🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
70 569d 15 43 ↑0.0/day
SUSPICIOUS
coinbase npm 0.1.1 — —
Package purpose: Coinbase integration providing alith utility for Coinbase
Matched naming pattern: coinbase-coinbase-alith
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 569
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 43 lines, 1.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('COINBASE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 584d 31 2 ↑0.1/day
SUSPICIOUS
web3 npm 1.0.6 — —
Package purpose: paw wallet package
Matched naming pattern: web3-web3-connector
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 584
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 31/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 83.3 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 600d 16 33 ↑0.0/day
SUSPICIOUS
google npm 1.0.0 UMAIR SHABBIR —
Package purpose: Free Google Translator API for Node.js
Claimed homepage: https://umairshabbir-83.github.io/google-translator
Matched naming pattern: google-google-ts
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 600
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 33 lines, 1.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/src/index.js:8
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/src/index.js:8

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 634d 111 29 ↑0.2/day
SUSPICIOUS
langchain pypi 0.1.1 Andrea Villa andreakarimodm@gmail.com gmail.com
Package purpose: Goat adapter for LangChain
Claimed homepage: https://ohmygoat.dev/
Matched naming pattern: goat-langchain-adapter
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 634
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 111/month, 21/week (MODERATE_USAGE)
Codebase size: 29 lines, 1.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'goat-sdk-adapter-langchain' matches AI hallucination template [goat] + [langchain] + [adapter].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'andreakarimodm@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOModerate community usage with 111 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
70 647d 0 0 ↑0.0/day
Possible Squatted Stub
llama pypi 0.1.4 — staneyffer@gmail.com gmail.com
Package purpose: Add your description here
Claimed homepage: https://pypi.org/project/llama-cpp-server-py/
Matched naming pattern: llama-llama-server
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 647
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'staneyffer@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
70 718d 27 0 ↑0.0/day
Possible Squatted Stub
langchain pypi 0.1.1 zbmain zbmaincn@gmail.com gmail.com
Package purpose: Langchain integration providing python utility for Langchain
Claimed homepage: https://pypi.org/project/langchain-volcengine-python-sdk/
Matched naming pattern: langchain-langchain-python
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 718
Registry downloads: 27/month, 11/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'zbmaincn@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
70 718d 23 0 ↑0.0/day
Possible Squatted Stub
langchain pypi 0.1.1 zbmain zbmaincn@gmail.com gmail.com
Package purpose: Langchain integration providing python utility for Langchain
Claimed homepage: https://pypi.org/project/langchain-volcengine-python/
Matched naming pattern: langchain-langchain-python
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 718
Registry downloads: 23/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'zbmaincn@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
70 734d 27 38 ↑0.0/day
SUSPICIOUS
google npm 1.0.6 Sarvesh Nayak —
Package purpose: A lightweight Google Analytics tracking page views module for any JavaScript environment.
Matched naming pattern: google-google-light
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 734
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 27/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 38 lines, 1.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:26
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/index.js:26

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 737d 14 18 ↑0.0/day
Possible Squatted Stub
langchain pypi 0.0.2 Kamal Bahadur Shahi kamal.shahi@olivegroup.io olivegroup.io
Package purpose: Langchain chat prompt
Claimed homepage: https://pypi.org/project/langchain-chat-prompt/
Matched naming pattern: langchain-langchain-prompt
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 737
Registry downloads: 14/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 18 lines, 736 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'kamal.shahi@olivegroup.io' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (18 LOC, 1 file(s), 736 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
70 816d 8 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-159
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 3 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-154
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 3/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 7 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-138
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 7 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-137
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 8 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-131
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 8 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-128
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 5 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-126
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 8 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-119
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 5 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-116
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 5 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-96
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 3 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-94
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 3/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 5 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-86
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 7 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-76
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 6 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-71
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 6 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-53
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 4 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-50
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 790 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 8 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-43
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 6 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-42
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 8 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-29
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 9 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-16
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 7 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-14
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 816d 4 14 ↑0.0/day
SUSPICIOUS
btc npm 1.0.0 hoangthang69 —
Package purpose: check btc price
Matched naming pattern: btc-btc-7
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 816
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 14 lines, 413 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BTC').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 868d 4 9 ↑0.0/day
SUSPICIOUS
sol npm 1.0.0 — —
Package purpose: Sol integration providing et utility for Sol
Matched naming pattern: sol-sol-et
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 868
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 9 lines, 239 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('SOL').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 842 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:4
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 929d 163 31 ↑0.2/day
SUSPICIOUS
supabase npm 2.0.4 — — 🪝
Matched naming pattern: node-supabase-moxo
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 929
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 163/month, 40/week (MODERATE_USAGE)
Codebase size: 31 lines, 1.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'moxo-supabase' matches AI hallucination template [node] + [supabase] + [moxo].
  • HIGHClaims critical enterprise brand identity ('SUPABASE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 903 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/env.mjs:1
  • INFOModerate community usage with 163 monthly downloads.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/env.mjs:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 954d 8 104 ↑0.0/day
SUSPICIOUS
eth npm 1.0.0 — —
Matched naming pattern: eth-eth-key
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 954
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 104 lines, 2.8 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 928 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/key-import.js:94
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/key-import.js:94

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 1189d 208 30 ↑0.2/day
SUSPICIOUS
metamask npm 0.0.85 — —
Package purpose: #### Installation
Matched naming pattern: node-metamask-wallet-adapter-metamask
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1189
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 208/month, 52/week (MODERATE_USAGE)
Codebase size: 30 lines, 1.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@coin98t/wallet-adapter-metamask' matches AI hallucination template [node] + [metamask] + [wallet-adapter-metamask].
  • HIGHClaims critical enterprise brand identity ('METAMASK').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1163 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • INFOModerate community usage with 208 monthly downloads.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 1213d 7 132 ↑0.0/day
SUSPICIOUS
circle npm 0.0.2 — —
Matched naming pattern: circle-circle-wecom
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1213
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 132 lines, 7.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1187 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/main.umd.cjs:1 (+1 more occurrence(s) elsewhere)
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/main.umd.cjs:1 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 1320d 335 15 ↑0.3/day
Possible Squatted Stub
azure pypi 0.0.1 — —
Package purpose: Template for PyPI packages
Claimed homepage: https://pypi.org/project/azure-logging/
Matched naming pattern: python-azure-logging
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1320
Registry downloads: 335/month, 97/week (MODERATE_USAGE)
Codebase size: 15 lines, 568 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'azure-logging' matches AI hallucination template [python] + [azure] + [logging].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1313 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (15 LOC, 2 file(s), 568 bytes).
  • INFOModerate community usage with 335 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
70 1589d 1 15 ↑0.0/day
Possible Squatted Stub
circle npm 0.1.0 — —
Matched naming pattern: circle-circle-example
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1589
Registry downloads: 1/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15 lines, 525 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1563 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (15 LOC, 1 file(s), 525 bytes).
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 1885d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: rLogin - Trezor EIP-1193 provider
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'Crypto Wallet Extension Storage' found in package/dist/bundle.js:2
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/dist/bundle.js:2
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/bundle.js:2
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/bundle.js:2

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
70 2178d 108 97 ↑0.0/day
SUSPICIOUS
microsoft npm 0.2.7 iTEAM Software software@iteamnm.com iteamnm.com
Package purpose: Sources user data for Gatsby from the Microsoft Graph API
Matched naming pattern: gatsby-microsoft-microsoft
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2178
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 108/month, 27/week (MODERATE_USAGE)
Codebase size: 97 lines, 3.0 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'gatsby-source-microsoft-graph' matches AI hallucination template [gatsby] + [microsoft] + [microsoft].
  • HIGHClaims critical enterprise brand identity ('MICROSOFT').
  • HIGHPublisher email 'software@iteamnm.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 2152 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/auth.mjs:52
  • INFOModerate community usage with 108 monthly downloads.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/auth.mjs:52

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 0h — — —
Unverified Signal
— npm latest DeepAdapt — 🪝 🌐
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/launcher/credentials.mjs:28
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/launcher/credentials.mjs:19 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/launcher/duplex-claude.mjs:58 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 0h — — —
Unverified Signal
— npm latest Peter Coates — 🪝
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli.js:47 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/alexa/session.js:33
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/alexa/session.js:33

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/auto.js:7 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/rn/inspect.js:229 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/install.js:19
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install.js:104

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 3h — — —
Very Risky
— pypi 0.1.0 — — 🪝
Package purpose: Agentic CVE triage pipeline: detect → patch → verify
Static code signals:
  • MODULE_TOPLEVEL_EXECUTION: 'subprocess.Popen' executed at module scope (runs on import) in cve_coder-0.1.0/cvecoder/app.py:217
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in cve_coder-0.1.0/cvecoder/app.py:219
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in cve_coder-0.1.0/cvecoder/config.py:29
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in cve_coder-0.1.0/cvecoder/cve_patch.py:165
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in cve_coder-0.1.0/cvecoder/cve_verify.py:152
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in cve_coder-0.1.0/cvecoder/get_cve_repos.py:75
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in cve_coder-0.1.0/cvecoder/triage_common.py:128
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in cve_coder-0.1.0/cvecoder/triage_common.py:30

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 3h — — —
SUSPICIOUS
— npm latest — — 🪝 🌐
Package purpose: Embedded Hub SDK and standalone web console.
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/hub/web/.next/server/pages/_error.js:12 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/hub/web/.next/static/chunks/453-135744db9235166e.js:1 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/dist/hub/web/.next/static/chunks/603-68cf9d4a52d6b62d.js:1 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/hub/web/.next/static/chunks/603-68cf9d4a52d6b62d.js:1 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/hub/web/.next/server/chunks/913.js:32

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 4h — — —
Unverified Signal
— npm latest — — 🪝
Package purpose: MCP server for Base token safety checks (honeypot test, liquidity, new launches) and text tools. Pay per call in USDC over x402.
Static code signals:
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/atlas-mcp.js:55
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/atlas-mcp.js:17
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/atlas-mcp.js:55

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 4h — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: AI token 用量统计 CLI：读本地会话日志，输出按厂商/模型/项目/会话/时间的用量报表，支持本地页面与增量上报。支持 Node 与 Bun。
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/cli.js:23076 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/cli.js:12840 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/cli.js:20666 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/cli.js:91 (+1 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'Extended Scanner Timeout Stall' found in package/cli.js:23545 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 5h — — —
Unverified Signal
— npm latest d4n-sec — 🪝 🌐
Package purpose: MCP manager for OpenCode 2: project toggles, refresh, reconnect, and sidebar hide rules.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/cli/index.js:154
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli/index.js:147
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/server.js:1168 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/tui.js:13056

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 6h — — —
Unverified Signal
— npm latest Rushil — 🪝 🌐
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/shell/15-session.js:21 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/shell/30-notes.js:330 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/server/child.js:157 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/server/child.js:85 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 6h — — —
Unverified Signal
— npm latest — — 🪝
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/articleBundle.js:32 (+4 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in package/dist/security.js:121
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/dist/security.js:121

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD