🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
75 186d 0 20 ↑0.0/day
Possible Squatted Stub
claude pypi 0.0.1 — —
Package purpose: TO BE CONTINUED - Package name reserved
Claimed homepage: https://pypi.org/project/claude-unlocked/
Matched naming pattern: python-claude-unlocked
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 186
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 20 lines, 725 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'claude-unlocked' matches AI hallucination template [python] + [claude] + [unlocked].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (176 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (20 LOC, 1 file(s), 725 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 188d 0 14 ↑0.0/day
Possible Squatted Stub
llama pypi 0.1.1 — security@datasciencetech.ca datasciencetech.ca
Package purpose: LlamaIndex integration for ForceField AI security -- scan prompts and moderate outputs in your LlamaIndex pipeline.
Claimed homepage: https://pypi.org/project/llama-index-forcefield/
Matched naming pattern: llama-llama-forcefield
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 188
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 556 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'security@datasciencetech.ca' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (177 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (14 LOC, 1 file(s), 556 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 188d 12 14 ↑0.1/day
Possible Squatted Stub
langchain pypi 0.1.1 — security@datasciencetech.ca datasciencetech.ca
Package purpose: LangChain integration for ForceField AI security -- scan prompts and moderate outputs in your LangChain pipeline.
Claimed homepage: https://pypi.org/project/langchain-forcefield/
Matched naming pattern: python-langchain-forcefield
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 188
Registry downloads: 12/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 524 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-forcefield' matches AI hallucination template [python] + [langchain] + [forcefield].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'security@datasciencetech.ca' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (177 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (14 LOC, 1 file(s), 524 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 188d 0 0 ↑0.0/day
Possible Squatted Stub
langchain pypi 1.0.0 — —
Package purpose: LangChain tools for OilPriceAPI — real-time oil, gas, and commodity prices
Claimed homepage: https://pypi.org/project/langchain-oilpriceapi/
Matched naming pattern: python-langchain-oilpriceapi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 188
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 4 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-oilpriceapi' matches AI hallucination template [python] + [langchain] + [oilpriceapi].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (177 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 4 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 188d — — —
Unverified Signal
— npm latest rynfar — 🪝 🌐
Package purpose: Use Claude and Antigravity subscriptions with Pi, OpenCode and other coding clients. Local API bridge, usage dashboard and optional Mac app.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node -e "try{require('child_process').spawnSync(process.execPath,[require.resolve('@anthropic-ai/claude-code/install.cjs')],{stdio:'inherit'})}catch(e){console.error('[meridian] claude-code postinstall skipped:',e.message)}"'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/antigravitySetup-esmq6zee.js:69 (+16 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/cli-9e27vb02.js:442
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/cli-9e27vb02.js:451 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/cli-chsp880k.js:176 (+9 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 189d 7 0 ↑0.0/day
Possible Squatted Stub
copilot pypi 0.0.1 — your.email@example.com example.com
Package purpose: An AI copilot for graph data and models (Under active development).
Claimed homepage: https://pypi.org/project/graph-copilot/
Matched naming pattern: python-copilot-graph
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 189
Registry downloads: 7/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'graph-copilot' matches AI hallucination template [python] + [copilot] + [graph].
  • HIGHClaims critical enterprise brand identity ('COPILOT').
  • HIGHPublisher email 'your.email@example.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (178 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 190d 31 2 ↑0.2/day
Possible Squatted Stub
claude pypi 0.0.1 — —
Package purpose: Hierarchical AI agent organization framework for Claude Code
Claimed homepage: https://pypi.org/project/claude-org/
Matched naming pattern: python-claude-org
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 190
Registry downloads: 31/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 91 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'claude-org' matches AI hallucination template [python] + [claude] + [org].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (179 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 91 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 190d 194 18 ↑1.0/day
Possible Squatted Stub
langchain pypi 0.5.0 — hello@fastcrw.com fastcrw.com
Package purpose: LangChain integration for CRW — high-performance web scraping document loader
Claimed homepage: https://pypi.org/project/langchain-crw/
Matched naming pattern: python-langchain-crw
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 190
Registry downloads: 194/month, 33/week (MODERATE_USAGE)
Codebase size: 18 lines, 996 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-crw' matches AI hallucination template [python] + [langchain] + [crw].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'hello@fastcrw.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (180 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (18 LOC, 2 file(s), 996 bytes).
  • INFOModerate community usage with 194 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 190d 0 0 ↑0.0/day
Possible Squatted Stub
claude pypi 3.0.0 redredchen01 —
Package purpose: Ops automation system for web property monitoring, GA4 analytics, and scheduled reporting with Telegram notifications
Claimed homepage: https://pypi.org/project/dex-bot-claude/
Matched naming pattern: dex-claude-claude
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 190
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 10 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'dex-bot-claude' matches AI hallucination template [dex] + [claude] + [claude].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (179 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 10 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 192d 10 2 ↑0.1/day
Possible Squatted Stub
claude pypi 0.0.0a1 — —
Package purpose: Claude OAuth-based OmniComp provider
Claimed homepage: https://pypi.org/project/omnicomp-claude-oauth/
Matched naming pattern: omnicomp-claude-oauth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 192
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 68 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'omnicomp-claude-oauth' matches AI hallucination template [omnicomp] + [claude] + [oauth].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 181 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 68 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 192d 6 2 ↑0.0/day
Possible Squatted Stub
gemini pypi 0.0.0a1 — —
Package purpose: Gemini OAuth-based omnicomp provider
Claimed homepage: https://pypi.org/project/omnicomp-gemini-oauth/
Matched naming pattern: omnicomp-gemini-oauth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 192
Registry downloads: 6/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 68 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'omnicomp-gemini-oauth' matches AI hallucination template [omnicomp] + [gemini] + [oauth].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 181 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 68 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 192d 9 5 ↑0.0/day
Possible Squatted Stub
claude pypi 0.0.1 — ray.voelker@gmail.com gmail.com
Package purpose: Manage headless remote Claude Code sessions via tmux + Tailscale
Claimed homepage: https://pypi.org/project/remote-claude-control/
Matched naming pattern: remote-claude-control
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 192
Registry downloads: 9/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 277 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'remote-claude-control' matches AI hallucination template [remote] + [claude] + [control].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'ray.voelker@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 181 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 277 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 192d 3,224 9,614 ↑16.8/day
Very Risky
siluzan npm 1.1.45 — — 🪝 🗄️
Package purpose: Siluzan platform AI Skill CLI — multi-platform content publishing (video/image-text) for Cursor, Claude Code, and OpenClaw.
Claimed homepage: https://www.siluzan.com
Matched naming pattern: siluzan-siluzan-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 192
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 3224/month, 806/week (ACTIVE_COMMUNITY_USE)
Codebase size: 9614 lines, 390.7 kB across 5 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (176 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/chunk-TVHODPID.js:99 (+1 more occurrence(s) elsewhere)
  • HIGHCREDENTIAL_PATH_HARVESTING: 'System Credentials (/etc/shadow, /etc/passwd)' found in package/dist/index.js:5338
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:2657
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:44
  • INFOSubstantial functional codebase (9614 LOC across 5 file(s)).
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/chunk-TVHODPID.js:99 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'System Credentials (/etc/shadow, /etc/passwd)' found in package/dist/index.js:5338
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:2657
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/index.js:44

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 192d 19 0 ↑0.1/day
Possible Squatted Stub
azure pypi 0.0.0 — patrik.valkovic@hotmail.cz hotmail.cz
Package purpose: Deploy to Azure using CDK
Claimed homepage: https://pypi.org/project/azure-cdk/
Matched naming pattern: python-azure-cdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 192
Registry downloads: 19/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 9 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'azure-cdk' matches AI hallucination template [python] + [azure] + [cdk].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'patrik.valkovic@hotmail.cz' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 182 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 9 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 193d 9 1 ↑0.0/day
Possible Squatted Stub
ledger pypi 0.1.0 — —
Package purpose: Git for AI agent actions — session logging, replay, rollback, and diffing for autonomous agents.
Claimed homepage: https://pypi.org/project/ledger-ai/
Matched naming pattern: python-ledger-ai
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 193
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 134 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'ledger-ai' matches AI hallucination template [python] + [ledger] + [ai].
  • HIGHClaims critical enterprise brand identity ('LEDGER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 181 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (1 LOC, 1 file(s), 134 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 194d 10 0 ↑0.1/day
Possible Squatted Stub
claude pypi 0.1.1 — —
Package purpose: Renamed to imbue-mngr-claude. Install imbue-mngr-claude instead.
Claimed homepage: https://pypi.org/project/mng-claude/
Matched naming pattern: python-claude-mng
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 194
Registry downloads: 10/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'mng-claude' matches AI hallucination template [python] + [claude] + [mng].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 183 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 195d 9 15 ↑0.0/day
Possible Squatted Stub
claude npm 0.1.0 — —
Package purpose: Claude integration providing for utility for Claude
Matched naming pattern: claude-claude-for
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 195
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15 lines, 525 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHPackage registered recently (180 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (15 LOC, 1 file(s), 525 bytes).
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 195d 21 0 ↑0.1/day
Possible Squatted Stub
web3 pypi 1.0.2 uliusio —
Package purpose: web3 wallet validator
Claimed homepage: https://pypi.org/project/web3-validate/
Matched naming pattern: python-web3-validate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 195
Registry downloads: 21/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 12 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-validate' matches AI hallucination template [python] + [web3] + [validate].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 184 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 12 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 196d 12 121 ↑0.1/day
SUSPICIOUS
llama pypi 0.1.0 — engineering@ainative.studio ainative.studio
Package purpose: ZeroDB vector store for LlamaIndex - AI-native vector database with free embeddings, semantic search, and RAG support. Pinecone alternative.
Claimed homepage: https://pypi.org/project/llama-index-vector-stores-zerodb/
Matched naming pattern: llama-llama-vector
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 196
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 121 lines, 5.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'engineering@ainative.studio' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (170 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage metadata contains: Discord invite link.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 197d 29 2 ↑0.1/day
Possible Squatted Stub
claude pypi 0.0.1 Dallas Pool codeninja@gmail.com gmail.com
Package purpose: A unified library for Claude Code channel integrations
Claimed homepage: https://pypi.org/project/claude-channels/
Matched naming pattern: python-claude-channels
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 197
Registry downloads: 29/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 61 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'claude-channels' matches AI hallucination template [python] + [claude] + [channels].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'codeninja@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 187 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 61 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 198d — — —
Unverified Signal
— npm latest yurukusa — 🪝
Package purpose: Safety hooks for Claude Code: PreToolUse/PostToolUse/Stop guards that block destructive or irreversible operations at the tool boundary and surface silent failures. Interactive installer, plain shell scripts, no npm dependencies (the hooks read their JSON
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/index.mjs:6609
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/index.mjs:470
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/index.mjs:20

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 200d 45 2 ↑0.2/day
Possible Squatted Stub
claude pypi 0.0.0a1 pledgesec —
Package purpose: Tool for statically configuring Claude Code
Claimed homepage: https://pypi.org/project/claude-config/
Matched naming pattern: python-claude-config
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 45/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 75 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'claude-config' matches AI hallucination template [python] + [claude] + [config].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 75 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 44 2 ↑0.2/day
Possible Squatted Stub
gemini pypi 0.0.0a1 pledgesec —
Package purpose: Tool for statically configuring Gemini CLI
Claimed homepage: https://pypi.org/project/gemini-config/
Matched naming pattern: python-gemini-config
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 44/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 74 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'gemini-config' matches AI hallucination template [python] + [gemini] + [config].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 74 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 4 2 ↑0.0/day
Possible Squatted Stub
ollama pypi 0.0.0a1 pledgesec —
Package purpose: Ollama omnicomp provider
Claimed homepage: https://pypi.org/project/omnicomp-ollama/
Matched naming pattern: python-ollama-omnicomp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 4/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 56 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'omnicomp-ollama' matches AI hallucination template [python] + [ollama] + [omnicomp].
  • HIGHClaims critical enterprise brand identity ('OLLAMA').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 56 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 0 2 ↑0.0/day
Possible Squatted Stub
openai pypi 0.0.0a1 pledgesec —
Package purpose: OpenAI omnicomp provider
Claimed homepage: https://pypi.org/project/omnicomp-openai/
Matched naming pattern: python-openai-omnicomp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 56 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'omnicomp-openai' matches AI hallucination template [python] + [openai] + [omnicomp].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 56 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 10 2 ↑0.1/day
Possible Squatted Stub
gemini pypi 0.0.0a1 pledgesec —
Package purpose: Gemini-RE omnicomp provider
Claimed homepage: https://pypi.org/project/omnicomp-gemini-re/
Matched naming pattern: omnicomp-gemini-re
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 10/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 59 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'omnicomp-gemini-re' matches AI hallucination template [omnicomp] + [gemini] + [re].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 188 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 59 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 10 2 ↑0.1/day
Possible Squatted Stub
claude pypi 0.0.0a1 pledgesec —
Package purpose: Claude-agent-sdk omnicomp provider
Claimed homepage: https://pypi.org/project/omnicomp-claude-sdk/
Matched naming pattern: omnicomp-claude-sdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 66 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'omnicomp-claude-sdk' matches AI hallucination template [omnicomp] + [claude] + [sdk].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 66 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 10 2 ↑0.1/day
Possible Squatted Stub
claude pypi 0.0.0a1 pledgesec —
Package purpose: Claude-RE omnicomp provider
Claimed homepage: https://pypi.org/project/omnicomp-claude-re/
Matched naming pattern: omnicomp-claude-re
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 10/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 59 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'omnicomp-claude-re' matches AI hallucination template [omnicomp] + [claude] + [re].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 59 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 24 2 ↑0.1/day
Possible Squatted Stub
claude pypi 0.0.0a1 pledgesec —
Package purpose: Claude API reimplementation
Claimed homepage: https://pypi.org/project/claude-re/
Matched naming pattern: python-claude-re
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 24/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 59 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'claude-re' matches AI hallucination template [python] + [claude] + [re].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 59 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 200d 32 2 ↑0.2/day
Possible Squatted Stub
gemini pypi 0.0.0a1 pledgesec —
Package purpose: Gemini API reimplementation
Claimed homepage: https://pypi.org/project/gemini-re/
Matched naming pattern: python-gemini-re
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 200
Registry downloads: 32/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 59 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'gemini-re' matches AI hallucination template [python] + [gemini] + [re].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 59 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 201d 180 7 ↑0.9/day
Possible Squatted Stub
crewai pypi 1.0.0 — —
Package purpose: DEPRECATED - renamed to crewai-lastsearch. https://lastsearch.ai/migrate
Claimed homepage: https://pypi.org/project/crewai-browseaidev/
Matched naming pattern: python-crewai-browseaidev
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 201
Registry downloads: 180/month, 16/week (MODERATE_USAGE)
Codebase size: 7 lines, 323 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'crewai-browseaidev' matches AI hallucination template [python] + [crewai] + [browseaidev].
  • HIGHClaims critical enterprise brand identity ('CREWAI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • MEDIUMPackage registered 190 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (7 LOC, 1 file(s), 323 bytes).
  • INFOModerate community usage with 180 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 201d 191 7 ↑1.0/day
Possible Squatted Stub
llamaindex pypi 1.0.0 — —
Package purpose: DEPRECATED - renamed to llamaindex-lastsearch. https://lastsearch.ai/migrate
Claimed homepage: https://pypi.org/project/llamaindex-browseaidev/
Matched naming pattern: python-llamaindex-browseaidev
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 201
Registry downloads: 191/month, 7/week (MODERATE_USAGE)
Codebase size: 7 lines, 339 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'llamaindex-browseaidev' matches AI hallucination template [python] + [llamaindex] + [browseaidev].
  • HIGHClaims critical enterprise brand identity ('LLAMAINDEX').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • MEDIUMPackage registered 190 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (7 LOC, 1 file(s), 339 bytes).
  • INFOModerate community usage with 191 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 201d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: OpenAI Responses provider plugin for Antseed via Codex backend auth
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/index.js:35
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:123
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/index.js:35

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 202d 12 0 ↑0.1/day
Possible Squatted Stub
crewai pypi 1.0.1 — dev@brainai.dev brainai.dev
Package purpose: AgentFolio tools for CrewAI — agent identity, trust scores, and marketplace access
Claimed homepage: https://pypi.org/project/crewai-agentfolio/
Matched naming pattern: python-crewai-agentfolio
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 202
Registry downloads: 12/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 5 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'crewai-agentfolio' matches AI hallucination template [python] + [crewai] + [agentfolio].
  • HIGHClaims critical enterprise brand identity ('CREWAI').
  • HIGHPublisher email 'dev@brainai.dev' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 191 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 5 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 202d 0 0 ↑0.0/day
Possible Squatted Stub
langchain pypi 0.1.0 — dev@brainai.dev brainai.dev
Package purpose: AgentFolio identity & trust tools for LangChain agents
Claimed homepage: https://pypi.org/project/langchain-agentfolio/
Matched naming pattern: python-langchain-agentfolio
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 202
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 12 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-agentfolio' matches AI hallucination template [python] + [langchain] + [agentfolio].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'dev@brainai.dev' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 191 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 12 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 203d 24 0 ↑0.1/day
Possible Squatted Stub
qdrant pypi 0.1.6 — —
Package purpose: MCP server for Qdrant vector database with local embedding support
Claimed homepage: https://pypi.org/project/mcp-server-qdrant-rs/
Matched naming pattern: mcp-qdrant-qdrant
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 203
Registry downloads: 24/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 5 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'mcp-server-qdrant-rs' matches AI hallucination template [mcp] + [qdrant] + [qdrant].
  • HIGHClaims critical enterprise brand identity ('QDRANT').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 192 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 5 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 207d 1,870 1,952 ↑9.0/day
Very Risky
depository npm 1.16.1 — — 🪝
Package purpose: Depository document management system – deployment wizard and installers
Matched naming pattern: node-depository-deploy
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 207
Registry downloads: 1870/month, 467/week (ACTIVE_COMMUNITY_USE)
Codebase size: 1952 lines, 94.7 kB across 4 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 184 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall-platform.mjs'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/download-release.mjs:96 (+3 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/download-release.mjs:34 (+2 more occurrence(s) elsewhere)
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Systemd / macOS LaunchAgent Persistence' found in package/wizard-server.mjs:301
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/wizard-server.mjs
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall-platform.mjs'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/download-release.mjs:96 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/download-release.mjs:34 (+2 more occurrence(s) elsewhere)
  • SYSTEM_PERSISTENCE_TAMPERING: 'Systemd / macOS LaunchAgent Persistence' found in package/wizard-server.mjs:301
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/wizard-server.mjs

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 209d 14 15 ↑0.1/day
Possible Squatted Stub
claude npm 0.1.0 — —
Package purpose: Claude integration providing tiny utility for Node
Matched naming pattern: node-claude-tiny
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 209
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15 lines, 525 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'tiny-claude' matches AI hallucination template [node] + [claude] + [tiny].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 204 days ago within the 1-year AI tool proliferation window.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHVERSION_NOT_FOUND
  • MEDIUMPackage is an empty placeholder (15 LOC, 1 file(s), 525 bytes).
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • VERSION_NOT_FOUND

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 211d 19,902 153,899 ↑94.3/day
Very Risky
harness npm 3.2.31 — — 🪝 📡
Package purpose: Give AI agents full access to the Harness.io platform — manage pipelines, deployments, cloud costs, chaos engineering, feature flags, SEI, and 125+ resource types through 11 MCP tools
Claimed homepage: https://github.com/harness/mcp-server#readme
Matched naming pattern: npm-harness-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 211
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19902/month, 4975/week (HIGH_COMMUNITY_ADOPTION)
Codebase size: 153899 lines, 7.0 MB across 408 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 207 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/ensure-secure-adm-zip.mjs'
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/build/utils/base64.js:70 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/build/registry/toolsets/ccm.js:2310 (+8 more occurrence(s) elsewhere)
  • HIGHSUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/build/registry/toolsets/chaos.js:496
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/build/utils/cli.js:84 (+7 more occurrence(s) elsewhere)
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in package/build/registry/toolsets/gitops.js:1537
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/ensure-secure-adm-zip.mjs'
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/build/utils/base64.js:70 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/build/registry/toolsets/ccm.js:2310 (+8 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/build/registry/toolsets/chaos.js:496
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/build/utils/cli.js:84 (+7 more occurrence(s) elsewhere)
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in package/build/registry/toolsets/gitops.js:1537
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/adm-zip-security-lib.mjs:169

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 212d 17 19 ↑0.1/day
Possible Squatted Stub
aws pypi 0.1.1 Marcelo Ferreira jaytilangus@gmail.com gmail.com
Package purpose: Conecta aws login via sso
Claimed homepage: https://pypi.org/project/aws-cli-conect/
Matched naming pattern: aws-aws-conect
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 212
Registry downloads: 17/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 19 lines, 555 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'jaytilangus@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 202 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (19 LOC, 1 file(s), 555 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 213d 40 0 ↑0.2/day
Possible Squatted Stub
claude pypi 1.4.0 — —
Package purpose: Transitional package — use kanibako-agent-claude instead
Claimed homepage: https://pypi.org/project/kanibako-plugin-claude/
Matched naming pattern: kanibako-claude-claude
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 213
Registry downloads: 40/month, 22/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 10 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'kanibako-plugin-claude' matches AI hallucination template [kanibako] + [claude] + [claude].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 201 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 10 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 215d 61 15 ↑0.3/day
Possible Squatted Stub
claude npm 0.1.0 — —
Package purpose: Claude integration providing switcher utility for Claude
Matched naming pattern: claude-claude-switcher
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 215
Registry downloads: 61/month, 15/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15 lines, 525 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (15 LOC, 1 file(s), 525 bytes).
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 222d 25 1 ↑0.1/day
Possible Squatted Stub
vllm pypi 0.0.1 — —
Package purpose: Vllm integration providing xpu utility for Python
Claimed homepage: https://pypi.org/project/vllm-xpu/
Matched naming pattern: python-vllm-xpu
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 222
Registry downloads: 25/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 35 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'vllm-xpu' matches AI hallucination template [python] + [vllm] + [xpu].
  • HIGHClaims critical enterprise brand identity ('VLLM').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 211 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (1 LOC, 1 file(s), 35 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 224d 12 2 ↑0.1/day
Possible Squatted Stub
langchain pypi 0.1.1 Max —
Package purpose: A minimal caching utility
Claimed homepage: https://pypi.org/project/langchain-caching/
Matched naming pattern: python-langchain-caching
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 224
Registry downloads: 12/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 71 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-caching' matches AI hallucination template [python] + [langchain] + [caching].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 213 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 71 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 224d 67 2 ↑0.3/day
Possible Squatted Stub
claude pypi 0.5.5 — —
Package purpose: Compatibility package; use agentrelay-cli
Claimed homepage: https://pypi.org/project/claude-relay/
Matched naming pattern: python-claude-relay
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 224
Registry downloads: 67/month, 28/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 48 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'claude-relay' matches AI hallucination template [python] + [claude] + [relay].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 213 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 48 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 225d 6 1 ↑0.0/day
Possible Squatted Stub
langchain pypi 0.0.1 Casparian Systems Inc. —
Package purpose: LangChain adapter for the Phellem security framework
Claimed homepage: https://pypi.org/project/phellem-langchain/
Matched naming pattern: python-langchain-phellem
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 225
Registry downloads: 6/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 128 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'phellem-langchain' matches AI hallucination template [python] + [langchain] + [phellem].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 215 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (1 LOC, 1 file(s), 128 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 228d 28 774 ↑0.1/day
SUSPICIOUS
groq pypi 1.0.0 — your-email@example.com example.com 🪝
Package purpose: A tool for downloading YouTube audio, generating subtitles, and sending them to an HTTP endpoint.
Claimed homepage: https://pypi.org/project/asb-groq-sub/
Matched naming pattern: asb-groq-sub
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 228
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 28/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 774 lines, 42.9 kB across 5 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'asb-groq-sub' matches AI hallucination template [asb] + [groq] + [sub].
  • HIGHClaims critical enterprise brand identity ('GROQ').
  • HIGHPublisher email 'your-email@example.com' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 218 days ago within the 1-year AI tool proliferation window.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in asb_groq_sub-1.0.0/groq_sub_gen/main.py:48
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in asb_groq_sub-1.0.0/groq_sub_gen/shared.py:284
  • CRITICALMODULE_TOPLEVEL_EXECUTION: 'subprocess.run' executed at module scope (runs on import) in asb_groq_sub-1.0.0/groq_sub_gen/watcher.py:480
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in asb_groq_sub-1.0.0/groq_sub_gen/watcher.py:79
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in asb_groq_sub-1.0.0/groq_sub_gen/main.py:48
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in asb_groq_sub-1.0.0/groq_sub_gen/shared.py:284
  • MODULE_TOPLEVEL_EXECUTION: 'subprocess.run' executed at module scope (runs on import) in asb_groq_sub-1.0.0/groq_sub_gen/watcher.py:480
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in asb_groq_sub-1.0.0/groq_sub_gen/watcher.py:79
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in asb_groq_sub-1.0.0/groq_sub_gen/watcher.py:24

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 228d 14,007 310 ↑61.4/day
Very Risky
signetai npm 0.157.3 Signet AI hello@signetai.sh signetai.sh 🪝 🌐
Package purpose: Signet native CLI installer wrapper
Claimed homepage: https://signetai.sh
Matched naming pattern: npm-signetai-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 228
Registry downloads: 14007/month, 3501/week (HIGH_COMMUNITY_ADOPTION)
Codebase size: 310 lines, 11.1 kB across 6 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOPublisher email domain '@signetai.sh' matches package identifier token 'signetai', verifying identifiable third-party organization ownership.
  • MEDIUMPackage registered 215 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install-native.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install-native.js:200
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/install-native.js:123
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/install-native.js:63 (+1 more occurrence(s) elsewhere)
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install-native.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install-native.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install-native.js:200
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/install-native.js:123
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/install-native.js:63 (+1 more occurrence(s) elsewhere)
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install-native.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
75 229d 8 19 ↑0.0/day
Possible Squatted Stub
langchain pypi 0.1.0 Hugh Pyle —
Package purpose: LangChain integration for keep — reflective memory for AI agents
Claimed homepage: https://pypi.org/project/langchain-keep/
Matched naming pattern: python-langchain-keep
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 229
Registry downloads: 8/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 19 lines, 588 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-keep' matches AI hallucination template [python] + [langchain] + [keep].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 219 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (19 LOC, 1 file(s), 588 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
75 231d 17 4,075 ↑0.1/day
Very Risky
shopify npm 1.0.0 — — 🪝 📡
Package purpose: Shopify App that turns any Shopify store into an agent:// endpoint via the Agenium protocol
Matched naming pattern: shopify-shopify-app
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 231
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4075 lines, 165.5 kB across 70 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 230 days ago within the 1-year AI tool proliferation window.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in package/dist/lib/bug-reporter.js:4 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/lib/bug-reporter.js:10 (+13 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/lib/bug-reporter.js:4 (+23 more occurrence(s) elsewhere)
  • INFOSubstantial functional codebase (4075 LOC across 70 file(s)).
  • INFOPackage affiliated with trusted vendor 'shopify' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in package/dist/lib/bug-reporter.js:4 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/lib/bug-reporter.js:10 (+13 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/lib/bug-reporter.js:4 (+23 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD