Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | 47vigen | — | 🪝 🌐 | |
|
Package purpose: Herds coding agents: autopilot builds from your own Claude Code session.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | Rayson Technologies | — | 🪝 🌐 | |
|
Package purpose: Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A workspace bash backend for Ambion over SSH: one remote server, one Unix account for each agent.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: SiteMills CLI Tool - Project Code Management on the SiteMills Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | Connor Tessaro | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: anyonce idempotency stores: DynamoDB, Redis, Postgres, D1 and Durable Objects
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | Nils Widal | — | 🪝 🌐 | |
|
Package purpose: Fast typed decisions about code, with probabilities, confidence and checked reasons. Runs on the host agent's own model in Claude Code and Codex.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A new date formatting utilit1
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | alibuyukkilinc | — | 🪝 🌐 | |
|
Package purpose: Shared project brain for humans and AIs: knowledge tree, board, decisions and AI activity in one place.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | AMEER ABDULKAREEM JABBAR LAMI | — | 🪝 🌐 | |
|
Package purpose: MCP server for a shadcn/ui registry: 79 RTL-ready components (radix-nova) any AI client can search and install by name.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | SaveCLI contributors | — | 🪝 🌐 | |
|
Package purpose: A token-efficient coding agent CLI. Full agent capability, minimal footprint.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The GigaRAG plugin for Claude Code. Commands, an indexing agent, hooks and an MCP server that carry the gigarag CLI inside them.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The GigaRAG plugin for Cursor. Skills and an MCP server that carry the gigarag CLI inside them.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The GigaRAG plugin for VS Code and Copilot CLI. Skills and an MCP server that carry the gigarag CLI inside them.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Connect GigaRAG to your AI clients. A CLI, a stdio MCP bridge, hooks for Claude Code, and a library.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Foundry: the opinionated agent harness built on @inixiative/foundry-core — providers, session adapters, planner, viewer and jobs
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Local Excalidraw canvas with a command-line interface
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Fill job applications from a profile that stays on your machine. Unpacks the built browser extension, ready to load.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Ben Dechrai | — | 🪝 🌐 | |
|
Package purpose: Run Claude Code on whichever of your subscriptions has quota closest to expiring, with shared config and sessions
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Saad Qadir | — | 🪝 🌐 | |
|
Package purpose: Adaptive, model-agnostic AI governance engine and RBAC policy generator for developer tools (Antigravity, Claude Code, Cursor, Aider, Ollama).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Model-selected capability catalog and demand-loaded Pi tools
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | TidyFactor Team | — | 🪝 🌐 | |
|
Package purpose: Sovereign Personal Assistant Agent with persistent SQLite Memory, CLI engine, and local Stdio MCP Server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Sameer Shaik | — | 🪝 🌐 | |
|
Package purpose: Find where Jev (TypeSafe Noul / Choice / Score) fits in your TypeScript / JavaScript codebase, and change it — from the terminal or from Claude Code / Cursor.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | André Negrelli | — | 🪝 🌐 | |
|
Package purpose: Agnostic agentic engineering framework installer (Claude Code, OpenCode, Claude Code plugin emission)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | deltaXmodules | — | 🪝 🌐 | |
|
Package purpose: codeTAC — see what your Node or Python app's code does, one action at a time: from the browser click to the server functions, database and external services.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Allchemy Labs | — | 🪝 🌐 | |
|
Package purpose: WCAG 2.1 AA accessibility scanner (Playwright + axe-core) with grounded, browser-verified fixes. MCP server for Claude Code and any MCP client; also a Claude Code plugin.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Alibaba Cloud | — | 🪝 🌐 | |
|
Package purpose: Swarm: independent repack of autowonder@0.2.150
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Authenticate Pi agent bash commands to GitHub as a GitHub App installation, without touching your personal git/gh credentials
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Standalone DeepSeek Harness plugin: edit .drawio diagrams in the Web Sidebar with the upstream draw.io editor
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Aanwik Solutions | — | 🪝 🌐 | |
|
Package purpose: XintoX: Real-Time Context Engine & Dual-Tier Team Memory for AI Coding Agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: JevCore Agent — local coding harness (Jev decisions, Guard hard policy, Profile authority, MCP + CLI). Package formerly jev-coding-guard / jevcore (npm name taken).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Michael Ficocelli | — | 🪝 🌐 | |
|
Package purpose: Turn a software spec into an editable HTML visualizer: technical summary, diagrams an charts, and round-trip back to the spec file.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Mosetta IDE: an IDE made of plugins. `npx @mosetta/ide` opens the current folder in your browser.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Tyler Skelton | — | 🪝 🌐 | |
|
Package purpose: molt — a coding agent that can't say done without proving it. Terminal CLI and TUI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: abatty - the Synovitec engineering standard as an installable instrument: init a repository per stack, measure it, gate it, run the unattended adoption nights, keep the harness in step.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Nwflower | — | 🪝 🌐 | |
|
Package purpose: Import Claude Code / Codex / ChatGPT / Cursor / Gemini / Reasonix / Pi Coding Agent / opencode / ZCode / Grok Build / OpenClaw / Hermes / Kimi CLI / Qoder CLI / WorkBuddy conversation histories as resumable ChatCode CLI sessions, plus movein asset migrati
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | Mohit Raj Purohit | — | 🪝 🌐 | |
|
Package purpose: Local FinOps dashboard for Claude Code: what you used, what it cost, why it cost that much, and what to change. Reads your own transcripts, no API key, no data leaves the machine.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | 7starsseeker | — | 🪝 🌐 | |
|
Package purpose: Pre-execution safety valve for DeepSeek Harness: a TypeSafe Jev question decides whether a shell command/script would irreversibly delete or overwrite real data. Four states (allow/revise/block/escalate), mounted on tools/pre-execute. Zero dependencies; W
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | Pol Amoros | — | 🪝 🌐 | |
|
Package purpose: CLI for DockAI — self-hosted Claude Code session manager
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: One folder structure for every machine. Clone, adopt and sync your GitHub repos from a manifest you own.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | celolopes | — | 🪝 🌐 | |
|
Package purpose: Developer Harness with TypeSafe AI / Jev for AI Coding Agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Global dsh-rsi command: status, doctor, and full purge for DSH enhanced plugin installations.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server for Mutex pods and rooms, with optional git coordination hooks.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLI + MCP server for reading FeedbackKit dashboard feedback from a coding agent.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Spec-driven agent harness: 7 roles, 5 code-enforced gates (Gate 5 is an adversarial agent), AC traceability from spec to test evidence.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||