🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
80 569d 6 72 ↑0.0/day
SUSPICIOUS
alchemy pypi 0.0.0a0 Bernhard Radermacher bernhard.radermacher@netlink-consulting.com netlink-consulting.com
Package purpose: Imuthes Alchemy Types
Claimed homepage: https://gitlab.com/imuthes/alchemy-types
Matched naming pattern: imuthes-alchemy-types
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 569
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 72 lines, 3.1 kB across 10 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'imuthes-alchemy-types' matches AI hallucination template [imuthes] + [alchemy] + [types].
  • HIGHClaims critical enterprise brand identity ('ALCHEMY').
  • HIGHPublisher email 'bernhard.radermacher@netlink-consulting.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 582d 2 108 ↑0.0/day
SUSPICIOUS
workspace pypi 0.0.4 — —
Package purpose: A simple password generator
Claimed homepage: https://pypi.org/project/passgejs25-workspace/
Matched naming pattern: python-workspace-passgejs25
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 582
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 2/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 108 lines, 2.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'passgejs25-workspace' matches AI hallucination template [python] + [workspace] + [passgejs25].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 586d 24 14 ↑0.0/day
SUSPICIOUS
stripe npm 8.168.0-legacy — —
Package purpose: Stripe service provider for Adonis
Matched naming pattern: node-stripe-adonis-stripe
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 586
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 24/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 469 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@valentech/adonis-stripe' matches AI hallucination template [node] + [stripe] + [adonis-stripe].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 599d 8 46 ↑0.0/day
SUSPICIOUS
hf pypi 0.1.0 — —
Package purpose: Hf integration providing hf utility for Syslink
Claimed homepage: https://pypi.org/project/syslink.ai.hf/
Matched naming pattern: syslink-hf-hf
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 599
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 46 lines, 1.9 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'syslink-ai-hf' matches AI hallucination template [syslink] + [hf] + [hf].
  • HIGHClaims critical enterprise brand identity ('HF').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 610d 88 54 ↑0.1/day
SUSPICIOUS
1inch pypi 0.1.1 GOAT SDK Team —
Package purpose: 1inch plugin for GOAT SDK
Claimed homepage: https://ohmygoat.dev/
Matched naming pattern: goat-1inch-plugin
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 610
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 88/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 54 lines, 2.3 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'goat-sdk-plugin-1inch' matches AI hallucination template [goat] + [1inch] + [plugin].
  • HIGHClaims critical enterprise brand identity ('1INCH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 610d 82 132 ↑0.1/day
SUSPICIOUS
opensea pypi 0.1.1 Devin devin@devin.ai devin.ai
Package purpose: Goat plugin for OpenSea
Claimed homepage: https://ohmygoat.dev/
Matched naming pattern: goat-opensea-plugin
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 610
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 82/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 132 lines, 4.8 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'goat-sdk-plugin-opensea' matches AI hallucination template [goat] + [opensea] + [plugin].
  • HIGHClaims critical enterprise brand identity ('OPENSEA').
  • HIGHPublisher email 'devin@devin.ai' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 610d 11 54 ↑0.0/day
SUSPICIOUS
1inch pypi 0.1.0 GOAT SDK Team —
Package purpose: 1inch plugin for GOAT SDK
Claimed homepage: https://ohmygoat.dev/
Matched naming pattern: goat-1inch-1inch
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 610
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 54 lines, 2.3 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'goat-plugin-1inch' matches AI hallucination template [goat] + [1inch] + [1inch].
  • HIGHClaims critical enterprise brand identity ('1INCH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 611d 13 70 ↑0.0/day
SUSPICIOUS
binance npm 1.0.2 — —
Package purpose: This library was generated with [Nx](https://nx.dev).
Matched naming pattern: node-binance-block-binance
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 611
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 70 lines, 3.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@chikistudio/block-binance' matches AI hallucination template [node] + [binance] + [block-binance].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 620d 0 33 ↑0.0/day
SUSPICIOUS
langchain pypi 0.0.6 Yash Jain yash0307jain@gmail.com gmail.com 🪝
Package purpose: Langchain Executor
Claimed homepage: https://github.com/yash0307jain/langchain-executor
Matched naming pattern: python-langchain-executor
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 620
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 33 lines, 1.2 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-executor' matches AI hallucination template [python] + [langchain] + [executor].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'yash0307jain@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in langchain_executor-0.0.6/langchain_executor/openai_execution.py:9
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in langchain_executor-0.0.6/langchain_executor/openai_execution.py:9

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 627d 28 29 ↑0.0/day
SUSPICIOUS
elevenlabs npm 0.0.5-beta.3 ElevenLabs —
Package purpose: ElevenLabs React Library
Claimed homepage: https://github.com/elevenlabs/packages#readme
Matched naming pattern: elis-elevenlabs-react
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 627
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 28/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 29 lines, 9.9 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'elis-elevenlabs-react' matches AI hallucination template [elis] + [elevenlabs] + [react].
  • HIGHClaims critical enterprise brand identity ('ELEVENLABS').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 641d 8 38 ↑0.0/day
SUSPICIOUS
stripe npm 0.0.1 — —
Package purpose: This project was generated using [Angular CLI](https://github.com/angular/angular-cli) version 19.0.0.
Matched naming pattern: node-stripe-payments
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 641
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 38 lines, 865 Bytes across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'stripe-payments' matches AI hallucination template [node] + [stripe] + [payments].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 646d 0 30 ↑0.0/day
SUSPICIOUS
hf pypi 0.0.0 sc —
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/shopee-hf-datasets/
Matched naming pattern: shopee-hf-datasets
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 646
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 30 lines, 1.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'shopee-hf-datasets' matches AI hallucination template [shopee] + [hf] + [datasets].
  • HIGHClaims critical enterprise brand identity ('HF').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 647d 2 31 ↑0.0/day
SUSPICIOUS
azure pypi 1.0.1 — michal.lejza@gmail.com gmail.com
Package purpose: Jarvis todo
Claimed homepage: https://pypi.org/project/jv-stt-azure/
Matched naming pattern: jv-azure-azure
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 647
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 2/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 31 lines, 1.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'jv-stt-azure' matches AI hallucination template [jv] + [azure] + [azure].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'michal.lejza@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 647d 3 20 ↑0.0/day
SUSPICIOUS
azure pypi 1.0.2 — michal.lejza@gmail.com gmail.com
Package purpose: Jarvis todo
Claimed homepage: https://pypi.org/project/jv-tts-azure/
Matched naming pattern: jv-azure-azure
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 647
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 3/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 20 lines, 1.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'jv-tts-azure' matches AI hallucination template [jv] + [azure] + [azure].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'michal.lejza@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 657d 35 111 ↑0.1/day
SUSPICIOUS
keycloak pypi 1.0.2 sahas sahasmcg2995@gmail.com gmail.com 🪝
Package purpose: Keycloak authentication for FastAPI that helps to secure your API endpoints with RBAC with minimal configurations
Claimed homepage: https://github.com/SahasPunchihewa/fastapi-keycloak-auth
Matched naming pattern: fastapi-keycloak-auth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 657
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 35/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 111 lines, 5.2 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'fastapi-keycloak-auth' matches AI hallucination template [fastapi] + [keycloak] + [auth].
  • HIGHClaims critical enterprise brand identity ('KEYCLOAK').
  • HIGHPublisher email 'sahasmcg2995@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fastapi_keycloak_auth-1.0.2/keycloak_auth/keycloak_auth.py:27
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fastapi_keycloak_auth-1.0.2/keycloak_auth/keycloak_auth.py:27

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 661d 8 37 ↑0.0/day
SUSPICIOUS
cisco pypi 0.2.0 — —
Package purpose: # polars_cisco_umrella
Claimed homepage: https://pypi.org/project/polars-cisco-umrella/
Matched naming pattern: polars-cisco-umrella
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 661
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 37 lines, 1.3 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'polars-cisco-umrella' matches AI hallucination template [polars] + [cisco] + [umrella].
  • HIGHClaims critical enterprise brand identity ('CISCO').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 666d 12 104 ↑0.0/day
SUSPICIOUS
stripe pypi 0.1.1 Dave Gaeddert dave.gaeddert@dropseed.dev dropseed.dev
Package purpose: Stripe integration providing forge utility for Python
Claimed homepage: https://pypi.org/project/forge-stripe/
Matched naming pattern: python-stripe-forge
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 666
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 104 lines, 5.0 kB across 7 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'forge-stripe' matches AI hallucination template [python] + [stripe] + [forge].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • HIGHPublisher email 'dave.gaeddert@dropseed.dev' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 667d 86 48 ↑0.1/day
SUSPICIOUS
auth0 npm 1.0.0 Josh Worden josh@parameter1.com parameter1.com
Package purpose: Auth0 integration providing marko-web-auth0 utility for Node
Claimed homepage: https://github.com/parameter1/mindful-web/tree/main#readme
Matched naming pattern: node-auth0-marko-web-auth0
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 667
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 86/month, 21/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 48 lines, 1.5 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@mindful-web/marko-web-auth0' matches AI hallucination template [node] + [auth0] + [marko-web-auth0].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • HIGHPublisher email 'josh@parameter1.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 702d 29 27 ↑0.0/day
SUSPICIOUS
openai pypi 0.4 Your Name your.email@example.com example.com 🪝 📡
Package purpose: A simple example package with openai api key
Claimed homepage: https://github.com/yourusername/pythongardenerpersonalpkg
Matched naming pattern: pythongardenerpersonalpkg-openai-api
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 702
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 29/month, 14/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 27 lines, 1.7 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'pythongardenerpersonalpkg-openai-api-key-chatgpt-api-key' matches AI hallucination template [pythongardenerpersonalpkg] + [openai] + [api].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'your.email@example.com' is not affiliated with official vendor domain.
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in pythongardenerpersonalpkg_openai_api_key_chatgpt_api_key-0.4/pythongardenerpersonalpkg/core.py:2
Static code signals:
  • EXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in pythongardenerpersonalpkg_openai_api_key_chatgpt_api_key-0.4/pythongardenerpersonalpkg/core.py:2

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 703d 22 23 ↑0.0/day
SUSPICIOUS
okta pypi 0.4 Your Name your.email@example.com example.com 🪝 📡
Package purpose: A simple example package okta api key
Claimed homepage: https://github.com/yourusername/pythongardenerpersonalpkg
Matched naming pattern: pythongardenerpersonalpkg-okta-api
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 703
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 22/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 23 lines, 906 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'pythongardenerpersonalpkg-okta-api-key' matches AI hallucination template [pythongardenerpersonalpkg] + [okta] + [api].
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • HIGHPublisher email 'your.email@example.com' is not affiliated with official vendor domain.
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in pythongardenerpersonalpkg_okta_api_key-0.4/pythongardenerpersonalpkg/core.py:2
Static code signals:
  • EXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in pythongardenerpersonalpkg_okta_api_key-0.4/pythongardenerpersonalpkg/core.py:2

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 705d 4 25 ↑0.0/day
SUSPICIOUS
gemini pypi 0.0.1 — —
Package purpose: Gemini integration providing sphinx utility for Python
Claimed homepage: https://pypi.org/project/sphinx-gemini/
Matched naming pattern: python-gemini-sphinx
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 705
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 25 lines, 986 Bytes across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'sphinx-gemini' matches AI hallucination template [python] + [gemini] + [sphinx].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 707d 15 131 ↑0.0/day
SUSPICIOUS
stripe pypi 0.0.3 tony carnevale <datasciencetony@gmail.com> datasciencetony@gmail.com gmail.com
Package purpose: stripe dash compoenent
Claimed homepage: https://pypi.org/project/stripe-dash/
Matched naming pattern: python-stripe-dash
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 707
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 13/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 131 lines, 5.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'stripe-dash' matches AI hallucination template [python] + [stripe] + [dash].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 709d 6 122 ↑0.0/day
SUSPICIOUS
solana pypi 0.1.0 wow-service 18599720961@163.com 163.com
Package purpose: Solana integration providing transfer utility for Pq
Claimed homepage: https://pypi.org/project/pq-solana-transfer-sdk/
Matched naming pattern: pq-solana-transfer
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 709
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 122 lines, 6.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'pq-solana-transfer-sdk' matches AI hallucination template [pq] + [solana] + [transfer].
  • HIGHClaims critical enterprise brand identity ('SOLANA').
  • HIGHPublisher email '18599720961@163.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 744d 14 128 ↑0.0/day
SUSPICIOUS
google pypi 0.5.0 Quique Ruiz joseenriqueruiznavarro@gmail.com gmail.com 🪝
Package purpose: A tool to run Trivy scans and export results to Google Sheets
Claimed homepage: https://github.com/joseEnrique/trivy-to-google-sheets
Matched naming pattern: trivy-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 744
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 128 lines, 6.4 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'trivy-to-google-sheets' matches AI hallucination template [trivy] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'joseenriqueruiznavarro@gmail.com' is not affiliated with official vendor domain.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in trivy_to_google_sheets-0.5.0/trivy_to_google_sheets/trivy_to_google_sheets.py:29
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in trivy_to_google_sheets-0.5.0/trivy_to_google_sheets/trivy_to_google_sheets.py:11
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in trivy_to_google_sheets-0.5.0/trivy_to_google_sheets/trivy_to_google_sheets.py:29
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in trivy_to_google_sheets-0.5.0/trivy_to_google_sheets/trivy_to_google_sheets.py:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 747d 5 4 ↑0.0/day
SUSPICIOUS
web3 npm 1.0.0 Devlord123 —
Package purpose: is a string
Claimed homepage: https://github.com/devlord123/is-web3-wdf-package#readme
Matched naming pattern: is-web3-wtf
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 747
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4 lines, 96 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'is-web3-wtf-package' matches AI hallucination template [is] + [web3] + [wtf].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 796d 7 6 ↑0.0/day
SUSPICIOUS
llama npm 0.0.1 Yousef-Hatem —
Package purpose: llama sdk
Matched naming pattern: node-llama-sdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 796
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 6 lines, 259 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'llama-sdk' matches AI hallucination template [node] + [llama] + [sdk].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 770 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 803d 6 25 ↑0.0/day
SUSPICIOUS
bitcoin npm 1.0.0 — —
Package purpose: Bitcoin integration providing package utility for Node
Matched naming pattern: node-bitcoin-package
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 803
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 25 lines, 1.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'bitcoin-package' matches AI hallucination template [node] + [bitcoin] + [package].
  • HIGHClaims critical enterprise brand identity ('BITCOIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 777 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 872d 2 40 ↑0.0/day
SUSPICIOUS
phantom npm 1.0.1 theanh098 —
Package purpose: a sample trpc
Matched naming pattern: node-phantom-trpc
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 872
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 2/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 40 lines, 1.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'trpc-phantom' matches AI hallucination template [node] + [phantom] + [trpc].
  • HIGHClaims critical enterprise brand identity ('PHANTOM').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 846 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 872d — — —
Unverified Signal
— npm latest Acute — 🪝 🌐
Package purpose: Acute Informatics - Common Base
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/index.js:130
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/index.js:1
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:6
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:133

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 885d 6 1 ↑0.0/day
SUSPICIOUS
together npm 1.0.1 — —
Package purpose: Together integration providing intelligence utility for Coursedio
Matched naming pattern: coursedio-together-intelligence
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 885
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 25 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'coursedio-artificial-intelligence-for-business-leaders-how-to-cluster-together-purchases' matches AI hallucination template [coursedio] + [together] + [intelligence].
  • HIGHClaims critical enterprise brand identity ('TOGETHER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 859 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 885d 4 1 ↑0.0/day
SUSPICIOUS
google npm 1.0.1 — —
Package purpose: Google integration providing intelligence utility for Coursedio
Matched naming pattern: coursedio-google-intelligence
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 885
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 25 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'coursedio-artificial-intelligence-and-business-strategy-how-google-deploys-ai-to-create-user-value' matches AI hallucination template [coursedio] + [google] + [intelligence].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 859 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 900d 29 99 ↑0.0/day
SUSPICIOUS
ledger npm 1.0.0 — —
Package purpose: Ledger integration providing wallet-adapter-ledger-hid utility for Node
Matched naming pattern: node-ledger-wallet-adapter-ledger-hid
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 900
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 29/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 99 lines, 3.3 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@rnb-web3/wallet-adapter-ledger-hid' matches AI hallucination template [node] + [ledger] + [wallet-adapter-ledger-hid].
  • HIGHClaims critical enterprise brand identity ('LEDGER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 874 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 935d 5 38 ↑0.0/day
SUSPICIOUS
supabase npm 0.0.2 — — 🪝
Package purpose: Supabase integration providing kuqoi utility for Node
Matched naming pattern: node-supabase-kuqoi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 935
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 38 lines, 1.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kuqoi-supabase' matches AI hallucination template [node] + [supabase] + [kuqoi].
  • HIGHClaims critical enterprise brand identity ('SUPABASE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 909 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/./dist/index.cjs:5 (+2 more occurrence(s) elsewhere)
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/./dist/index.cjs:5 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 935d 26 94 ↑0.0/day
SUSPICIOUS
btc pypi 0.1.4 toy1v — 🪝
Package purpose: 基于Paddle构建简单神经网络比特币价格预测
Claimed homepage: https://github.com/toy1v/Btc_price1
Matched naming pattern: python-btc-price1
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 935
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 26/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 94 lines, 5.1 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'btc-price1' matches AI hallucination template [python] + [btc] + [price1].
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 924 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in Btc_price1-0.1.4/Btc_price1/Btc_price.py:19
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in Btc_price1-0.1.4/Btc_price1/Btc_price.py:19

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 939d 7 24 ↑0.0/day
SUSPICIOUS
eth npm 1.0.0 dongbelschnerxt — 🪝
Package purpose: Get main net ETH balances
Claimed homepage: https://github.com/dongbelschnerxt/dongbelschnerxtn-eth#readme
Matched naming pattern: node-eth-dongbelschnerxtn
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 939
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 974 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'dongbelschnerxtn-eth' matches AI hallucination template [node] + [eth] + [dongbelschnerxtn].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 913 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 939d 18 24 ↑0.0/day
SUSPICIOUS
eth npm 1.0.0 rowan-turcotte — 🪝
Package purpose: Get main net ETH balances
Claimed homepage: https://github.com/rowan-turcotte/rowan-turcotte0-eth#readme
Matched naming pattern: rowan-eth-eth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 939
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 970 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'rowan-turcotte0-eth' matches AI hallucination template [rowan] + [eth] + [eth].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 913 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 939d 36 24 ↑0.0/day
SUSPICIOUS
eth npm 1.0.0 adaline-pagac — 🪝
Package purpose: Get main net ETH balances
Claimed homepage: https://github.com/adaline-pagac/adaline-pagac6-eth#readme
Matched naming pattern: adaline-eth-eth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 939
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 36/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 968 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'adaline-pagac6-eth' matches AI hallucination template [adaline] + [eth] + [eth].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 913 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 939d 36 24 ↑0.0/day
SUSPICIOUS
eth npm 1.0.0 kristoffer-bergstrom — 🪝
Package purpose: Get main net ETH balances
Claimed homepage: https://github.com/kristoffer-bergstrom/kristoffer-bergstromg-eth#readme
Matched naming pattern: kristoffer-eth-eth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 939
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 36/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 982 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kristoffer-bergstromg-eth' matches AI hallucination template [kristoffer] + [eth] + [eth].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 913 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 939d 31 24 ↑0.0/day
SUSPICIOUS
eth npm 1.0.0 carmel-farrell — 🪝
Package purpose: Get main net ETH balances
Claimed homepage: https://github.com/carmel-farrell/carmel-farrellz-eth#readme
Matched naming pattern: carmel-eth-eth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 939
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 31/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 970 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'carmel-farrellz-eth' matches AI hallucination template [carmel] + [eth] + [eth].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 913 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 939d 46 24 ↑0.0/day
SUSPICIOUS
eth npm 1.0.0 marion-kozey — 🪝
Package purpose: Get main net ETH balances
Claimed homepage: https://github.com/marion-kozey/marion-kozey0-eth#readme
Matched naming pattern: marion-eth-eth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 939
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 46/month, 11/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 966 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'marion-kozey0-eth' matches AI hallucination template [marion] + [eth] + [eth].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 913 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/index.js:11

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 940d 46 28 ↑0.0/day
SUSPICIOUS
uniswap npm 1.0.0 — —
Package purpose: swap project
Matched naming pattern: ?-uniswap-uniswap
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 940
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 46/month, 11/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 28 lines, 685 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '-teaswap-uniswap-sdk' matches AI hallucination template [] + [uniswap] + [uniswap].
  • HIGHClaims critical enterprise brand identity ('UNISWAP').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 914 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 962d 0 26 ↑0.0/day
SUSPICIOUS
google pypi 0.2.0 Sergio Franco sergiofrfo@gmail.com gmail.com 🪝
Package purpose: Google integration providing de utility for Sergiofrfo
Claimed homepage: https://pypi.org/project/sergiofrfo-google-de-toolkit/
Matched naming pattern: sergiofrfo-google-de
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 962
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 26 lines, 799 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'sergiofrfo-google-de-toolkit' matches AI hallucination template [sergiofrfo] + [google] + [de].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'sergiofrfo@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 951 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in sergiofrfo_google_de_toolkit-0.2.0/sergiofrfo_google_de_toolkit/vm.py:7
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in sergiofrfo_google_de_toolkit-0.2.0/sergiofrfo_google_de_toolkit/vm.py:7

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
80 968d 12 11 ↑0.0/day
SUSPICIOUS
workspace npm 0.0.5 — —
Package purpose: Workspace integration providing plus-two utility for Node
Matched naming pattern: node-workspace-plus-two
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 968
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 424 Bytes across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@yarn-workspace-test/plus-two' matches AI hallucination template [node] + [workspace] + [plus-two].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 942 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 968d 12 16 ↑0.0/day
SUSPICIOUS
workspace npm 0.1.1 — —
Package purpose: Workspace integration providing sum utility for Node
Matched naming pattern: node-workspace-sum
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 968
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 16 lines, 543 Bytes across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@yarn-workspace-test/sum' matches AI hallucination template [node] + [workspace] + [sum].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 942 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 986d 7 63 ↑0.0/day
SUSPICIOUS
clerk npm 1.0.1 — —
Package purpose: ![Remix Auth Clerk](https://github.com/danestves/remix-auth-clerk/assets/31737273/82cde78a-a58c-4e14-bd1a-23fcf0da78d2)
Matched naming pattern: remix-clerk-clerk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 986
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 63 lines, 4.4 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'remix-auth-clerk' matches AI hallucination template [remix] + [clerk] + [clerk].
  • HIGHClaims critical enterprise brand identity ('CLERK').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 960 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:5 (+1 more occurrence(s) elsewhere)
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:5 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 1004d 28 91 ↑0.0/day
SUSPICIOUS
workspace npm 0.0.6 — — 🪝
Package purpose: This library was generated with [Nx](https://nx.dev).
Matched naming pattern: node-workspace-create-mmc-workspace
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1004
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 28/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 91 lines, 3.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@ebd-connect/create-mmc-workspace' matches AI hallucination template [node] + [workspace] + [create-mmc-workspace].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 978 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/index.mjs:38
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/index.mjs:38

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 1025d 63 37 ↑0.1/day
SUSPICIOUS
metamask npm 0.1.73 — —
Package purpose: #### Installation
Matched naming pattern: node-metamask-wallet-adapter-metamask
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1025
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 63/month, 15/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 37 lines, 2.1 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@coin98-com/wallet-adapter-metamask' matches AI hallucination template [node] + [metamask] + [wallet-adapter-metamask].
  • HIGHClaims critical enterprise brand identity ('METAMASK').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1000 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 1025d 39 33 ↑0.0/day
SUSPICIOUS
binance npm 0.1.73 — —
Package purpose: Binance integration providing wallet-adapter-binance-wallet utility for Node
Matched naming pattern: node-binance-wallet-adapter-binance-wallet
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1025
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 39/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 33 lines, 1.6 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@coin98-com/wallet-adapter-binance-wallet' matches AI hallucination template [node] + [binance] + [wallet-adapter-binance-wallet].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1000 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 1033d 10 15 ↑0.0/day
SUSPICIOUS
clerk npm 0.0.1 — — 🪝
Package purpose: Clerk integration providing types utility for Clerk
Matched naming pattern: clerk-clerk-types
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1033
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15 lines, 475 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLERK').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1007 days ago (predates modern AI hallucination waves).
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node update.mjs'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node update.mjs'
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
80 1145d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/api/eam/spotCheck/abnormal.js:12 (+56 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/kztool/kztool.common.17.js:273 (+12 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/kztool/kztool.common.3.js:23621 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/kztool/kztool.common.3.js:3086 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/kztool/kztool.common.6.js:16962 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD