Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 85 | 235d | 5 | 9 | ↑0.0/day |
SUSPICIOUS
|
solana | npm | 2.0.4 | davidov0516 | — | ||
|
Package purpose: validate solana toolkit
Matched naming pattern: solana-solana-toolkit
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 235
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 9 lines, 3.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 237d | 51 | 25 | ↑0.2/day |
SUSPICIOUS
|
claude | npm | 0.4.0 | Daniel Andreasson | — | 🪝 🗄️ | |
|
Package purpose: Norse-themed statusline for Claude Code with OAuth usage tracking, git integration, and beautiful themes
Claimed homepage: https://github.com/danjuls/claude-norns-statusline
Matched naming pattern: claude-claude-statusline
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 237
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 51/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 25 lines, 41.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 243d | 17 | 67 | ↑0.1/day |
SUSPICIOUS
|
binance | npm | 1.0.5 | — | — | ||
|
Package purpose: Secure Auth Module
Matched naming pattern: binance-binance-secure
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 243
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 67 lines, 2.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 259d | 147 | 34 | ↑0.6/day |
SUSPICIOUS
|
langchain | pypi | 0.1.2 | — | — | ||
|
Package purpose: LangChain ChatOpenAI wrapper for Crynux.
Claimed homepage: https://pypi.org/project/langchain-crynux/
Matched naming pattern: python-langchain-crynux
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 259
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 147/month, 14/week (MODERATE_USAGE)
Codebase size: 34 lines, 1.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 85 | 315d | 26 | 60 | ↑0.1/day |
SUSPICIOUS
|
arbitrum | npm | 1.0.2 | Your Name | — | 🪝 | |
|
Package purpose: CLI faucet tool for Arbitrum Sepolia with claim limits
Matched naming pattern: arbitrum-arbitrum-faucet
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 315
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 26/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 60 lines, 2.2 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 319d | 845 | 26,378 | ↑2.6/day |
Very Risky
|
grok | npm | 1.10.0 | wolfejam team@faf.one | faf.one | 🪝 🗄️ | |
|
Package purpose: Persistent Project Context for xAI Grok. IANA-registered .faf format, MCP server on a URL.
Claimed homepage: https://grok.faf.one
Matched naming pattern: npm-grok-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 319
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 845/month, 211/week (MODERATE_USAGE)
Codebase size: 26378 lines, 1.1 MB across 176 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 333d | 616 | 57,380 | ↑1.8/day |
Very Risky
|
chittycan | npm | latest | chittycorp | — | 🪝 🗄️ | |
|
Package purpose: ChittyCan CLI and infrastructure interface — AI gateway, ecosystem tooling, DNA ownership
Claimed homepage: https://github.com/chittyos/chittycan#readme
Matched naming pattern: node-chittycan-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 333
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 616/month, 154/week (MODERATE_USAGE)
Codebase size: 57380 lines, 2.2 MB across 321 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 350d | 11 | 9 | ↑0.0/day |
SUSPICIOUS
|
polygon | npm | 1.0.9 | davidov0516 | — | ||
|
Package purpose: validate solana toolkit
Matched naming pattern: polygon-polygon-toolkit
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 350
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 9 lines, 3.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 589d | 7 | 26 | ↑0.0/day |
SUSPICIOUS
|
ethereum | npm | 4.0.3 | — | — | ||
|
Package purpose: Ethereum integration providing address.js utility for Ethereum
Matched naming pattern: ethereum-ethereum-address.js
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 589
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 26 lines, 811 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 592d | 100 | 90 | ↑0.2/day |
SUSPICIOUS
|
pypi | 0.2.3 | — | — | |||
|
Package purpose: # Platzky Google Tag Manager Plugin
## Overview
Platzky Google Tag Manager is a plugin for the Platzky framework that allows you to set up GTM easily.
## Installation
```sh
pip install platzky-google-tag-manager
```
### Usage
```json
"plugins": [
{
"name": "google_tag_manager",
"conf
Claimed homepage: https://pypi.org/project/platzky-google-tag-manager/
Matched naming pattern: platzky-google-tag
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 592
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 100/month, 13/week (MODERATE_USAGE)
Codebase size: 90 lines, 4.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 85 | 3433d | — | — | — |
Unverified Signal
|
— | npm | latest | Syncfusion Inc. | — | 🪝 🌐 | |
|
Package purpose: A common package of Essential JS 2 base libraries, methods and class definitions
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 85 | 4044d | — | — | — |
Very Risky
|
— | pypi | 3.0.187 | myquant_dev | — | 🪝 | |
|
Package purpose: 掘金量化 掘金3 sdk
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 82 | 52h | 0 | 2,876 | ↑0.0/day |
Very Risky
|
@myagentroam/marctl | npm | 0.9.120 | — | — | 🪝 | |
|
Package purpose: MyAgentRoam command-line interface for authorized Node access.
Matched naming pattern: npm-@myagentroam/marctl-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2876 lines, 104.6 kB across 14 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 9d | 0 | 89 | ↑0.0/day |
Very Risky
|
selfsigned | npm | 1.0.0 | — | — | 🪝 | |
|
Package purpose: Generate a batch of randomized self-signed SSL certificates
Matched naming pattern: npm-selfsigned-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 9
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 89 lines, 2.4 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 11d | 144 | 576 | ↑13.1/day |
Very Risky
|
@tzssangglass/pi | npm | 0.1.0 | kurt tu tzssangglass@gmail.com | gmail.com | 🪝 🌐 | |
|
Package purpose: pi extension: render architecture/flow diagrams from declarative JSON with asynchronous child-process rendering and bounded inline playback
Claimed homepage: https://github.com/tzssangglass/pi-diagram
Matched naming pattern: node-@tzssangglass/pi-pi-diagram
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 11
Registry downloads: 144/month, 36/week (MODERATE_USAGE)
Codebase size: 576 lines, 27.3 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 12d | 220 | 96 | ↑18.3/day |
Very Risky
|
sapeum | npm | 0.0.0 | — | — | 🪝 🌐 | |
|
Package purpose: Call the Sapeum REST API from your terminal.
Claimed homepage: https://app.sapeum.com
Matched naming pattern: node-sapeum-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 12
Registry downloads: 220/month, 55/week (MODERATE_USAGE)
Codebase size: 96 lines, 4.4 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 30d | 557 | 553 | ↑18.6/day |
Very Risky
|
@smallfishworld/open | npm | 1.11.2-svn.1 | — | — | 🪝 🌐 | |
|
Package purpose: OpenCodeReview CLI fork with SVN workspace review support
Claimed homepage: https://github.com/smallfishworld/open-code-review-svn#readme
Matched naming pattern: node-@smallfishworld/open-open-code-review-svn
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 30
Registry downloads: 557/month, 139/week (MODERATE_USAGE)
Codebase size: 553 lines, 17.2 kB across 5 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 47d | 855 | 35,008 | ↑18.2/day |
Very Risky
|
aetherai | npm | 0.9.1 | TQSY114514 | — | 🪝 🗄️ | |
|
Package purpose: Aether headless agent — CLI, TUI, and Electron-free SDK. Pairs with the Aether Desktop GUI (separate installer) sharing the same agent runtime and SQLite store.
Claimed homepage: https://github.com/TQSY114514/Aether#readme
Matched naming pattern: npm-aetherai-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 47
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 855/month, 213/week (MODERATE_USAGE)
Codebase size: 35008 lines, 1.7 MB across 168 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 51d | 10,747 | 444 | ↑210.7/day |
Very Risky
|
@qinghuangniao/heron | npm | 1.2.0 | janostudio | — | 🪝 🌐 | |
|
Package purpose: Multi-IM agent bridge connecting AI coding agents to messaging platforms
Claimed homepage: https://github.com/janostudio/heron-connect
Matched naming pattern: npm-@qinghuangniao/heron-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 51
Registry downloads: 10747/month, 2686/week (HIGH_COMMUNITY_ADOPTION)
Codebase size: 444 lines, 15.8 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 109d | 27,765 | 375 | ↑254.7/day |
Very Risky
|
@volcengine/ark | npm | 1.0.33 | — | — | 🪝 🌐 | |
|
Package purpose: 火山方舟 ARK 平台命令行工具
Claimed homepage: https://github.com/volcengine/ark-cli#readme
Matched naming pattern: npm-@volcengine/ark-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 109
Registry downloads: 27765/month, 6941/week (HIGH_COMMUNITY_ADOPTION)
Codebase size: 375 lines, 15.2 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 134d | 590 | 14,342 | ↑4.4/day |
Very Risky
|
claude | npm | 1.4.3 | Archer Simmons | — | 🪝 📡 🗄️ | |
|
Package purpose: Discord Rich Presence for Claude Code — live model, project, tokens, and lifetime stats driven by Claude Code's hook system.
Claimed homepage: https://claude-rpc.com
Matched naming pattern: npm-claude-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 134
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 590/month, 147/week (MODERATE_USAGE)
Codebase size: 14342 lines, 704.5 kB across 53 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 185d | 23 | 4,293 | ↑0.1/day |
Very Risky
|
base | npm | 1.0.0 | — | — | 🪝 | |
|
Package purpose: Portable knowledge base with web dashboard and MCP server for AI tools
Matched naming pattern: node-base-willynikes2-knowledge-base-server
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 185
Registry downloads: 23/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4293 lines, 169.0 kB across 42 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 186d | 69 | 12,506 | ↑0.4/day |
Very Risky
|
copilot | npm | 4.0.0 | Microsoft Corporation | — | 🪝 | |
|
Package purpose: Public Preview — AgentOS GitHub Copilot Extension: Build safe AI agents with natural language and 0% policy violations
Claimed homepage: https://github.com/microsoft/agent-governance-toolkit#readme
Matched naming pattern: node-copilot-agent-os-copilot-extension
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 186
Registry downloads: 69/month, 17/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12506 lines, 491.6 kB across 40 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 226d | 9 | 1,559 | ↑0.0/day |
Very Risky
|
claude | npm | 0.1.0 | — | — | 🪝 📡 | |
|
Package purpose: Share Claude Code sessions via GitHub Gist
Matched naming pattern: node-claude-cast
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 226
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1559 lines, 53.4 kB across 26 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 414d | 9 | 638 | ↑0.0/day |
Very Risky
|
claude | npm | 1.2.0 | jfuginay | — | 🪝 | |
|
Package purpose: Protect Claude Code from configuration corruption
Claimed homepage: https://github.com/jfuginay/claude-config-protector#readme
Matched naming pattern: claude-claude-protector
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 414
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 638 lines, 21.9 kB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 82 | 1010d | 160 | 623 | ↑0.2/day |
Very Risky
|
ethereum | npm | 4.6.0 | Animoca Brands | — | 🪝 | |
|
Package purpose: Solidity contracts for the Anichess project.
Claimed homepage: https://github.com/animoca/anichess-ethereum-contracts
Matched naming pattern: node-ethereum-anichess-ethereum-contracts
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1010
Registry downloads: 160/month, 40/week (MODERATE_USAGE)
Codebase size: 623 lines, 16.8 kB across 9 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 1h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Phonebook for Claude Code: ask other people's Claude agents questions, with email sign-in and explicit sender approval.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 2h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Cloud-first agent CLI for Design Mode MCP: Cloud, Local and Self-hosted
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 4h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Native Codex realtime voice bridge for an existing Pi coding session.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 5h | — | — | — |
Unverified Signal
|
— | npm | latest | Zhihu Pilot | — | 🪝 | |
|
Package purpose: 智护 Pilot CLI：认证、数字员工、资产、指标、告警、指定告警诊断和巡检只读能力（P1 Read-only）
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 6h | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Webamp music player channel plugin for Kwirth - a Winamp 2 clone running in a Kwirth tab, with drag-and-drop audio and skin support
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 8h | — | — | — |
Unverified Signal
|
— | npm | latest | guzhuofan | — | 🪝 🌐 | |
|
Package purpose: 在每条最终回答旁加一个 🔊：用方舟 Agent Plan 的豆包语音合成 2.0 朗读回复。零依赖。Read assistant replies aloud with Volcengine Ark Agent Plan TTS.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 9h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Connect your Linux or WSL2 Pi host to a Pistead workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 14h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Codex-style Computer Use for DeepSeek Harness: Windows desktop control, screenshots, UI Automation, human input handoff, approval gates and prebuilt native workers. Install and update from dsh-market without PowerShell 7 or build steps.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 15h | — | — | — |
Unverified Signal
|
— | npm | latest | Loombotic | — | 🪝 🌐 | |
|
Package purpose: MCP local bridge: lets Claude Code or Codex edit the harness open in the Loombotic editor
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 18h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Source-driven mobile app maps, deterministic CI capture, and visual reviews
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 19h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: TypeScript runtime for AWS Bedrock Converse models, local function tools, streaming, and normalized responses.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 19h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: End-to-end-encrypted, on-chain messaging for AI agents. Store conversations between any two agents on Hedera and pay per request with x402 — no account needed on either side.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 20h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Every agent run, on the record. Post Claude Code run summaries to Clavva.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 21h | — | — | — |
Unverified Signal
|
— | npm | latest | Amk | — | 🪝 | |
|
Package purpose: Lightweight Windows webview2 framework for Node.js – Electron-like API with a thin native host
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 22h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Euro-Office's document editors running entirely in the browser, with x2t as WebAssembly (part eurooffice of: @kreijstal/eurooffice @kreijstal/eurooffice-fonts-1 @kreijstal/eurooffice-fonts-2 @kreijstal/eurooffice-sdkjs-common @kreijstal/eurooffice-web-app
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 24h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 24h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Studio UI for optional Directus 10.13.4 and 11.17.4 security backports of 12.x fixes. Patches are checksum-pinned to those builds and will not apply on other versions.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 27h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Switchyard on the command line
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 27h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Switchyard modules for Claude, Cursor and other MCP clients
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 27h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Connects the coding agents on this machine to Brigada HQ: `npx brigada-hq connect`.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 28h | — | — | — |
Unverified Signal
|
— | npm | latest | Chris Thomas | — | 🪝 🌐 | |
|
Package purpose: An Astro-native CMS that bolts onto an existing project with one command
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 32h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Declarative config reconciler: edit a typed config repo, push it, and your hosts converge. Also exports the schema library config repos import.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 36h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Live2D desktop pet for the DeepSeek Harness web GUI: a real Cubism 5 model with breath, physics, blinking, gaze tracking, 81 motions and 70 expressions, plus 11 voiced lines that animate both the character and her plush, driven by session activity.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 80 | 38h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: 手机远程访问 DSH 的一站式插件：移动端 UI 适配 + 公网零配置访问。安装后无论用 frp / ngrok / Cloudflare Tunnel / 路由器端口转发，只要把本地端口映射到公网即可直接用，无需任何额外配置；自带 HTTP Basic Auth 门卫保护公网入口。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||