🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
90 418d 26 189 ↑0.1/day
Very Risky
claude npm 1.0.8 GailenTech — 🪝 🌐
Package purpose: Terminal-based agent manager for Claude Code with extensible sources system
Claimed homepage: https://github.com/GailenTech/claude-agent-manager#readme
Matched naming pattern: claude-claude-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 418
Registry downloads: 26/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 189 lines, 7.0 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/download-binary.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/agent-manager.js:3 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/download-binary.js:88
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/download-binary.js:3
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/download-binary.js, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor 'claude' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (130 -> 65) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/download-binary.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/agent-manager.js:3 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/download-binary.js:88
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/download-binary.js:3
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/download-binary.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 970d 20 17 ↑0.0/day
SUSPICIOUS
aave npm 1.0.3 — — 🪝
Package purpose: Aave integration providing gho utility for Node
Claimed homepage: https://github.com/mukkalasneha/Aave-gho-beta#readme
Matched naming pattern: node-aave-gho
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 970
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 20/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 17 lines, 514 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'aave-gho' matches AI hallucination template [node] + [aave] + [gho].
  • HIGHClaims critical enterprise brand identity ('AAVE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 944 days ago (predates modern AI hallucination waves).
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'patch-package'
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'patch-package'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 1221d — — —
Unverified Signal
— npm latest cc-pwa-kit@salesforce.com cc-pwa-kit@salesforce.com salesforce.com 🪝 🌐
Package purpose: :loudspeaker: Hey there, Salesforce Commerce Cloud community!
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'npm run compile-translations && npm run compile-translations:pseudo'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/translations/compile-folder.js:9 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/config/default.js:23 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/utils/locale.js:34 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 1262d 8 96 ↑0.0/day
SUSPICIOUS
web3 npm 1.0.1-Beta-1 — — 🪝
Package purpose: myDAPPwallet JavaScript API
Claimed homepage: https://github.com/mdw/mdw-web3.js#readme
Matched naming pattern: node-web3-mdw
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1262
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 96 lines, 3.4 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'mdw-web3' matches AI hallucination template [node] + [web3] + [mdw].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1236 days ago (predates modern AI hallucination waves).
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'echo "mdw-web3.js 1.x alpha has been released for early testing and feedback. Checkout doc at https://docs.mydappwallet.com/ "'
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'echo "mdw-web3.js 1.x alpha has been released for early testing and feedback. Checkout doc at https://docs.mydappwallet.com/ "'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 1388d — — —
SUSPICIOUS
— npm latest — — 🪝 🌐
Package purpose: Form Builder for O3
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'husky install'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/237d897892d45083fa60f6b81d5254ee.js:1 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/4538.js:22
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/4538.js:12 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/4538.js:3 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/dist/6c6d192b6860b4508a14c2d04769a35e.js:1 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
90 1768d — — —
Unverified Signal
— npm latest — — 🪝
Package purpose: Rush plugin for Azure storage cloud build cache
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/lib-commonjs/AdoCodespacesAuthCredential.js:33 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/lib-commonjs/AdoCodespacesAuthCredential.js:64 (+1 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/lib-commonjs/AdoCodespacesAuthCredential.js:64 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib-commonjs/AzureAuthenticationBase.js:42 (+3 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 23h 0 133 ↑0.0/day
Very Risky
@carlos npm 1.0.0 Carlos Burelo — 🪝 🌐
Package purpose: El gestor de procesos definitivo para Windows Server escrito en Rust
Claimed homepage: https://github.com/carlos-burelo/wyrm#readme
Matched naming pattern: npm-@carlos-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 133 lines, 4.5 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/cli.js:4
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/install.js:7
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/install.js:73
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor '@carlos' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (125 -> 62) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/cli.js:4
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/install.js:7
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/install.js:73
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 4d 0 232 ↑0.0/day
Very Risky
@dayzero_run/d0 npm 0.2.0 dayzero.run dayzero.run 🪝 🌐
Package purpose: CLI to host vibe-coded UIs — deploy a public HTTPS subdomain without opening a cloud account
Claimed homepage: https://dayzero.run/
Matched naming pattern: npm-@dayzero_run/d0-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 4
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 232 lines, 6.5 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node lib/install-binary.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/d0.js:4
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/d0.js:14 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/lib/install-binary.js:6
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/lib/install-binary.js, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor '@dayzero_run/d0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (125 -> 62) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node lib/install-binary.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/d0.js:4
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/d0.js:14 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/lib/install-binary.js:6
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/lib/install-binary.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 5d 0 931 ↑0.0/day
Very Risky
flex npm 1.0.0 — — 🪝 📡
Package purpose: FlexOffice 独立登录 CLI — OAuth2.0 浏览器授权 / Token 手动设置 / 状态查询
Matched naming pattern: npm-flex-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 5
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 931 lines, 42.2 kB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install-env.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in package/lib/auth.js:19
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/lib/auth.js:98
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/lib/auth.js:269
  • HIGHSUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/lib/auth.js:235
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install-env.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in package/lib/auth.js:19
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/lib/auth.js:98
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/lib/auth.js:269
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/lib/auth.js:235
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/commands.js:59
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install-env.js:21

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 9d 0 101 ↑0.0/day
Very Risky
@easyi18n.com/cli npm 0.13.0-rc.1 — — 🪝 🌐
Package purpose: The easyi18n CLI and MCP server as a prebuilt binary: no Dart SDK needed.
Claimed homepage: https://docs.easyi18n.com/developers/agents
Matched naming pattern: npm-@easyi18n.com/cli-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 9
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 101 lines, 4.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:60
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:33
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:42
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor '@easyi18n.com/cli' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (125 -> 62) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:60
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:33
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:42
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 10d 0 166 ↑0.0/day
Very Risky
salamlang npm 0.4.3 Seyyed Ali Mohammadiyeh and the Salam Team — 🪝 🌐
Package purpose: General-purpose systems programming language with a built-in DSL
Claimed homepage: https://github.com/SalamLang/Salam
Matched naming pattern: npm-salamlang-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 10
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 166 lines, 5.3 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:96 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:66
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/salam.js:31
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor 'salamlang' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (125 -> 62) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:96 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:66
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/salam.js:31
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 10d 0 166 ↑0.0/day
Very Risky
salam npm 0.4.3 Seyyed Ali Mohammadiyeh and the Salam Team — 🪝 🌐
Package purpose: Salam integration providing general utility for Npm
Claimed homepage: https://github.com/SalamLang/Salam
Matched naming pattern: npm-salam-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 10
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 166 lines, 5.3 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:96 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:66
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/salam.js:31
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor 'salam' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (125 -> 62) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:96 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:66
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/salam.js:31
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 17d 72 481 ↑4.2/day
Very Risky
waydocs npm latest — — 🪝 🌐
Package purpose: Local MCP server for Waydocs — versioned, agent-navigable project docs.
Claimed homepage: https://github.com/aquaprogit/waydocs#readme
Matched naming pattern: node-waydocs-mcp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 17
Registry downloads: 72/month, 18/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 481 lines, 23.7 kB across 6 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (10 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node ./scripts/download-api.mjs'
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/client.js:11 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/client.js:1 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/download-api.mjs:85
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/download-api.mjs, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor 'waydocs' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (125 -> 62) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node ./scripts/download-api.mjs'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/client.js:11 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/client.js:1 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/download-api.mjs:85
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/download-api.mjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 54d 21 1,143 ↑0.4/day
Very Risky
claude npm 0.3.0 Toshon Jennings — 🪝
Package purpose: Learned coding preferences for Claude Code and OpenCode — captured from real signals, stored as markdown, shared over git.
Claimed homepage: https://github.com/toshon-jennings/taste#readme
Matched naming pattern: node-claude-taste
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 54
Registry downloads: 21/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1143 lines, 47.7 kB across 13 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'claude-taste' matches AI hallucination template [node] + [claude] + [taste].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (42 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/hooks/capture.mjs:40 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/cli.mjs:209
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Shell Profile Backdoor Injection' found in package/src/cli.mjs:206
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/src/cli.mjs
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/hooks/capture.mjs:40 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/cli.mjs:209
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shell Profile Backdoor Injection' found in package/src/cli.mjs:206
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/src/cli.mjs

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 93d 23 1,061 ↑0.2/day
Very Risky
claude npm 1.1.0 mmnaderi mmnaderi.ir@gmail.com gmail.com 🪝
Package purpose: A smart RTL (Right-to-Left) patcher with UI settings for the Claude application.
Claimed homepage: https://github.com/mmnaderi/claude-desktop-rtl#readme
Matched naming pattern: node-claude-rtl
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 93
Registry downloads: 23/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1061 lines, 52.1 kB across 2 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'claude-rtl' matches AI hallucination template [node] + [claude] + [rtl].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (75 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/index.js:52
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/index.js:64
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in package/bin/index.js:151
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/bin/index.js
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/index.js:52
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/index.js:64
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in package/bin/index.js:151
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/bin/index.js

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 128d 63 2,995 ↑0.5/day
Very Risky
claude npm 1.0.0 dpkay hello@dpkay.com dpkay.com 🪝
Package purpose: Optimize your Claude Max 5-hour slots by scheduling strategic session pings
Claimed homepage: https://github.com/dpkay-io/claude-shift#readme
Matched naming pattern: node-claude-shift
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 128
Registry downloads: 63/month, 15/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2995 lines, 119.0 kB across 63 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'claude-shift' matches AI hallucination template [node] + [claude] + [shift].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (125 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/utils/claude-check.js:6 (+4 more occurrence(s) elsewhere)
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/dist/scheduler/cron.js:11
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/dist/scheduler/cron.js
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/commands/init.js:43 (+1 more occurrence(s) elsewhere)
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/utils/claude-check.js:6 (+4 more occurrence(s) elsewhere)
  • SYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/dist/scheduler/cron.js:11
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/dist/scheduler/cron.js
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/commands/init.js:43 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 206d 3,702 294 ↑18.0/day
Very Risky
@volcengine/cli npm 1.1.10 — — 🪝 🌐
Package purpose: Volcengine CLI npm installer
Claimed homepage: https://github.com/volcengine/volcengine-cli#readme
Matched naming pattern: npm-@volcengine/cli-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 206
Registry downloads: 3702/month, 925/week (ACTIVE_COMMUNITY_USE)
Codebase size: 294 lines, 9.2 kB across 1 file (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 194 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:3
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:157
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:14
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:3
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:157
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:14
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 218d 3,525 126 ↑16.2/day
Very Risky
@mark3labs/kit npm 0.108.2 — — 🪝 🌐
Package purpose: AI-powered CLI tool
Claimed homepage: https://github.com/mark3labs/kit
Matched naming pattern: npm-@mark3labs/kit-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 218
Registry downloads: 3525/month, 881/week (ACTIVE_COMMUNITY_USE)
Codebase size: 126 lines, 4.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 206 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:3
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:95
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:6
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:3
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:95
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:6
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 218d 2,846 174 ↑13.1/day
Very Risky
homebutler npm 0.32.0 Higangssh — 🪝 🌐
Package purpose: What changed on your server, and only what's worth telling — CLI, dashboard and MCP server in one binary
Claimed homepage: https://github.com/Higangssh/homebutler
Matched naming pattern: npm-homebutler-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 218
Registry downloads: 2846/month, 711/week (ACTIVE_COMMUNITY_USE)
Codebase size: 174 lines, 6.3 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 205 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:4 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:98 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:7
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:63
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:161
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:4 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:98 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:7
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:63
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:161
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 227d 2,203 58,567 ↑9.7/day
Very Risky
greprag npm latest — — 🪝 🗄️
Package purpose: Private GrepRAG client for existing Claude Code, Codex, OpenCode, and Grok Build tenants.
Matched naming pattern: node-greprag-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 227
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 2203/month, 550/week (ACTIVE_COMMUNITY_USE)
Codebase size: 58567 lines, 2.7 MB across 221 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 220 days ago within the 1-year AI tool proliferation window.
  • MEDIUMPackage registered with suspiciously high major version (v5.82.1, major 5) despite recent registration (220 days ago, 253 release(s)), indicating potential dependency confusion attack to shadow internal organization builds.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/commands/agents.js:364 (+52 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/commands/agents.js:81 (+87 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/commands/grok-spawn.js:51 (+9 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/commands/agents.js:364 (+52 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/commands/agents.js:81 (+87 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/commands/grok-spawn.js:51 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/commands/ingress-trigger.js:5
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/commands/init.js:407 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/dist/commands/init.js:101

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
87 354d 72 249 ↑0.2/day
Very Risky
solana npm 0.0.9 Lili CLI Team — 🪝
Package purpose: Production-ready CLI tool for Solana developers - Build, Deploy, and Manage Solana programs
Claimed homepage: https://github.com/reposlayer/lili-cli#readme
Matched naming pattern: lili-solana-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 354
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 72/month, 18/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 249 lines, 263.3 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'lili-solana-cli' matches AI hallucination template [lili] + [solana] + [cli].
  • HIGHClaims critical enterprise brand identity ('SOLANA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 353 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'bash ./install.sh || true'
  • CRITICALSUSPICIOUS_SHELL_COMMAND: Pattern 'bash' in 'postinstall' script
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/lili.js:12 (+2 more occurrence(s) elsewhere)
  • INFOPackage affiliated with trusted vendor 'solana' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (125 -> 62) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'bash ./install.sh || true'
  • SUSPICIOUS_SHELL_COMMAND: Pattern 'bash' in 'postinstall' script
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/lili.js:12 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 0h — — —
Unverified Signal
— npm latest staminna — 🪝 🌐
Package purpose: Send, receive and thread email inside Directus, with a per-user inbox backed by your own SMTP server
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/api.js:1
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/api.js:1
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/api.js:1
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/api.js:1
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/api.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 0h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Stores large files by hash in a remote store and leaves a text pointer in git.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/remote/budget.ts:6 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/git/git.ts:21 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/remote/s3/remote.ts:95
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/src/remote/ssh.ts:64

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 5h — — —
Unverified Signal
— npm latest Alpha-Oi — 🪝 🌐
Package purpose: Cost-aware, local-first skill routing for AI agents. MCP server + CLI.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/packages/core/src/gates/checker.mjs:33 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/packages/core/src/search/embedder.mjs:20 (+6 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/integrations/claude-code/install.mjs:3
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/packages/core/src/providers/generic-provider.ts:49

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 10h — — —
Unverified Signal
— npm latest Sarvesh Talele — 🪝 🌐
Package purpose: Local-first token observability for every AI coding agent: Claude Code, Codex CLI, Gemini CLI, OpenCode and more. Debug prompts, context and cost.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/src/autostart.js:16 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/autostart.js:32 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/autostart.js:139 (+4 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/src/hooks.js:1
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/run.js:3 (+1 more occurrence(s) elsewhere)
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in package/src/shortcut.js:187

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 12h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: See what your coding agent actually did: a floating pal for Claude Code, Codex and any agent that shows every file changed, command run and step taken, in plain words. Also a zero-dependency animated Web Component for agent UIs.
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/bridge/checker.js:90 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bridge/config.js:14 (+15 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/bin/dotpals.js:246 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/dotpals.js:31 (+3 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 15h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: The SKETCH plugin of adoc: Excalidraw drawings that the user makes and the agent reads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/client/chunks/chunk-7RHOXHZ5.js:2
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/client/chunks/chunk-7RHOXHZ5.js:1 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/client/chunks/chunk-LFHHSSHU.js:34 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/client/chunks/swimlanes-42K2YHIH-ZRVWHHK7.js:1
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/client/chunks/swimlanes-42K2YHIH-ZRVWHHK7.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 18h — — —
Unverified Signal
— npm latest Pacific AI Labs — 🪝 🌐
Package purpose: Check your website before you launch — test speed, accessibility, and security headers, generate essential SEO files, and get guidance on what to fix. Works with your terminal or AI coding assistant.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/a11y.mjs:25 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/lib/cookies.mjs:13 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/lib/lighthouse.mjs:61
  • CREDENTIAL_PATH_HARVESTING: 'Cloud Instance Metadata (AWS/GCP/Azure IMDS)' found in package/lib/safe.mjs:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 20h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • CREDENTIAL_PATH_HARVESTING: 'Cloud Instance Metadata (AWS/GCP/Azure IMDS)' found in package/thunderboltRegistry.js:27
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/thunderboltRegistry.js:10
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/thunderboltRegistry.js:16
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/thunderboltRegistry.js:6

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 20h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • CREDENTIAL_PATH_HARVESTING: 'Cloud Instance Metadata (AWS/GCP/Azure IMDS)' found in package/thunderboltRegistry.js:30
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/thunderboltRegistry.js:16
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/thunderboltRegistry.js:21
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/thunderboltRegistry.js:12

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 20h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Reads a person's past work — git, agent sessions, tickets, mail, documents — and builds the operating model it runs on.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/check-records.mjs:523 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/skills/running-retrospectives/lib/google-auth.mjs:48 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/skills/running-retrospectives/bin/inventory.mjs:27 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Registry / Git Configuration (~/.yarnrc, ~/.gitconfig)' found in package/skills/running-retrospectives/bin/read-git.mjs:252

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 25h — — —
Unverified Signal
— npm latest Compound Labs — 🪝 🌐
Package purpose: One tool for shipping safely. Security, dependency, agent-instruction, rendered-page and plan checks, each measured with selectors and numbers. It fails closed and runs offline.
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/page/browser.mjs:153 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/page/browser.mjs:42 (+7 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/src/agents-md/index.mjs:27
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/agents-md/index.mjs:218 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 27h — — —
Unverified Signal
— npm latest RubyCLI — 🪝 🌐
Package purpose: RubyCLI — AI coding agent powered by RubyCLI Cloud. Derived from OpenCLI (MIT).
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/chunk-B5CQI5Z4.js:27 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'AWS Credentials (~/.aws/credentials)' found in package/dist/index.js:2007
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:704
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:1006

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 30h — — —
SUSPICIOUS
— npm latest Fintech Open Source Foundation — 🪝 🌐
Package purpose: Static FDC3 conformance test site, local App Directory records, and a server to run them
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/dist/lib/fdc3-compliance.js:157 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/lib/fdc3-compliance.js:37
  • SUSPICIOUS_OBFUSCATION: 'Invisible Unicode Steganography / Bidi Override' found in package/dist/lib/fdc3-compliance.js:30
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/serve.mjs:24

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 44h — — —
SUSPICIOUS
— npm latest — — 🪝 🌐
Package purpose: AI-powered gradient micro-frontend components for Vue 3. Add beautiful, dynamic gradients to any web app.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/dist/esm/useRainbowState-BHYLwXK2.js:8
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/esm/useRainbowState-BHYLwXK2.js:2
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/esm/useRainbowState-BHYLwXK2.js:2
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/esm/useRainbowState-BHYLwXK2.js:18
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/esm/useRainbowState-BHYLwXK2.js:2

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 44h — — —
Unverified Signal
— npm latest Hamza Ahmad Aslam — 🪝 🌐
Package purpose: Chonky Cat: meet Arshia, a chubby, always-on-top desktop cat that shows what Claude Code is doing, live.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/plugin/scripts/chonky-hook.js:16 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/plugin/scripts/chonky-hook.js:15 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/plugin/scripts/chonky-hook.js:19 (+3 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/bin/chonkycat.js:85

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 46h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: What you, your agents, and your machines can jointly do — and where your own time is going.
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/plugins/ambit-telemetry.js:28 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/plugins/ambit-telemetry.js:23 (+28 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/plugins/ambit-tracker.js:104 (+3 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist-cli/engine/cli.js:583 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 47h — — —
🐛 Potential Cross-Ecosystem Worm Unverified Signal
— npm latest C. Spencer Beggs — 🪝 🐛
Package purpose: The GitHub Actions workflow-command grammar as pure functions: render a command, and neutralize text so the runner cannot read it as one.
Static code signals:
  • CROSS_ECOSYSTEM_WORM_PROPAGATION: 'CI Runner Memory Dump / Evasion' found in package/CommandNeutralizer.js:19 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 54h — — —
SUSPICIOUS
— npm latest OpenGSD — 🪝 🌐
Package purpose: i3-composer is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/i3-composer/bin/lib/active-workstream-store.cjs:81 (+100 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/check-env.cjs:30 (+28 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/check-env.cjs:202 (+45 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/ci-next-health.cjs:212 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Sensitive Token Harvesting' found in package/scripts/ci-next-health.cjs:198 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in package/i3-composer/bin/lib/install-engine.cjs:2005
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/i3-composer/bin/lib/install-engine.cjs:2005
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shell Profile Backdoor Injection' found in package/i3-composer/bin/lib/shell-command-projection.cjs:510

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 54h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Minimal self-hosted web UI for the omp coding agent
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/app.js:1 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/app.js:71 (+2 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Invisible Unicode Steganography / Bidi Override' found in package/dist/app.js:72
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/server.ts:43

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 67h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: See what your AI coding agents really cost. Local-first usage report for Claude Code, Codex, Copilot CLI, Antigravity and more, with optional sync to mytokentracker.io.
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/api.js:18
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/ccusage.js:30 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/src/legacy.js:92
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/legacy.js:49 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 71h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Local aggregate activity server for KitCode.
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/companion-electron.mjs:31 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/companion-electron.mjs:10 (+6 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/git.mjs:16 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/src/hook-installers.mjs:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 3d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 3d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 3d — — —
Unverified Signal
— npm latest Vahap Ogut — 🪝 🌐
Package purpose: Open-source community CLI for Antigravity - supports custom AI models (OpenAI, Anthropic, Ollama, OpenRouter, Google AI Studio) alongside Gemini, with agent-context injection so custom models behave like Antigravity agents
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/cli.js:44 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli.js:96 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/dist/context/compaction.js:55 (+2 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/crypto.js:79
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/manifest.js:67

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 4d — — —
Very Risky
— pypi 0.0.15 — — 🪝
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in emulation_compat_shim-0.0.15/werkzeug_compat_shim.pth: 'import sys; import urllib.request; import threading; threading.Thread(target=lambda: urllib.request.urlopen("http://loca'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'urllib.request' imported in emulation_compat_shim-0.0.15/werkzeug_compat_shim.pth: 'import sys; import urllib.request; import threading; threading.Thread(target=lambda: urllib.request.urlopen("http://loca'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 4d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: The MonkeysCode agent engine in process: the same query() that runs `mc -p`.
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/dist/index.cjs:6124 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Infrastructure & DB Credentials (~/.terraform.d, ~/.vault-token, ~/.pgpass, ~/.netrc)' found in package/dist/index.cjs:6130 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Registry / Git Credentials (~/.npmrc, ~/.pypirc)' found in package/dist/index.cjs:6128 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Kube / Docker Credentials' found in package/dist/index.cjs:6126 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/dist/index.cjs:4117 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/index.cjs:9649 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.cjs:4367 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.cjs:620 (+4 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 4d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Check messages, npm packages and crypto addresses before acting. The engine behind savesavesavesave.xyz, for scripts and AI agents (library, CLI and MCP server). Read-only, zero dependencies.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/lib/core.js:6
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/lib/promptscan.js:1142
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/lib/promptscan.js:1142
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/lib/promptscan.js:698
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/lib/promptscan.js:1142
  • SUSPICIOUS_OBFUSCATION: 'Invisible Unicode Steganography / Bidi Override' found in package/lib/promptscan.js:40

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 4d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Draft an APP_FACTS.md label from a repository.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/generate_app_facts.js:610
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/generate_app_facts.js:868
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/generate_app_facts.js:884
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'vm.runInContext' found in package/qr.js:25
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/viewer_codec.js:70

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 4d — — —
Unverified Signal
— npm latest jeffreydpayne — 🪝 🌐
Package purpose: Stax Payments Typescript Client
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/lib/src/client.js:48
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/_bundles/staxpayments.js:39063 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/_bundles/staxpayments.js:38419
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/_bundles/staxpayments.js:36916 (+1 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Invisible Unicode Steganography / Bidi Override' found in package/_bundles/staxpayments.js:16903 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD