Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | tickernelz | — | 🪝 🌐 | |
|
Package purpose: OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Keeps a codebase legible to coding agents, and keeps that legibility true as the code changes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Harish Balu | — | 🪝 🌐 | |
|
Package purpose: Automatically blocks git commits when npm dependencies use licenses that restrict commercial use — checked via SPDX rules, npm registry data, and AI verification.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Mario Zechner | — | 🪝 🌐 | |
|
Package purpose: Unified LLM API with automatic model discovery and provider configuration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | N. Hariharan | — | 🪝 🌐 | |
|
Package purpose: Meshly — the operating system for autonomous workers.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | 125 | 1,195 | ↑11.4/day |
SUSPICIOUS
|
astrotools | pypi | 1.0.0 | CINEFy | — | 🪝 | |
|
Package purpose: Network reconnaissance, security, diagnostics and cryptography CLI toolkit
Claimed homepage: https://pypi.org/project/astrotools-cli/
Matched naming pattern: python-astrotools-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 11
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 125/month, 10/week (MODERATE_USAGE)
Codebase size: 1195 lines, 64.2 kB across 3 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Illia Puzanov | — | 🪝 🌐 | |
|
Package purpose: Build, run, inspect, and control iOS apps in Simulator from a JSON-first CLI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Michael Accetto | — | 🪝 🌐 | |
|
Package purpose: The connectors companion for @hames-ai/harness-patterns — Microsoft Graph app-side tools, the Neo4j non-agentic layer, and the MCP-gateway namespace catalog, all behind injected seams.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Docs that keep up with your product
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | 179 | 3,783 | ↑16.3/day |
Very Risky
|
devxeazy | npm | latest | DEVxEAZY | — | 🪝 | |
|
Package purpose: One table for everything scheduled on a Linux box: user crontab, /etc/crontab, /etc/cron.d, run-parts and systemd timers — plus a preflight that says why a job will fail before it fires.
Claimed homepage: https://github.com/devxeazy/cron-cli#readme
Matched naming pattern: node-devxeazy-cron-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 11
Registry downloads: 179/month, 44/week (MODERATE_USAGE)
Codebase size: 3783 lines, 185.8 kB across 14 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: npx installer for the verification compiler: uv, elan, the repository, its Python environment, the Lean corpus and the Claude Code recorder hooks
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: codesafe extension for Pi/OMP — intent hints, safe commit/delete tools, commit/diff rule checks
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | AgentSchool Team | — | 🪝 🌐 | |
|
Package purpose: AgentSchool CLI —— 让 AI Agent 一行命令接入 AgentSchool：抖音解析 / 语音转写 / 文件平台 / 公众号创作（as / agentschool 双入口，Agent Skill 公开仓分发）
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Just-in-time preview apps from any commit.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Rhinestone Wallet SDK for passkey-backed smart accounts
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | LevviCode | — | 🪝 🌐 | |
|
Package purpose: WhatsApp Web API Library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Install, diagnose and update agent plugins (Agent Plugins spec) and MCP configs across Claude Code, Codex, Cursor, Kimi and more
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | 4,202 | 3,625 | ↑382.0/day |
Very Risky
|
@andrian.yablonskyy/thub | npm | 1.0.34 | — | — | 🪝 🗄️ | |
|
Package purpose: thub-client — runs on lab machines, executes test jobs against a DUT (HW) or emulator (SW)
Matched naming pattern: npm-@andrian.yablonskyy/thub-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 11
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4202/month, 1050/week (ACTIVE_COMMUNITY_USE)
Codebase size: 3625 lines, 153.8 kB across 23 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | 4,220 | 813 | ↑383.6/day |
Very Risky
|
@andrian.yablonskyy/thub | npm | 1.0.31 | — | — | 🪝 🗄️ | |
|
Package purpose: TestHub Agent CLI — the single entry point CI/CD and developers use to submit and follow test jobs
Matched naming pattern: npm-@andrian.yablonskyy/thub-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 11
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4220/month, 1055/week (ACTIVE_COMMUNITY_USE)
Codebase size: 813 lines, 31.8 kB across 7 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 11d | 201 | 3,735 | ↑18.3/day |
SUSPICIOUS
|
suoku | pypi | 0.1.0a2 | — | — | 🪝 | |
|
Package purpose: Video evidence and structured insights for LLMs, with local search and bring-your-own-key analysis
Claimed homepage: https://pypi.org/project/suoku/
Matched naming pattern: python-suoku-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 11
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 201/month, 10/week (MODERATE_USAGE)
Codebase size: 3735 lines, 168.5 kB across 26 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 12d | 335 | 9 | ↑27.9/day |
Very Risky
|
it | npm | latest | — | — | 🪝 📡 | |
|
Package purpose: CATT IT 系统命令行工具
Matched naming pattern: catt-it-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 12
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 335/month, 83/week (MODERATE_USAGE)
Codebase size: 9 lines, 84.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: ChatCode CLI Web plugin: a VS Code-like right sidebar (explorer / editor / terminal / git / browser), isolated per conversation session. Exposes a service for other plugins to register sidebar tabs and file viewers.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | Neopix | — | 🪝 🌐 | |
|
Package purpose: Professional drop-in status page for Node.js & Express applications with 90-day uptime bars, zero-false-data history, custom logo support, and automated health monitoring.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server for Logto: users, applications. Works with Cloud or self-hosted.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | CrisD3v | — | 🪝 | |
|
Package purpose: CLI for Aetherion Framework
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Slugify, convert case, and encode text locally. No network and no key.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | 0 | 45,585 | ↑0.0/day |
SUSPICIOUS
|
jsr | pypi | 0.1.0 | Brianna Laugher, Bruno Oliveira, Floris Bruynooghe, Freya Bruhin, Holger Krekel, Jackson Severino da Rocha, Others (See AUTHORS), Ronny Pfannschmidt | — | 🪝 | |
|
Package purpose: testrunner: simple powerful testing with Python
Claimed homepage: https://pypi.org/project/jsr-testrunner/
Matched naming pattern: python-jsr-testrunner
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 12
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 45585 lines, 2.0 MB across 145 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | ForgeGraph contributors | — | 🪝 🌐 | |
|
Package purpose: Effect runtime for ForgeGraph applications: engine, storage adapters (D1, DynamoDB, PostgreSQL, memory), hosts (Cloudflare, AWS, Node), workflows, schedules, realtime, governance and telemetry.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Discover, install and manage EvalDock Top100 plugins and Skills in DeepSeek Harness
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: npm wrapper for the NCC CLI: locates (or downloads) the platform Rust binary and runs it.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | noxaascript | — | 🪝 🌐 | |
|
Package purpose: AI router lokal OAuth + API key untuk semua provider AI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Windows CLI and Web manager for local OpenCode instances
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | ITService EOOD | — | 🪝 | |
|
Package purpose: Lunos — EU-sovereign, open-source AI coding agent for the terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | irfndi | — | 🪝 | |
|
Package purpose: Enforce your own AGENTS.md rules on every edit a coding agent makes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Records design decisions made during agent-assisted UI work and feeds them back into the agent's context.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13d | 163 | 526 | ↑12.5/day |
Very Risky
|
telsandbox | npm | latest | lintg | — | 🪝 📡 | |
|
Package purpose: Instant reverse proxy and intranet penetration CLI for developers and AI agents
Matched naming pattern: node-telsandbox-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 13
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 163/month, 40/week (MODERATE_USAGE)
Codebase size: 526 lines, 20.4 kB across 12 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Cloudflare sandbox provider for TanStack AI — run harness adapters inside Cloudflare Containers (edge) through the uniform SandboxHandle.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 14d | — | — | — |
Very Risky
|
— | npm | latest | Hassan Habib | — | 🪝 🌐 | |
|
Package purpose: Command-line PeerLLM host: serve decentralized AI compute from a headless machine.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 14d | — | — | — |
Unverified Signal
|
— | npm | latest | RizkyFx | — | 🪝 🌐 | |
|
Package purpose: WhatsApp Web API Library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 14d | 0 | 441 | ↑0.0/day |
SUSPICIOUS
|
vba | pypi | 0.1.0 | — | — | 🪝 | |
|
Package purpose: Pure Rust static analysis, P-code disassembly, and stomping detection for VBA & Office macros
Claimed homepage: https://pypi.org/project/vba-insight/
Matched naming pattern: python-vba-insight
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 14
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 441 lines, 22.4 kB across 5 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 14d | — | — | — |
Unverified Signal
|
— | npm | latest | CH4ACKO3 | — | 🪝 🌐 | |
|
Package purpose: A library for patching, replacing and decorating DeepSeek Harness plugins during runtime
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 14d | — | — | — |
Unverified Signal
|
— | npm | latest | bluesliu | — | 🪝 🌐 | |
|
Package purpose: WebWork abilities for opencode
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 15d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: npm distribution wrapper for iterate-harness — installs the Python harness (ih CLI) into a managed venv on install and exposes it as a global command
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 15d | — | — | — |
Unverified Signal
|
— | npm | latest | Andrei Hasna | — | 🪝 🌐 | |
|
Package purpose: Universal memory system for AI agents - CLI + MCP server + library API
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 15d | — | — | — |
Unverified Signal
|
— | npm | latest | nerslm | — | 🪝 | |
|
Package purpose: Coding agent CLI with read, bash, edit, write tools and session management
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 15d | 600 | 1,483 | ↑40.0/day |
SUSPICIOUS
|
redmine | pypi | 0.3.0 | — swarajmehta.work@gmail.com | gmail.com | 🪝 | |
|
Package purpose: A tiny retro CLI to log daily tasks to Redmine in plain text.
Claimed homepage: https://pypi.org/project/redmine-worklog/
Matched naming pattern: python-redmine-worklog
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 15
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 600/month, 25/week (MODERATE_USAGE)
Codebase size: 1483 lines, 67.7 kB across 8 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 16d | — | — | — |
Unverified Signal
|
— | npm | latest | yuda-lyu | — | 🪝 🌐 | |
|
Package purpose: A tool for kriging.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 16d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: DeepSeek Harness for HarmonyOS — 一条命令装好:JS-only 替代/裁剪 profile、鸿蒙文件系统补丁、compat loader(zstd/fs-ext/sharp shim)、自启脚本(优先原生 zstd 的 node)。装完跑 dsh-ohos 即可。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 16d | 111 | 2,180 | ↑6.9/day |
SUSPICIOUS
|
decido | pypi | 0.1.0 | yairshy | — | 🪝 | |
|
Package purpose: Typed provider-neutral decisions and bounded semantic web exploration
Claimed homepage: https://pypi.org/project/decido/
Matched naming pattern: python-decido-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 16
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 111/month, 10/week (MODERATE_USAGE)
Codebase size: 2180 lines, 95.0 kB across 26 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 17d | — | — | — |
Unverified Signal
|
— | pypi | 2.2 | — | — | 🪝 | |
|
Package purpose: Model Context Protocol (MCP) endpoint security auditor
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||