Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 65 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Governed, per-session identity and brokered egress for AI agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Client SDK for apps talking to a user's CEF Vault from outside the Agent Runtime: chat UIs, Slack bots, data pipelines, integrations.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: The `yaak` CLI for publishing plugins and creating/updating/sending requests.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | Relay Messenger | — | 🪝 🌐 | |
|
Package purpose: Relay Messenger channel for Claude Code over Relay v1 WebSocket delivery.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 19d | — | — | — |
Unverified Signal
|
— | pypi | 0.3.0 | — | — | 🪝 | |
|
Package purpose: Flashless Windows & macOS Computer-Use Engine & Model Context Protocol (MCP) Server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 19d | — | — | — |
Very Risky
|
— | pypi | 0.1.2 | Torbjörn Sjögren | — | 🪝 | |
|
Package purpose: Interactive GPU-accelerated 2D turbulence for macOS, Windows and Linux
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | caozhiyuan | — | 🪝 🌐 | |
|
Package purpose: GitHub Copilot, OpenAI Codex, OpenCode Go, and third-party AI provider gateway with OpenAI and Anthropic API compatibility.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 19d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The framework-neutral SDK for building Command Center-compatible resource applications, navigation, layouts, themes, feedback, and embeds.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 20d | — | — | — |
Very Risky
|
— | pypi | 0.6.3 | golergka | — | 🪝 | |
|
Package purpose: Declare, organize, validate, and run synchronous or asynchronous Python tools.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 20d | — | — | — |
Unverified Signal
|
— | pypi | 1.2.1 | OpenCTF | — | 🪝 | |
|
Package purpose: Flask API and sandboxed target-website service for the OpenCTF lab CTF platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: <p align="center"> <h1 align="center">DevEco Code</h1> </p> <p align="center">面向 HarmonyOS 开发场景的 AI Agent 工具。</p> <p align="center"> <a href="README.en.md">English</a> · 简体中文 </p>
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: One CLI for operating MetaMask Extension, Mobile, and Core and producing reviewable recipe evidence. Run it inside a checkout; the product, slot, ports, and runtime paths are detected automatically.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | Alex Gavrilescu | — | 🪝 | |
|
Package purpose: <h1 align="center">Backlog.md</h1> <h1 align="center"> 让 AI Agent 在你的代码仓库里持续工作。 </h2>
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: OpenCode plugin for Legion's Envoy subsystem.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | yuda-lyu | — | 🪝 | |
|
Package purpose: A tool for publish(pub) and subscribe(sub).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 21d | — | — | — |
Very Risky
|
— | pypi | 0.16.1 | docdailey | — | 🪝 | |
|
Package purpose: NotBefore: verify an hourly commit-then-reveal seed from the public qrng-beacon-log and derive labeled seeds, shuffles and splits from it — with a pinned, vendored verifier.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | oliverjessner | — | 🪝 🌐 | |
|
Package purpose: SQLite-only local management app backend and SPA shell
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | tapflow contributors | — | 🪝 | |
|
Package purpose: Android emulator agent for tapflow — ADB control and scrcpy H.264 streaming
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: UniRTM - Universal Runtime Manager: enterprise-grade foundational toolchain for multi-AI IDE collaboration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Unofficial Termux-native Claude Code wrapper with audited native replay
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | Sebastian Rindom | — | 🪝 | |
|
Package purpose: Telemetry for Medusa
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Open-source terminal coding agent with parallel subagents, persistent memory, code-graph intelligence, and built-in web research.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | Hedra | — | 🪝 | |
|
Package purpose: Command-line interface for the Hedra Web API — API spec 3.20.0
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The official CLI for Resend
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: npm wrapper for the Code Knowledge Graph CLI (ck)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 23d | — | — | — |
Very Risky
|
— | pypi | 0.1.1 | Paul Escande, Caroline Chaux, Jérôme Gateau, Hwee Kuan Lee | — | 🪝 | |
|
Package purpose: Scalable GPU forward and adjoint operators for 3D photoacoustic tomography that model the transducer spatial impulse response
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: OmicOS — agentic omics-analysis runtime & CLI (omicos-core). Installs the matching native binary for your platform.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 23d | — | — | — |
Unverified Signal
|
— | npm | latest | Microsoft Corporation | — | 🪝 | |
|
Package purpose: Microsoft 365 Agents Toolkit CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | pypi | 1.0.2 | — | — | 🪝 | |
|
Package purpose: Discover and message Claude Code, Codex, and Antigravity sessions locally, over SSH, through MCP, or via an optional end-to-end encrypted relay.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | pypi | 0.1.17 | Thor Whalen | — | 🪝 | |
|
Package purpose: Run the loop between a non-technical partner who tests an app and a coding agent that answers, fixes, builds and redeploys — over GitHub issues
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 24d | — | — | — |
Very Risky
|
— | pypi | 0.3.1 | — | — | 🪝 | |
|
Package purpose: Beancount.io CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Very Risky
|
— | pypi | 0.2.41 | — | — | 🪝 | |
|
Package purpose: Fast, modular sandboxes for AI agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: Itential SevOne Adapter
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Netlify Inc. | — | 🪝 🌐 | |
|
Package purpose: Netlify command line tool
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Netlify Inc. | — | 🪝 🌐 | |
|
Package purpose: Netlify command line tool
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system Steel_connect
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: Azure DevOps.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: restApiForDocuments.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: Sample.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: remedy.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: gogetsslApi(v1)Documentation.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: nvd.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: securityManagerApi.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: BlueCat IPAM
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: Infoblox Threat Defense.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | Acoustic, L.P., Radoslaw Serek, Aksana Naskalava | — | 🪝 | |
|
Package purpose: BETA: React native plugin for Acoustic Connect
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | harm@nullix.nl harm@nullix.nl | nullix.nl | 🪝 🌐 | |
|
Package purpose: Monaco-powered TypeScript playground for @nullix/zod-mongoose
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | epilot GmbH | — | 🪝 | |
|
Package purpose: General purpose React components for epilot UI elements.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||