Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 15 | 44d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Circle flag SVGs as Mithril.js components
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 44d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: External BYOK provider for OpenAI (ChatGPT/Codex) in cmd.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 45d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | info@overcast.xyz info@overcast.xyz | overcast.xyz | ||
|
Package purpose: RawSigner implementation backed by AWS KMS (Ed25519).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 46d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 48d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 55d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Stripe payment abstractions — injectable services for checkout sessions, webhooks, customers, billing portal, discounts, products, prices, and revenue analytics
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 61d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Reusable Wilma Copilot presentational components for React and Wildix UIKit.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 61d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: React hooks for Wilma Copilot relationships, session streams and asks with injected clients.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 61d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Framework-free Wilma Copilot events, reducer, transcript, assets, timeline and session helpers.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 63d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 68d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: ```bash npm install @dynamic-labs/legacy-solana-extension ```
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 81d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Voltro UG | — | ||
|
Package purpose: Auth0-backed AuthStrategy for the Voltro framework. Verifies Auth0-issued JWTs via the tenant's JWKS endpoint. Conforms to @voltro/protocol AuthStrategy so it composes with other IdP plugins.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 82d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: @wildix/wilma-copilot-sessions-client client
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 82d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: @wildix/wilma-copilot-client client
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 84d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 87d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: SharePoint Framework base class for building Copilot Components
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 89d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 89d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 90d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 91d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Server-side Stripe adapter for PayFanout (PaymentIntents, Refunds, webhook signature verification). Holds secrets — never bundle client-side.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 91d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Client-side Stripe adapter for PayFanout (Stripe.js + Payment Element). No secrets, no server code.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 94d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Yasser Rosas | — | ||
|
Package purpose: Qdrant long-term memory store for galdor-bun: vector search over the Qdrant HTTP REST API.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 99d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: node-llama-cpp provider for smoltalk
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 107d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Web3 addon for cruzo: wallet providers, sign, verify
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 153d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Stripe payment abstractions (StripeClient, CheckoutSession, WebhookEvent) for bagou-packages
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 178d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Aasim Bhat | — | ||
|
Package purpose: TC Payments Stripe contracts
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 190d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Mayank Khan Singh DeSouza | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 197d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 205d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Alchemy smart account integration for Para
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 219d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: OpenAI-compatible provider plugin for Antseed
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 222d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Third-party Anthropic Claude provider with OAuth authentication
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 222d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Claude Code keychain provider plugin for Antseed
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 222d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Anthropic API key provider plugin for Antseed
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 238d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 243d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 281d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Binance Wallet integration for hub. [Homepage](https://www.binance.com/en/binancewallet) | [Docs](https://developers.binance.com/docs/binance-w3w/introduction)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 341d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Reusable Google Reviews widgets + API helpers for Astro projects.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 356d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 357d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Svelte library for building animated mesh gradients with warp and grain, powered by WebGL.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 695d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Optimajet | — | ||
|
Package purpose: OptimaJet Form Builder Components - Google Maps integration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 716d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 819d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Trezor integration for hub. [Homepage](https://trezor.io//) | [Docs](https://docs.trezor.io/trezor-suite/)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 911d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 914d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: This is a CLI tool that scaffolds Next.js and React projects with a focus on Web3 development.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 923d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 1166d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: WalletConnect integration for hub. [Homepage](https://walletconnect.com/) | [Docs](https://docs.walletconnect.com/)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 1286d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Signer for Tron Transacations generated by Rango API
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 1315d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: Trust Wallet integration for hub. [Homepage](https://trustwallet.com/) | [Docs](https://developer.trustwallet.com/developer/develop-for-trust/browser-extension)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 1537d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 15 | 1907d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
Package purpose: This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 10.0.6.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||