Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local Reddit twin (an account's submissions — self, link, image, video with poster — comments, deletion, listings and threads; the media lease with its S3-style signed upload; the password and client-credentials grants) with a reddit.com profile/subreddit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local Postmark twin — a faithful, stateful local Postmark transactional-email API your real `postmark` SDK talks to unmodified. Plain/templated/batch sends, outbound + inbound message activity, bounces and delivery stats, templates, message streams, suppr
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local Mailgun twin — a faithful, stateful local Mailgun v3/v4 API your real `mailgun.js` SDK talks to unmodified. Domain-scoped form-encoded sends, stored messages, the Events API with paging, the four suppression tables, domains/webhooks/routes/mailing-l
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local LinkedIn twin (organization posts with image, video or article; the Images and Videos upload protocols; admin roles) with a linkedin.com company-page mirror, built on @volter/world-core.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local HubSpot CRM twin — a faithful, stateful local HubSpot v3/v4 CRM API your @hubspot/api-client integration talks to unmodified. Mirror, simulate, and fork. Built on @volter/world-core.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local Clerk twin — a faithful, stateful local Clerk Backend API your real `@clerk/backend` SDK talks to unmodified. Users, sessions, orgs, real signed JWTs + a JWKS endpoint. Mirror, simulate, and fork. Built on @volter/world-core.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local Bluesky twin (an account's PDS over XRPC: app-password sessions, service-auth tokens, post/follow/profile records with facets and image, video or link-card embeds, blob upload and ranged getBlob; the App View's profile, author feed and thread; the v
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Local-first MCP workbench for Project Telos receipts, manifests, routing ledgers, creative engines, model-foundry lanes, and verification packets.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Replay what a coding agent did, change by change — Claude Code, Codex and Gemini CLI sessions, and git history.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Pi-Desktop 自托管 web 形态 —— 一条命令起 Coding Agent 工作台（core HTTP/SSE 服务 + 同源托管 Web UI，浏览器随处访问）
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Criss Moldovan | — | 🪝 🌐 | |
|
Package purpose: WhatsApp for coding agents, read-only: list, read and search the chats WhatsApp for Mac keeps on this Mac, and draft replies as links the person sends. No network client; it never sends.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Criss Moldovan | — | 🪝 🌐 | |
|
Package purpose: Resend for coding agents: read domains, sent and received mail, metrics and suppressions, and send mail that nothing sends without a person's approval of exactly what goes out.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Very Risky
|
— | npm | latest | Chris Zemmel | — | 🪝 🌐 | |
|
Package purpose: Checks a GitHub repository for the known signatures of fake-job-interview malware, without ever running its code.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | lazyneoaz | — | 🪝 🌐 | |
|
Package purpose: Unofficial Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically (Xtreme FCA)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Sync a shared SkillX library to local Codex and Claude skill folders
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Very Risky
|
— | pypi | 3.3.0 | — | — | 🪝 | |
|
Package purpose: Runs a scheduled Duplicacy backup and reports progress to healthchecks.io.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Moamen | — | 🪝 🌐 | |
|
Package purpose: Click-to-comment feedback for your web app: install the widget, then turn pending comments into AI apply prompts.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | NexusOS Systems | — | 🪝 🌐 | |
|
Package purpose: Universal kinetic & accessibility automation across Web, Mobile, and Desktop for AI agents. Substrates: BiDi, Windows UIA, macOS AX, Android ADB/UIAutomator2, iOS WDA.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Sheldon de Souza | — | 🪝 🌐 | |
|
Package purpose: Cybersecurity for AI founders and vibe coders. A pre-push security gate for apps built with Claude Code, Cursor, Codex, Lovable and Bolt: 12 offline checks for leaked keys, Supabase RLS, cross-account (IDOR) access, injection, Stripe webhooks, known CVEs
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: git push, but louder — play a trending sound on every git push
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Ravi Krishnan Gupta | — | 🪝 🌐 | |
|
Package purpose: Engineering quality control for AI coding agents: detect, attribute, prioritize, repair, verify.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Pager for your AI coding agents — approve, reply and hear results on your phone. End-to-end encrypted.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Shared toolchain config and CLI for TypeScript projects — ESLint, Prettier, TypeScript, Lefthook, cspell, VS Code, and AI assistant files (CLAUDE.md, plus AGENTS.md / GEMINI.md pointing at it), wired together. It is framework-agnostic; the SvelteKit-speci
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Use your logged-in web AI (DeepSeek, GLM, Kimi, Qwen, Doubao...) as model providers in DeepSeek Harness. Web models emit tool calls, DSH runs them under its native permission system, and results return to the same web session. No API keys.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Winter's agent engine: the turn loop, the built-in tools, the session store and the provider wiring that the compiled `winter` binary runs. Most hosts never install this package — they install `@yanlinglabs/winter-agent-sdk`, whose `query()` spawns that b
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Yatharth Roy | — | 🪝 🌐 | |
|
Package purpose: Overarch CLI v1.3.0 — The Agentic OS for Autonomous Software Engineering
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The Cyber-Feline AI Coding Agent unifying Rust, Go, and TypeScript
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CUELO — open-source AI coding agent workspace and harness for omp (oh-my-pi)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Agente CLI autónomo para desarrollo de software
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A standalone terminal coding agent for the Ambient decentralized-inference network.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | hxh230802 | — | 🪝 🌐 | |
|
Package purpose: DSH 纯方案 B 插件 bundle：.dspack 导出/导入/多 profile，零官方源码改动、零第三方插件
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Install a tesserai design system into your project as components you own, keep it in sync, and give your coding agent an MCP server that reads it.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Ilya Utov | — | 🪝 | |
|
Package purpose: A prompt-injection firewall for AI agents, with no AI inside: your agent reads anything and takes orders only from you. For Claude Code, Codex CLI, Kimi Code, DeepSeek Harness, Gemini CLI, MCP hosts and LangChain.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter AI, Inc. | — | 🪝 🌐 | |
|
Package purpose: The Volter Model Editor: Blender modeling on the Volter Editor kit.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Kiki CLI/TUI and desktop app
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Gurkan Yilmaz | — | 🪝 🌐 | |
|
Package purpose: SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | zlZayn | — | 🪝 🌐 | |
|
Package purpose: 将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | cmdaltctr | — | 🪝 🌐 | |
|
Package purpose: Opinionated modular memory system for coding agents (OpenCode + Pi)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Publish TypeScript functions to Functhis
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | Mrityunjay | — | 🪝 🌐 | |
|
Package purpose: J.A.A. - Just An AI: a local-first, multi-provider terminal coding agent. Bring your own key from any provider, or run fully local on Ollama.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A self-hosted team chat with the shape of Slack: channels, threads, direct messages, reactions, uploads, and search, from one small server with no database.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Lockpick from the terminal: device login, project status, findings, repair briefs, Pulse checks and an MCP server for coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Local session manager for coding agents: one Docker sandbox with a desktop per session.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: VSL MCP Server — Model Context Protocol integration for AI agents (Claude Desktop, Cline, TaoCoder)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Risk gate for coding-agent shell commands: deterministic rules + TypeSafe Jev judgments + an editable policy
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Prebuilt Paperclip board UI assets.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Shared utilities for Paperclip adapters: process spawning, environment injection, sandbox/SSH transport, workspace sync, and the round-trip helpers that move code between the local execution-workspace cwd and wherever the agent actually runs.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Установка скиллов, MCP-серверов и CLI из каталога SkillFoxx в Claude Code, Cursor, Codex и другие агенты
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||