FlagThis | Sentinel Threat Feed

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference

Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.

Package	Score ▼	Age	Users	Lines	Growth	Verdict	Targeted	Ecosystem	Version	Author	Email domain	Signals
	65	566d	31	66	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.Windows.ApplicationModel.WindowsAppRuntime/ Matched naming pattern: winui3-microsoft-windows Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 31/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 66 lines, 2.8 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-windows-applicationmodel-windowsappruntime' matches AI hallucination template [winui3] + [microsoft] + [windows]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	566d	33	58	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.Windows.ApplicationModel.Resources/ Matched naming pattern: winui3-microsoft-windows Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 33/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 58 lines, 2.2 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-windows-applicationmodel-resources' matches AI hallucination template [winui3] + [microsoft] + [windows]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	566d	92	58	↑0.2/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.Windows.ApplicationModel.DynamicDependency/ Matched naming pattern: winui3-microsoft-windows Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 92/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 58 lines, 2.3 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-windows-applicationmodel-dynamicdependency' matches AI hallucination template [winui3] + [microsoft] + [windows]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	566d	9	51	↑0.0/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Shapes/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 9/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 51 lines, 1.8 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-shapes' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	566d	37	38	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Resources/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 37/month, 15/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 38 lines, 1.7 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-resources' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	566d	50	57	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Printing/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 50/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 57 lines, 2.3 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-printing' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	566d	60	68	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Navigation/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 60/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 68 lines, 2.7 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-navigation' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	566d	57	46	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Media.Media3D/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 566 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 57/month, 14/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 46 lines, 1.9 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-media-media3d' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	59	70	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Interop/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 59/month, 11/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 70 lines, 2.7 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-interop' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	32	63	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Hosting/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 32/month, 13/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 63 lines, 2.5 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-hosting' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	32	95	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Documents/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 32/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 95 lines, 2.8 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-documents' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	98	47	↑0.2/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Controls.AnimatedVisuals/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 98/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 47 lines, 2.2 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-controls-animatedvisuals' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	81	43	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Automation.Text/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 81/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 43 lines, 1.7 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-automation-text' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	83	138	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Xaml.Automation.Provider/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 83/month, 18/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 138 lines, 4.2 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-xaml-automation-provider' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	35	33	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.System/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 35/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 33 lines, 1.5 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-system' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	69	33	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Input.Interop/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 69/month, 25/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 33 lines, 1.5 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-input-interop' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	49	58	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Input.DragDrop/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 49/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 58 lines, 2.1 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-input-dragdrop' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	70	114	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Content/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 70/month, 13/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 114 lines, 4.0 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-content' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	93	63	↑0.2/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Composition.SystemBackdrops/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 93/month, 17/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 63 lines, 2.4 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-composition-systembackdrops' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	89	102	↑0.2/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Composition.Scenes/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 89/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 102 lines, 3.5 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-composition-scenes' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	61	113	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Composition.Interactions/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 61/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 113 lines, 4.5 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-composition-interactions' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	63	38	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Composition.Effects/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 63/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 38 lines, 1.7 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-composition-effects' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	66	47	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.UI.Composition.Diagnostics/ Matched naming pattern: winui3-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 66/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 47 lines, 1.9 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-ui-composition-diagnostics' matches AI hallucination template [winui3] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	37	45	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui3-Microsoft.Graphics.Display/ Matched naming pattern: winui3-microsoft-graphics Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 37/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 45 lines, 1.9 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui3-microsoft-graphics-display' matches AI hallucination template [winui3] + [microsoft] + [graphics]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	31	33	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui2-Microsoft.UI.Xaml.XamlTypeInfo/ Matched naming pattern: winui2-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 31/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 33 lines, 1.6 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui2-microsoft-ui-xaml-xamltypeinfo' matches AI hallucination template [winui2] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	10	60	↑0.0/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui2-Microsoft.UI.Xaml.Media/ Matched naming pattern: winui2-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 10/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 60 lines, 2.2 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui2-microsoft-ui-xaml-media' matches AI hallucination template [winui2] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	0	98	↑0.0/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui2-Microsoft.UI.Xaml.Controls.Primitives/ Matched naming pattern: winui2-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 98 lines, 3.8 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui2-microsoft-ui-xaml-controls-primitives' matches AI hallucination template [winui2] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	20	47	↑0.0/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui2-Microsoft.UI.Xaml.Controls.AnimatedVisuals/ Matched naming pattern: winui2-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 20/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 47 lines, 2.2 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui2-microsoft-ui-xaml-controls-animatedvisuals' matches AI hallucination template [winui2] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	567d	80	116	↑0.1/day	SUSPICIOUS	microsoft	pypi	3.2.1	—	—
Package purpose: Python projection of Windows Runtime (WinRT) APIs Claimed homepage: https://pypi.org/project/winui2-Microsoft.UI.Xaml.Automation.Peers/ Matched naming pattern: winui2-microsoft-ui Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 567 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 80/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 116 lines, 4.6 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'winui2-microsoft-ui-xaml-automation-peers' matches AI hallucination template [winui2] + [microsoft] + [ui]. HIGHClaims critical enterprise brand identity ('MICROSOFT'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	568d	—	—	—	Unverified Signal	—	pypi	2.10.7	—	—	🪝
Package purpose: The open source durable AI runtime for model training and batch/online inference. Static code signals: SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in flyte/_checkpoint.py:325 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in flyte/_image.py:834 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in flyte/_initialize.py:201 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in flyte/_interactive_run_context.py:136 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in flyte/_logging.py:75 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in flyte/_run.py:505 SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in flyte/_run_python_script.py:209 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in flyte/_secret.py:21 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	569d	9	33	↑0.0/day	SUSPICIOUS	langchain	pypi	0.1.0	—	—
Package purpose: Langchain Alith Python Integration Claimed homepage: https://pypi.org/project/langchain-alith/ Matched naming pattern: python-langchain-alith Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 569 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 9/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 33 lines, 1.1 kB across 1 file (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'langchain-alith' matches AI hallucination template [python] + [langchain] + [alith]. HIGHClaims critical enterprise brand identity ('LANGCHAIN'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	570d	16	32	↑0.0/day	SUSPICIOUS	openai	pypi	0.1.0	Andrea Villa andreakarimodm@gmail.com	gmail.com
Package purpose: Goat adapter for OpenAI Agents SDK Claimed homepage: https://ohmygoat.dev/ Matched naming pattern: goat-openai-adapter Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 570 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 16/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 32 lines, 1.4 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'goat-sdk-adapter-openai-agents-sdk' matches AI hallucination template [goat] + [openai] + [adapter]. HIGHClaims critical enterprise brand identity ('OPENAI'). HIGHPublisher email 'andreakarimodm@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	574d	8	4	↑0.0/day	SUSPICIOUS	langgraph	pypi	0.1.0	— sisung.kim1@gmail.com	gmail.com
Package purpose: A lightweight library for langgraph that provides useful shortcuts and additional utility functions. Claimed homepage: https://pypi.org/project/crimson-langgraph-dev-tool/ Matched naming pattern: crimson-langgraph-dev Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 574 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 8/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 4 lines, 225 Bytes across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'crimson-langgraph-dev-tool' matches AI hallucination template [crimson] + [langgraph] + [dev]. HIGHClaims critical enterprise brand identity ('LANGGRAPH'). HIGHPublisher email 'sisung.kim1@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	598d	17	18	↑0.0/day	SUSPICIOUS	cryptocom	npm	0.0.1	Tiago Siebler	—
Package purpose: EARLY BETA. Node.js connector for cryptocom's REST APIs and WebSockets, with TypeScript & end-to-end tests. Claimed homepage: https://github.com/tiagosiebler/cryptocom-api#readme Matched naming pattern: node-cryptocom-api Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 598 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 18 lines, 624 Bytes across 3 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'cryptocom-api' matches AI hallucination template [node] + [cryptocom] + [api]. HIGHClaims critical enterprise brand identity ('CRYPTOCOM'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	65	599d	8	26	↑0.0/day	SUSPICIOUS	groq	pypi	0.1.0	Saurabh Sharma saurabh.kpxt@gmail.com	gmail.com
Package purpose: A collection of database and RAG operation tools Claimed homepage: https://github.com/saurabhkpxt/tools_groq_pip Matched naming pattern: tools-groq-groq Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 599 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 8/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 26 lines, 818 Bytes across 1 file (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'tools-pip-groq' matches AI hallucination template [tools] + [groq] + [groq]. HIGHClaims critical enterprise brand identity ('GROQ'). HIGHPublisher email 'saurabh.kpxt@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	599d	96	20	↑0.2/day	SUSPICIOUS	deepseek	pypi	0.0.8	— edfeff@163.com	163.com
Package purpose: This project supports the calculation of token counts. Claimed homepage: https://pypi.org/project/langchain-deepseek-extension/ Matched naming pattern: langchain-deepseek-extension Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 599 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 96/month, 23/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 20 lines, 767 Bytes across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'langchain-deepseek-extension' matches AI hallucination template [langchain] + [deepseek] + [extension]. HIGHClaims critical enterprise brand identity ('DEEPSEEK'). HIGHPublisher email 'edfeff@163.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	606d	13	96	↑0.0/day	SUSPICIOUS	uniswap	pypi	0.1.0	Andrea Villa andreakarimodm@gmail.com	gmail.com	🪝
Package purpose: Goat example for Langchain with uniswap Claimed homepage: https://ohmygoat.dev/ Matched naming pattern: goat-uniswap-example Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 606 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 13/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 96 lines, 4.6 kB across 1 file (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'goat-sdk-example-langchain-uniswap' matches AI hallucination template [goat] + [uniswap] + [example]. HIGHClaims critical enterprise brand identity ('UNISWAP'). HIGHPublisher email 'andreakarimodm@gmail.com' is not affiliated with official vendor domain. HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in goat_sdk_example_langchain_uniswap-0.1.0/example.py:23 Static code signals: SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in goat_sdk_example_langchain_uniswap-0.1.0/example.py:23 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	607d	81	94	↑0.1/day	SUSPICIOUS	google	pypi	0.1.2	5X support@5x.co	5x.co	🪝
Package purpose: A simple Python library for creating a Google BigQuery client using either an access token or a service account JSON file. Claimed homepage: https://github.com/5x-Platform/5x-nextgen-python-libraries.git Matched naming pattern: 5x-google-bigquery Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 607 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 81/month, 39/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 94 lines, 4.9 kB across 3 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name '5x-google-bigquery-auth-manager' matches AI hallucination template [5x] + [google] + [bigquery]. HIGHClaims critical enterprise brand identity ('GOOGLE'). HIGHPublisher email 'support@5x.co' is not affiliated with official vendor domain. HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in 5x_google_bigquery_auth_manager-0.1.2/bigquery_auth/bigquery_auth.py:28 Static code signals: SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in 5x_google_bigquery_auth_manager-0.1.2/bigquery_auth/bigquery_auth.py:28 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	611d	25	25	↑0.0/day	SUSPICIOUS	google	npm	1.0.3	Joao Pedro	—
Package purpose: A React Native component for Google authentication using Firebase. Claimed homepage: https://github.com/seu-usuario/generic-google-auth-firebase#readme Matched naming pattern: generic-google-auth Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 611 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 25/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 25 lines, 4.9 kB across 5 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'generic-google-auth-firebase' matches AI hallucination template [generic] + [google] + [auth]. HIGHClaims critical enterprise brand identity ('GOOGLE'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	65	616d	8	143	↑0.0/day	SUSPICIOUS	cursor	pypi	0.1.2	okld	—
Package purpose: Ace editor component for Streamlit. Claimed homepage: https://share.streamlit.io/okld/streamlit-gallery/main?p=ace-editor Matched naming pattern: streamlit-cursor-cursor Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 616 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 143 lines, 6.4 kB across 3 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'streamlit-ace-cursor' matches AI hallucination template [streamlit] + [cursor] + [cursor]. HIGHClaims critical enterprise brand identity ('CURSOR'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	630d	8	147	↑0.0/day	SUSPICIOUS	cursor	pypi	2.1.0	Adel Elawady adel50ali50@gmail.com	gmail.com	🪝
Package purpose: A utility tool to manage and reset Cursor Editor app IDs Claimed homepage: https://pypi.org/project/cursor-snap/ Matched naming pattern: python-cursor-snap Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 630 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 147 lines, 6.9 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'cursor-snap' matches AI hallucination template [python] + [cursor] + [snap]. HIGHClaims critical enterprise brand identity ('CURSOR'). HIGHPublisher email 'adel50ali50@gmail.com' is not affiliated with official vendor domain. HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in cursor_snap-2.1.0/cursor_snap/cursor_snap.py:60 Static code signals: SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in cursor_snap-2.1.0/cursor_snap/cursor_snap.py:60 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	633d	21	75	↑0.0/day	SUSPICIOUS	polygon	pypi	0.0.1	— dev@ryayoung.com	ryayoung.com
Package purpose: Organize and maintain your prompts the right way. Claimed homepage: https://pypi.org/project/adi-polygon/ Matched naming pattern: python-polygon-adi Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 633 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 21/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 75 lines, 2.1 kB across 1 file (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'adi-polygon' matches AI hallucination template [python] + [polygon] + [adi]. HIGHClaims critical enterprise brand identity ('POLYGON'). HIGHPublisher email 'dev@ryayoung.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	633d	6	42	↑0.0/day	SUSPICIOUS	eth	pypi	0.1	0xKJ kernel1983@gmail.com	gmail.com
Package purpose: eth_fn: Simple Python utilities for web3py to call ETH contract without ABI Claimed homepage: https://github.com/kernel1983/eth-fn Matched naming pattern: python-eth-fn Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 633 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 6/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 42 lines, 1.3 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'eth-fn' matches AI hallucination template [python] + [eth] + [fn]. HIGHClaims critical enterprise brand identity ('ETH'). HIGHPublisher email 'kernel1983@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	640d	16	69	↑0.0/day	SUSPICIOUS	google	npm	0.0.4	Hrithvik gadhiyahrithvik@gmail.com	gmail.com
Package purpose: Check whether android device running Capacitor app supports Google Play Services. Claimed homepage: https://github.com/hrithvik123/capacitor-google-play-services-checker.git#readme Matched naming pattern: node-google-capacitor-google-play-services-checker Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 640 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 69 lines, 2.8 kB across 8 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name '@hrithvik123/capacitor-google-play-services-checker' matches AI hallucination template [node] + [google] + [capacitor-google-play-services-checker]. HIGHClaims critical enterprise brand identity ('GOOGLE'). HIGHPublisher email 'gadhiyahrithvik@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	65	643d	18	11	↑0.0/day	SUSPICIOUS	solana	npm	1.3.1	—	—
Package purpose: Create a Solana dapp in seconds Claimed homepage: https://github.com/syndicate-xyz/create-solana-dapp#readme Matched naming pattern: node-solana-dapp Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 643 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 11 lines, 3.7 kB across 1 file (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'solana-dapp' matches AI hallucination template [node] + [solana] + [dapp]. HIGHClaims critical enterprise brand identity ('SOLANA'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	65	645d	5	109	↑0.0/day	SUSPICIOUS	kraken	pypi	0.1.2	Pedro Montt Pacheco p-montt@hotmail.com	hotmail.com
Package purpose: Un proyecto para calcular entradas de compra y venta usando las Bandas de Bollinger y la API de Kraken. Claimed homepage: https://github.com/pmontt/proyecto-kraken Matched naming pattern: proyecto-kraken-kraken Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 645 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 5/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 109 lines, 5.0 kB across 6 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'proyecto-final-kraken' matches AI hallucination template [proyecto] + [kraken] + [kraken]. HIGHClaims critical enterprise brand identity ('KRAKEN'). HIGHPublisher email 'p-montt@hotmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	646d	0	93	↑0.0/day	SUSPICIOUS	llama	pypi	0.1.1	—	—
Package purpose: A library for KitchenAI to use LlamaIndex Claimed homepage: https://pypi.org/project/kitchenai-llama/ Matched naming pattern: python-llama-kitchenai Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 646 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 93 lines, 4.6 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'kitchenai-llama' matches AI hallucination template [python] + [llama] + [kitchenai]. HIGHClaims critical enterprise brand identity ('LLAMA'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	65	646d	13	1	↑0.0/day	SUSPICIOUS	cursor	npm	1.0.0	Vaibhaw Mishra	—
Package purpose: A lightweight cursor-following animation component for React JS by Vaibhaw Mishra Claimed homepage: https://github.com/itsvaibhavmishra/react-one-cursor#readme Matched naming pattern: react-cursor-cursor Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 646 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 1 lines, 7.8 kB across 1 file (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'react-one-cursor' matches AI hallucination template [react] + [cursor] + [cursor]. HIGHClaims critical enterprise brand identity ('CURSOR'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	65	649d	18	6	↑0.0/day	SUSPICIOUS	circle	npm	1.0.3	kirsenko_da	—
Package purpose: A simple package that calculate circle area . Claimed homepage: https://github.com/KirsenkoDA/kirsenko-da-first-package#readme Matched naming pattern: calculate-circle-area Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 649 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 6 lines, 379 Bytes across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'calculate-circle-area' matches AI hallucination template [calculate] + [circle] + [area]. HIGHClaims critical enterprise brand identity ('CIRCLE'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	65	656d	21	36	↑0.0/day	SUSPICIOUS	web3	pypi	0.0.17	Gnosis AI ai@gnosis.io	gnosis.io
Package purpose: Streamlit component that allows users to connect a wallet and send transactions with dynamic recipients and amounts Claimed homepage: https://pypi.org/project/python-web3-wallet/ Matched naming pattern: python-web3-wallet Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 656 Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself) Registry downloads: 21/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 36 lines, 3.4 kB across 2 files (TINY_CODEBASE) Automated signals flagged: MEDIUMPackage name 'python-web3-wallet' matches AI hallucination template [python] + [web3] + [wallet]. HIGHClaims critical enterprise brand identity ('WEB3'). HIGHPublisher email 'ai@gnosis.io' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →

Package: pypi · 0.1.2

Author: 5X (support@5x.co)

Package purpose: A simple Python library for creating a Google BigQuery client using either an access token or a service account JSON file.

Claimed homepage: https://github.com/5x-Platform/5x-nextgen-python-libraries.git

Official vendor account: No

Days since publish: 607

Code-only verdict: BENIGN_COMMUNITY

Registry downloads: 81/month

Codebase size: 94 lines (TINY_CODEBASE)

Automated signals flagged:

MEDIUMPackage name '5x-google-bigquery-auth-manager' matches AI hallucination template [5x] + [google] + [bigquery].
HIGHClaims critical enterprise brand identity ('GOOGLE').
HIGHPublisher email 'support@5x.co' is not affiliated with official vendor domain.
HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in 5x_google_bigquery_auth_manager-0.1.2/bigquery_auth/bigquery_auth.py:28

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: npm · 0.0.4

Author: Hrithvik (gadhiyahrithvik@gmail.com)

Package purpose: Check whether android device running Capacitor app supports Google Play Services.

Claimed homepage: https://github.com/hrithvik123/capacitor-google-play-services-checker.git#readme

Official vendor account: No

Days since publish: 640

Code-only verdict: BENIGN_COMMUNITY

Registry downloads: 16/month

Codebase size: 69 lines (TINY_CODEBASE)

Automated signals flagged:

MEDIUMPackage name '@hrithvik123/capacitor-google-play-services-checker' matches AI hallucination template [node] + [google] + [capacitor-google-play-services-checker].
HIGHClaims critical enterprise brand identity ('GOOGLE').
HIGHPublisher email 'gadhiyahrithvik@gmail.com' is not affiliated with official vendor domain.
INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →

SHARE INTELLIGENCE WIRE