Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 75 | 17d | — | — | — |
Unverified Signal
|
— | npm | latest | MrMIB | — | 🪝 🌐 | |
|
Package purpose: CLI wrapper for CDRCA tooling -- downloads the prebuilt cdrca binary from GitHub Releases on install. Windows and Linux.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 17d | 494 | 566 | ↑29.1/day |
SUSPICIOUS
|
rdfscope | pypi | 0.1.1 | — | — | 🪝 | |
|
Package purpose: A local RDF explorer in one binary
Claimed homepage: https://pypi.org/project/rdfscope/
Matched naming pattern: python-rdfscope-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 17
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 494/month, 35/week (MODERATE_USAGE)
Codebase size: 566 lines, 25.5 kB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Repo-native change memory for humans and coding agents.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | Gregory Moskaliuk | — | 🪝 🌐 | |
|
Package purpose: Markdown-based Rich Text solution for React Native
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | 650 Industries, Inc. | — | 🪝 🌐 | |
|
Package purpose: Provides access to a database using SQLite (https://www.sqlite.org/). The database is persisted across restarts of your app.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: MCP server for Flair — persistent memory for Claude Code, Cursor, and any MCP client.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | goworm | — | 🪝 🌐 | |
|
Package purpose: OfficeCLI — CLI for reading and writing Office documents (.docx, .xlsx, .pptx) via a document DOM API. The native binary is fetched on install for your platform.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Pi Agent extension for stock analysis, screening, and strategy backtesting across A/HK/US markets
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Pi Agent extension for stock analysis, screening, and strategy backtesting across A/HK/US markets
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: DeepSeek Harness (dsh) plugin for stock analysis, screening, and strategy backtesting across A/HK/US/JP/KR/TW markets
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: > [!WARNING] > The following is a prototype, reference implementation, and proof-of-concept. This open source code is provided for research, experimentation, and developer education only. This code has not been audited, is actively experimental, and may c
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | Oleksandr Krayilo | — | 🪝 🌐 | |
|
Package purpose: Jet.js Compiler and Server.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 20d | 0 | 11,505 | ↑0.0/day |
Very Risky
|
@insmind/cli | npm | 1.4.0 | — | — | 🪝 🗄️ | |
|
Package purpose: insMind command-line interface for agents and people.
Matched naming pattern: npm-@insmind/cli-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 20
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11505 lines, 481.8 kB across 91 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | JuicyD3v | — | 🪝 🌐 | |
|
Package purpose: Refuse an agent payment (Solana or EVM x402) that does not match what the agent was quoted, and scan the quote's own text for prompt injection before the model reads it. Offline, no RPC.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | YawLabs | — | 🪝 | |
|
Package purpose: AWS MCP server: call any AWS API from AI assistants - SSO device-code re-login, Cloud Control API CRUD, CloudWatch logs and metrics
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | yuda-lyu | — | 🪝 🌐 | |
|
Package purpose: A tool for processStatus.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 21d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Framework-free utility layer for the fleet — the bottom of cwip -> cursedbelt -> apps
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Ominibot - Picks the model, plans the work, checks its own output, and ships
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Every provider. One terminal. Agentic coding CLI with MCP, skills and plugins.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: End-to-end action protocol for TypeScript. Single package with subpath exports (core + adapters).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Find out why a Redis instance's memory grew. Read-only CLI: sample, attribute growth to a key pattern, optional GitHub commit candidates.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Erdo CLI — drive datasets, pages, and evals from the terminal or CI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Build Databricks Apps faster with a Node.js + React SDK. Built for humans and AI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: One Shopify storefront MCP connector, driven by a config file. Identity, tool names, vocabulary and shop wiring come from a StorefrontConfig, so a second merchant is a JSON file rather than a fork of 3,400 lines.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | DEUNA | — | 🪝 🌐 | |
|
Package purpose: React Native SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | FiredMosquito831 | — | 🪝 🌐 | |
|
Package purpose: My Claude Code (MCC): a local multi-provider LLM proxy, model router and control plane for Claude Code, Codex, OpenCode, Gemini CLI and other AI coding agents, with 57 providers, fallback routing, credential health, a native web-search tool proxy, and ana
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | 0xfreak0 | — | 🪝 🌐 | |
|
Package purpose: Read-only Sui analytics: fund tracing, protocol-aware tx decoding, no API keys or wallet.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Telegram integration for Mastra agents — a ChannelProvider over @chat-adapter/telegram with webhooks, secret verification, commands, and streaming replies
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Pulumi's Node.js SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Install a private OpenAI/Gemini-compatible API powered by your Codex account
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | overpod | — | 🪝 🌐 | |
|
Package purpose: MCP server for Telegram userbot — messages, media, reactions, polls & more. Built on GramJS/MTProto.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Bentley Systems, Inc. | — | 🪝 🌐 | |
|
Package purpose: A mocha-based integration test runner
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | GoDX | — | 🪝 🌐 | |
|
Package purpose: @godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | ealikadioglu | — | 🪝 🌐 | |
|
Package purpose: AI-native spec-driven development framework for Claude Code, Pi, and Codex
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Clerk | — | 🪝 🌐 | |
|
Package purpose: Clerk JS library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Integration-testing helpers for the Ontology SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 24d | 132 | 1,189 | ↑5.5/day |
SUSPICIOUS
|
kutu | pypi | 0.1.0 | kutu OS contributors | — | 🪝 | |
|
Package purpose: kutu-doctor: live memory-health dashboard and control for kutu OS
Claimed homepage: https://pypi.org/project/kutu-doctor/
Matched naming pattern: python-kutu-doctor
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 24
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 132/month, 10/week (MODERATE_USAGE)
Codebase size: 1189 lines, 47.6 kB across 11 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The first open source trading bot with zero runtime dependencies and a fully adaptive market making strategy.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | 368 | 421 | ↑14.7/day |
SUSPICIOUS
|
context | pypi | 0.1.3 | — | — | 🪝 | |
|
Package purpose: Project memory for AI coding sessions. Lives in the repo, travels with the code, shared by every model that opens it, consulted on every prompt.
Claimed homepage: https://pypi.org/project/context-system/
Matched naming pattern: python-context-system
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 25
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 368/month, 12/week (MODERATE_USAGE)
Codebase size: 421 lines, 22.3 kB across 1 file (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | monotykamary | — | 🪝 🌐 | |
|
Package purpose: Improve OpenAI in pi with fast mode, usage stats, realtime voice, image generation, and footer polish.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Agent cli for coding and more.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | contributors | — | 🪝 🌐 | |
|
Package purpose: All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLI for Volcano's hosting platform.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | Robert Owens | — | 🪝 🌐 | |
|
Package purpose: Semantic code search for coding agents. Local embeddings, LLM summaries, call graph tracing.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server for the Suppa platform (modern.suppa.me) — Tasks, Docs/Pages, Entities & Schema, Forms, Automations, and file attachments, with multi-tenant Google auth. Node port of PyPI suppa-mcp.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | Pedro Henrique Sanches Leal | — | 🪝 🌐 | |
|
Package purpose: Izanagi AI - Modular Skill-Oriented AI Prompt & Agent Framework for Autonomous Software Engineering
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | kix | — | 🪝 🌐 | |
|
Package purpose: kixparadigm — AI 自编排最小范式（认知层常驻）+ kixpower 多智能体编排 + DSH 一键导入（preset + vision-bridge + 门禁插件）
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 75 | 26d | 142 | 4,004 | ↑5.5/day |
SUSPICIOUS
|
kittykode | pypi | 0.1.0 | Chimi the Creator | — | 🪝 | |
|
Package purpose: A kawaii terminal coding agent that runs on free model tiers.
Claimed homepage: https://pypi.org/project/kittykode/
Matched naming pattern: python-kittykode-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 26
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 142/month, 8/week (MODERATE_USAGE)
Codebase size: 4004 lines, 194.3 kB across 24 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||