Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: Native CLI binary for @anthropic-ai/claude-agent-sdk on darwin-x64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: Native CLI binary for @anthropic-ai/claude-agent-sdk on linux-arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: Native CLI binary for @anthropic-ai/claude-agent-sdk on linux-arm64-musl
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: Native CLI binary for @anthropic-ai/claude-agent-sdk on linux-x64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: Native CLI binary for @anthropic-ai/claude-agent-sdk on linux-x64-musl
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: Native CLI binary for @anthropic-ai/claude-agent-sdk on win32-arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: Native CLI binary for @anthropic-ai/claude-agent-sdk on win32-x64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Geordie AI | — | ||
|
Package purpose: OTEL trace viewer for Claude Code sessions
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Private service for blocking and restoring site scrolling while modal UI is active.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: 全景图标签和标注的共享视觉组件。宿主负责坐标投影、数据读取，以及通过 `onClick` 绑定业务行为。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: LangGraph.js adapter for the canonical Yieldpoint CLI verifier
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 10d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: OpenCode plugin that loads GitHub Copilot custom instruction files
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 11d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 12d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Postgres-backed resources for @owlmeans/marketing-consent — the state and log tables of a generated target project, compiled from the shared AJV schema in @owlmeans/server-marketing-consent.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 12d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Mongo storage for @owlmeans/server-marketing-consent's two resources (marketing-consent-state, marketing-consent-log) — schemas imported, never duplicated. For the platform; generated target projects use @owlmeans/marketing-consent-postgres.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 12d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Hydra routing, unified BYOK inference, streaming, usage and prepaid billing client
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 12d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Longzai Intelligence Decision 注册表引擎
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 13d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Utility to simplify integration with Open Telemetry for Fastify API Server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 15d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: OIDC trusted publishing setup package for @lunora/cloudflare-access
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 15d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: 语义包：combos.yaml 唯一真相源，36 组语义条目
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 15d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Utility to simplify integration with Open Telemetry
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 15d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Voltro UG | — | ||
|
Package purpose: SQLite dialect adapter for Voltro's cross-dialect DataStore (single-process; in-process change events).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 15d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Voltro UG | — | ||
|
Package purpose: Deep Sentry integration — error tracking correlated to distributed traces, breadcrumbs from the framework log sink, controlled browser performance spans, and server traces routed from the framework's OTel tracer via @sentry/node in OTel-consumer mode.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 16d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Cleartrip | — | ||
|
Package purpose: LinearGradient Component
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 16d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 16d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: linux-arm64 binary for @xai-official/grok. Do not install directly; install @xai-official/grok instead.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 16d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Starknet OFT Mint/Burn contracts for LayerZero v2
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 16d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 16d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 16d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Pegasystems | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 17d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Exposes the EVM gas sponsorship surface of `@dynamic-labs/ethereum-gasless-core` as a `ethereumGasless` namespace on the Dynamic client. Works for both the web and React Native (WebView) consumers — the extension forwards each call across `messageTranspor
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 17d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Pegasystems | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 17d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Pegasystems | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 17d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Pegasystems | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 17d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Pegasystems | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 18d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: This package contains the APTOS integration for the Dynamic SDK. It enables support for APTOS external wallets using the [@aptos-labs/wallet-standard](https://github.com/aptos-labs/wallet-standard) interface.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 18d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: A modal is a dialog window that appears on top of the main content, requiring user interaction before returning to the main interface. Also known as dialog, lightbox, or popup.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 18d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Dynamic Labs, Inc. | — | ||
|
Package purpose: A React SDK for implementing wallet web3 authentication and authorization to your website.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Dynamic Labs, Inc. | — | ||
|
Package purpose: Core package for Ethereum Account Abstraction utilities and types
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Pure (no React, no message-transport) implementation of Dynamic's EVM gasless flows: sponsored transactions and EIP-7702 delegation.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Dynamic Labs, Inc. | — | ||
|
Package purpose: A React SDK for implementing wallet web3 authentication and authorization to your website.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | TheTruckCompany | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Native binary for Claude Code on linux-x64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: BullMQ queue-explorer plugin for NestJS Dash (dashboard widget + Queue Explorer page)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 20d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: This npm package provides TypeScript type definitions for the Pimcore Copilot Studio integration. The UI components are delivered via module federation at runtime.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 20d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Atlassian | — | ||
|
Package purpose: Forge Jira bridge API for custom UI apps
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 20d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Pi-native OpenAI Codex subscription model provider plugin for Assembly Line.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 21d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Per-container CPU, memory, network, and block-I/O metrics via the docker_stats receiver
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 22d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: kitcn Resend plugin
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||