Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 77 | 84d | 9,376 | 191 | ↑111.6/day |
Very Risky
|
@paulnsorensen/hallouminate | npm | 0.0.0-experimental.206.1 | — | — | 🪝 🌐 | |
|
Package purpose: EXPERIMENTAL rolling build of paulnsorensen/hallouminate off main — NOT the official `hallouminate` package
Claimed homepage: https://github.com/paulnsorensen/hallouminate#readme
Matched naming pattern: npm-@paulnsorensen/hallouminate-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 84
Registry downloads: 9376/month, 2344/week (ACTIVE_COMMUNITY_USE)
Codebase size: 191 lines, 7.6 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 115d | 6,207 | 492 | ↑54.0/day |
Very Risky
|
tesseract | npm | 0.11.16 | Corneliu Maftuleac | — | 🪝 🌐 | |
|
Package purpose: tesseract — install on a headless server to run agents remotely under your account (the GUI-less counterpart to the desktop app's hosting).
Matched naming pattern: npm-tesseract-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 115
Registry downloads: 6207/month, 1551/week (ACTIVE_COMMUNITY_USE)
Codebase size: 492 lines, 22.3 kB across 8 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 149d | 1,502 | 699 | ↑10.1/day |
Very Risky
|
@sokeai/cli | npm | 1.0.92 | 授客AI | — | 🪝 🌐 | |
|
Package purpose: 授客AI官方CLI工具 - 支持AI Agent Skills
Claimed homepage: https://github.com/sokeai/soke-cli#readme
Matched naming pattern: npm-@sokeai/cli-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 149
Registry downloads: 1502/month, 375/week (ACTIVE_COMMUNITY_USE)
Codebase size: 699 lines, 25.6 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 158d | 1,247 | 735 | ↑7.9/day |
Very Risky
|
zor | npm | 0.9.62 | — | — | 🪝 🌐 | |
|
Package purpose: The Agent That Lives - daemon-first AI agent runtime
Claimed homepage: https://zorai.app
Matched naming pattern: npm-zor-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 158
Registry downloads: 1247/month, 311/week (ACTIVE_COMMUNITY_USE)
Codebase size: 735 lines, 26.6 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 165d | 2,592 | 1,393 | ↑15.7/day |
Very Risky
|
@zackees/soldr | npm | 0.9.22 | — | — | 🪝 🌐 | |
|
Package purpose: Instant Rust tools and builds from one command.
Claimed homepage: https://github.com/zackees/soldr
Matched naming pattern: npm-@zackees/soldr-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 165
Registry downloads: 2592/month, 648/week (ACTIVE_COMMUNITY_USE)
Codebase size: 1393 lines, 59.0 kB across 4 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 208d | 442 | 95 | ↑2.1/day |
Very Risky
|
mflrevan | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Unity Control Protocol - CLI for programmatic Unity Editor control
Claimed homepage: https://github.com/mflRevan/unity-control-protocol#readme
Matched naming pattern: node-mflrevan-ucp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 208
Registry downloads: 442/month, 110/week (MODERATE_USAGE)
Codebase size: 95 lines, 3.3 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 246d | 808 | 87,003 | ↑3.3/day |
Very Risky
|
claude | npm | 2.11.7 | evan043 | — | 🪝 🗄️ | |
|
Package purpose: Advanced Claude Code CLI toolkit - agents, hooks, skills, MCP servers, phased development, and GitHub integration
Claimed homepage: https://github.com/evan043/claude-cli-advanced-starter-pack#readme
Matched naming pattern: claude-claude-advanced
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 246
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 808/month, 202/week (MODERATE_USAGE)
Codebase size: 87003 lines, 3.1 MB across 545 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 252d | 38 | 3,751 | ↑0.2/day |
Very Risky
|
claude | npm | 1.3.1 | Varun R | — | 🪝 | |
|
Package purpose: Enhanced viewer for Claude Code transcripts with dark mode, infinite scroll, message filtering, and search
Claimed homepage: https://github.com/varunr89/claude-transcript-viewer#readme
Matched naming pattern: claude-claude-viewer
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 252
Registry downloads: 38/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3751 lines, 134.6 kB across 30 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 77 | 1903d | 57 | 59,427 | ↑0.0/day |
Very Risky
|
brand | npm | 6.0.0 | huhongxun | — | 🪝 📡 | |
|
Package purpose: openlayer通过vue进行封
Matched naming pattern: vue-brand-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1903
Registry downloads: 57/month, 14/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 59427 lines, 5.2 MB across 208 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 1h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: SetupTier CLI: measure what your AI setup adds. Sign in, scan your loadout (names only), run challenges.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 1h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 1h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 1h | — | — | — |
Unverified Signal
|
— | npm | latest | Abel Yagubyan | — | 🪝 | |
|
Package purpose: One permission policy for every coding agent.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 2h | — | — | — |
Unverified Signal
|
— | npm | latest | noxXza.exe | noxxza.exe | 🪝 🌐 | |
|
Package purpose: WhatsApp Web API Library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 2h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Hash, the SeptemberAI component library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 5h | — | — | — |
Unverified Signal
|
— | npm | latest | lpf0404 | — | 🪝 🌐 | |
|
Package purpose: DSH 插件市场：浏览官方与社区插件，装之前先给出兼容性结论，一键交给官方安装管线。Plugin market for DeepSeek Harness: browse official and community DSH plugins with a compatibility verdict, and install them through the official plugin manager.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 8h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server for ZendIQ: screen Solana tokens for free, triage a swap ($0.01) or build it ($0.02), paid per call over x402. Zero custody.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 9h | — | — | — |
Unverified Signal
|
— | npm | latest | Belov Digital Agency, Inc. | — | 🪝 🌐 | |
|
Package purpose: Belov Cloud from your terminal — sites, deploys and rollbacks, env vars, logs, WP-CLI, staging, backups.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 10h | — | — | — |
Unverified Signal
|
— | npm | latest | David Neuy | — | 🪝 🌐 | |
|
Package purpose: madAuth server: Google and e-mail & password sign-in with madAuth sessions, for Docker, AWS Lambda and Azure Functions.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 10h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Local debugging memory for coding agents. Search before guess. Capture reusable failures. Playbook after verify.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: iterate's React components, built to import from a URL in a no-build page
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12h | — | — | — |
SUSPICIOUS
|
— | npm | latest | The Babel Team | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Sui MCP is a local-first toolkit for helping AI applications and users inspect Sui DeFi actions before execution.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13h | — | — | — |
SUSPICIOUS
|
— | npm | latest | TJ Holowaychuk | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13h | — | — | — |
SUSPICIOUS
|
— | npm | latest | TJ Holowaychuk | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 17h | — | — | — |
Unverified Signal
|
— | npm | latest | Joaquín Peñalva | — | 🪝 🌐 | |
|
Package purpose: Este es el Model Context Protocol server NO OFICIAL de la UTN para buscar informacion o archivos en el aula virtual.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 18h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Set up the OpenCode Browser extension: registers its helper with your browsers and connects it to opencode.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 19h | — | — | — |
Unverified Signal
|
— | npm | latest | Sean Latimer | — | 🪝 | |
|
Package purpose: OpenCode v2 plugin preventing coding agents from disabling or bypassing Git integrity controls (hooks, signing).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 20h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Visibility and curation of the context an agent runs with on this machine: skills, launchers, and memories, across Claude Code, Codex, Cursor, and Antigravity.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 20h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your proce
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 우유팩을 터미널에서 설치하고 관제합니다.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24h | — | — | — |
Unverified Signal
|
— | npm | latest | Damian Wilusz | — | 🪝 | |
|
Package purpose: Preflight, scaffolding and agent wiring for Cue.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 26h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 27h | — | — | — |
Unverified Signal
|
— | npm | latest | Tako Network Engineering Team | — | 🪝 🌐 | |
|
Package purpose: Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 28h | — | — | — |
Unverified Signal
|
— | npm | latest | Vishy204 | — | 🪝 | |
|
Package purpose: See what Claude Code did, in plain English, for zero tokens. Type wd.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 29h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Unofficial Claude Code helpers using TypeSafe Jev: compact/clear advice and an rm guard
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 29h | — | — | — |
Unverified Signal
|
— | npm | latest | Stephen McQueen | — | 🪝 🌐 | |
|
Package purpose: Apple Silicon-friendly aws-azure-login fork with native Chromium support.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 30h | — | — | — |
Unverified Signal
|
— | npm | latest | Jimmy Sadek | — | 🪝 | |
|
Package purpose: Give your project a memory: a session briefing, one list of everything open, safe automatic saves and one rulebook for Claude Code and Codex. Works on new and existing projects.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 32h | 0 | 4,598 | ↑0.0/day |
Very Risky
|
@leahd/co | npm | 0.1.4 | — | — | 🪝 🗄️ | |
|
Package purpose: 面向 Codex 的 pi SDK 子代理与 pi-tui 监控器
Matched naming pattern: npm-@leahd/co-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4598 lines, 253.6 kB across 41 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 37h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Experimental: the Ficta redaction engine as a library — detect sensitive values, replace them with surrogates, restore them
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 38h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: gate-hub integration kit: token and webhook verification, OIDC relying party, directory mirror, revocation guard, Fastify/tRPC adapters, Postgres stores and a testing kit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 38h | — | — | — |
Unverified Signal
|
— | npm | latest | Lablup Inc. | — | 🪝 | |
|
Package purpose: The ui-common command line: the pinned Astryx CLI in @lablup/ui-common terms, the agent block, and the upgrade codemods
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 42h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A macOS CLI bridge for Muse messaging, events, and browser automation.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 42h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Scaffold tyohnn design systems (shadcn components on Base UI with a three-layer CSS architecture) into Next.js and Vite apps and monorepos.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 45h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Build an app for Initiative: one typed definition of its endpoints, hooks, schedules, widgets and listing, the server Initiative calls, the client it calls Initiative with, the CLI that builds its manifest, and declarative integrations Initiative runs fro
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 45h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: ruOS from your terminal: browser sign-in, desktops, a stdio MCP bridge for Codex/Cursor, doctor, and a Claude Code mod (/ruos overview drawn like the ruOS console, an interactive live desktop view you click and type into, guard, audit, status line).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 45h | — | — | — |
Unverified Signal
|
— | npm | latest | Shah Khalid | — | 🪝 🌐 | |
|
Package purpose: Server-driven reactive components for Bunyad views.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 46h | — | — | — |
Unverified Signal
|
— | npm | latest | Mario Zechner | — | 🪝 🌐 | |
|
Package purpose: Unified LLM API with automatic model discovery and provider configuration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 47h | — | — | — |
Unverified Signal
|
— | npm | latest | Ever Co. LTD | — | 🪝 🌐 | |
|
Package purpose: OpenID Connect identity provider plugin (Ever ID) for Ever Works
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 48h | — | — | — |
Unverified Signal
|
— | npm | latest | Nexus-402 Protocol Working Group & BluSky Core Contributors | — | 🪝 🌐 | |
|
Package purpose: Turnkey Machine-Native Compute & Sentinel-Shield Pre-Flight Security SDK for Autonomous AI Agents on Base L2 (x402 Protocol)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||