Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Execution-boundary security plugin for OpenCode (v2 plugin API): static + dynamic shell-command classification, bypass leases, and a session read/write permission ceiling.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Jaitus — a coding agent in your terminal.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The bosun-x dashboard: every project, task board, handoff, server and backup your AI agents touch, on one self-hosted page. Plain files underneath.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | pypi | 1.0.1 | — | — | 🪝 | |
|
Package purpose: Lightweight HTTP request parser
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: SDK and CLI for the oz.* data API and the <oz-*> web components.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Mario Zechner | — | 🪝 🌐 | |
|
Package purpose: Kairo-only fork of @earendil-works/pi-coding-agent 0.87.1 (MIT). See NOTICE.md for attribution. No CLI bin: the built dist/bundle/cli.js is run by path by the Kairo launcher.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Sergej Popov | — | 🪝 🌐 | |
|
Package purpose: Bring yourself back to the conversation: your coding agents reach you by Slack, a sound or a spoken line when they finish, get stuck, or need a decision, and you answer from your phone.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | coflyn | — | 🪝 🌐 | |
|
Package purpose: Universal social media downloader and media link resolver for Node.js (TikTok, Instagram, YouTube, Spotify, Twitter/X, and more).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | ateriss | — | 🪝 🌐 | |
|
Package purpose: AI Watch — monitor and coach AI coding assistant usage (Claude Code, OpenCode) across a team on the local network. Collaborator agent + leader server + dashboard in one CLI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A TypeScript CLI and library that gives coding agents structured control of WordPress and Playwright screenshots for visual verification. It uses the WordPress REST API for pages, media, plugins, and discovery. The optional WordPress bridge provides regis
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Install Unl in your coding agent: one command, one sign-in, and your decisions reach your agent with their reasons.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Criss Moldovan | — | 🪝 🌐 | |
|
Package purpose: Slack for coding agents: read channels, threads and search across workspaces, and draft messages nothing posts without a person.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Mario Zechner | — | 🪝 🌐 | |
|
Package purpose: Coding agent CLI with read, bash, edit, write tools and session management
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
Unverified Signal
|
— | npm | latest | Jason Liggi | — | 🪝 🌐 | |
|
Package purpose: Lattice - a self-hosted workspace for running Claude Code and Codex agents on projects
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 8d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Connor Tessaro | — | 🪝 🌐 | |
|
Package purpose: A study tool that runs on your computer. You teach, Kizuki plays the student, and every question quotes your own material.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | Wildo AI | — | 🪝 🌐 | |
|
Package purpose: Application-creation workbench: the built operator UI and the server that fronts it on an application's companion.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CreditDaddy — Qoder / WorkBuddy / ZCode / mirasim / 妙手 / Trae 多账号本地管理与每日积分自动签到助手
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: 9Router CLI - Start and manage 9Router server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | aozai | — | 🪝 🌐 | |
|
Package purpose: 极速、安全、纯本地运行的 Cursor IDE 多账号管理与防封虚拟机器指纹切换纯命令行工具
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: ScaleQuality CLI. Connect your computer to the ScaleQuality AI Workspace (`scalequality login`), run its coding engine in any folder of your computer, and import your Claude Code and Codex conversations.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Oriel: a Laravel-style, full-stack TypeScript framework for Node.js and Bun.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Connect your agents to anything. One local MCP endpoint for every OpenAPI, GraphQL and MCP integration you use — with a web UI to manage them.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 给 dsh（DeepSeek Harness）加 QQ 机器人通道：OneBot 11 协议，兼容 NapCat，支持私聊群聊、图片语音、t2i 卡片与设置页配置。QQ bot channel plugin for deepseek harness via OneBot 11.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Independent checks for AI agents, paid per call over x402: a second opinion on your draft before your human sees it ($0.02), and an acceptance check of work another agent hands back ($0.03). MCP server and CLI; verifies a signed receipt.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | Rizki Ananda | — | 🪝 🌐 | |
|
Package purpose: AgenRiya Studio v2.0 — Asisten AI Otomasi Dokumen & Naskah Akademik untuk Microsoft Word
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | Harsh Agarwal | — | 🪝 🌐 | |
|
Package purpose: Run the Ribil land-records API backend (village maps + RTC) on any machine, exposed via a Cloudflare tunnel.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MyAgentRoam Node terminal manager CLI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A local-first job-search machine: watches hundreds of company job boards, scores every posting against your profile, and files matches into a folder of markdown notes you own. Bring your own LLM through MCP.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Wink CLI for cloud image and video processing: login, media validation, upload, submit, poll and return result URLs.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Very Risky
|
— | npm | latest | agent-scan contributors | — | 🪝 | |
|
Package purpose: Security scanner for the AI agent ecosystem: MCP servers, Agent Skills, AGENTS.md / rule files, and agent tool code. Detects prompt injection, tool poisoning, data exfiltration and supply-chain risks. Zero dependencies.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Orca DAG: a skill that teaches your agent to build an orchestration task DAG, plus a viewer binary to visualize it and fire tasks per-harness.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Murmur CLI — invite-based setup, background service, client configuration and diagnostics.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | Martijn Schimmel | — | 🪝 | |
|
Package purpose: A typed, class-based Docker Engine API client for Node.js.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Self-hosted control plane for budget-guarded AI agents.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Modern self-hosted comic book library server, smart AI guided reader, and cataloging platform.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Verify a dependency bump before you merge it, for npm/yarn/pnpm and Python (uv/poetry/pip): real tests, changelog breaking changes vs. actual usage, bisection to the breaking version.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Very Risky
|
— | npm | latest | Milan Víšek | — | 🪝 🌐 | |
|
Package purpose: Genealogical research toolkit for AI coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Lapka: a local anime player. Paste a link, it finds the episodes and the dubs, plays them and saves them to your folder.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 9d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: DSH 划词解读：选中文字浮出按钮，点击弹窗流式显示专业中英翻译 + 该文字在当前上下文中的含义详解
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Bugmole CLI and MCP server for autonomous QA and smoke testing.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A transparent, composable Bun AI agent harness library for people and things.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Salim Hamed | — | 🪝 🌐 | |
|
Package purpose: Guides coding agents through repeatable workflows
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Model Context Protocol server for SEAL — model never holds capability by default (handoff mode); explicit opt-in to forward mode with strict TTL/recipient policy.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 10Router dashboard
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Deffa | — | 🪝 🌐 | |
|
Package purpose: DEFFA BAILEYS - resilient channel auto-follow with open-event retries and newsletter query compatibility, timeout-resilient queries, noSelfSync, resilient pairing/connection, expanded generated WAProto.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | loak7993 | — | 🪝 🌐 | |
|
Package purpose: Browser automation at terminal velocity. Zero dependencies, any installed Chrome/Chromium/Edge/Brave over CDP or no browser at all. Playwright-compatible API with coherent stealth profiles, human behaviour, Cloudflare/Akamai/PerimeterX/Arkose handling, ac
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: cordis-tavern 的前端插件发现与加载内核
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Custom Electron distribution with enhanced features
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||