Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 30 | 45d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | info@overcast.xyz info@overcast.xyz | overcast.xyz | 🪝 | |
|
Package purpose: RawSigner implementation backed by GCP Cloud KMS (Ed25519).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 78d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Shopify ingress channel connector for Porulle.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 79d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Export Cursor hook telemetry and agent transcripts to Volcengine TLS with OTLP traces.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 93d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Yasser Rosas | — | 🪝 | |
|
Package purpose: Anthropic (Claude Messages API) provider adapter for galdor-bun.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 137d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Claude Agent SDK-backed AgentHarness implementation for @salesforce/sfdx-agent-sdk
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 145d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: NARP stdio launcher for the NextClaw Claude Code SDK runtime.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 173d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | MissionSquad | — | 🪝 | |
|
Package purpose: MissionSquad Grok MCP server for searching X.com with xAI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 194d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Qdrant adapter implementing IVectorStore interface
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 194d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: OpenAI adapter implementing ILLM and IEmbeddings interfaces
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 222d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Core workspace utilities for KB Labs, including root directory resolution and workspace detection
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 226d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | APort Technologies Inc. | — | 🪝 | |
|
Package purpose: APort guardrails for CrewAI — task decorator / middleware
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 226d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | APort Technologies Inc. | — | 🪝 | |
|
Package purpose: APort guardrails for LangChain/LangGraph — callback handler
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 307d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: fork from vite-plugin-dynamic-base, add some custom transform content for legacy html
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 369d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | CDMBase LLC | — | 🪝 | |
|
Package purpose: Sample core for higher packages to depend on
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 373d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | OA Drive Team | — | 🪝 | |
|
Package purpose: Redis cache connector with TTL, invalidation, and namespace support for OA Drive microservices
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 573d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Babylon Labs Ltd. | — | 🪝 | |
|
Package purpose: Library exposing methods for the creation and consumption of Bitcoin transactions pertaining to Babylon's Bitcoin Staking protocol.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 608d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Byte9 | — | 🪝 | |
|
Package purpose: visual regression testing tools for blaze projects
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 752d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: V5.3 Einstein Bots API
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 893d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Ledger integration for hub. [Homepage](https://www.ledger.com/) | [Docs](https://developers.ledger.com/)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1065d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Einstein Copilot Bot API Family
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1194d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: It is a workspace having standard and custom objects.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1236d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: This package publishes stderr to a Discord thread.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1237d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: ```bash pnpm cli -p ../../../../wighawag/jolly-roger/indexer/dist/index.cjs -n http://localhost:8545 -f indexed/localhost.json -d ../../../../wighawag/jolly-roger/contracts/deployments/localhost ```
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1286d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Signer for Rango Solana Transactions
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1547d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Michał Łaszczewski | — | 🪝 | |
|
Package purpose: --- title: @live-change/frontend-base ---
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1662d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Nice Auth0 kit is a wrapper of the OAuth2 and MFA api for Auth0. We support the password, refresh_token and mfa grant types.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1663d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1663d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1663d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1663d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1684d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1697d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1697d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1697d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1703d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1781d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | fanmingfei | — | 🪝 | |
|
Package purpose: @eva/spine-base
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1787d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1791d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1791d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1798d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1798d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1803d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1809d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1809d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1822d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 1850d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 | |
|
Package purpose: Extension package to enable newsletter on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 2143d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 3407d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 27 | 82d | 18 | 0 | ↑0.2/day |
Possible Squatted Stub
|
priceless | pypi | 0.1.0 | Pricing UK Red pricing-uk-red@prima.it | prima.it | ||
|
Package purpose: Priceless integration providing point utility for Primapy
Claimed homepage: https://pypi.org/project/primapy-priceless-point-of-sale-underwriting/
Matched naming pattern: primapy-priceless-point
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 82
Registry downloads: 18/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 27 | 87d | 30 | 20 | ↑0.3/day |
Possible Squatted Stub
|
langchain | pypi | 0.1.1 | — hello@baponi.ai | baponi.ai | ||
|
Package purpose: Baponi sandbox provider for LangChain Deep Agents
Claimed homepage: https://pypi.org/project/langchain-baponi/
Matched naming pattern: python-langchain-baponi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 87
Registry downloads: 30/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 20 lines, 887 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||