Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 60 | 4d | — | — | — |
Unverified Signal
|
— | npm | latest | FiredMosquito831 | — | 🪝 🌐 | |
|
Package purpose: Zero-config-friendly desktop-grade tool for viewing, understanding, and safely editing GSD (open-gsd/gsd-core) configuration files.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 4d | — | — | — |
Unverified Signal
|
— | npm | latest | shivesh | — | 🪝 🌐 | |
|
Package purpose: MCP server for Backend Builder — lets AI agents design, build, test, and manage backend APIs using natural language
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 4d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Install Markdown skills for AI agents from ecomdly.com into your project.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 4d | — | — | — |
Unverified Signal
|
— | npm | latest | Zanora | — | 🪝 🌐 | |
|
Package purpose: Shared domain types for Zanora: Money (integer minor units), the x402 event catalogue, and ed25519 signing helpers.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 4d | — | — | — |
Unverified Signal
|
— | npm | latest | Zanora | — | 🪝 🌐 | |
|
Package purpose: Agent-side Zanora SDK: discover capabilities, pay x402 challenges from an agent wallet, and verify signed receipts.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 4d | — | — | — |
Unverified Signal
|
— | npm | latest | Zanora | — | 🪝 🌐 | |
|
Package purpose: Provider-side x402 middleware for Express — one line makes an endpoint paid, with no billing code.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 4d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Envi is an env manager for TypeScript projects. A project defines its env in a typed `envi.config.ts`. Envi resolves the config once from a secret provider, caches the result, and injects the values into a runtime. 1Password is the only provider for now.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | PalionTech / Maximilian Bertram | — | 🪝 🌐 | |
|
Package purpose: Package manager for agent resources: skills, agents, instructions, commands, hooks, MCP servers and plugins, installed into Claude Code, Codex, GitHub Copilot, Cursor, Gemini CLI and OpenCode.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | keenskills | — | 🪝 | |
|
Package purpose: Professional, print-ready architecture diagrams (Azure, AWS, GCP, network topology) as editable draw.io files plus PNG and PDF. Installs itself as a skill for Claude Code, Codex, Gemini CLI, Cursor, Windsurf, Cline and Copilot.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Promise-based SSDB client
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Connect any agent harness to a Marginalia library through Marginalia Relay, end-to-end encrypted
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: See what your AI coding agent loads into context before you type, and switch off what you pick. Claude Code, Codex, Kiro. Local, no account.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: External provider clients shared by the Avakado services. OAuth, API-key, and basic-auth adapters for WhatsApp, Google, Microsoft, and the rest.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Generated TypeScript client for the Filament API
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Accept x402 payments from users on other chains. Non-custodial escrow settlement with Hedera Consensus Service as the clearing ledger.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | mfahelper | — | 🪝 🌐 | |
|
Package purpose: security holding package
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Rava Reviews components for Shopify Hydrogen and React storefronts
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | Eleaus Hossain Evan | — | 🪝 | |
|
Package purpose: Sync the global rules and skills of every AI coding agent (Claude Code, Cursor, Codex, Gemini, OpenCode, Windsurf, Copilot…) between Macs through Dropbox.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The orlan command: connect Claude Code, Codex, Cursor or OpenCode to Orlan with a token and skills, and work with its topics, files and comments from the terminal.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 5d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Babtab local relay: auth, pairing, WSS routing, Streamable HTTP MCP for the Babtab Chrome extension. No DOM, no grounding, no page storage.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: NodeTool image nodes — sharp-based + WebGPU shader pool (image, lib-image-*, lib-shader-utils, lib-grid)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP stdio and Streamable HTTP server for the Coragentic API
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Composable React UI and full Mermaid visual editor SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Publish HTML pages to The Artifact from the command line and CI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Production-grade reliability and security control plane for AI agents.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Anatoly Ben | — | 🪝 🌐 | |
|
Package purpose: A local test server for the Telegram Bot API, for testing bots: members, restrictions, join requests, invite links, multiple bots, channels, polls, business chats, Telegram Login, webhooks and callback buttons
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Rove Code CLI executable for darwin-arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Rove Code CLI executable for linux-arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Rove Code CLI executable for linux-x64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local OpenRouter twin — a faithful, stateful local OpenRouter API your OpenAI-compatible SDK talks to unmodified. Chat completions and streaming return deterministic labeled stubs, generation stats and key/credits/model surfaces are local. Built on @volte
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: The tunnel twin (Protocol 3).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local Veriff identity-verification twin — a faithful, stateful local stationapi.veriff.com/v1 your KYC integration talks to unmodified: sessions, the decision lifecycle, HMAC-signed decision/event webhooks, attempts, media and watchlist screening. Built o
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Volter | — | 🪝 🌐 | |
|
Package purpose: Local X (Twitter) identity twin — the real x.com authorize screen, the full OAuth 2.0 authorization-code + PKCE round trip (token, refresh, revoke), and GET /2/users/me with X's real field/expansion/problem envelopes, so an unmodified X client completes s
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Francois Chastel | — | 🪝 🌐 | |
|
Package purpose: Route each coding-agent turn to the cheapest model that can finish it. Switchyard-style execution signals, TypeSafe's jev as the judge, and honest cost accounting. Works with Claude Code, Codex, OpenCode, and Pi.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: High-level TypeScript SDK for AWS Lambda MicroVMs - sandboxes, exec, auth tokens, lifecycle
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Agentar (agent + avatar): give your AI agent a body with a customizable 3D talking avatar for Claude Code, Codex, and other agent harnesses.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The machine client of clankercreds: fetches a bundle of credentials and places each where its tool expects it.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Load, edit, manage and hot-reload trusted JavaScript and TypeScript userscripts in DeepSeek Harness.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | ice5kysl | — | 🪝 🌐 | |
|
Package purpose: dsh (DeepSeek Harness) taskboard kit: one local task board per workspace. Agents create/claim/progress tasks with model tools; humans watch and drive the same board in a kanban tab — a single JSON file in the workspace is the only source of truth, no serv
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Animastor URL Safety — the SSRF guard of the Animastor backend, physically extracted from the host: public-endpoint assertion (http/https only, literal loopback/private/link-local/metadata IPv4+IPv6 incl. decimal/octal/hex alternative forms and IPv4-mappe
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 6d | — | — | — |
Unverified Signal
|
— | npm | latest | Tanvir Ahmed | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Official KnoxCall API client for Node.js and TypeScript
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Tuguldur Munkhbat | — | 🪝 🌐 | |
|
Package purpose: Sync Claude Code conversation history between your computers through one private git repo. Exit on one PC, `claude --resume` on another.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Eidon | — | 🪝 🌐 | |
|
Package purpose: Read-only x402 payment challenge inspector: parses HTTP 402 payment documents (scheme, network, asset, amount, payTo) and records response evidence
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Tom Hundley | — | 🪝 | |
|
Package purpose: Distributed task scheduler and rate limiter
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Set up Boundless as the inference provider for your coding harness. Run: npx -y @boundless.md/setup@latest
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Client-side Solid 2 with Bun: compiler, HMR, workers, source maps and bun:test.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | Victor Castro | — | 🪝 | |
|
Package purpose: Your English coach for AI prompts. One command. Every agent. Always on.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Native multi-account OAuth adapters for ChatGPT and Google Antigravity
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 60 | 7d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 여러 Claude Code·Codex 세션의 승인 요청을 한 자리에서 처리하는 로컬 대기함. 훅 계약만 사용하며 판단은 사용자 정책이 갖는다.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||