🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
65 1529d 8 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-circle-twotone/1.3.0
Matched naming pattern: node-circle-material-icon-circle-twotone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-circle-twotone' matches AI hallucination template [node] + [circle] + [material-icon-circle-twotone].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 7 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-check-circle-sharp/1.3.0
Matched naming pattern: node-circle-material-icon-check-circle-sharp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-check-circle-sharp' matches AI hallucination template [node] + [circle] + [material-icon-check-circle-sharp].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 13 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-check-circle-outline-round/1.3.0
Matched naming pattern: node-circle-material-icon-check-circle-outline-round
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-check-circle-outline-round' matches AI hallucination template [node] + [circle] + [material-icon-check-circle-outline-round].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 15 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-build-circle-filled/1.3.0
Matched naming pattern: node-circle-material-icon-build-circle-filled
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-build-circle-filled' matches AI hallucination template [node] + [circle] + [material-icon-build-circle-filled].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 13 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-arrow-circle-down-twotone/1.3.0
Matched naming pattern: node-circle-material-icon-arrow-circle-down-twotone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-arrow-circle-down-twotone' matches AI hallucination template [node] + [circle] + [material-icon-arrow-circle-down-twotone].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 21 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/material-icon-add-circle-outline-sharp/1.3.0
Matched naming pattern: node-circle-material-icon-add-circle-outline-sharp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 21/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/material-icon-add-circle-outline-sharp' matches AI hallucination template [node] + [circle] + [material-icon-add-circle-outline-sharp].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 16 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/antd-icon-reddit-circle-filled/1.3.0
Matched naming pattern: node-circle-antd-icon-reddit-circle-filled
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.8 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/antd-icon-reddit-circle-filled' matches AI hallucination template [node] + [circle] + [antd-icon-reddit-circle-filled].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 16 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/antd-icon-pound-circle-filled/1.3.0
Matched naming pattern: node-circle-antd-icon-pound-circle-filled
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/antd-icon-pound-circle-filled' matches AI hallucination template [node] + [circle] + [antd-icon-pound-circle-filled].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 15 92 ↑0.0/day
SUSPICIOUS
google npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/antd-icon-google-plus-outlined/1.3.0
Matched naming pattern: node-google-antd-icon-google-plus-outlined
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.9 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/antd-icon-google-plus-outlined' matches AI hallucination template [node] + [google] + [antd-icon-google-plus-outlined].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 13 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/antd-icon-exclamation-circle-twotone/1.3.0
Matched naming pattern: node-circle-antd-icon-exclamation-circle-twotone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/antd-icon-exclamation-circle-twotone' matches AI hallucination template [node] + [circle] + [antd-icon-exclamation-circle-twotone].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 15 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/antd-icon-close-circle-twotone/1.3.0
Matched naming pattern: node-circle-antd-icon-close-circle-twotone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.7 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/antd-icon-close-circle-twotone' matches AI hallucination template [node] + [circle] + [antd-icon-close-circle-twotone].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 17 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/antd-icon-behance-circle-filled/1.3.0
Matched naming pattern: node-circle-antd-icon-behance-circle-filled
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 14.7 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/antd-icon-behance-circle-filled' matches AI hallucination template [node] + [circle] + [antd-icon-behance-circle-filled].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 9 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/antd-icon-alipay-circle-outlined/1.3.0
Matched naming pattern: node-circle-antd-icon-alipay-circle-outlined
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/antd-icon-alipay-circle-outlined' matches AI hallucination template [node] + [circle] + [antd-icon-alipay-circle-outlined].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 15 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-search-circle/1.3.0
Matched naming pattern: node-circle-ionicons-search-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-search-circle' matches AI hallucination template [node] + [circle] + [ionicons-search-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 10 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-reload-circle-sharp/1.3.0
Matched naming pattern: node-circle-ionicons-reload-circle-sharp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-reload-circle-sharp' matches AI hallucination template [node] + [circle] + [ionicons-reload-circle-sharp].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 15 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-play-skip-forward-circle-outline/1.3.0
Matched naming pattern: node-circle-ionicons-play-skip-forward-circle-outline
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-play-skip-forward-circle-outline' matches AI hallucination template [node] + [circle] + [ionicons-play-skip-forward-circle-outline].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 21 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-play-circle-sharp/1.3.0
Matched naming pattern: node-circle-ionicons-play-circle-sharp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 21/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-play-circle-sharp' matches AI hallucination template [node] + [circle] + [ionicons-play-circle-sharp].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 12 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-person-circle-sharp/1.3.0
Matched naming pattern: node-circle-ionicons-person-circle-sharp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-person-circle-sharp' matches AI hallucination template [node] + [circle] + [ionicons-person-circle-sharp].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 14 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-person-circle-outline/1.3.0
Matched naming pattern: node-circle-ionicons-person-circle-outline
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.1 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-person-circle-outline' matches AI hallucination template [node] + [circle] + [ionicons-person-circle-outline].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 13 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-ellipsis-vertical-circle-sharp/1.3.0
Matched naming pattern: node-circle-ionicons-ellipsis-vertical-circle-sharp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-ellipsis-vertical-circle-sharp' matches AI hallucination template [node] + [circle] + [ionicons-ellipsis-vertical-circle-sharp].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 9 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-caret-up-circle-sharp/1.3.0
Matched naming pattern: node-circle-ionicons-caret-up-circle-sharp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.0 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-caret-up-circle-sharp' matches AI hallucination template [node] + [circle] + [ionicons-caret-up-circle-sharp].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 15 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-caret-down-circle/1.3.0
Matched naming pattern: node-circle-ionicons-caret-down-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-caret-down-circle' matches AI hallucination template [node] + [circle] + [ionicons-caret-down-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 15 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons-alert-circle/1.3.0
Matched naming pattern: node-circle-ionicons-alert-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons-alert-circle' matches AI hallucination template [node] + [circle] + [ionicons-alert-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 18 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons4-md-information-circle-outline/1.3.0
Matched naming pattern: node-circle-ionicons4-md-information-circle-outline
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.7 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons4-md-information-circle-outline' matches AI hallucination template [node] + [circle] + [ionicons4-md-information-circle-outline].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 9 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons4-ios-information-circle/1.3.0
Matched naming pattern: node-circle-ionicons4-ios-information-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.4 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons4-ios-information-circle' matches AI hallucination template [node] + [circle] + [ionicons4-ios-information-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 16 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons4-ios-checkmark-circle-outline/1.3.0
Matched naming pattern: node-circle-ionicons4-ios-checkmark-circle-outline
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 13.2 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons4-ios-checkmark-circle-outline' matches AI hallucination template [node] + [circle] + [ionicons4-ios-checkmark-circle-outline].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1529d 20 92 ↑0.0/day
SUSPICIOUS
circle npm 1.3.0 — — 🪝
Package purpose: 👉 https://hyper.fun/c/ionicons4-ios-arrow-dropdown-circle/1.3.0
Matched naming pattern: node-circle-ionicons4-ios-arrow-dropdown-circle
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1529
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 20/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 12.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@hyper.fun/ionicons4-ios-arrow-dropdown-circle' matches AI hallucination template [node] + [circle] + [ionicons4-ios-arrow-dropdown-circle].
  • HIGHClaims critical enterprise brand identity ('CIRCLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1503 days ago (predates modern AI hallucination waves).
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in pkg/wfm/entry.js:1

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1535d — — —
Unverified Signal
— npm latest Amazon Web Services — 🪝 🌐
Package purpose: Amazon IVS Web Broadcast SDK
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/amazon-ivs-web-broadcast.js:2
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/amazon-ivs-web-broadcast.js:2
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/amazon-ivs-web-broadcast.js:2

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1562d 29 25 ↑0.0/day
SUSPICIOUS
binance npm 0.2.9 qiaomengnan —
Package purpose: Binance Pay SDK
Claimed homepage: https://github.com/qiaomengnan16/react-native-binance-pay-abu#readme
Matched naming pattern: react-binance-binance
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1562
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 29/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 25 lines, 859 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'react-native-binance-pay-abu' matches AI hallucination template [react] + [binance] + [binance].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1536 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1562d 19 22 ↑0.0/day
SUSPICIOUS
web3 npm 1.0.1 mjdierkes —
Package purpose: An interaction layer for Web3 storage
Matched naming pattern: merlin-web3-engine
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1562
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 22 lines, 768 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'merlin-web3-engine' matches AI hallucination template [merlin] + [web3] + [engine].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1536 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1569d 0 12 ↑0.0/day
Possible Squatted Stub
amazon pypi 0.0.2 Areeb Shafqat —
Package purpose: Package that scrapes the computer & accessories products in the best seller and most wished for categories. The data is uploaded to AWS S3 and AWS PostgresSQL RDS
Claimed homepage: https://github.com/Areeb297/Data-Collection-Pipeline.git
Matched naming pattern: areeb-amazon-scraper
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1569
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 633 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'areeb-amazon-scraper' matches AI hallucination template [areeb] + [amazon] + [scraper].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1558 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 1 file(s), 633 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1577d 0 76 ↑0.0/day
SUSPICIOUS
google pypi 0.1 — —
Package purpose: Google integration providing search utility for Ask
Claimed homepage: https://pypi.org/project/ask-google-search/
Matched naming pattern: ask-google-search
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1577
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 76 lines, 2.9 kB across 7 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'ask-google-search' matches AI hallucination template [ask] + [google] + [search].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1566 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1583d 36 75 ↑0.0/day
SUSPICIOUS
google pypi 0.1.1 Manuel Castillo manucalop@gmail.com gmail.com
Package purpose: Google integration providing secretmanager utility for Cloudops
Claimed homepage: https://pypi.org/project/cloudops-google-secretmanager/
Matched naming pattern: cloudops-google-secretmanager
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1583
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 36/month, 18/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 75 lines, 2.9 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'cloudops-google-secretmanager' matches AI hallucination template [cloudops] + [google] + [secretmanager].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'manucalop@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1576 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1583d 13 39 ↑0.0/day
SUSPICIOUS
google pypi 0.1.0 Manuel Castillo manucalop@gmail.com gmail.com
Package purpose: Google integration providing cloudops utility for Python
Claimed homepage: https://pypi.org/project/cloudops-google/
Matched naming pattern: python-google-cloudops
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1583
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 39 lines, 1.3 kB across 6 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'cloudops-google' matches AI hallucination template [python] + [google] + [cloudops].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'manucalop@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1572 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1604d 10 103 ↑0.0/day
SUSPICIOUS
polygon pypi 0.0.1 Jung Gyu Yoon yjg30737@gmail.com gmail.com
Package purpose: PyQt polygon window
Claimed homepage: https://github.com/yjg30737/pyqt-polygon-window.git
Matched naming pattern: pyqt-polygon-window
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1604
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 103 lines, 4.6 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'pyqt-polygon-window' matches AI hallucination template [pyqt] + [polygon] + [window].
  • HIGHClaims critical enterprise brand identity ('POLYGON').
  • HIGHPublisher email 'yjg30737@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1593 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1615d 12 63 ↑0.0/day
SUSPICIOUS
web3 pypi 0.0.2 Powei Lin poweilin1994@gmail.com gmail.com
Package purpose: Useful web3 abi
Claimed homepage: https://github.com/powei-lin/web3-abi
Matched naming pattern: python-web3-abi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1615
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 63 lines, 2.5 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'web3-abi' matches AI hallucination template [python] + [web3] + [abi].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'poweilin1994@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1604 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1628d 7 76 ↑0.0/day
SUSPICIOUS
eth pypi 0.2.3 vonum vonum.mk@gmail.com gmail.com
Package purpose: # eth-blocky [![Build Status](https://vonum.semaphoreci.com/badges/eth-blocky.svg)](https://vonum.semaphoreci.com/projects/eth-blocky) [![PyPI version](https://badge.fury.io/py/eth-blocky.svg)](https://badge.fury.io/py/eth-blocky) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)
Claimed homepage: https://pypi.org/project/eth-blocky/
Matched naming pattern: python-eth-blocky
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1628
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 76 lines, 4.0 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'eth-blocky' matches AI hallucination template [python] + [eth] + [blocky].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'vonum.mk@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1617 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1633d 0 64 ↑0.0/day
SUSPICIOUS
web3 pypi 0.0.6 Powei Lin poweilin1994@gmail.com gmail.com
Package purpose: Useful web3 constant
Claimed homepage: https://github.com/powei-lin/web3-constant
Matched naming pattern: python-web3-constant
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1633
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 64 lines, 3.1 kB across 12 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'web3-constant' matches AI hallucination template [python] + [web3] + [constant].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'poweilin1994@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1622 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1689d 9 0 ↑0.0/day
Possible Squatted Stub
eth pypi 0.0.1 Kalinin Mitko kalinin.mitko@gmail.com gmail.com
Package purpose: Extension for Django REST framework error display
Claimed homepage: https://github.com/null-none/django-eth-fields
Matched naming pattern: django-eth-fields
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1689
Registry downloads: 9/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 12 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'django-eth-fields' matches AI hallucination template [django] + [eth] + [fields].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • HIGHPublisher email 'kalinin.mitko@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1678 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 12 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1689d 35 40 ↑0.0/day
SUSPICIOUS
web3 npm 0.4.0 Magma Collective info@magmacollective —
Package purpose: Contracts for dark-crystal-web3, for storing and retrieving shares
Matched naming pattern: dark-web3-web3
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1689
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 35/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 40 lines, 966 Bytes across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'dark-crystal-web3-contracts' matches AI hallucination template [dark] + [web3] + [web3].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • HIGHPublisher email 'info@magmacollective' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1663 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1690d 56 75 ↑0.0/day
SUSPICIOUS
google npm 1.1.6 Thomas Büchi Sagredo thombuchi@gmail.com gmail.com
Package purpose: A simple plugin to add Google Cloud Storage support for Ghost Blog
Matched naming pattern: node-google-bluedot-google-cloud-storage
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1690
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 56/month, 14/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 75 lines, 2.7 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@withbluedot/bluedot-google-cloud-storage' matches AI hallucination template [node] + [google] + [bluedot-google-cloud-storage].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'thombuchi@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1664 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 1703d 7 124 ↑0.0/day
SUSPICIOUS
auth0 pypi 0.1.0 dem4ply dem4ply@gmail.com gmail.com
Package purpose: chibi lib for use auth0 api
Claimed homepage: https://github.com/dem4ply/chibi_auth0
Matched naming pattern: python-auth0-chibi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1703
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 7/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 124 lines, 4.7 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'chibi-auth0' matches AI hallucination template [python] + [auth0] + [chibi].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • HIGHPublisher email 'dem4ply@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1697 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1707d 13 3 ↑0.0/day
Possible Squatted Stub
binance pypi 0.0.1 me me@me.com me.com
Package purpose: This is a placeholder package created by registerit.
Claimed homepage: http://www.github.com
Matched naming pattern: python-binance-tradingbot
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1707
Registry downloads: 13/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3 lines, 276 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'binance-tradingbot' matches AI hallucination template [python] + [binance] + [tradingbot].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'me@me.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1697 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (3 LOC, 2 file(s), 276 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1707d 18 3 ↑0.0/day
Possible Squatted Stub
binance pypi 0.0.1 me me@me.com me.com
Package purpose: This is a placeholder package created by registerit.
Claimed homepage: http://www.github.com
Matched naming pattern: python-binance-miningbot
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1707
Registry downloads: 18/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3 lines, 274 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'binance-miningbot' matches AI hallucination template [python] + [binance] + [miningbot].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'me@me.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1696 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (3 LOC, 2 file(s), 274 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1707d 0 3 ↑0.0/day
Possible Squatted Stub
binance pypi 0.0.1 me me@me.com me.com
Package purpose: This is a placeholder package created by registerit.
Claimed homepage: http://www.github.com
Matched naming pattern: python-binance-backtesting
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1707
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3 lines, 292 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'python-binance-backtesting' matches AI hallucination template [python] + [binance] + [backtesting].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'me@me.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1696 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (3 LOC, 2 file(s), 292 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1707d 11 3 ↑0.0/day
Possible Squatted Stub
binance pypi 0.0.1 me me@me.com me.com
Package purpose: This is a placeholder package created by registerit.
Claimed homepage: http://www.github.com
Matched naming pattern: python-binance-miningbot
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1707
Registry downloads: 11/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3 lines, 288 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'python-binance-miningbot' matches AI hallucination template [python] + [binance] + [miningbot].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'me@me.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1696 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (3 LOC, 2 file(s), 288 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1707d 8 3 ↑0.0/day
Possible Squatted Stub
binance pypi 0.0.1 me me@me.com me.com
Package purpose: This is a placeholder package created by registerit.
Claimed homepage: http://www.github.com
Matched naming pattern: python-binance-tradingbot
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1707
Registry downloads: 8/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3 lines, 290 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'python-binance-tradingbot' matches AI hallucination template [python] + [binance] + [tradingbot].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • HIGHPublisher email 'me@me.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1696 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (3 LOC, 2 file(s), 290 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 1947d — — —
Unverified Signal
— npm latest Itential — 🪝
Package purpose: This adapter integrates with system described as: okta.
Static code signals:
  • LIFECYCLE_SCRIPT: 'preinstall' -> 'node utils/setup.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/adapterBase.js:15 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/adapterBase.js:45 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/adapterBase.js:171

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 2104d — — —
Unverified Signal
— npm latest Microsoft Corporation — 🪝
Package purpose: Common Lib for MSDeploy Utility
Static code signals:
  • BUNDLED_NATIVE_BINARY: Unexpected compiled binary 'package/MSDeploy/M229/MSDeploy3.6/msdeploy.exe' in npm tarball
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/deployusingmsdeploy.js:38 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/msdeployutility.js:25
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/xdttransformationutility.js:143

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
65 2271d — — —
Unverified Signal
— npm latest Amazon Web Services — 🪝 🌐
Package purpose: Amazon IVS Player Web SDK
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/assets/amazon-ivs-wasmworker.min.js:2 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/assets/amazon-ivs-wasmworker.min.js:2 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/assets/amazon-ivs-wasmworker.min.js:2 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD