🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
65 1358d 6 3 ↑0.0/day
SUSPICIOUS
aws pypi 0.1.4 Amit M Mangalvedkar —
Package purpose: EC2 Instance Counter
Claimed homepage: https://pypi.org/project/mashyperscaler-aws/
Matched naming pattern: python-aws-mashyperscaler
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1358
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3 lines, 60 Bytes across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'mashyperscaler-aws' matches AI hallucination template [python] + [aws] + [mashyperscaler].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1347 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1362d 21 80 ↑0.0/day
SUSPICIOUS
cursor pypi 0.2 Wagner Corrales wagnerc4@gmail.com gmail.com
Package purpose: DuckDB cursor wrapper
Claimed homepage: https://gitlab.com/wcorrales/duckdb-cursor
Matched naming pattern: python-cursor-duckdb
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1362
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 21/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 80 lines, 3.0 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'duckdb-cursor' matches AI hallucination template [python] + [cursor] + [duckdb].
  • HIGHClaims critical enterprise brand identity ('CURSOR').
  • HIGHPublisher email 'wagnerc4@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1351 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1378d 11 38 ↑0.0/day
SUSPICIOUS
supabase npm 0.0.0-build.1 — —
Package purpose: > A template for creating a new Remix Auth strategy.
Matched naming pattern: node-supabase-remix-auth-supabase
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1378
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 38 lines, 1.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@nkzn/remix-auth-supabase' matches AI hallucination template [node] + [supabase] + [remix-auth-supabase].
  • HIGHClaims critical enterprise brand identity ('SUPABASE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1352 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1399d 8 96 ↑0.0/day
SUSPICIOUS
google pypi 1.0 Ahmad Mohammadi mohammadi.ahmad00@gmail.com gmail.com
Package purpose: "Django Google auth"
Claimed homepage: https://github.com/ahmad-00/django_google_oauth_rest
Matched naming pattern: django-google-oauth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1399
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 96 lines, 3.8 kB across 7 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'django-google-oauth-rest' matches AI hallucination template [django] + [google] + [oauth].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'mohammadi.ahmad00@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1388 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1413d 4 6 ↑0.0/day
SUSPICIOUS
aws pypi 0.0.12 — —
Package purpose: small aws utilitary package
Claimed homepage: https://pypi.org/project/cookiecutter-aws-extensions/
Matched naming pattern: cookiecutter-aws-extensions
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1413
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 6 lines, 193 Bytes across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'cookiecutter-aws-extensions' matches AI hallucination template [cookiecutter] + [aws] + [extensions].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1405 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1420d 10 78 ↑0.0/day
SUSPICIOUS
eth pypi 0.2.0 Louis Holbrook dev@holbrook.no holbrook.no
Package purpose: EIP165 interface
Claimed homepage: https://git.defalsify.org/eth-interface
Matched naming pattern: python-eth-interface
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1420
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 78 lines, 2.5 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'eth-interface' matches AI hallucination template [python] + [eth] + [interface].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'dev@holbrook.no' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1413 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1422d 35 16 ↑0.0/day
Possible Squatted Stub
google pypi 14.0.1.1.1.dev4 Open Source Integrators, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org
Package purpose: Google map widget allowing to set marker's color
Claimed homepage: https://github.com/OCA/geospatial
Matched naming pattern: odoo14-google-web
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1422
Registry downloads: 35/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 16 lines, 708 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'odoo14-addon-web-widget-google-marker-icon-picker' matches AI hallucination template [odoo14] + [google] + [web].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'support@odoo-community.org' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1411 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (16 LOC, 2 file(s), 708 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1467d 5 30 ↑0.0/day
SUSPICIOUS
google pypi 1.0.0 sc —
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/shopeepay-google-api/
Matched naming pattern: shopeepay-google-api
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1467
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 5/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 30 lines, 1.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'shopeepay-google-api' matches AI hallucination template [shopeepay] + [google] + [api].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1455 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1468d 6 92 ↑0.0/day
SUSPICIOUS
workspace npm 0.0.0 — —
Package purpose: This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 14.2.3.
Matched naming pattern: common-workspace-workspace
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1468
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 2.5 kB across 6 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'common-pipes-workspace' matches AI hallucination template [common] + [workspace] + [workspace].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1442 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1471d 7 44 ↑0.0/day
SUSPICIOUS
google pypi 0.0.3 issei momonge mggyggf@gmail.com gmail.com
Package purpose: Não é oficial do google
Claimed homepage: https://pypi.org/project/django-google-keys/
Matched naming pattern: django-google-keys
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1471
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 44 lines, 1.4 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'django-google-keys' matches AI hallucination template [django] + [google] + [keys].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'mggyggf@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1461 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1474d 5 24 ↑0.0/day
Possible Squatted Stub
sol pypi 0.0.0 Coinfabrik team —
Package purpose: Script to estimate the size of solidity source code
Claimed homepage: https://github.com/CoinFabrik/estimate-sol
Matched naming pattern: python-sol-estimate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1474
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 654 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'estimate-sol' matches AI hallucination template [python] + [sol] + [estimate].
  • HIGHClaims critical enterprise brand identity ('SOL').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1463 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (24 LOC, 1 file(s), 654 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1506d 10 68 ↑0.0/day
SUSPICIOUS
google npm 0.2.0 sohit_dev —
Package purpose: Google auth component
Claimed homepage: https://bitbucket.org/sohit_dev/react-google-auth#readme
Matched naming pattern: react-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1506
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 68 lines, 3.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'react-dev-google-auth' matches AI hallucination template [react] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1480 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1509d 4 27 ↑0.0/day
SUSPICIOUS
aws pypi 0.0.1 kush kushagra.mittal@ihsmarkit.com ihsmarkit.com
Package purpose: My first package
Claimed homepage: https://github.com/kushagra.mittal/my-aws-cloud
Matched naming pattern: my-aws-cloud
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1509
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 27 lines, 722 Bytes across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'my-aws-cloud' matches AI hallucination template [my] + [aws] + [cloud].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'kushagra.mittal@ihsmarkit.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1501 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1511d 9 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-tag-circle-regular/2.0.0
Matched naming pattern: node-circle-fluentui-icon-tag-circle-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1511
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.9 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-tag-circle-regular' matches AI hallucination template [node] + [circle] + [fluentui-icon-tag-circle-regular].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1485 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 7 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-dismiss-circle-regular/2.0.0
Matched naming pattern: node-circle-fluentui-icon-dismiss-circle-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 12.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-dismiss-circle-regular' matches AI hallucination template [node] + [circle] + [fluentui-icon-dismiss-circle-regular].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 8 90 ↑0.0/day
SUSPICIOUS
cursor npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-cursor-hover-off-regular/2.0.0
Matched naming pattern: node-cursor-fluentui-icon-cursor-hover-off-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 12.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-cursor-hover-off-regular' matches AI hallucination template [node] + [cursor] + [fluentui-icon-cursor-hover-off-regular].
  • HIGHClaims critical enterprise brand identity ('CURSOR').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 6 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-circle-small-regular/2.0.0
Matched naming pattern: node-circle-fluentui-icon-circle-small-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-circle-small-regular' matches AI hallucination template [node] + [circle] + [fluentui-icon-circle-small-regular].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 7 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-checkmark-circle-filled/2.0.0
Matched naming pattern: node-circle-fluentui-icon-checkmark-circle-filled
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.6 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-checkmark-circle-filled' matches AI hallucination template [node] + [circle] + [fluentui-icon-checkmark-circle-filled].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 9 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-arrow-circle-up-filled/2.0.0
Matched naming pattern: node-circle-fluentui-icon-arrow-circle-up-filled
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.7 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-arrow-circle-up-filled' matches AI hallucination template [node] + [circle] + [fluentui-icon-arrow-circle-up-filled].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 10 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-arrow-circle-left-regular/2.0.0
Matched naming pattern: node-circle-fluentui-icon-arrow-circle-left-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.8 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-arrow-circle-left-regular' matches AI hallucination template [node] + [circle] + [fluentui-icon-arrow-circle-left-regular].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 11 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-arrow-circle-left-filled/2.0.0
Matched naming pattern: node-circle-fluentui-icon-arrow-circle-left-filled
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.7 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-arrow-circle-left-filled' matches AI hallucination template [node] + [circle] + [fluentui-icon-arrow-circle-left-filled].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 9 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-add-subtract-circle-regular/2.0.0
Matched naming pattern: node-circle-fluentui-icon-add-subtract-circle-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 12.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-add-subtract-circle-regular' matches AI hallucination template [node] + [circle] + [fluentui-icon-add-subtract-circle-regular].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1512d 10 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-icon-add-circle-regular/2.0.0
Matched naming pattern: node-circle-fluentui-icon-add-circle-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1512
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-icon-add-circle-regular' matches AI hallucination template [node] + [circle] + [fluentui-icon-add-circle-regular].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1486 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1513d 14 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-emoji-white-circle-flat/2.0.0
Matched naming pattern: node-circle-fluentui-emoji-white-circle-flat
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1513
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 12.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-emoji-white-circle-flat' matches AI hallucination template [node] + [circle] + [fluentui-emoji-white-circle-flat].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1487 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1513d 8 90 ↑0.0/day
SUSPICIOUS
together npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-emoji-palms-up-together-flat-default/2.0.0
Matched naming pattern: node-together-fluentui-emoji-palms-up-together-flat-default
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1513
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 24.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-emoji-palms-up-together-flat-default' matches AI hallucination template [node] + [together] + [fluentui-emoji-palms-up-together-flat-default].
  • HIGHClaims critical enterprise brand identity ('TOGETHER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1487 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1513d 11 90 ↑0.0/day
SUSPICIOUS
together npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-emoji-palms-up-together-flat-dark/2.0.0
Matched naming pattern: node-together-fluentui-emoji-palms-up-together-flat-dark
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1513
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 24.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-emoji-palms-up-together-flat-dark' matches AI hallucination template [node] + [together] + [fluentui-emoji-palms-up-together-flat-dark].
  • HIGHClaims critical enterprise brand identity ('TOGETHER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1487 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1513d 10 90 ↑0.0/day
SUSPICIOUS
llama npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-emoji-llama-high-contrast/2.0.0
Matched naming pattern: node-llama-fluentui-emoji-llama-high-contrast
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1513
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 18.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-emoji-llama-high-contrast' matches AI hallucination template [node] + [llama] + [fluentui-emoji-llama-high-contrast].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1487 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1514d 12 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-emoji-brown-circle-high-contrast/2.0.0
Matched naming pattern: node-circle-fluentui-emoji-brown-circle-high-contrast
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1514
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 13.8 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-emoji-brown-circle-high-contrast' matches AI hallucination template [node] + [circle] + [fluentui-emoji-brown-circle-high-contrast].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1488 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1514d 13 90 ↑0.0/day
SUSPICIOUS
circle npm 2.0.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fluentui-emoji-black-circle-color/2.0.0
Matched naming pattern: node-circle-fluentui-emoji-black-circle-color
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1514
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 16.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fluentui-emoji-black-circle-color' matches AI hallucination template [node] + [circle] + [fluentui-emoji-black-circle-color].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1488 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1514d 11 53 ↑0.0/day
SUSPICIOUS
google pypi 1.0.4 Roman Milyushkevich roman@scrape-it.cloud scrape-it.cloud
Package purpose: Real-Time Google Maps API
Claimed homepage: https://github.com/Scrapeit-Cloud/google-maps-api-python
Matched naming pattern: sc-google-maps
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1514
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 53 lines, 2.0 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'sc-google-maps-api' matches AI hallucination template [sc] + [google] + [maps].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'roman@scrape-it.cloud' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1515d 13 90 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/hero-icon-arrow-circle-left-outline/1.3.0
Matched naming pattern: node-circle-hero-icon-arrow-circle-left-outline
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1515
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 11.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/hero-icon-arrow-circle-left-outline' matches AI hallucination template [node] + [circle] + [hero-icon-arrow-circle-left-outline].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1489 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1520d 31 2 ↑0.0/day
SUSPICIOUS
workspace npm 0.1.4 Yudai Shinnoki y.shinnoki@gmail.com gmail.com
Package purpose: Workspace integration providing restore utility for Node
Matched naming pattern: node-workspace-restore
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1520
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 31/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 1.3 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'restore-workspace' matches AI hallucination template [node] + [workspace] + [restore].
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • HIGHPublisher email 'y.shinnoki@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1494 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1523d 7 147 ↑0.0/day
SUSPICIOUS
google npm 0.0.3 — —
Package purpose: Description
Claimed homepage: https://github.com/birdly/plato-packages#readme
Matched naming pattern: node-google-nestjs-google-storage
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1523
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 147 lines, 6.5 kB across 10 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@platohq/nestjs-google-storage' matches AI hallucination template [node] + [google] + [nestjs-google-storage].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1497 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 13 92 ↑0.0/day
SUSPICIOUS
ripple npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/tabler-currency-ripple/1.3.0
Matched naming pattern: node-ripple-tabler-currency-ripple
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/tabler-currency-ripple' matches AI hallucination template [node] + [ripple] + [tabler-currency-ripple].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 14 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/tabler-circle-half-vertical/1.3.0
Matched naming pattern: node-circle-tabler-circle-half-vertical
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/tabler-circle-half-vertical' matches AI hallucination template [node] + [circle] + [tabler-circle-half-vertical].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 4 28 ↑0.0/day
SUSPICIOUS
aws pypi 0.1.0 Adams Aliu aa2858@gmail.com gmail.com
Package purpose: Aws integration providing cookiecutter utility for Python
Claimed homepage: https://pypi.org/project/cookiecutter-aws/
Matched naming pattern: python-aws-cookiecutter
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 28 lines, 630 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'cookiecutter-aws' matches AI hallucination template [python] + [aws] + [cookiecutter].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'aa2858@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1520 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1528d 11 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/tabler-arrow-right-circle/1.3.0
Matched naming pattern: node-circle-tabler-arrow-right-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/tabler-arrow-right-circle' matches AI hallucination template [node] + [circle] + [tabler-arrow-right-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 15 92 ↑0.0/day
SUSPICIOUS
stripe npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fa-stripe/1.3.0
Matched naming pattern: node-stripe-fa-stripe
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 14.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fa-stripe' matches AI hallucination template [node] + [stripe] + [fa-stripe].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 83 92 ↑0.1/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fa-gg-circle/1.3.0
Matched naming pattern: node-circle-fa-gg-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 83/month, 20/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fa-gg-circle' matches AI hallucination template [node] + [circle] + [fa-gg-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 17 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fa-check-circle/1.3.0
Matched naming pattern: node-circle-fa-check-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fa-check-circle' matches AI hallucination template [node] + [circle] + [fa-check-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 41 92 ↑0.0/day
SUSPICIOUS
bitcoin npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fa-bitcoin/1.3.0
Matched naming pattern: node-bitcoin-fa-bitcoin
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 41/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.9 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fa-bitcoin' matches AI hallucination template [node] + [bitcoin] + [fa-bitcoin].
  • HIGHClaims critical enterprise brand identity ('BITCOIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 15 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fa-arrow-circle-left/1.3.0
Matched naming pattern: node-circle-fa-arrow-circle-left
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fa-arrow-circle-left' matches AI hallucination template [node] + [circle] + [fa-arrow-circle-left].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 13 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fa-arrow-circle-down/1.3.0
Matched naming pattern: node-circle-fa-arrow-circle-down
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fa-arrow-circle-down' matches AI hallucination template [node] + [circle] + [fa-arrow-circle-down].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 11 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/fa-arrow-alt-circle-up-regular/1.3.0
Matched naming pattern: node-circle-fa-arrow-alt-circle-up-regular
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/fa-arrow-alt-circle-up-regular' matches AI hallucination template [node] + [circle] + [fa-arrow-alt-circle-up-regular].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 12 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-swap-horizontal-circle-twotone/1.3.0
Matched naming pattern: node-circle-material-icon-swap-horizontal-circle-twotone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-swap-horizontal-circle-twotone' matches AI hallucination template [node] + [circle] + [material-icon-swap-horizontal-circle-twotone].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 11 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-remove-circle-outline-round/1.3.0
Matched naming pattern: node-circle-material-icon-remove-circle-outline-round
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-remove-circle-outline-round' matches AI hallucination template [node] + [circle] + [material-icon-remove-circle-outline-round].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1528d 13 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-pause-circle-filled-outlined/1.3.0
Matched naming pattern: node-circle-material-icon-pause-circle-filled-outlined
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1528
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-pause-circle-filled-outlined' matches AI hallucination template [node] + [circle] + [material-icon-pause-circle-filled-outlined].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 6 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-lightbulb-circle-twotone/1.3.0
Matched naming pattern: node-circle-material-icon-lightbulb-circle-twotone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-lightbulb-circle-twotone' matches AI hallucination template [node] + [circle] + [material-icon-lightbulb-circle-twotone].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 12 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-lightbulb-circle-round/1.3.0
Matched naming pattern: node-circle-material-icon-lightbulb-circle-round
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-lightbulb-circle-round' matches AI hallucination template [node] + [circle] + [material-icon-lightbulb-circle-round].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1502 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 11 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-flag-circle-twotone/1.3.0
Matched naming pattern: node-circle-material-icon-flag-circle-twotone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.6 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-flag-circle-twotone' matches AI hallucination template [node] + [circle] + [material-icon-flag-circle-twotone].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD