🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
65 1085d 2 0 ↑0.0/day
Possible Squatted Stub
copilot pypi 0.1.0b1 — —
Package purpose: Azure Machine Learning Promptflow copilot
Claimed homepage: https://pypi.org/project/promptflow-copilot/
Matched naming pattern: python-copilot-promptflow
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1085
Registry downloads: 2/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 6 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'promptflow-copilot' matches AI hallucination template [python] + [copilot] + [promptflow].
  • HIGHClaims critical enterprise brand identity ('COPILOT').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1077 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 6 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1086d 7 107 ↑0.0/day
SUSPICIOUS
auth0 pypi 1.1 — — 🪝
Package purpose: Auth0 integration providing component utility for Streamlit
Claimed homepage: https://pypi.org/project/streamlit-auth0-component-prime/
Matched naming pattern: streamlit-auth0-component
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1086
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 107 lines, 3.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'streamlit-auth0-component-prime' matches AI hallucination template [streamlit] + [auth0] + [component].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1075 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in streamlit-auth0-component_prime-1.1/auth0_component_prime/__init__.py:94
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in streamlit-auth0-component_prime-1.1/auth0_component_prime/__init__.py:94

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1087d 25 4 ↑0.0/day
SUSPICIOUS
google pypi 0.0.4 — thainm.uet@gmail.com gmail.com
Package purpose: A package to search for URLs
Claimed homepage: https://pypi.org/project/google-surfer/
Matched naming pattern: python-google-surfer
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1087
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 25/month, 15/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4 lines, 166 Bytes across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'google-surfer' matches AI hallucination template [python] + [google] + [surfer].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'thainm.uet@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1077 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1090d 137 0 ↑0.1/day
Possible Squatted Stub
azure pypi 0.0.0b0 Microsoft Corporation —
Package purpose: Azure integration providing common utility for Azure
Claimed homepage: https://learn.microsoft.com/en-us/python/api/overview/azure/ml/?view=azure-ml-py
Matched naming pattern: azure-azure-common
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1090
Registry downloads: 137/month, 15/week (MODERATE_USAGE)
Codebase size: 0 lines, 0 Bytes across 4 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPublisher display name 'Microsoft Corporation' claims vendor identity 'microsoft', but the publishing email '@?' is not on microsoft.com.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1083 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 4 file(s), 0 bytes).
  • INFOModerate community usage with 137 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1091d 33 123 ↑0.0/day
SUSPICIOUS
together pypi 0.4 Kévin Quesada —
Package purpose: llm together plugin
Claimed homepage: https://github.com/wearedevx/llm-together
Matched naming pattern: python-together-llm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1091
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 33/month, 19/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 123 lines, 4.9 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'llm-together' matches AI hallucination template [python] + [together] + [llm].
  • HIGHClaims critical enterprise brand identity ('TOGETHER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1079 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1122d 13 0 ↑0.0/day
Possible Squatted Stub
aws pypi 0.0.1rc1 Appsec-Team SBB application-security@sbb.ch sbb.ch
Package purpose: Dummy package to prevent any kind of dependency confusion attacks against internal python packages
Claimed homepage: https://pypi.org/project/billing-importer-aws/
Matched naming pattern: billing-aws-aws
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1122
Registry downloads: 13/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'billing-importer-aws' matches AI hallucination template [billing] + [aws] + [aws].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'application-security@sbb.ch' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1114 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1122d 14 0 ↑0.0/day
Possible Squatted Stub
aws pypi 0.0.1rc1 Appsec-Team SBB application-security@sbb.ch sbb.ch
Package purpose: Dummy package to prevent any kind of dependency confusion attacks against internal python packages
Claimed homepage: https://pypi.org/project/aws-mobi/
Matched naming pattern: python-aws-mobi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1122
Registry downloads: 14/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'aws-mobi' matches AI hallucination template [python] + [aws] + [mobi].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'application-security@sbb.ch' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1114 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1153d 12 142 ↑0.0/day
SUSPICIOUS
chroma pypi 0.0.1 — jd@example.com example.com
Package purpose: # example_store [![PyPI - Version](https://img.shields.io/pypi/v/example-store.svg)](https://pypi.org/project/example-store) [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/example-store.svg)](https://pypi.org/project/example-store) ----- **Table of Contents** - [example\_store]
Claimed homepage: https://pypi.org/project/chroma-store/
Matched naming pattern: python-chroma-store
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1153
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 142 lines, 7.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'chroma-store' matches AI hallucination template [python] + [chroma] + [store].
  • HIGHClaims critical enterprise brand identity ('CHROMA').
  • HIGHPublisher email 'jd@example.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1143 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1172d 85 128 ↑0.1/day
SUSPICIOUS
auth0 pypi 0.9 — — 🪝
Package purpose: Auth0 integration providing auth0 utility for Garrett
Claimed homepage: https://github.com/chris-garrett/garrett-streamlit-auth0
Matched naming pattern: garrett-auth0-auth0
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1172
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 85/month, 58/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 128 lines, 4.3 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'garrett-streamlit-auth0' matches AI hallucination template [garrett] + [auth0] + [auth0].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1165 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in garrett-streamlit-auth0-0.9/auth0_component/__init__.py:5
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in garrett-streamlit-auth0-0.9/auth0_component/__init__.py:5

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1190d 35 27 ↑0.0/day
SUSPICIOUS
google npm 0.0.7 — —
Package purpose: Everything you need to build a Svelte library, powered by [`create-svelte`](https://github.com/sveltejs/kit/tree/master/packages/create-svelte).
Matched naming pattern: node-google-sveltekit-google-maps
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1190
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 35/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 27 lines, 763 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@samht/sveltekit-google-maps' matches AI hallucination template [node] + [google] + [sveltekit-google-maps].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1163 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1192d 20 7 ↑0.0/day
Possible Squatted Stub
openai pypi 1.1.3 — pedrodupim@icloud.com icloud.com
Package purpose: Easily check the current costs of OpenAI's GPT and ChatGPT models.
Claimed homepage: https://pypi.org/project/openai-pricing/
Matched naming pattern: python-openai-pricing
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1192
Registry downloads: 20/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 7 lines, 1.2 kB across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'openai-pricing' matches AI hallucination template [python] + [openai] + [pricing].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'pedrodupim@icloud.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1184 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (7 LOC, 1 file(s), 1220 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1200d 13 97 ↑0.0/day
SUSPICIOUS
workspace npm 16.1.4 — —
Package purpose: This library was generated with [Nx](https://nx.dev).
Matched naming pattern: node-workspace-api-http-org-and-workspace
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1200
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 97 lines, 4.4 kB across 6 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@nx-turbo/api-http-org-and-workspace' matches AI hallucination template [node] + [workspace] + [api-http-org-and-workspace].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1174 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1204d 10 21 ↑0.0/day
SUSPICIOUS
openai pypi 0.1.0 kaixinol keiplyer@gmail.com gmail.com
Package purpose: # openai hook
Claimed homepage: https://pypi.org/project/yamlgenerator-hook-openai/
Matched naming pattern: yamlgenerator-openai-openai
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1204
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 21 lines, 1.5 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yamlgenerator-hook-openai' matches AI hallucination template [yamlgenerator] + [openai] + [openai].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'keiplyer@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1196 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1205d 7 23 ↑0.0/day
Possible Squatted Stub
llamaindex pypi 0.0.1 Jung Gyu Yoon yjg30737@gmail.com gmail.com
Package purpose: Example of using LLamaIndex in Python desktop app
Claimed homepage: https://github.com/yjg30737/pyqt-llamaindex.git
Matched naming pattern: python-llamaindex-pyqt
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1205
Registry downloads: 7/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 23 lines, 744 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'pyqt-llamaindex' matches AI hallucination template [python] + [llamaindex] + [pyqt].
  • HIGHClaims critical enterprise brand identity ('LLAMAINDEX').
  • HIGHPublisher email 'yjg30737@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1197 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (23 LOC, 1 file(s), 744 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1213d 91 57 ↑0.1/day
SUSPICIOUS
google pypi 0.1.7 Manuel Castillo-Lopez manucalop@gmail.com gmail.com 🪝
Package purpose: # cloudops-logging-google
Claimed homepage: https://github.com/manucalop/cloudops-logging-google
Matched naming pattern: cloudops-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1213
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 91/month, 25/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 57 lines, 2.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'cloudops-logging-google' matches AI hallucination template [cloudops] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'manucalop@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1206 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in cloudops_logging_google-0.1.7/cloudops/logging/google/logging.py:31
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in cloudops_logging_google-0.1.7/cloudops/logging/google/logging.py:31

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1214d 18 29 ↑0.0/day
SUSPICIOUS
llama pypi 0.0.1 Roboflow support@roboflow.com roboflow.com
Package purpose: # Autodistill autodistill-llama ![Autodistill banner](https://raw.githubusercontent.com/autodistill/autodistill/main/docs/assets/banner.png) The autodistill-llama package integrates with the [Autodistill ecosystem](https://autodistill.com), a framework for distilling large models into smaller, edg
Claimed homepage: https://pypi.org/project/autodistill-llama/
Matched naming pattern: python-llama-autodistill
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1214
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 18/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 29 lines, 1.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'autodistill-llama' matches AI hallucination template [python] + [llama] + [autodistill].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'support@roboflow.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1204 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1214d 9 29 ↑0.0/day
SUSPICIOUS
azure pypi 0.0.1 Roboflow support@roboflow.com roboflow.com
Package purpose: # Autodistill autodistill-azure ![Autodistill banner](https://raw.githubusercontent.com/autodistill/autodistill/main/docs/assets/banner.png) The autodistill-azure package integrates with the [Autodistill ecosystem](https://autodistill.com), a framework for distilling large models into smaller, edg
Claimed homepage: https://pypi.org/project/autodistill-azure/
Matched naming pattern: python-azure-autodistill
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1214
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 29 lines, 1.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'autodistill-azure' matches AI hallucination template [python] + [azure] + [autodistill].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'support@roboflow.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1207 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1222d 37 1 ↑0.0/day
SUSPICIOUS
aws npm 0.5.2 Contxt Ltd. — 🪝
Package purpose: Darkspark Plug for AWS Lambda@Edge
Claimed homepage: https://darkspark.io
Matched naming pattern: darkspark-aws-lambda
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1222
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 37/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 321.4 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'darkspark-aws-lambda-edge-plug' matches AI hallucination template [darkspark] + [aws] + [lambda].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOEstablished pre-AI legacy package registered 1196 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/darkspark_aws_lambda_edge.js:1
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/darkspark_aws_lambda_edge.js:1
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/darkspark_aws_lambda_edge.js:1
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/darkspark_aws_lambda_edge.js:1
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/darkspark_aws_lambda_edge.js:1
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/darkspark_aws_lambda_edge.js:1
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/darkspark_aws_lambda_edge.js:1
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/darkspark_aws_lambda_edge.js:1
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/darkspark_aws_lambda_edge.js:1
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/darkspark_aws_lambda_edge.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1226d 5 16 ↑0.0/day
Possible Squatted Stub
aws pypi 1.0.5 Tom R —
Package purpose: Login to AWS SSO with this simple utility - just invoke get_aws_session with: region, role_name, account_id, sso_endpoint. Then use the returned aws session instead of boto3
Claimed homepage: https://pypi.org/project/sso-aws/
Matched naming pattern: python-aws-sso
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1226
Registry downloads: 5/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 16 lines, 573 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sso-aws' matches AI hallucination template [python] + [aws] + [sso].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1217 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (16 LOC, 1 file(s), 573 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1241d 15 24 ↑0.0/day
Possible Squatted Stub
google pypi 0.0.1 Omar Ibrahim —
Package purpose: API Interface for Google NGram
Claimed homepage: https://pypi.org/project/google-pygram/
Matched naming pattern: python-google-pygram
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1241
Registry downloads: 15/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 1.3 kB across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'google-pygram' matches AI hallucination template [python] + [google] + [pygram].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1230 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (24 LOC, 1 file(s), 1252 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1261d 10 137 ↑0.0/day
SUSPICIOUS
tron npm 1.0.0 abngn —
Package purpose: zarabotok-na-obmene-kriptovaliuty-tron-787ea87vs
Matched naming pattern: zarabotok-tron-obmene
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 137 lines, 5.5 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'zarabotok-na-obmene-kriptovaliuty-tron-787ea87vs' matches AI hallucination template [zarabotok] + [tron] + [obmene].
  • HIGHClaims critical enterprise brand identity ('TRON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 5 127 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: cryptobox-binance-zarabotok-a31cupzc1
Matched naming pattern: cryptobox-binance-zarabotok
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 127 lines, 5.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'cryptobox-binance-zarabotok-a31cupzc1' matches AI hallucination template [cryptobox] + [binance] + [zarabotok].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 6 139 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: kak-vyvesti-sredstva-s-binance-cherez-p2p-okiux3t9b
Matched naming pattern: kak-binance-sredstva
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 139 lines, 5.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kak-vyvesti-sredstva-s-binance-cherez-p2p-okiux3t9b' matches AI hallucination template [kak] + [binance] + [sredstva].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 6 125 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: kak-zavodit-dengi-na-binance-cherez-p2p-i3vs9gxyq
Matched naming pattern: kak-binance-dengi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 125 lines, 5.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kak-zavodit-dengi-na-binance-cherez-p2p-i3vs9gxyq' matches AI hallucination template [kak] + [binance] + [dengi].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 4 137 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: passivnyi-zarabotok-binance-l9lv33amr
Matched naming pattern: passivnyi-binance-binance
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 137 lines, 5.5 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'passivnyi-zarabotok-binance-l9lv33amr' matches AI hallucination template [passivnyi] + [binance] + [binance].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 6 145 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: kupit-usd-na-binance-cherez-p2p-u3mc4ytdf
Matched naming pattern: kupit-binance-na
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 145 lines, 5.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kupit-usd-na-binance-cherez-p2p-u3mc4ytdf' matches AI hallucination template [kupit] + [binance] + [na].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 6 143 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: kak-rabotaet-p2p-na-binance-na33nxcqt
Matched naming pattern: kak-binance-p2p
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 143 lines, 5.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kak-rabotaet-p2p-na-binance-na33nxcqt' matches AI hallucination template [kak] + [binance] + [p2p].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 6 130 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: pokupka-p2p-na-binance-tl79jrjku
Matched naming pattern: pokupka-binance-na
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 130 lines, 5.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'pokupka-p2p-na-binance-tl79jrjku' matches AI hallucination template [pokupka] + [binance] + [na].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 8 142 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: kak-prodat-na-binance-cherez-p2p-t0bzqau40
Matched naming pattern: kak-binance-na
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 142 lines, 5.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kak-prodat-na-binance-cherez-p2p-t0bzqau40' matches AI hallucination template [kak] + [binance] + [na].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 7 131 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: kak-vyvesti-s-pomoshchiu-p2p-binance-sxchgp9ru
Matched naming pattern: kak-binance-s
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 131 lines, 5.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'kak-vyvesti-s-pomoshchiu-p2p-binance-sxchgp9ru' matches AI hallucination template [kak] + [binance] + [s].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 6 126 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: vyvod-sredstv-s-binance-na-kartu-p2p-m21x8aj71
Matched naming pattern: vyvod-binance-s
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 126 lines, 5.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'vyvod-sredstv-s-binance-na-kartu-p2p-m21x8aj71' matches AI hallucination template [vyvod] + [binance] + [s].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 9 143 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: scam-binance-p2p-sposob-i6wwelw09
Matched naming pattern: scam-binance-p2p
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 143 lines, 5.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'scam-binance-p2p-sposob-i6wwelw09' matches AI hallucination template [scam] + [binance] + [p2p].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 7 140 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: p2p-sviazki-binance-rabochie-telegram-3t6sudiid
Matched naming pattern: p2p-binance-binance
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 140 lines, 5.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'p2p-sviazki-binance-rabochie-telegram-3t6sudiid' matches AI hallucination template [p2p] + [binance] + [binance].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1261d 7 134 ↑0.0/day
SUSPICIOUS
binance npm 1.0.0 abngn —
Package purpose: zarabotok-na-sprede-binance-p2p-w1e7narlk
Matched naming pattern: zarabotok-binance-sprede
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1261
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 134 lines, 5.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'zarabotok-na-sprede-binance-p2p-w1e7narlk' matches AI hallucination template [zarabotok] + [binance] + [sprede].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1235 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1266d 11 25 ↑0.0/day
SUSPICIOUS
polygon npm 0.5.0 — —
Package purpose: This project was bootstrapped with [Create React App](https://github.com/facebook/create-react-app).
Matched naming pattern: node-polygon-adopham
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1266
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 25 lines, 585 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'adopham-polygon' matches AI hallucination template [node] + [polygon] + [adopham].
  • HIGHClaims critical enterprise brand identity ('POLYGON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1239 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1273d 15 132 ↑0.0/day
SUSPICIOUS
circle npm 1.0.1 Alireza Shalforoosh alirezashalforoosh75@gmail.com gmail.com
Package purpose: customizable circle progressbar with slot for vue2
Claimed homepage: https://github.com/lastsecondir/vue2-circle-progressbar#readme
Matched naming pattern: node-circle-vue2-circle-progressbar
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1273
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 132 lines, 8.3 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@lastsecond/vue2-circle-progressbar' matches AI hallucination template [node] + [circle] + [vue2-circle-progressbar].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'alirezashalforoosh75@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1247 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1275d 12 111 ↑0.0/day
SUSPICIOUS
auth0 pypi 0.1.5 — — 🪝
Package purpose: Auth0 integration providing component utility for Streamlit
Claimed homepage: https://pypi.org/project/streamlit-auth0-component-allregions/
Matched naming pattern: streamlit-auth0-component
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1275
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 111 lines, 3.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'streamlit-auth0-component-allregions' matches AI hallucination template [streamlit] + [auth0] + [component].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1264 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in streamlit-auth0-component-allregions-0.1.5/auth0_component/__init__.py:99
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in streamlit-auth0-component-allregions-0.1.5/auth0_component/__init__.py:99

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1277d 5 96 ↑0.0/day
SUSPICIOUS
google npm 0.0.9 walbor —
Package purpose: plugin for get google account
Matched naming pattern: capacitor-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1277
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 96 lines, 3.0 kB across 8 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'capacitor-get-google-account' matches AI hallucination template [capacitor] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1251 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1283d 9 1 ↑0.0/day
SUSPICIOUS
amazon npm 2.0.7 harshad —
Package purpose: **GlucoTrust** is a dietary supplement that is designed to help people control their blood sugar levels. It is marketed as a natural and effective alternative to prescription medications for those who suffer from type 2 diabetes, pre-diabetes, or simply h
Matched naming pattern: glucotrust-amazon-reviews
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1283
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 29 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'glucotrust-amazon-reviews-soqur' matches AI hallucination template [glucotrust] + [amazon] + [reviews].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1257 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1283d 14 1 ↑0.0/day
SUSPICIOUS
amazon npm 2.0.7 harshad —
Package purpose: **Prostadine** is a dietary supplement that promotes the prostate health and urinary health of individuals using completely natural ingredients like pomegranate extract, kelp powder, palmetto extract, wakame extract, etc
Matched naming pattern: prostadine-amazon-kkqvm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1283
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 29 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'prostadine-amazon-kkqvm' matches AI hallucination template [prostadine] + [amazon] + [kkqvm].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1257 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1283d 9 1 ↑0.0/day
SUSPICIOUS
amazon npm 2.0.7 harshad —
Package purpose: <strong>ProDentim</strong> is a doctor-formulated oral probiotic candy that helps rebuild healthy teeth and gums and long-lasting fresh breath by a creating bacteria-rich environment in the mouth microbiome. Dr. Drew Sutton MD, who is the doctor who formu
Matched naming pattern: prodentim-amazon-reviews
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1283
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 29 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'prodentim-amazon-reviews-ppiew' matches AI hallucination template [prodentim] + [amazon] + [reviews].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1257 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1287d 0 9 ↑0.0/day
Possible Squatted Stub
openai pypi 0.1.0 anki-code a@a.a —
Package purpose: Use Open AI models in xonsh shell.
Claimed homepage: https://github.com/anki-code/xontrib-openai
Matched naming pattern: python-openai-xontrib
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1287
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 9 lines, 498 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'xontrib-openai' matches AI hallucination template [python] + [openai] + [xontrib].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'a@a.a' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1279 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (9 LOC, 1 file(s), 498 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1288d 34 29 ↑0.0/day
SUSPICIOUS
web3 pypi 0.1.2 — —
Package purpose: # Web3-rush.py 🚀 web3-rush.py is a Python library designed for fast and easy interaction with the Ethereum blockchain🌐. It provides an interface similar to web3.py while utilizing Rust internally, resulting in significantly faster performance⚡. ## 📈 Performance ![Screenshot from 2023-03-26 08-31-
Claimed homepage: https://pypi.org/project/web3-rush/
Matched naming pattern: python-web3-rush
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1288
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 34/month, 30/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 29 lines, 733 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'web3-rush' matches AI hallucination template [python] + [web3] + [rush].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1277 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1289d 12 22 ↑0.0/day
Possible Squatted Stub
openai pypi 0.0.1 Jung Gyu Yoon yjg30737@gmail.com gmail.com
Package purpose: This package is an alias of the 'pyqt-openai' package to support PySide
Claimed homepage: https://pypi.org/project/pyside-openai/
Matched naming pattern: python-openai-pyside
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1289
Registry downloads: 12/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 22 lines, 697 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'pyside-openai' matches AI hallucination template [python] + [openai] + [pyside].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'yjg30737@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1281 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (22 LOC, 1 file(s), 697 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1306d 6 55 ↑0.0/day
SUSPICIOUS
workspace npm 0.0.1 — —
Package purpose: This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 15.2.1.
Matched naming pattern: my-workspace-khanhle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1306
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 55 lines, 1.1 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'my-workspace-khanhle' matches AI hallucination template [my] + [workspace] + [khanhle].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1280 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1314d — — —
Unverified Signal
— npm latest — — 🪝
Package purpose: OKX Wallet integration for hub. [Homepage](https://www.okx.com/web3) | [Docs](https://www.okx.com/web3/build/docs)
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/mod.js:1 (+1 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/dist/mod.js:1 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1318d 19 97 ↑0.0/day
SUSPICIOUS
google npm 14.0.0 — —
Package purpose: This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 14.2.0.
Matched naming pattern: node-google-ngx-bl-google-translate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1318
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 97 lines, 3.2 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@bookinglab/ngx-bl-google-translate' matches AI hallucination template [node] + [google] + [ngx-bl-google-translate].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1292 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1332d 8 0 ↑0.0/day
Possible Squatted Stub
openai pypi 0.1.0 — joblixt@gmail.com gmail.com
Package purpose: A simple way to get response from the ChatGPT 3 model. Written in rust.
Claimed homepage: https://pypi.org/project/openai-simple/
Matched naming pattern: python-openai-simple
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1332
Registry downloads: 8/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1447 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'openai-simple' matches AI hallucination template [python] + [openai] + [simple].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'joblixt@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1324 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1447 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1350d 3 34 ↑0.0/day
SUSPICIOUS
google pypi 0.2 — —
Package purpose: Google ads reporter
Claimed homepage: https://pypi.org/project/reporter-google-ads-dn/
Matched naming pattern: reporter-google-ads
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1350
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 3/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 34 lines, 1.6 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'reporter-google-ads-dn' matches AI hallucination template [reporter] + [google] + [ads].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1340 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1356d 25 98 ↑0.0/day
SUSPICIOUS
google npm 1.1.2 Smrutikant Nayak —
Package purpose: google odrd implementation
Claimed homepage: https://github.com/smrutikant/npm-google-odrd#readme
Matched naming pattern: node-google-odrd
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1356
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 25/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 98 lines, 3.6 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'google-odrd' matches AI hallucination template [node] + [google] + [odrd].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1330 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD