Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 65 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | Jacek Juraszek | — | 🪝 | |
|
Package purpose: Opinionated, gated workflow skills, subagent personas, and runtime extensions for the pi coding agent.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: phpipam.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: Cisco Application Policy Infrastructure Controller (Cisco APIC) is the unifying point of automation and management for the Application Centric Infrastructure (ACI) fabric.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | Itential | — | 🪝 | |
|
Package purpose: This adapter integrates with system described as: adtranMosaicDeviceManager.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | Svix Inc. | — | 🪝 | |
|
Package purpose: A CLI to interact with the Svix API.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | ScottyMade | — | 🪝 | |
|
Package purpose: MANA - LLM Token Optimization
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: ContextECF CodeLedger — deterministic context selection for AI coding agents. Safe unscoped alias for @codeledger/cli; avoid the unrelated codeledger package.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Official ContextECF CodeLedger CLI wrapper. Installs the hardened binary from GitHub Releases; zero engine code ships in this package.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Platform-specific CodeM binary for win32-arm64-gnu.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | Macula | — | 🪝 | |
|
Package purpose: Model Context Protocol server that exposes the Macula mesh to any agent harness
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: npm proxy for the Orbit CLI. Downloads the matching native binary from GitHub Releases on install and forwards all invocations.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | Huy-DNA | — | 🪝 | |
|
Package purpose: Typedown RPC server binary.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | RouterHub Team | — | 🪝 | |
|
Package purpose: Shared Copilot agent rules and guidelines for RouterHub projects
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A self-contained Next.js articles library providing components, server utilities, SEO helpers, and a comments system. Drop it into any Next.js + Tailwind CSS v4 app.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Local-first coding agent memory for Claude Code and OpenAI Codex
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Portable trust receipts for agent workflows
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | BlueArch | — | 🪝 | |
|
Package purpose: BlueArch Mission Control — keyboard-first terminal TUI to monitor & run dozens of Claude Code agents: 10 live at once, every session saved and resumable.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: CLI companion for Kurrent Capacitor — records and visualizes Claude Code sessions
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Boost CLI — compress agent/CI tool output (prebuilt binary wrapper)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 35d | — | — | — |
Unverified Signal
|
— | npm | latest | takkub | — | 🪝 | |
|
Package purpose: Desktop cockpit for orchestrating a team of Claude Code agents (Windows + macOS). Install globally: npm i -g agent-takkub
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 35d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 35d | — | — | — |
Unverified Signal
|
— | npm | latest | PYB-XC | — | 🪝 | |
|
Package purpose: PYB-CLI - Minimal AI Agent with multi-model support and CLI interface
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 41d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Cloudflare Worker lifecycle, security, administration, and operational CLI helpers.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 43d | — | — | — |
Unverified Signal
|
— | pypi | 0.2.50 | — | — | 🪝 | |
|
Package purpose: A self-improving coding agent harness. It improves with your usage.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 43d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Customize the PC mouse cursor for every UI state inside DeepSeek Harness. 在 DSH 里自定义鼠标各种状态的图案。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 45d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 45d | — | — | — |
Unverified Signal
|
— | npm | latest | Zack Jackson | — | 🪝 🌐 | |
|
Package purpose: CLI and Agent Bundle plugin for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 46d | — | — | — |
Unverified Signal
|
— | pypi | 0.3.1 | Fred Pearce | — | 🪝 | |
|
Package purpose: Scrub Claude Code session JSONL files for safe publication.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 61d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Google Play In-App Purchase provider for molecule.dev.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 69d | 67 | 104 | ↑1.0/day |
SUSPICIOUS
|
pypi | 0.0.1 | Circles info@circlez.ai | circlez.ai | |||
|
Package purpose: PyPI Package for Circles google-drive--storage-local Python
Claimed homepage: https://github.com/circles-zone/google-drive--storage-local-python-package
Matched naming pattern: google-google-storage
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 69
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 67/month, 33/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 104 lines, 5.0 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 69d | 22 | 15 | ↑0.3/day |
SUSPICIOUS
|
langchain | pypi | 0.0.0 | projectmanoj itsmanojthapa@gmail.com | gmail.com | ||
|
Package purpose: LangChain integrations with Apple Foundation Model
Claimed homepage: https://pypi.org/project/langchain-apple-fm/
Matched naming pattern: langchain-langchain-fm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 69
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 22/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15 lines, 521 Bytes across 6 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 72d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: BIM Engine SDK for Vue2, Vue3, React and HTML
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 74d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Base packages for the Patchwork system
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 75d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Team AI development toolkit — installs standards, skills and tooling for Claude Code, OpenCode, Kiro and Antigravity
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 82d | — | — | — |
Unverified Signal
|
— | npm | latest | oakimov | — | 🪝 🌐 | |
|
Package purpose: Use Cursor subscription models from OpenCode via Cursor's Connect-RPC agent protocol
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 82d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Platform-specific CodeM binary for win32-x64-msvc.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 83d | — | — | — |
Unverified Signal
|
— | npm | latest | Gowalk | — | 🪝 | |
|
Package purpose: Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 83d | — | — | — |
Unverified Signal
|
— | pypi | 2.2.0 | — | — | 🪝 | |
|
Package purpose: Knowledge Item (KI) management MCP server for AI-assisted development
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 88d | — | — | — |
Unverified Signal
|
— | npm | latest | Tien Tran | — | 🪝 | |
|
Package purpose: Launch Claude Desktop in a sandbox environment via Docker
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 89d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Padroes Claude Code da Altis Sistemas - instalador, auto-update e liberacao por estacao
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 93d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: DeepSeek provider extension for pi - V4 Pro, V4 Flash & Reasoner with 1M context and thinking mode
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 93d | 16 | 97 | ↑0.2/day |
SUSPICIOUS
|
llama | pypi | 0.1.0 | Casper Kwok | — | ||
|
Package purpose: LlamaIndex reader for pdfmuse — deterministic PDF/DOCX parsing for RAG.
Claimed homepage: https://pypi.org/project/llama-index-readers-pdfmuse/
Matched naming pattern: llama-llama-readers
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 93
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 97 lines, 4.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 93d | 15 | 81 | ↑0.2/day |
SUSPICIOUS
|
llama | pypi | 0.1.0 | — isadohergar@gmail.com | gmail.com | ||
|
Package purpose: LlamaIndex tool integration for SearchApi.io — multi-engine web search
Claimed homepage: https://pypi.org/project/llama-index-tools-searchapi/
Matched naming pattern: llama-llama-tools
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 93
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 81 lines, 3.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 95d | — | — | — |
Unverified Signal
|
— | npm | latest | Comradery64 | — | 🪝 | |
|
Package purpose: Spin up a fully wired Google Cloud project — APIs enabled, service account keyed, OAuth credentials downloaded — in one command. A TypeScript reimplementation inspired by GAM-team/got-your-back.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 101d | — | — | — |
Unverified Signal
|
— | npm | latest | ehmpathy | — | 🪝 | |
|
Package purpose: a simple and opinionated sdk for aws lambda. define endpoints, ask endpoints, auto-propagate trace-ids.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 65 | 107d | 13 | 134 | ↑0.1/day |
SUSPICIOUS
|
pypi | 0.1.1 | — olami@example.com | example.com | 🪝 | ||
|
Package purpose: Submit data rows to Google Forms via POST requests
Claimed homepage: https://pypi.org/project/google-form-poster/
Matched naming pattern: google-google-poster
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 107
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 134 lines, 5.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 108d | 10 | 76 | ↑0.1/day |
SUSPICIOUS
|
pypi | 0.0.1 | wordstotech | — | |||
|
Package purpose: Python client for scraping Google Flights using the ScrapingBee web scraping API
Claimed homepage: https://pypi.org/project/google-flights-scraper-api/
Matched naming pattern: google-google-scraper
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 108
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 76 lines, 3.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 112d | 11 | 147 | ↑0.1/day |
SUSPICIOUS
|
llama | pypi | 0.1.0 | — | — | ||
|
Package purpose: LlamaIndex memory integration for Recollect
Claimed homepage: https://pypi.org/project/llama-index-memory-recollect/
Matched naming pattern: llama-llama-memory
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 112
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 147 lines, 6.4 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 114d | 0 | 116 | ↑0.0/day |
SUSPICIOUS
|
llama | pypi | 0.1.0 | Voxell, Inc. | — | ||
|
Package purpose: llama-index embeddings voxell integration
Claimed homepage: https://pypi.org/project/llama-index-embeddings-voxell/
Matched naming pattern: llama-llama-embeddings
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 114
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 116 lines, 5.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 65 | 121d | 11 | 45 | ↑0.1/day |
SUSPICIOUS
|
llama | pypi | 0.1.0 | Aaron Shaw | — | 🪝 | |
|
Package purpose: llama-index llms duel agents integration
Claimed homepage: https://pypi.org/project/llama-index-llms-duel/
Matched naming pattern: llama-llama-llms
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 121
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 45 lines, 1.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||