🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
90 97d 16 14 ↑0.2/day
SUSPICIOUS
claude npm 0.1.0 Priyanku Hazarika —
Package purpose: Generalized CLAUDE.md template with house coding standards, dropped into any project.
Claimed homepage: https://github.com/priyankuhazarika/bluehop/tree/main/packages/bluehop-claude-md#readme
Matched naming pattern: node-claude-bluehop-claude-md
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 97
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 610 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@sleepingasteroid/bluehop-claude-md' matches AI hallucination template [node] + [claude] + [bluehop-claude-md].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (72 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 99d 24 125 ↑0.2/day
SUSPICIOUS
vllm pypi 0.1.1 wuxuedaifu —
Package purpose: Pipecat community TTS integration for the XTTSv2-vLLM streaming server
Claimed homepage: https://pypi.org/project/pipecat-xtts-vllm/
Matched naming pattern: pipecat-vllm-vllm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 99
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 24/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 125 lines, 6.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'pipecat-xtts-vllm' matches AI hallucination template [pipecat] + [vllm] + [vllm].
  • HIGHClaims critical enterprise brand identity ('VLLM').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (73 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 102d 17 29 ↑0.2/day
SUSPICIOUS
langchain pypi 0.1.0 — sbryngelson@gmail.com gmail.com
Package purpose: LangChain embeddings that run on the Apple Neural Engine, via ANEForge (no CoreML).
Claimed homepage: https://pypi.org/project/langchain-aneforge/
Matched naming pattern: python-langchain-aneforge
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 102
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 17/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 29 lines, 1.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-aneforge' matches AI hallucination template [python] + [langchain] + [aneforge].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'sbryngelson@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (91 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 104d — — —
Unverified Signal
— npm latest — — 🪝
Package purpose: One-step installer for the TLS Observer Claude Code plugin.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/index.js:255 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/index.js:282 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:118 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 104d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: patient-growth-chart frontend module for O3
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'husky install'
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/307.js:38
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/307.js:12 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/307.js:1 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/main.js:5 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 106d 9 71 ↑0.1/day
SUSPICIOUS
google pypi 0.0.2 danialcala94 danielalcalavalera@gmail.com gmail.com
Package purpose: Youtube Autonomous FastAPI Docker TTS Google Module
Claimed homepage: https://pypi.org/project/yta-fastapi-docker-tts-google/
Matched naming pattern: django-google-auth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 106
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 71 lines, 2.2 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-fastapi-docker-tts-google' matches AI hallucination template [django] + [google] + [auth].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (80 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 110d 895 166 ↑8.1/day
Very Risky
tachograph npm 0.6.1 kosako — 🪝 🌐
Package purpose: A compact instrument cluster for your coding agents (Claude Code / Codex). Shows model, rate-limit headroom, and context at a glance.
Claimed homepage: https://github.com/kosako/tachograph#readme
Matched naming pattern: npm-tachograph-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 110
Registry downloads: 895/month, 223/week (MODERATE_USAGE)
Codebase size: 166 lines, 7.1 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (99 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:13 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:86 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:28
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:52
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:13 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:86 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:28
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:52
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 112d 14 118 ↑0.1/day
SUSPICIOUS
uniswap npm 0.1.0 Juan Gomez — 🪝
Package purpose: The first Uniswap plugin for the Hedera Agent Kit — let a Hedera agent swap tokens through Uniswap permissionless liquidity on EVM chains. Cross-asset settlement, treasury rebalancing, optionally Ledger-gated.
Claimed homepage: https://github.com/jmgomezl/hak-uniswap-plugin#readme
Matched naming pattern: hak-uniswap-plugin
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 112
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 118 lines, 5.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'hak-uniswap-plugin' matches AI hallucination template [hak] + [uniswap] + [plugin].
  • HIGHClaims critical enterprise brand identity ('UNISWAP').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOLegitimate documentation effort (209 chars with homepage link).
  • HIGHPackage registered recently (86 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:39
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:15
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:39
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:15

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 114d 61 102 ↑0.5/day
SUSPICIOUS
google npm 1.1.1 — —
Package purpose: Google Cloud Identity Platform auth plugin for the C2PA Soft Binding Resolution API server
Claimed homepage: https://github.com/Cognitive-Proof/c2pa-soft-binding-server#readme
Matched naming pattern: node-google-softbinding-api-plugin-google-auth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 114
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 61/month, 15/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 102 lines, 4.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@cognitiveproof/softbinding-api-plugin-google-auth' matches AI hallucination template [node] + [google] + [softbinding-api-plugin-google-auth].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (88 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 116d 131 3,072 ↑1.1/day
Very Risky
google npm 2.0.27 — — 🪝
Package purpose: A homebridge plugin that uses the Google Smart Device Management API.
Claimed homepage: https://github.com/josephsieh/homebridge-google-nest-sdm
Matched naming pattern: node-google-homebridge-google-nest-sdm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 116
Registry downloads: 131/month, 32/week (MODERATE_USAGE)
Codebase size: 3072 lines, 137.6 kB across 30 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@josephsjc/homebridge-google-nest-sdm' matches AI hallucination template [node] + [google] + [homebridge-google-nest-sdm].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (107 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/sdm/Camera.js:135
  • HIGHANTI_ANALYSIS_EVASION: 'Extended Scanner Timeout Stall' found in package/dist/sdm/Camera.js:139
  • CRITICALSOURCE_CODE_EVASIVE_PAYLOAD: anti-analysis evasion combined with execution/payload hook in package/dist/sdm/Camera.js
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/FfMpegProcess.js:4 (+1 more occurrence(s) elsewhere)
Static code signals:
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/sdm/Camera.js:135
  • ANTI_ANALYSIS_EVASION: 'Extended Scanner Timeout Stall' found in package/dist/sdm/Camera.js:139
  • SOURCE_CODE_EVASIVE_PAYLOAD: anti-analysis evasion combined with execution/payload hook in package/dist/sdm/Camera.js
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/FfMpegProcess.js:4 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/FfMpegProcess.js:14 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 116d 12 110 ↑0.1/day
SUSPICIOUS
microsoft npm 1.0.1 kelvinzer0 —
Package purpose: Visual Search API lets you discover insights about an image such as visually similar images, shopping sources, and related searches. The API can also perform text recognition, identify entities (pe..
Claimed homepage: https://n8n-code.github.io/n8n-dev/#/n8n-nodes-microsoft-cognitiveservices-visualsearch
Matched naming pattern: node-microsoft-n8n-nodes-microsoft-cognitiveservices-visualsearch
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 116
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 110 lines, 5.5 kB across 6 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@n8n-dev/n8n-nodes-microsoft-cognitiveservices-visualsearch' matches AI hallucination template [node] + [microsoft] + [n8n-nodes-microsoft-cognitiveservices-visualsearch].
  • HIGHClaims critical enterprise brand identity ('MICROSOFT').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (91 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 122d 23 148 ↑0.2/day
Very Risky
claude npm 1.2.1 Jainil Sevalia — 🪝
Package purpose: Keep your Claude Code rate-limit window working for you. Zero-dependency cross-platform scheduled pinger.
Claimed homepage: https://github.com/jainilsevalia/claude-ping#readme
Matched naming pattern: claude-claude-ping
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 122
Registry downloads: 23/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 148 lines, 5.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (106 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/cli.js:3
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/cli.js:68
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/bin/cli.js:76
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/bin/cli.js
  • INFOPackage affiliated with trusted vendor 'claude' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (130 -> 65) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/cli.js:3
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/cli.js:68
  • SYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/bin/cli.js:76
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/bin/cli.js

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 123d 20 45 ↑0.2/day
SUSPICIOUS
vllm pypi 0.1.0 — suarezpm@csnat.unt.edu.ar csnat.unt.edu.ar
Package purpose: Apohara ContextForge plugin for vLLM V1 — multi-agent KV-cache coordination, JCR Safety Gate (INV-15), RotateKV INT4 hooks, on AMD Instinct MI300X.
Claimed homepage: https://pypi.org/project/apohara-vllm-plugin/
Matched naming pattern: apohara-vllm-plugin
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 123
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 20/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 45 lines, 2.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'apohara-vllm-plugin' matches AI hallucination template [apohara] + [vllm] + [plugin].
  • HIGHClaims critical enterprise brand identity ('VLLM').
  • HIGHPublisher email 'suarezpm@csnat.unt.edu.ar' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (97 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 124d 13 23 ↑0.1/day
SUSPICIOUS
claude npm 0.1.0 — —
Package purpose: Claude adapter for installing AIPM skill packages.
Claimed homepage: https://aipm-registry.com
Matched naming pattern: node-claude-adapter-claude
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 124
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 23 lines, 1.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@aipm-registry/adapter-claude' matches AI hallucination template [node] + [claude] + [adapter-claude].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (98 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 124d 13 23 ↑0.1/day
SUSPICIOUS
cursor npm 0.1.0 — —
Package purpose: Cursor adapter for installing AIPM skill packages.
Claimed homepage: https://aipm-registry.com
Matched naming pattern: node-cursor-adapter-cursor
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 124
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 23 lines, 1.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@aipm-registry/adapter-cursor' matches AI hallucination template [node] + [cursor] + [adapter-cursor].
  • HIGHClaims critical enterprise brand identity ('CURSOR').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (98 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 127d 67 119 ↑0.5/day
SUSPICIOUS
cursor npm 1.4.0 Keshav Kumar — 🪝
Package purpose: Extremely lightweight React cursor effects (0 dependencies other than React)
Claimed homepage: https://github.com/Keshav-poha/Cursors#readme
Matched naming pattern: lite-cursor-effects
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 127
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 67/month, 16/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 119 lines, 304.9 kB across 8 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'lite-cursor-effects' matches AI hallucination template [lite] + [cursor] + [effects].
  • HIGHClaims critical enterprise brand identity ('CURSOR').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (101 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:1 (+3 more occurrence(s) elsewhere)
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:1 (+3 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 135d — — —
Unverified Signal
— npm latest developer@yoooclaw.com developer@yoooclaw.com yoooclaw.com 🪝
Package purpose: yoooclaw 独立 CLI（Go 实现，按平台分发原生二进制）
Static code signals:
  • LIFECYCLE_SCRIPT: 'preinstall' -> 'node bin/prepare-owner.js'
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node bin/activate-owner.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/activate-owner.js:51 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/activate-owner.js:12 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 138d 15 90 ↑0.1/day
SUSPICIOUS
ledger npm 0.1.0-alpha.0 ALEF-PRIME —
Package purpose: Append-only public ledger of self-imposed penalties for AI-driven projects. Stacks-by-key dedupe, time-based expiry, score-aware aggregation. The accountability layer ALEF wears in public.
Claimed homepage: https://www.n50.io/evolution
Matched naming pattern: node-ledger-penalty-ledger
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 138
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 3.3 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@alef-prime/penalty-ledger' matches AI hallucination template [node] + [ledger] + [penalty-ledger].
  • HIGHClaims critical enterprise brand identity ('LEDGER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (112 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 138d 5 22 ↑0.0/day
SUSPICIOUS
google pypi 0.1.1.dev1 — jacob@swarmauri.com swarmauri.com
Package purpose: Installable SSOT governance pack for GA4 Measurement Protocol, Google tag, Google Tag Manager, GA4 event parameters, and BigQuery exports.
Claimed homepage: https://pypi.org/project/ga4-google-tagging-governance-pack/
Matched naming pattern: ga4-google-tagging
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 138
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 22 lines, 1.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'ga4-google-tagging-governance-pack' matches AI hallucination template [ga4] + [google] + [tagging].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'jacob@swarmauri.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (128 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 140d 46 45 ↑0.3/day
SUSPICIOUS
llama npm 4.2.2 Deep Chakraborty —
Package purpose: DVAI-Bridge Capacitor plugin: llama.cpp on iOS (Metal) + Android (Vulkan/CPU) with embedded HTTP server.
Claimed homepage: https://github.com/dvai-global/dvai-bridge#readme
Matched naming pattern: node-llama-capacitor-llama
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 140
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 46/month, 11/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 45 lines, 1.7 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@dvai-bridge/capacitor-llama' matches AI hallucination template [node] + [llama] + [capacitor-llama].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (114 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 147d 134 358 ↑0.9/day
Very Risky
x711 npm latest Criptic agents@x711.io x711.io 🪝 🌐
Package purpose: 26 AI agent tools in 2 lines. Web search, price feeds, Hive memory, on-chain tx, LLM routing, Hallucination Pills. Free tier, no credit card.
Claimed homepage: https://x711.io
Matched naming pattern: node-x711-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 147
Registry downloads: 134/month, 33/week (MODERATE_USAGE)
Codebase size: 358 lines, 14.9 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOPublisher email domain '@x711.io' matches package identifier token 'x711', verifying identifiable third-party organization ownership.
  • HIGHPackage registered recently (135 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node postinstall.js'
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/index.js:26 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:218 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/index.js:137 (+1 more occurrence(s) elsewhere)
  • HIGHANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/postinstall.js:19
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node postinstall.js'
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/index.js:26 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:218 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/index.js:137 (+1 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/postinstall.js:19
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/postinstall.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 147d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Feishu bot bridge for Claude Code
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall-sharp-check.mjs'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/src/agent-capability-grants.js:41 (+22 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/src/agent-team/web/agent-team-page.js:128 (+12 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/src/adapters/codex-app-server.js:279 (+7 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 148d — — —
Unverified Signal
— npm latest Dan Moisan — 🪝
Package purpose: Stdio MCP server exposing drm-copilot repo-automation tools.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/out/mcp-server.js:2948
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/out/mcp-server.js:33686
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/out/mcp-server.js:7950
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/out/mcp-server.js:15800
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/out/mcp-server.js:33686

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 152d — — —
Unverified Signal
— npm latest Mitch Fultz — 🪝
Package purpose: pi provider extension backed by @cursor/sdk local and cloud agents
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cursor-agents-context.js:66 (+60 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/cursor-cloud-local-state.js:50 (+12 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Invisible Unicode Steganography / Bidi Override' found in package/dist/cursor-fallback-models.generated.js:8628 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/scripts/platform-smoke/artifact-bundle-contract.mjs:25
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/scripts/steering-rpc-smoke.mjs:267 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 152d 17 62 ↑0.1/day
SUSPICIOUS
clerk pypi 0.0.4 — phildini@phildini.net phildini.net
Package purpose: Community-contributed fetchers for civicband-clerk
Claimed homepage: https://pypi.org/project/clerk-fetchers/
Matched naming pattern: django-clerk-auth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 152
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 17/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 62 lines, 2.6 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'clerk-fetchers' matches AI hallucination template [django] + [clerk] + [auth].
  • HIGHClaims critical enterprise brand identity ('CLERK').
  • HIGHPublisher email 'phildini@phildini.net' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (127 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 158d 39 118 ↑0.2/day
SUSPICIOUS
google pypi 0.4.0 — — 🪝
Package purpose: Drop-in Google Generative AI SDK shim for EvalOps llm-gateway routing
Claimed homepage: https://pypi.org/project/evalops-google-generativeai/
Matched naming pattern: evalops-google-generativeai
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 158
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 39/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 118 lines, 4.6 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'evalops-google-generativeai' matches AI hallucination template [evalops] + [google] + [generativeai].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (132 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in evalops_google_generativeai-0.4.0/src/evalops_google_generativeai/__init__.py:32
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in evalops_google_generativeai-0.4.0/src/evalops_google_generativeai/__init__.py:32

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 159d 6 55 ↑0.0/day
SUSPICIOUS
microsoft pypi 0.0.1 — goadriving@gmail.com gmail.com 🪝
Package purpose: Synap integration for microsoft-agent.
Claimed homepage: https://pypi.org/project/synap-microsoft-agent/
Matched naming pattern: synap-microsoft-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 159
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 55 lines, 2.4 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'synap-microsoft-agent' matches AI hallucination template [synap] + [microsoft] + [agent].
  • HIGHClaims critical enterprise brand identity ('MICROSOFT').
  • HIGHPublisher email 'goadriving@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (149 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in synap_microsoft_agent-0.0.1/src/synap_microsoft_agent/__init__.py:21
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in synap_microsoft_agent-0.0.1/src/synap_microsoft_agent/__init__.py:21

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 159d 13 55 ↑0.1/day
SUSPICIOUS
google pypi 0.0.1 — goadriving@gmail.com gmail.com 🪝
Package purpose: Synap integration for google-adk.
Claimed homepage: https://pypi.org/project/synap-google-adk/
Matched naming pattern: synap-google-adk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 159
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 55 lines, 2.4 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'synap-google-adk' matches AI hallucination template [synap] + [google] + [adk].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'goadriving@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (133 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in synap_google_adk-0.0.1/src/synap_google_adk/__init__.py:21
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in synap_google_adk-0.0.1/src/synap_google_adk/__init__.py:21

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 161d 15 85 ↑0.1/day
SUSPICIOUS
chroma pypi 1.1.0 Niels Kootstra —
Package purpose: ChromaDB-backed KnowledgeStore adapter for Zeno.
Claimed homepage: https://pypi.org/project/zeno-chroma/
Matched naming pattern: python-chroma-zeno
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 161
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 85 lines, 3.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'zeno-chroma' matches AI hallucination template [python] + [chroma] + [zeno].
  • HIGHClaims critical enterprise brand identity ('CHROMA').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (135 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 162d 16 32 ↑0.1/day
SUSPICIOUS
langchain pypi 0.1.1 MAXIA majorel.alexis@gmail.com gmail.com
Package purpose: Langchain integration for BudgetForge API with budget enforcement
Claimed homepage: https://github.com/maxialab/budgetforge
Matched naming pattern: python-langchain-budgetforge
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 162
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 32 lines, 1.2 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-budgetforge' matches AI hallucination template [python] + [langchain] + [budgetforge].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'majorel.alexis@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (151 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 165d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Local-first visual generation runtime and studio for people and coding agents, with reproducible image and video workflows across multiple providers.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'echo '\n [ima2] Gallery thumbnails will be auto-generated on next server start.\n Or run: ima2 backfill-thumbs\n''
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/routes/admin.js:10 (+38 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/lib/agent-driven.js:30 (+32 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/bin/lib/agent-driven.js:27
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/lib/agentImageVideoGen.js:205 (+18 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/lib/doctor-checks.js:32 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/lib/githubStar.js:83
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/ui/dist/assets/pptxgen.es-XHiluGIr.js:2

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 171d 67 109 ↑0.4/day
SUSPICIOUS
google npm 0.1.0 CryptoWombat —
Package purpose: Google One Tap sign-in React component for Next.js + Supabase projects. Handles GIS script loading, credential exchange, ad-blocker fallback, and loading state.
Claimed homepage: https://github.com/konduktor-dev/konduktor#readme
Matched naming pattern: node-google-auth-google-onetap
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 171
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 67/month, 16/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 109 lines, 5.8 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@konduktor/auth-google-onetap' matches AI hallucination template [node] + [google] + [auth-google-onetap].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (145 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 171d 0 14 ↑0.0/day
SUSPICIOUS
binance pypi 0.1.0 nekojiru contributors —
Package purpose: Binance public data sync CLI and Python API powered by Rust
Claimed homepage: https://pypi.org/project/nekojiru-binance/
Matched naming pattern: python-binance-nekojiru
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 171
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 473 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'nekojiru-binance' matches AI hallucination template [python] + [binance] + [nekojiru].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (145 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 172d 12 135 ↑0.1/day
SUSPICIOUS
elevenlabs pypi 0.0.1 — —
Package purpose: Moss semantic search integration for ElevenLabs Conversational AI
Claimed homepage: https://pypi.org/project/elevenlabs-moss/
Matched naming pattern: python-elevenlabs-moss
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 172
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 135 lines, 5.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'elevenlabs-moss' matches AI hallucination template [python] + [elevenlabs] + [moss].
  • HIGHClaims critical enterprise brand identity ('ELEVENLABS').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (146 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 173d 0 94 ↑0.0/day
SUSPICIOUS
phantom pypi 0.2.0 Phantom contributors — 🪝
Package purpose: Phantom ML compiler: declarative model definitions compiled to native code via LLVM. pip install phantom-lang; import phantom.
Claimed homepage: https://pypi.org/project/phantom-lang/
Matched naming pattern: python-phantom-lang
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 173
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 94 lines, 3.7 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'phantom-lang' matches AI hallucination template [python] + [phantom] + [lang].
  • HIGHClaims critical enterprise brand identity ('PHANTOM').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (147 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in phantom/__init__.py:109
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in phantom/__init__.py:109

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 185d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/gateway/src/accounts.js:10 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/host/src/drivers/codex/app-server.js:30 (+21 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/cli/src/commands/doctor.js:16 (+6 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/host/src/fs.js:222 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 187d 12 38 ↑0.1/day
SUSPICIOUS
vllm pypi 0.0.0 Development Team test@test.com test.com
Package purpose: This name has been reserved using Reserver
Claimed homepage: https://url.com
Matched naming pattern: python-vllm-messages
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 187
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 38 lines, 1.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'vllm-messages' matches AI hallucination template [python] + [vllm] + [messages].
  • HIGHClaims critical enterprise brand identity ('VLLM').
  • HIGHPublisher email 'test@test.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (161 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 187d 15 38 ↑0.1/day
SUSPICIOUS
vllm pypi 0.0.0 Development Team test@test.com test.com
Package purpose: This name has been reserved using Reserver
Claimed homepage: https://url.com
Matched naming pattern: python-vllm-responses
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 187
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 38 lines, 1.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'vllm-responses' matches AI hallucination template [python] + [vllm] + [responses].
  • HIGHClaims critical enterprise brand identity ('VLLM').
  • HIGHPublisher email 'test@test.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (161 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 190d 28 71 ↑0.1/day
SUSPICIOUS
chroma npm 1.0.0 — — 🪝
Package purpose: Chroma vector-store adapter for Sisu RAG composition.
Claimed homepage: https://github.com/finger-gun/sisu#readme
Matched naming pattern: node-chroma-vector-chroma
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 190
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 28/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 71 lines, 2.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@sisu-ai/vector-chroma' matches AI hallucination template [node] + [chroma] + [vector-chroma].
  • HIGHClaims critical enterprise brand identity ('CHROMA').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (164 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:9
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:9

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 194d 8 64 ↑0.0/day
SUSPICIOUS
tether pypi 0.1.0 Revise Robotics —
Package purpose: Lightweight JSON-RPC client for Arduino over serial
Claimed homepage: https://pypi.org/project/tether-arduino/
Matched naming pattern: python-tether-arduino
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 194
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 64 lines, 2.6 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'tether-arduino' matches AI hallucination template [python] + [tether] + [arduino].
  • HIGHClaims critical enterprise brand identity ('TETHER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (168 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 195d 35 2,227 ↑0.2/day
SUSPICIOUS
google pypi 7.6 Ivan Sincek —
Package purpose: Not another Google Dorking tool.
Claimed homepage: https://pypi.org/project/google-chad/
Matched naming pattern: django-google-auth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 195
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 35/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2227 lines, 82.4 kB across 27 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'google-chad' matches AI hallucination template [django] + [google] + [auth].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (169 days ago) during the active AI hallucination slopsquatting wave.
  • MEDIUMPackage registered with suspiciously high major version (v7.6, major 7) despite recent registration (169 days ago, 1 release(s)), indicating potential dependency confusion attack to shadow internal organization builds.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOSubstantial functional codebase (2227 LOC across 27 file(s)).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 199d 31 101 ↑0.2/day
SUSPICIOUS
polygon npm 1.0.4 Thalaxis opensource@thalaxis.com thalaxis.com
Package purpose: Polygon chain adapter for Routex
Claimed homepage: https://github.com/routexcc/routex#readme
Matched naming pattern: node-polygon-chain-polygon
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 199
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 31/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 101 lines, 3.9 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@routexcc/chain-polygon' matches AI hallucination template [node] + [polygon] + [chain-polygon].
  • HIGHClaims critical enterprise brand identity ('POLYGON').
  • HIGHPublisher email 'opensource@thalaxis.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (173 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 201d — — —
Unverified Signal
— npm latest garetheddies — 🪝
Package purpose: CFML grammar for tree-sitter
Static code signals:
  • LIFECYCLE_SCRIPT: 'install' -> 'node-gyp-build'
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/ensure-tree-sitter-cli-binary.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/tree-sitter-cli.cjs:3 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/tree-sitter-cli.cjs:31 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/build-native.js:40 (+8 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 205d 19 121 ↑0.1/day
SUSPICIOUS
google pypi 1.4.0 — — 🪝
Package purpose: TuringPulse SDK integration for Google GenAI (Gemini)
Claimed homepage: https://pypi.org/project/turingpulse-sdk-google-genai/
Matched naming pattern: turingpulse-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 205
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 121 lines, 5.3 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'turingpulse-sdk-google-genai' matches AI hallucination template [turingpulse] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (179 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in turingpulse_sdk_google_genai-1.4.0/turingpulse_sdk_google_genai/_wrapper.py:31
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in turingpulse_sdk_google_genai-1.4.0/turingpulse_sdk_google_genai/_wrapper.py:31

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 205d 13 60 ↑0.1/day
SUSPICIOUS
google pypi 1.4.0 — —
Package purpose: TuringPulse SDK integration for Google Agent Development Kit
Claimed homepage: https://pypi.org/project/turingpulse-sdk-google-adk/
Matched naming pattern: turingpulse-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 205
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 60 lines, 2.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'turingpulse-sdk-google-adk' matches AI hallucination template [turingpulse] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (179 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 206d 14 20 ↑0.1/day
SUSPICIOUS
ripple pypi 0.1.1 — konstantin@taletskiy.com taletskiy.com
Package purpose: Ripple: Reactive notebook execution in JupyterLab. Automatically re-executes downstream cells when their dependencies change.
Claimed homepage: https://pypi.org/project/jupyterlab-ripple/
Matched naming pattern: python-ripple-jupyterlab
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 206
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 20 lines, 1.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'jupyterlab-ripple' matches AI hallucination template [python] + [ripple] + [jupyterlab].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • HIGHPublisher email 'konstantin@taletskiy.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (180 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 237d 509 126 ↑2.1/day
SUSPICIOUS
llama pypi 0.2.0 — hhichri60@gmail.com gmail.com
Package purpose: llama-index Chonkie integration
Claimed homepage: https://pypi.org/project/llama-index-node-parser-chonkie/
Matched naming pattern: llama-llama-node
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 237
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 509/month, 41/week (MODERATE_USAGE)
Codebase size: 126 lines, 6.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'hhichri60@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage claims legitimate high-profile upstream repository 'run-llama/llama_index' (llama-index) in metadata to artificially inflate trust / SourceRank.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • MEDIUMPackage registered 211 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOModerate community usage with 320 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 368d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: ⚡ Intégrations app front-end
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'husky'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/mf/5475.js:1 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/mf/9430.js:1 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/mf/index.js:4 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/mf/index.js:2 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 387d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: 🤖 Tech app front-end
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'husky'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/mf/1659.js:1 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/mf/3364.js:1 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/mf/index.js:29 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/mf/index.js:27 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 401d 210 2,289 ↑0.5/day
Very Risky
llama npm 0.1.6 Cantoo — 🪝 🌐
Package purpose: Capacitor binding of llama.cpp
Claimed homepage: https://github.com/cantoo-scribe/capacitor-llama#readme
Matched naming pattern: node-llama-capacitor-llama
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 401
Registry downloads: 210/month, 52/week (MODERATE_USAGE)
Codebase size: 2289 lines, 92.7 kB across 19 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@cantoo/capacitor-llama' matches AI hallucination template [node] + [llama] + [capacitor-llama].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node ./install/download-native-artifacts.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install/download-native-artifacts.js:9
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install/download-native-artifacts.js:144
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install/download-native-artifacts.js:5
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install/download-native-artifacts.js:187
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node ./install/download-native-artifacts.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install/download-native-artifacts.js:9
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install/download-native-artifacts.js:144
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install/download-native-artifacts.js:5
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install/download-native-artifacts.js:187
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install/download-native-artifacts.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD