Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 55 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Yonglitong Badatong (八达通) ERP special-price inquiry MCP — create/query customerInquiry
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 12d | — | — | — |
Unverified Signal
|
— | npm | latest | VirWave OAM, Inc | — | 🪝 | |
|
Package purpose: Calm, animated breathing sessions from the VirWave app, as an MCP server. Runs on your computer and collects nothing.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Shared Ingestron project compiler, operations and editor schemas
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 13d | — | — | — |
SUSPICIOUS
|
— | pypi | 1.1.0 | YJGR, DNS-AID Contributors | — | 🪝 | |
|
Package purpose: YJGR Agent DNS MCP server: DNS-based agent discovery with working Bearer / OAuth2 / MCP-spec OAuth authentication. Fork of dns-aid-core.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Quick Image Agent Plugin for supported AI agent hosts
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 13d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Focus code review on complexity changes after each coding task.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 13d | — | — | — |
Unverified Signal
|
— | pypi | 0.2.9 | Serkan Korkut | — | 🪝 | |
|
Package purpose: Local token usage, cost and limits dashboard for Claude Code, Codex and GitHub Copilot CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 15d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Prisma database schema and client for s-private project
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 15d | — | — | — |
Unverified Signal
|
— | pypi | 0.10.1 | — | — | 🪝 | |
|
Package purpose: Human-in-the-loop evaluation engine for Databricks Genie agents: harvest, sync, grade, review.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 16d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: CmdCtrl daemon for Claude Code - connects your workstation to the CmdCtrl orchestration server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 16d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 16d | — | — | — |
Unverified Signal
|
— | pypi | 0.5.0 | Kyle James Walker | — | 🪝 | |
|
Package purpose: Require SME review of load-bearing code by pinning a review gate to an AST node
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 16d | — | — | — |
Unverified Signal
|
— | npm | latest | ihen404 | — | 🪝 | |
|
Package purpose: Autonomous x402 web scraper tool for AI agents with automatic Base mainnet USDC micro-settlement
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 17d | — | — | — |
Unverified Signal
|
— | pypi | 0.1.7 | — | — | 🪝 | |
|
Package purpose: Shared maintenance and validation for research software repositories
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 17d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Installer that scaffolds the Commerce Business Configuration App Builder app (actions, web-src, config) into a project without overwriting existing files.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 17d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: ClawBench — AI Workbench, United Across Devices. Go backend + Vue3 frontend, runs on PC, Android, and Termux
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 18d | — | — | — |
Unverified Signal
|
— | npm | latest | astrosheep | — | 🪝 | |
|
Package purpose: A shared public square where agents join, catch activity, express, and step out when done.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 18d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 19d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Vaultwarden/Bitwarden MCP server backed by Bitwarden CLI (bw).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 20d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: prototype - simple demo built from Stencil & Tailwind
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 20d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Stencil Component Starter
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 20d | — | — | — |
Unverified Signal
|
— | pypi | 0.13.0 | — | — | 🪝 | |
|
Package purpose: The Silent Observer — Open-source Python security scanner for dependencies, secrets & insecure code
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 22d | — | — | — |
Unverified Signal
|
— | pypi | 1.5 | — | — | 🪝 | |
|
Package purpose: External Attack Surface Management (EASM) scanner for authorized audits
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 22d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | backnotprop | — | 🪝 | |
|
Package purpose: Plannotator plugin for OpenCode - interactive plan review with visual annotation
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 25d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: MiXCR software dependency for Platforma Backend
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 26d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: This package provides configuration and code for common chain operations such as contract deployment etc.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 26d | — | — | — |
Unverified Signal
|
— | pypi | 2.5.8 | — | — | 🪝 | |
|
Package purpose: Deterministic, read-only repository evidence for coding agents and automation
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 28d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: CamStack shared-memory frame ring — cross-platform N-API segment mapping + seqlock ring
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 28d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Stencil Component Starter
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Code review tool for DeepSeek Harness: integrates ESLint, Prettier and heuristic checks to produce structured review reports with fix suggestions.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | Agoric | — | 🪝 | |
|
Package purpose: Snapshotting VM worker based on Moddable's XS Javascript engine
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Stencil Component Starter
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 33d | — | — | — |
Unverified Signal
|
— | npm | latest | Graphy | — | 🪝 | |
|
Package purpose: Grammar-of-graphics engine for Graphy charts
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 34d | — | — | — |
Unverified Signal
|
— | npm | latest | Rebase | — | 🪝 | |
|
Package purpose: PostgreSQL data source backend implementation for Rebase with Drizzle ORM
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 50d | — | — | — |
Unverified Signal
|
— | npm | latest | mofeng2223 | — | 🪝 | |
|
Package purpose: Custom Claude provider support for DeepSeek Harness 0.2.1-alpha.1
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 76d | — | — | — |
Unverified Signal
|
— | npm | latest | chem | — | 🪝 | |
|
Package purpose: The convenience of your Claude subscription in Pi, with the fewest possible surprises. Uses Claude Code's CLI under the hood. Mothballed after 0.6.0.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 79d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: One-step installer for the TLS Observer Cursor plugin.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 132d | 7 | 5 | ↑0.1/day |
Possible Squatted Stub
|
aave | npm | 0.0.0 | — | — | ||
|
Package purpose: Aave integration providing lending utility for Wdk
Matched naming pattern: wdk-aave-lending
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 132
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 58 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 138d | 39 | 5 | ↑0.3/day |
Possible Squatted Stub
|
openai | npm | 0.0.0 | — | — | ||
|
Package purpose: Placeholder package.
Matched naming pattern: node-openai-adapter-openai-agents
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 138
Registry downloads: 39/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 182 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 146d | 9 | 5 | ↑0.1/day |
Possible Squatted Stub
|
claude | npm | 0.0.0 | — | — | ||
|
Package purpose: Claude integration providing pi utility for Node
Matched naming pattern: node-claude-pi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 146
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 68 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 163d | — | — | — |
Unverified Signal
|
— | pypi | 0.5.1 | — | — | 🪝 | |
|
Package purpose: Tooling for running AI coding agents in CI/CD environments
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 166d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Claude Code integration for @nfinitmonkeys/clan — drops mode-aware skill + slash commands into .claude/ so Claude Code becomes clan-aware
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 174d | — | — | — |
Unverified Signal
|
— | pypi | 0.9.29 | Zach Vorhies | — | 🪝 | |
|
Package purpose: Instant tools. Instant builds. One command.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 55 | 176d | 16 | 5 | ↑0.1/day |
Possible Squatted Stub
|
claude | npm | 0.0.0 | — | — | ||
|
Package purpose: Claude integration providing e2b utility for Node
Matched naming pattern: node-claude-e2b
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 176
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 49 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 176d | 11 | 5 | ↑0.1/day |
Possible Squatted Stub
|
claude | npm | 0.0.0 | — | — | ||
|
Package purpose: Claude integration providing e2b utility for Node
Matched naming pattern: node-claude-e2b
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 176
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 49 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 189d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Base SFDX project template
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 193d | 12 | 5 | ↑0.1/day |
Possible Squatted Stub
|
copilot | npm | 0.1.0 | — | — | ||
|
Package purpose: Copilot integration providing agent utility for Node
Matched naming pattern: node-copilot-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 193
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 89 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 55 | 198d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||