Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | 20d | — | — | — |
Possible Squatted Stub
|
— | pypi | added | Rawson Consulting B.V. | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 20d | — | — | — |
Possible Squatted Stub
|
— | pypi | added | Rawson Consulting B.V. | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 20d | — | — | — |
Possible Squatted Stub
|
— | pypi | added | Rawson Consulting B.V. | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 20d | — | — | — |
Possible Squatted Stub
|
— | pypi | added | Rawson Consulting B.V. | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 20d | — | — | — |
Possible Squatted Stub
|
— | pypi | added | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 20d | — | — | — |
Possible Squatted Stub
|
— | pypi | added | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 21d | — | — | — |
Very Risky
|
— | pypi | 2.2.1 | SwirEngine contributors | — | 🪝 | |
|
Package purpose: Modern Python-first 2D/3D game engine with a unified API.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 21d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 0 | 25d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.9.19 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 25d | — | — | — |
Very Risky
|
— | pypi | 3.4.1 | Amit Singh | — | 🪝 | |
|
Package purpose: Privacy-first static code health analysis for Python packages
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 31d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.0.88 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 31d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.0.88 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 31d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.0.88 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 35d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 0 | 129d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 144d | — | — | — |
Possible Squatted Stub
|
— | pypi | 1.0.35 | Cursor | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 157d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 158d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 158d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 158d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 158d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 158d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 158d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 159d | — | — | — |
Possible Squatted Stub
|
— | pypi | 2.4.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 162d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.8.0 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 168d | — | — | — |
Possible Squatted Stub
|
— | pypi | 1.7.0b2 | ethereum | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 183d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | pypi | 0.9.12 | — | — | 🪝 🐛 | |
|
Package purpose: Core types for the Reflex framework.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 208d | — | — | — |
Possible Squatted Stub
|
— | pypi | 6.2.2 | ActiveViam | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 233d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.15.2 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 477d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | pypi | 2.0.0 | — | — | 🪝 🐛 | |
|
Package purpose: Comprehensive, highly performant Google Workspace Streamable HTTP & SSE MCP Server for Calendar, Gmail, Docs, Sheets, Slides & Drive
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 631d | — | — | — |
Possible Squatted Stub
|
— | pypi | 1.7.0.dev1 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 1326d | — | — | — |
Possible Squatted Stub
|
— | pypi | 0.14.25 | — | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 3637d | — | — | — |
Very Risky
|
— | pypi | 5.0.2 | — | — | 🪝 | |
|
Package purpose: BGmi is a cli tool for subscribed bangumi.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 0 | 3861d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | npm, Inc | — | ||
|
No additional detail available for this finding. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||