Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 12d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: HAAI — High Availability AI: streaming reverse proxy for OpenAI-compatible LLMs with admin UI, CLI, and MCP server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | SpringBrand | — | 🪝 🌐 | |
|
Package purpose: SpringBrand CLI — connect MCP hosts to the SpringBrand Gateway
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | cudoment | — | 🪝 | |
|
Package purpose: Export cudoc documentation as a standalone HTML site, PDF and Word from one collection
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: DeepSeek Harness (dsh) for LoongArch64 — one-command npm install, carrying the native pieces upstream never published for linux-loong64: a source-built libvips 8.19.0, a source-built sharp, and the missing node-addon-system platform package.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Fork of @agegr/pi-web: local web UI for the pi coding agent with split-pane chat and background task panels
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: 9Router CLI - Start and manage 9Router server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | weisheng.luo | weisheng.luo | 🪝 🌐 | |
|
Package purpose: BlueAI atomic capabilities CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Web UI for the oh-my-pi (omp) coding agent
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 12d | — | — | — |
Very Risky
|
— | npm | latest | Anjingyeong | — | 🪝 🌐 | |
|
Package purpose: JK local MCP coding runtime with project-scoped safety, persistent work sessions, Git, E2E, and optional remote executors.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 15d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: 9Router CLI - Start and manage 9Router server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 15d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Unified AI router with 377 providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs. RedRouter fork of OmniRoute (MIT, diegosouzapw/OmniRoute).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 17d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Damon agent core — local multi-provider agent daemon
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 18d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Jacek Dąbrowski | — | 🪝 🌐 | |
|
Package purpose: Synerise base-context: a coding and research agent with durable context and a persistent Python REPL
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Automated documentation toolchain for building client side documentation from figma
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | DeepPulse | — | 🪝 🌐 | |
|
Package purpose: Cut the tokens Claude Code and Codex spend: routes simple work to cheaper models, converts documents to compact Markdown, and shows spend and savings live. Ratchet rules and Korean writing checks included.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 20d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: AFRouter CLI - Start and manage AFRouter server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | NiceHello666 | — | 🪝 🌐 | |
|
Package purpose: hncode — A cyan-blue TUI AI coding agent with zero runtime dependencies.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | bluesliu | — | 🪝 🌐 | |
|
Package purpose: Unified CLI — package management (npm/pip/dnf/apt) + config view + opencode maintenance
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 20d | 2,921 | 25,247 | ↑146.1/day |
Very Risky
|
devstationlabs | npm | 0.1.0 | — | — | 🪝 🌐 | |
|
Package purpose: The DevStation coding agent, in your terminal.
Claimed homepage: https://devstation.online
Matched naming pattern: node-devstationlabs-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 20
Registry downloads: 2921/month, 730/week (ACTIVE_COMMUNITY_USE)
Codebase size: 25247 lines, 914.8 kB across 4 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Shared Rust browser service with MCP and CLI clients and a Node execution adapter for Ugot CEF, Chrome extension and explicit CDP sessions.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A policy-gated Pi supervisor for observing and verifying Claude Code workers.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 21d | — | — | — |
Unverified Signal
|
— | npm | latest | Prompt One, Inc. | — | 🪝 🌐 | |
|
Package purpose: Agent CLI Framework: command-line tools for AI agents, one grammar and canonical names across every SaaS provider
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 22d | — | — | — |
SUSPICIOUS
|
— | npm | latest | CloudCLI UI Contributors | — | 🪝 🌐 | |
|
Package purpose: Plateforme IA pour juristes français
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 22d | — | — | — |
SUSPICIOUS
|
— | pypi | 0.5.7 | liming | — | 🪝 | |
|
Package purpose: kisama agent for python
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 100 | 22d | — | — | — |
Unverified Signal
|
— | npm | latest | JAPofc | — | 🪝 🌐 | |
|
Package purpose: Feature-rich WhatsApp Multi-Device library for Node.js — interactive messages, native flows, polls, newsletters, VoIP, mini-apps and everyday bot utilities.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 23d | — | — | — |
SUSPICIOUS
|
— | npm | latest | yctimlin | — | 🪝 🌐 | |
|
Package purpose: Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Generic agent<->model plaintext capture proxy for CANNBot-Insight
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 24d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 26d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: TianShu agent: runs a Claude Code session on your machine and bridges it to a TianShu control plane. This package downloads the compiled binary for your platform.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 26d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Local, fast task-and-memory layer for coding agents: task queue, oplog of decisions, hybrid search. Requires Bun.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 27d | — | — | — |
SUSPICIOUS
|
— | pypi | 0.3.2 | Tangible.finance | tangible.finance | 🪝 | |
|
Package purpose: Stack-colocated, secretless-by-default, laptop-local isolated dev environment
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 100 | 27d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Structural code intelligence & call-graph engine for C# and .NET — built for AI coding agents under hard token budgets
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 27d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: 9Router CLI - Start and manage 9Router server (AnggaR96s fork)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 28d | — | — | — |
Unverified Signal
|
— | npm | latest | bluesliu | — | 🪝 | |
|
Package purpose: SOCKS5 proxy manager (client SSH tunnel / server remote), CLI + web UI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 28d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Record a browser workflow, replay it, and capture the Supabase / Vercel / Railway logs your backend produced.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 28d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Mac daemon — Conductor core: worktrees + headless Claude Code sessions behind a multiplexed WSS protocol.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 29d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: is it ready to use ?
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 30d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Zero-config observability SDK for [RELIA](https://github.com/relia-platform). Instruments Node.js services, browser sessions, and AI agents with a single CLI command.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 31d | — | — | — |
SUSPICIOUS
|
— | npm | latest | WindCli contributors | — | 🪝 🌐 | |
|
Package purpose: A local-first web interface for AI coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 31d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AgentWorkShop 软件开发系统 - 基于 Nuxt 4 的配置驱动运行范式
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 31d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Extensible virtual shell with pluggable filesystems and streaming commands
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 31d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Budgeted JavaScript interpreter with explicit host capabilities and resumable execution
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 32d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: 9Router CLI - Start and manage 9Router server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 32d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Gaoding command-line interface for agents and people.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 33d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Tracked Oh My Pi extension for Envoy messaging. It shares the Envoy HTTP client, tool contract, envelope parsing, and subject helpers with the other Legion adapters while keeping OMP's direct NATS subscriptions and Pi steering delivery local (inbound mess
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 34d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: 10Router CLI - Start and manage 10Router server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||