaw) - turn any folder of code, docs, papers, images, or audio/video transcripts into
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: kebab — your org's shared memory for coding agents, from the terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Vmake Labs CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | dixonSolutions | — | 🪝 🌐 | |
|
Package purpose: Self-hosted voice bridge for Cursor, Codex, and Claude Code CLIs
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | das-fed | — | 🪝 | |
|
Package purpose: 远程仓库克隆并按需提取指定目录或文件的脚手架命令行工具
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | katticot | — | 🪝 | |
|
Package purpose: Universal MCP Apps Host & UI Plugin for DeepSeek Harness (DSH)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | lefos13 | — | 🪝 | |
|
Package purpose: Antigravity CLI (agy) as a Paseo provider: streaming turns, tool rows with diffs, images, structured output, skills and slash commands, question cards for ask_question, conversation import, opt-in MCP sharing, and multiple accounts with per-account usage
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Connect your local agent clients (Claude Code, Codex, Cursor, OpenCode, Qoder) to M2 Canvas over MCP in one command.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Blue Cloud Cyber Solutions LTD | — | 🪝 🌐 | |
|
Package purpose: MCP server for the Blue Cloud Cyber Agent Guestbook: read and verify the hash-chained ledger, register an Ed25519 key, sign one entry per UTC day.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | SEAL | — | 🪝 🌐 | |
|
Package purpose: Official SEAL SDK: send and open end-to-end encrypted files and secrets, and ask a person for one, from any website or server. The key never reaches SEAL.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Kinthala Samuel Sampath Kumar | — | 🪝 🌐 | |
|
Package purpose: Secure one-command Mecord Connect runtime for connecting ChatGPT to a user-authorized Windows computer.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Voice + click-to-caret + TTS + screenshots — drop-in wrapper for the Cursor Agent CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: QualityExec Agent - Local browser execution sandbox for AI verification
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: web frontend for dsh (DeepSeek Harness) with mobile remote access
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: sk-Hermes：可自我进化的 AI Agent 命令行工具（Java fat-jar 的 npm 分发壳）
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | rts-mb | — | 🪝 | |
|
Package purpose: Claude Codex Navigator - pick a Claude Code or Codex session and resume it in its directory
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Ojas S.K Mohbansi | — | 🪝 🌐 | |
|
Package purpose: Automatic authenticator for the IIITN Fortinet captive portal — headless, secure, and daemon-capable.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Server-only Blob Storage SDK for IGA Pages
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Server-only Agent SDK for IGA Pages
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | xingzhen199186 | — | 🪝 🌐 | |
|
Package purpose: DSH 极简移动端遥控器：只把「你的指令」和「AI 的最终回复」送到手机，屏蔽全部中间过程。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||