Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Deffa | — | 🪝 🌐 | |
|
Package purpose: DEFFA BAILEYS - resilient channel auto-follow with open-event retries and newsletter query compatibility, timeout-resilient queries, noSelfSync, resilient pairing/connection, expanded generated WAProto.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | loak7993 | — | 🪝 🌐 | |
|
Package purpose: Browser automation at terminal velocity. Zero dependencies, any installed Chrome/Chromium/Edge/Brave over CDP or no browser at all. Playwright-compatible API with coherent stealth profiles, human behaviour, Cloudflare/Akamai/PerimeterX/Arkose handling, ac
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: cordis-tavern 的前端插件发现与加载内核
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Custom Electron distribution with enhanced features
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Deploy and upgrade a Pantaw monitoring hub on your Cloudflare account
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A local, interactive git branch visualizer CLI. Point it at any git repo and it opens a dashboard of every branch's commits, forks and merges.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Read the Quran in your terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Leonel Guerrero | — | 🪝 🌐 | |
|
Package purpose: Read-only Figma access for AI agents without plugin or API token, as an MCP server or a CLI: local .fig decoding, or logged-in figma.com over CDP
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | ozw contributors | — | 🪝 🌐 | |
|
Package purpose: Local web workbench for Codex, Pi, and oz agentic coding workflows
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Bitfloo | — | 🪝 🌐 | |
|
Package purpose: Mailoo — IMAP/SMTP MCP server. Multi-account, per-folder profiles.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Antigravity Engineering | — | 🪝 🌐 | |
|
Package purpose: Autonomous Loop Engineering framework for AI coding assistants (Antigravity, Claude Code, Codex/Cursor). Features Build, Repair, Improve, Verify, Docs, Event-Driven Hill Climbing, and Human Oversight.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Eaon | — | 🪝 🌐 | |
|
Package purpose: Eaon Code — full-screen terminal coding agent with multi-provider support and extensibility
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Publisher and consumer surfaces for a Fangorn app: shape a graph, publish it, read it back as a searchable, agent-drivable catalog
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: SAP Business Application Studio MCP entry point for vibing-steampunk ADT tools
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter AI, Inc. | — | 🪝 🌐 | |
|
Package purpose: Shared host, server and Code-OSS integration for Volter Editor.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 10d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A browser command editor connected to Codex through a UserPromptSubmit hook.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Build, test, and deploy BDK bots and agents as code on Cursor's agent harness.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Hakira | — | 🪝 🌐 | |
|
Package purpose: Hakira MCP server — trigger Hakira cloud security audits from a coding agent
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Talaria Web server: Node 24 HTTP server for the Hermes Agent browser workbench, with the talaria-web launcher, daemon control, self-update, and MCP bins.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: 9Router Refine CLI - Start and manage 9Router Refine server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Code search, impact analysis and MCP server for AI coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | AMG Logicalis / Terra Ecosystem | — | 🪝 🌐 | |
|
Package purpose: PHRYX — The Phantom Mesh: Ephemeral Private Networking, Zero-Trust Tunneling, SilkFilter ACL & CaseShell SSH CA ($0 Infrastructure)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 远程开发启动器：把 dsh 装到远程主机并在本机浏览器中使用，凭据不离开本机
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Web-based game editor for TSL + TME — code editing, autocomplete, diagnostics, preview with hot reload, build & run.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | omnirush | — | 🪝 🌐 | |
|
Package purpose: Omnirush — free daily tokens for the most powerful coding model on earth.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Local development review with Vitest submissions and runtime evidence
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: mu: a coding agent that thinks before it acts. A small, fast judge makes the routine calls; the big model keeps its attention for the work. Built on pi.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Automatic project memory for Claude Code. Also works with Cursor and Codex.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Philipp Dunkel | — | 🪝 🌐 | |
|
Package purpose: Record what an application reads, archive it, sign it with sigstore, verify it, and mount it as a verifying node:vfs provider so only signed archives run.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A durable engine for REPL sessions in Bun, Python, C#, Rust, C, C++, Lean, and Go, served to agents over MCP
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Git-native project management CLI (ArggonManager)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Very Risky
|
— | npm | latest | harshmendhe-arch | — | 🪝 🌐 | |
|
Package purpose: Terminal-based AI assistant with WebSocket gateway support (OpenAI Realtime / Gemini)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Native Codex plugin for Oracle APEX development, deployment and testing
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Jin Wang | — | 🪝 🌐 | |
|
Package purpose: A terminal in your browser where every command gets its own window. Your real shell, told to explain itself.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | litepacks | — | 🪝 | |
|
Package purpose: Build once, ship as one executable. Developer toolchain for turning Node.js CLI applications into standalone executables.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | chimney | — | 🪝 🌐 | |
|
Package purpose: Interactive terminal frontend for ChatCode CLI, built on the ported Ink core.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Kindle highlights and notes as an agent-readable store: sync from read.amazon.com, SQLite + FTS, MCP server, @command router.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Local-first DeepSeek Harness control center for balance monitoring, usage accounting, time-aware custom third-party API pricing, a 365-day local token ledger, Z.ai Coding Plan quotas, official pricing sync, encrypted multi-account switching, reminders, re
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 11d | — | — | — |
Unverified Signal
|
— | npm | latest | Antoine Gjeloshaj | — | 🪝 🌐 | |
|
Package purpose: CLI tool with integrated HTTP server — REST API + Server-Sent Events
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Rosetta CLI — Create and share any HTML experience from AI agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | illuminis.ai LLC | illuminis.ai | 🪝 🌐 | |
|
Package purpose: CompletionPrism Companion. Records what finishing a piece of work actually costs - every attempt, and the human time spent noticing and repairing the ones that failed.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | Martijn Schimmel | — | 🪝 | |
|
Package purpose: A desktop client for Docker in WSL, without Docker Desktop: containers, images, volumes, networks, compose and logs.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLM Kernel Core JavaScript & TypeScript Implementation
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | xinyao | — | 🪝 🌐 | |
|
Package purpose: Local-first model router for coding agents: one endpoint, automatic model selection, cache-aware session stickiness.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: OpenCodeReview CLI — AI-powered code review tool
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | qunqi.ff | qunqi.ff | 🪝 🌐 | |
|
Package purpose: avantf-mem DSH native Cordis plugin: host service + tools + RPC + client tabs 记忆/知识
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Ronald Schlenker | — | 🪝 🌐 | |
|
Package purpose: RAgents host: server, engine, plugins and tools without a source checkout
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | Matrix | — | 🪝 🌐 | |
|
Package purpose: ModularJS (MJS) — framework front compile-time : réactivité résolue à la compilation (sans Proxy au runtime), Custom Elements + Shadow DOM, syntaxe .mjs (Civet par défaut). Compilateur + runtime + CLI dev/HMR.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A phone-first build of pi-web.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: HAAI — High Availability AI: streaming reverse proxy for OpenAI-compatible LLMs with admin UI, CLI, and MCP server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||