🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
85 13d — — —
SUSPICIOUS
— npm latest Willem Botha — 🪝 🌐
Package purpose: Prometheus metrics provider plugin for node-red-plugincore.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/build/Nodes.js:7820 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/build/Nodes.js:11123 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/build/Nodes.js:36012
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/build/Nodes.js:10084 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/build/Nodes.js:10207 (+1 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Dense Hex Escape Sequences' found in package/build/Nodes.js:12063 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 14d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: DSH Web GUI 的 Docker 容器面板插件：本机或 SSH 主机上的容器列表 / 启停删 / 日志 / 统计 / 镜像 / 一次性 exec，默认只读，配套只读优先的 agent 工具。
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in package/client.js:2354 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/client.js:2354 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/client.js:2335 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/index.js:2957 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/scripts/client-smoke.mjs:259

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 14d 1,888 108 ↑134.9/day
Very Risky
omnisql npm 1.0.6 OmniSQL Contributors — 🪝 🌐
Package purpose: Blazing-fast, next-generation SQL linter
Claimed homepage: https://github.com/Shivam-Jha96/omnisql#readme
Matched naming pattern: node-omnisql-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 14
Registry downloads: 1888/month, 472/week (ACTIVE_COMMUNITY_USE)
Codebase size: 108 lines, 4.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (11 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/index.js:3 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/index.js:27
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:10
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/index.js:3 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/index.js:27
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:10
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 15d — — —
Unverified Signal
— npm latest Layero — 🪝 🌐
Package purpose: Layero CLI — deploy a directory or a repo to hosting with build servers in Russia. JSON events and exit codes for AI agents and CI.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.cjs || true'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/postinstall.cjs:12 (+5 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/dist/agent.js:11
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/api.js:64 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/commands/init.js:206

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 17d — — —
Unverified Signal
— npm latest spardutti — 🪝 🌐
Package purpose: Guardrails for Claude Code — best-practice skills, planning commands, and delivery gates.
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/lib/auto-mode.mjs:11 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/lib/github.mjs:23
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/lib/github.mjs:61
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/github.mjs:16 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Sensitive Token Harvesting' found in package/lib/github.mjs:16

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 17d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 17d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 19d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 19d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 19d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 19d — — —
Very Risky
— pypi 0.9.0rc1 Unified Cache Team — 🪝
Package purpose: Persist and reuse KV Cache to speedup your LLM.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:35
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:36
  • SOURCE_CODE_ENV_VARS_ACCESS: Call to os.getenv() in setup.py:37
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in setup.py:35
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in ucm_patch.pth: 'import sys, os; exec("try:\n from ucm.integration.vllm.patch.boot_patch import install_hook as _vllm_hook\n _vllm_'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in ucm/logger.py:91

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 20d 4,651 60 ↑232.6/day
Very Risky
gulutux npm latest — — 🪝 🌐
Package purpose: 🦊 Multi-provider agentic coding CLI — swap the brain (Nebius Token Factory, Cloudflare, Google, any OpenAI-compatible), keep the fox.
Claimed homepage: https://github.com/autokeren/gulutux#readme
Matched naming pattern: node-gulutux-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 20
Registry downloads: 4651/month, 1162/week (ACTIVE_COMMUNITY_USE)
Codebase size: 60 lines, 2.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (10 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:1 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:3
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:46 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/run.js:6
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:1 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:3
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:46 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/run.js:6
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 21d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: OpenCode 2 plugin that uses your Claude Code subscription credentials.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/betas.js:5 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/credentials.js:317 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/credentials.js:224 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/dist/keychain.js:49

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 26d 1,224 225 ↑47.1/day
Very Risky
@agent npm 1.4.0 — — 🪝 🌐
Package purpose: agm, the Agent GM command line. A thin wrapper that downloads the release binary for your platform.
Claimed homepage: https://github.com/thisnick/agent-gm
Matched naming pattern: npm-@agent-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 26
Registry downloads: 1224/month, 306/week (ACTIVE_COMMUNITY_USE)
Codebase size: 225 lines, 9.1 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (23 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/agm.js:14 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/agm.js:33 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/agm.js:17 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.js:44
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/postinstall.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/agm.js:14 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/agm.js:33 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/agm.js:17 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.js:44
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/postinstall.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 28d 1,595 151 ↑57.0/day
Very Risky
bit npm 0.6.15 — — 🪝 🌐
Package purpose: BIT - 本地优先的 AI Agent 工具集（MCP / 工具注册 / 技能）。安装后自动下载对应平台的 BIT 应用。
Claimed homepage: https://github.com/yxpil/bit
Matched naming pattern: node-bit-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 28
Registry downloads: 1595/month, 398/week (ACTIVE_COMMUNITY_USE)
Codebase size: 151 lines, 6.7 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (22 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/bit-agent.js:4 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/bit-agent.js:27 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/install.js:6
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOActive community usage with 1,595 monthly downloads.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/bit-agent.js:4 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/bit-agent.js:27 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/install.js:6
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 32d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Node.js bindings for DoltLite — a SQLite fork with Git-style version control
Static code signals:
  • LIFECYCLE_SCRIPT: 'install' -> 'node scripts/install.js'
  • BUNDLED_NATIVE_BINARY: Unexpected compiled binary 'package/prebuilds/win32-x64/doltlite.exe' in npm tarball
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/download.js:16 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/download.js:79 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/download.js:13

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 34d — — —
Unverified Signal
— npm latest The MongoDB NodeJS Team — 🪝 🌐
Package purpose: The official MongoDB driver for Node.js
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/cmap/auth/aws_temporary_credentials.js:33 (+13 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Cloud Instance Metadata (AWS/GCP/Azure IMDS)' found in package/lib/client-side-encryption/providers/azure.js:13 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Kubernetes Service Account Token' found in package/lib/cmap/auth/mongodb_oidc/k8s_machine_workflow.js:7 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/lib/client-side-encryption/mongocryptd_manager.js:39 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/lib/utils.js:54
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/mongo_types.ts:511 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 35d 798 5,836 ↑22.8/day
Very Risky
easy npm 0.2.5 — — 🪝 🗄️
Package purpose: Install dependencies, point domains, deploy apps and run Postgres on a VPS from one UI
Matched naming pattern: node-easy-vps
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 35
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 798/month, 199/week (MODERATE_USAGE)
Codebase size: 5836 lines, 1.2 MB across 66 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (32 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • HIGHLIFECYCLE_SCRIPT: 'preuninstall' -> 'node scripts/preuninstall.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/services/auth.js:35 (+8 more occurrence(s) elsewhere)
  • HIGHCREDENTIAL_PATH_HARVESTING: 'Registry / Git Credentials (~/.npmrc, ~/.pypirc)' found in package/dist/services/deploy.js:296 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/dev.js:66 (+1 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • LIFECYCLE_SCRIPT: 'preuninstall' -> 'node scripts/preuninstall.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/services/auth.js:35 (+8 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Registry / Git Credentials (~/.npmrc, ~/.pypirc)' found in package/dist/services/deploy.js:296 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/dev.js:66 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/client/assets/index-0ephobfl.js:1 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Registry / Git Configuration (~/.yarnrc, ~/.gitconfig)' found in package/dist/services/packages.js:73

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 36d 1,326 125 ↑36.8/day
Very Risky
arifyaman npm latest — — 🪝 🌐
Package purpose: CLI status monitor for the multistream RTMP re-broadcast chain (OBS -> mediamtx -> platforms)
Claimed homepage: https://github.com/arifyaman/multistream#readme
Matched naming pattern: node-arifyaman-multistream
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 36
Registry downloads: 1326/month, 331/week (ACTIVE_COMMUNITY_USE)
Codebase size: 125 lines, 5.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (32 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:13 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:64 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:11
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:99 (+1 more occurrence(s) elsewhere)
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:13 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:64 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:11
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:99 (+1 more occurrence(s) elsewhere)
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 42d 1,498 101 ↑35.7/day
Very Risky
clawde npm 0.3.5 Matt Maddox — 🪝 🌐
Package purpose: Open-source, multi-provider terminal coding agent built in Rust
Claimed homepage: https://mattcmaddox.github.io/Clawde
Matched naming pattern: npm-clawde-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 42
Registry downloads: 1498/month, 374/week (ACTIVE_COMMUNITY_USE)
Codebase size: 101 lines, 3.8 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (41 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:9
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:91
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:4
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOActive community usage with 1,498 monthly downloads.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:9
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:91
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:4
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 43d 3,771 148 ↑87.7/day
Very Risky
nur npm 0.36.9 — — 🪝 🌐
Package purpose: NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli
Claimed homepage: https://www.nuroctane.xyz/cli
Matched naming pattern: npm-nur-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 43
Registry downloads: 3771/month, 942/week (ACTIVE_COMMUNITY_USE)
Codebase size: 148 lines, 5.4 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (31 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node bin.js --ensure || exit 0'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin.js:20
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin.js:137
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/bin.js:15
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin.js:85
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/bin.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node bin.js --ensure || exit 0'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin.js:20
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin.js:137
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/bin.js:15
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin.js:85
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/bin.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 44d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: OpenCode plugin that uses your Claude Code credentials — no separate login needed. Fork of opencode-claude-auth with a configurable proactive refresh window.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/betas.js:5 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/credentials.js:284 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:244
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/dist/keychain.js:49

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 57d 6,346 146 ↑111.3/day
Very Risky
@mediaio/cli npm 0.5.1 — — 🪝 🌐
Package purpose: Media.io AI CLI — generate images and videos from the terminal.
Claimed homepage: https://www.media.io
Matched naming pattern: node-@mediaio/cli-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 57
Registry downloads: 6346/month, 1586/week (ACTIVE_COMMUNITY_USE)
Codebase size: 146 lines, 4.9 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (55 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:5 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:83
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:4
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:34 (+1 more occurrence(s) elsewhere)
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:5 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:83
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:4
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:34 (+1 more occurrence(s) elsewhere)
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 61d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Community-agnostic base framework for Claude Agent SDK bots: platform adapters, RBAC, persistent memory, confirm-gated tools, and a module API for building specific agents on top.
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/platforms/discord/adapter.js:27 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/agent/auth.js:18 (+7 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Cloud Instance Metadata (AWS/GCP/Azure IMDS)' found in package/dist/util/safeFetch.js:24
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/check-security-test-count.mjs:270 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Sensitive Token Harvesting' found in package/scripts/consumption-test.mjs:45

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 62d 1,065 80 ↑17.2/day
Very Risky
@hipmmai/hipmmcode npm 1.1.1 — — 🪝 🌐
Package purpose: Provider-agnostic AI coding agent for your terminal (binary distribution)
Claimed homepage: https://github.com/HiPMMAI/hipmmcode
Matched naming pattern: npm-@hipmmai/hipmmcode-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 62
Registry downloads: 1065/month, 266/week (ACTIVE_COMMUNITY_USE)
Codebase size: 80 lines, 3.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (50 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:5 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:36 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:2
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:9
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:5 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:36 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/install.js:2
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:9
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 80d 1,826 159 ↑22.8/day
Very Risky
@suiflex/rdb npm 0.47.1 — — 🪝 🌐
Package purpose: RDB — native cross-platform database manager (PostgreSQL, MySQL, Redis, MongoDB)
Claimed homepage: https://rdb.suiflex.dev
Matched naming pattern: npm-@suiflex/rdb-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 80
Registry downloads: 1826/month, 456/week (ACTIVE_COMMUNITY_USE)
Codebase size: 159 lines, 6.8 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (67 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:11 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:76 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:10
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOActive community usage with 1,826 monthly downloads.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:11 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:76 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:10
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 87d 3,593 189 ↑41.3/day
Very Risky
@paulnsorensen/tilth npm 0.0.0-experimental.91.1 — — 🪝 🌐
Package purpose: EXPERIMENTAL rolling build of paulnsorensen/tilth off main — unofficial fork, NOT the official `tilth` package
Claimed homepage: https://github.com/paulnsorensen/tilth#readme
Matched naming pattern: npm-@paulnsorensen/tilth-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 87
Registry downloads: 3593/month, 898/week (ACTIVE_COMMUNITY_USE)
Codebase size: 189 lines, 7.3 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (79 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:9 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:132
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOActive community usage with 3,593 monthly downloads.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:9 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:132
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 94d 1,449 9,678 ↑15.4/day
Very Risky
g7e6-sdlc npm latest — — 🪝 🌐 🗄️
Package purpose: SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配
Matched naming pattern: node-g7e6-sdlc-sdlc-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 94
Registry downloads: 1449/month, 362/week (ACTIVE_COMMUNITY_USE)
Codebase size: 9678 lines, 402.5 kB across 1 file (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (88 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node ./dist/cli.js install || true'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/dist/cli.js:641
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/cli.js:1243
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/cli.js:3663
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli.js:655
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node ./dist/cli.js install || true'
  • MISSING_SOURCE_REPOSITORY_URL
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/dist/cli.js:641
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/cli.js:1243
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/cli.js:3663
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli.js:655
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/dist/cli.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 100d 407 31 ↑4.1/day
SUSPICIOUS
grok pypi 0.4.0 MosRat — 🪝
Package purpose: Rust MCP server for Grok web search and Tavily-backed source retrieval
Claimed homepage: https://pypi.org/project/grok-search-rs/
Matched naming pattern: grok-grok-rs
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 100
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 407/month, 13/week (MODERATE_USAGE)
Codebase size: 31 lines, 1.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GROK').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (74 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in grok_search_rs-0.4.0.data/purelib/grok_search_rs/cli.py:30
  • INFOModerate community usage with 266 monthly downloads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in grok_search_rs-0.4.0.data/purelib/grok_search_rs/cli.py:30

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
85 102d 2,690 116 ↑26.4/day
Very Risky
wenlan npm 0.18.7 7xuanlu h164654156465@gmail.com gmail.com 🪝 🌐
Package purpose: Local-first memory layer for AI agents - MCP server
Claimed homepage: https://github.com/7xuanlu/wenlan#readme
Matched naming pattern: npm-wenlan-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 102
Registry downloads: 2690/month, 672/week (ACTIVE_COMMUNITY_USE)
Codebase size: 116 lines, 4.5 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (89 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:6 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:74
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:7
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOActive community usage with 2,690 monthly downloads.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:6 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:74
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:7
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 103d — — —
Unverified Signal
— npm latest JustGains — 🪝 🌐
Package purpose: Run Claude Code, omp, Pi, Codex, or DeepSeek Harness against native, OpenAI-compatible, and Anthropic-compatible model providers — plus JustImagine, a self-hosted image and video generation gallery.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/claude-browser-preload.cjs:13 (+29 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/src/claude-browser.js:40 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/claude-browser.js:476 (+6 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/claude-oauth-bridge.js:126 (+12 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/pool/src/subprocess/claude.ts:113 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 103d 3,358 97 ↑32.6/day
Very Risky
@agora npm 0.3.8 — — 🪝 🌐
Package purpose: DialF — autonomous phone pick/call daemon (dialfd) + CLI
Claimed homepage: https://github.com/Agora-Build/DialF#readme
Matched naming pattern: npm-@agora-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 103
Registry downloads: 3358/month, 839/week (ACTIVE_COMMUNITY_USE)
Codebase size: 97 lines, 4.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (90 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/dialf.js:12 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:52
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:11
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/dialf.js:12 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:52
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:11
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 112d 1,463 69,013 ↑13.1/day
Very Risky
infinite npm 0.12.0 Infinite — 🪝 🗄️
Package purpose: Founder-run installer that adds analytics (the Infinite first-party pixel, Google Analytics 4, PostHog, X/Twitter Pixel, Meta Pixel) to your web app — public keys only, idempotent, and reversible. --server-lane adds the lossless server lane: every HTML do
Claimed homepage: https://infinite.fast/?utm_source=npm&utm_medium=package&utm_campaign=infinite-tag
Matched naming pattern: npm-infinite-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 112
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 1463/month, 365/week (ACTIVE_COMMUNITY_USE)
Codebase size: 69013 lines, 3.5 MB across 580 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOLegitimate documentation effort (255 chars with homepage link).
  • HIGHPackage registered recently (111 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node -e "const msg='infinite-tag installed. Next: run npx infinite-tag in your website repo. Package install alone does not wire analytics.'; console.error(msg)"'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/src/checks/census.js:11 (+15 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/src/server-lane/copy.js:189 (+12 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/src/inspect.js:13 (+5 more occurrence(s) elsewhere)
  • HIGHCREDENTIAL_PATH_HARVESTING: 'Infrastructure & DB Credentials (~/.terraform.d, ~/.vault-token, ~/.pgpass, ~/.netrc)' found in package/dist/src/agents/paths.js:64 (+2 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node -e "const msg='infinite-tag installed. Next: run npx infinite-tag in your website repo. Package install alone does not wire analytics.'; console.error(msg)"'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/src/checks/census.js:11 (+15 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/src/server-lane/copy.js:189 (+12 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/src/inspect.js:13 (+5 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Infrastructure & DB Credentials (~/.terraform.d, ~/.vault-token, ~/.pgpass, ~/.netrc)' found in package/dist/src/agents/paths.js:64 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Registry / Git Credentials (~/.npmrc, ~/.pypirc)' found in package/dist/src/agents/paths.js:64 (+2 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Invisible Unicode Steganography / Bidi Override' found in package/dist/src/agents/sanitize.js:26
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/src/checks/turn-gate.js:123

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 113d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Claude Code and Codex harness with rules, skills, agents, hooks, and verification gates.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/skills/visual-companion/scripts/server-utils.cjs:14 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/skills/visual-companion/scripts/server.cjs:392 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/skills/visual-companion/scripts/server.cjs:2
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/claude-everything-workflow.js:55 (+7 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/scripts/verify/repository-checks.js:358

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 114d — — —
Unverified Signal
— npm latest Mithun Wijayasiri — 🪝 🌐
Package purpose: A customizable statusline for Claude Code that tracks context usage and session limits
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/statusline.js:556
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/statusline.js:9
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/statusline.js:183
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/statusline.js:8
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/statusline.js:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 119d 9,026 138 ↑75.8/day
Very Risky
@inference npm 0.205.2 Inference Gateway — 🪝 🌐
Package purpose: A Git-first CLI coding agent that turns ideas, issues, and tasks into real code changes.
Claimed homepage: https://github.com/inference-gateway/cli#readme
Matched naming pattern: npm-@inference-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 119
Registry downloads: 9026/month, 2256/week (ACTIVE_COMMUNITY_USE)
Codebase size: 138 lines, 5.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (108 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node bin/install.js'
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/bin/install.js:13
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/install.js:19
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/run.js:9
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/run.js:15
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/bin/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node bin/install.js'
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/bin/install.js:13
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/install.js:19
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/run.js:9
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/run.js:15
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/bin/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 122d 3,245 167 ↑26.6/day
Very Risky
@inference npm 0.63.5 Inference Gateway — 🪝 🌐
Package purpose: Scaffold complete A2A (Agent-to-Agent) projects from YAML Agent Definition Language (ADL) manifests. Thin npm wrapper around the native adl binary.
Claimed homepage: https://github.com/inference-gateway/adl-cli#readme
Matched naming pattern: npm-@inference-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 122
Registry downloads: 3245/month, 811/week (ACTIVE_COMMUNITY_USE)
Codebase size: 167 lines, 5.8 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (112 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node bin/install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/install.js:13 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/install.js:104 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/bin/install.js:11
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/install.js:18
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/bin/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node bin/install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/install.js:13 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/install.js:104 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/bin/install.js:11
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/install.js:18
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/bin/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 136d 1,904 9,575 ↑14.0/day
Very Risky
real npm 3.3.1 codeiva11 — 🪝 🗄️
Package purpose: MCP Server for Real Browser - Patchright Blocker.
Matched naming pattern: real-real-mcp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 136
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 1904/month, 476/week (ACTIVE_COMMUNITY_USE)
Codebase size: 9575 lines, 445.2 kB across 64 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (117 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'patchright install chromium'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/src/mcp/handlers/browser.js:98 (+7 more occurrence(s) elsewhere)
  • HIGHANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/dist/src/shared/env-utils.js:20
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/src/mcp/handlers/extract.js:81 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/src/mcp/handlers/extract.js:121 (+4 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'patchright install chromium'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/src/mcp/handlers/browser.js:98 (+7 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/dist/src/shared/env-utils.js:20
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/src/mcp/handlers/extract.js:81 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/src/mcp/handlers/extract.js:121 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/src/mcp/handlers/state.js:151 (+1 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/src/mcp/handlers/state.js:151

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 141d 1,361 270 ↑9.7/day
Very Risky
@obedience npm 0.3.12 — — 🪝 🌐
Package purpose: Festival Methodology CLI suite: fest, camp, and the festival installer/launcher
Claimed homepage: https://fest.build
Matched naming pattern: npm-@obedience-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 141
Registry downloads: 1361/month, 340/week (ACTIVE_COMMUNITY_USE)
Codebase size: 270 lines, 8.4 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (136 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:7 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:212 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOActive community usage with 1,361 monthly downloads.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:7 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:212 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 144d 1,179 223 ↑8.2/day
Very Risky
atlascloud npm 0.1.26 — — 🪝 🌐
Package purpose: AtlasCloud CLI for calling LLM, image, video, and audio APIs from terminals, scripts, and CI jobs.
Claimed homepage: https://atlascloud.ai
Matched naming pattern: npm-atlascloud-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 144
Registry downloads: 1179/month, 294/week (ACTIVE_COMMUNITY_USE)
Codebase size: 223 lines, 6.8 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (134 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:6 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:133
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:4
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:10 (+1 more occurrence(s) elsewhere)
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:6 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:133
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:4
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:10 (+1 more occurrence(s) elsewhere)
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 144d — — —
Unverified Signal
— npm latest Alessandro Colomba — 🪝 🌐
Package purpose: Access Claude plugin marketplaces from Pi Coding Agent. Supports Claude commands, skills, agents, hooks and MCP servers.
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/extensions/pi-claude-marketplace/orchestrators/plugin/clone-cache.ts:128 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/extensions/pi-claude-marketplace/shared/debug-log.ts:7 (+6 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'System Credentials (/etc/shadow, /etc/passwd)' found in package/extensions/pi-claude-marketplace/bridges/hooks/if-field/glob.ts:38
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/extensions/pi-claude-marketplace/bridges/commands/stage.ts:234 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 162d 2,590 42,559 ↑16.0/day
Very Risky
@hanzlaa/rcode npm 4.18.0 Hanzla Habib hanzla.dev@gmail.com gmail.com 🪝 🗄️
Package purpose: rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.
Claimed homepage: https://github.com/hanzlahabib/rihal-code#readme
Matched naming pattern: npm-@hanzlaa/rcode-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 162
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 2590/month, 647/week (ACTIVE_COMMUNITY_USE)
Codebase size: 42559 lines, 2.2 MB across 143 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (157 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node cli/postinstall.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/rcode/bin/lib/brain.cjs:241 (+27 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/rcode/bin/lib/brain.cjs:213 (+20 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/rcode/bin/lib/code-references.cjs:157 (+20 more occurrence(s) elsewhere)
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in package/rcode/bin/rcode-hooks.cjs:257
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/rcode/bin/rcode-hooks.cjs:257
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node cli/postinstall.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/rcode/bin/lib/brain.cjs:241 (+27 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/rcode/bin/lib/brain.cjs:213 (+20 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/rcode/bin/lib/code-references.cjs:157 (+20 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in package/rcode/bin/rcode-hooks.cjs:257
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/rcode/bin/rcode-hooks.cjs:257
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/rcode/bin/rcode-tools.cjs:3027 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/server/dashboard.js:23 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 179d — — —
Unverified Signal
— npm latest NikiforovAll — 🪝 🌐
Package purpose: Memory explorer dashboard for Claude Code
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/public/app.js:196 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/net-guard.js:110 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/server.js:253
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/server.js:531

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 202d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Claude Code usage dashboard — token costs, quota cycle tracking, cache efficiency, multi-machine sync across all your devices
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/cli.cjs:4
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/cli.cjs:27 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/cli.cjs:10 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/public/js/api.js:9 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/server/credentials.js:13

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 206d 271 60,813 ↑1.3/day
Very Risky
claude npm 2.46.0 — — 🪝 📡 🗄️
Package purpose: Standalone MCP bridge for Claude Code IDE integration with any editor — 137+ tools for LSP, debugging, terminals, Git, GitHub, and more
Claimed homepage: https://github.com/Oolab-labs/claude-ide-bridge#readme
Matched naming pattern: claude-claude-bridge
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 206
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 271/month, 67/week (MODERATE_USAGE)
Codebase size: 60813 lines, 2.5 MB across 394 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 181 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs || true'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/mcp-stdio-shim.cjs:35 (+23 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/analyticsSend.js:19 (+8 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/tools/bridgeDoctor.js:419 (+4 more occurrence(s) elsewhere)
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Tunneling Service' found in package/dist/config.js:524
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs || true'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/mcp-stdio-shim.cjs:35 (+23 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/analyticsSend.js:19 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/tools/bridgeDoctor.js:419 (+4 more occurrence(s) elsewhere)
  • EXFILTRATION_DESTINATION_DETECTED: 'Tunneling Service' found in package/dist/config.js:524
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/index.js:684 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/tools/lsp.js:92 (+2 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/tools/lsp.js:80 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 209d 922 280 ↑4.4/day
Very Risky
ludus npm latest — — 🪝 🌐
Package purpose: UE5 dedicated server deployment CLI with MCP server
Claimed homepage: https://github.com/jpvelasco/ludus#readme
Matched naming pattern: node-ludus-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 209
Registry downloads: 922/month, 230/week (MODERATE_USAGE)
Codebase size: 280 lines, 10.1 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 196 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:8 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:131
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:6
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/run.js:40
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:8 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:131
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:6
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/run.js:40
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 212d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Reliable Claude Code usage monitoring via Claude Desktop's web session cookies. Bypasses OAuth API rate limiting with multiple sessions.
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/combined-statusline.js:39 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/combined-statusline.js:4 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/combined-statusline.js:39 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/combined-statusline.js:5 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/combined-statusline.js:411 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 214d 13 9 ↑0.1/day
SUSPICIOUS
workspace npm 1.0.2 — —
Package purpose: Workspace integration providing b utility for Workspace
Matched naming pattern: workspace-workspace-b
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 214
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 9 lines, 187 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 188 days ago within the 1-year AI tool proliferation window.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 220d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: Use your Claude Pro or Max subscription with [OpenCode](https://github.com/anomalyco/opencode). Supports multiple accounts with automatic rotation when you hit rate limits.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/lib/accounts.mjs:145 (+14 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/lib/cc-credentials.mjs:9
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/lib/cc-credentials.mjs:52
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/cli.mjs:179 (+4 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
85 227d 17 24 ↑0.1/day
Very Risky
safe npm 0.0.2 — — 🪝
Package purpose: SAFE test package: includes obfuscated-looking code for scanner testing; not executed.
Matched naming pattern: safe-safe-test
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 227
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 741 Bytes across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 209 days ago within the 1-year AI tool proliferation window.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/obfuscated-sample.js:16
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/obfuscated-sample.js:22
  • HIGHSUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/obfuscated-sample.js:22
  • CRITICALSOURCE_CODE_DYNAMIC_CODE_LOADER: execution primitive combined with decode/network/obfuscation call in package/obfuscated-sample.js
  • INFOPackage affiliated with trusted vendor 'safe' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (120 -> 60) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/obfuscated-sample.js:16
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/obfuscated-sample.js:22
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/obfuscated-sample.js:22
  • SOURCE_CODE_DYNAMIC_CODE_LOADER: execution primitive combined with decode/network/obfuscation call in package/obfuscated-sample.js

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD