FlagThis | Sentinel Threat Feed

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference

Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.

Package	Score ▼	Age	Users	Lines	Growth	Verdict	Targeted	Ecosystem	Version	Author	Email domain	Signals
	55	189d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝
Package purpose: Base SFDX project template Static code signals: MISSING_SOURCE_REPOSITORY_URL SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/org-setup-dev.mjs:100 (+1 more occurrence(s) elsewhere) SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/org-setup-utils.mjs:368 (+2 more occurrence(s) elsewhere) Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	193d	12	5	↑0.1/day	Possible Squatted Stub	copilot	npm	0.1.0	—	—
Package purpose: Copilot integration providing agent utility for Node Matched naming pattern: node-copilot-agent Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 193 Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 5 lines, 89 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: MEDIUMPackage name 'agent-copilot' matches AI hallucination template [node] + [copilot] + [agent]. HIGHClaims critical enterprise brand identity ('COPILOT'). INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk. MEDIUMPackage has empty or near-zero description (potential reservation stub). HIGHPackage registered recently (167 days ago) during the active AI hallucination slopsquatting wave. HIGHMISSING_SOURCE_REPOSITORY_URL MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 89 bytes). INFOPackage affiliated with trusted vendor 'copilot' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (110 -> 55) to reduce false positives while retaining hijack/takeover detection. Static code signals: MISSING_SOURCE_REPOSITORY_URL Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	198d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:55 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:55 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:55 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	204d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	249d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:40 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:40 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:40 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	326d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Package purpose: Solana blockchain adapter powered by @solana/kit Static code signals: MISSING_SOURCE_REPOSITORY_URL SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/index.cjs:8158 (+3 more occurrence(s) elsewhere) SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.cjs:11026 (+3 more occurrence(s) elsewhere) SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/index.cjs:12483 (+5 more occurrence(s) elsewhere) SOURCE_CODE_ENV_VARS_ACCESS: 'Sensitive Token Harvesting' found in package/index.cjs:12483 (+1 more occurrence(s) elsewhere) Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	354d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:49 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:5 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:4 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:4 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:49 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	403d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:3 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:3 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:1 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	403d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Package purpose: Solana blockchain adapter powered by @solana/web3.js Static code signals: MISSING_SOURCE_REPOSITORY_URL SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/index.cjs:8011 (+3 more occurrence(s) elsewhere) SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/index.cjs:10894 (+3 more occurrence(s) elsewhere) SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/index.cjs:12351 (+5 more occurrence(s) elsewhere) SOURCE_CODE_ENV_VARS_ACCESS: 'Sensitive Token Harvesting' found in package/index.cjs:12351 (+1 more occurrence(s) elsewhere) Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	418d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:44 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:5 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:5 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:44 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	427d	20	0	↑0.0/day	Possible Squatted Stub	langgraph	pypi	0.1.0	— af.alquwayfili@gmail.com	gmail.com
Package purpose: Open-source alternative to langgraph-runtime-inmem Claimed homepage: https://pypi.org/project/langgraph-runtime-inmem-open/ Matched naming pattern: langgraph-langgraph-inmem Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 427 Registry downloads: 20/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 0 lines, 0 Bytes across 10 files (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('LANGGRAPH'). HIGHPublisher email 'af.alquwayfili@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (0 LOC, 10 file(s), 0 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	430d	18	10	↑0.0/day	Possible Squatted Stub	aws	pypi	0.0.2	— monicamengni@gmail.com	gmail.com
Package purpose: A serverless German vocabulary app that picks a fresh word each day, gets Generative AI to write example sentences, and emails it to subscribers. Claimed homepage: https://pypi.org/project/aws-wort-des-tages/ Matched naming pattern: aws-aws-des Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 430 Registry downloads: 18/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 10 lines, 550 Bytes across 2 files (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('AWS'). HIGHPublisher email 'monicamengni@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 550 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	432d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	445d	38	2	↑0.1/day	Possible Squatted Stub	claude	pypi	0.0.1	— claude-code-hooks@iainmaitland.com	iainmaitland.com
Package purpose: A package for claude-code hooks Claimed homepage: https://pypi.org/project/claude-code-hooks/ Matched naming pattern: claude-claude-hooks Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 445 Registry downloads: 38/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 2 lines, 80 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('CLAUDE'). HIGHPublisher email 'claude-code-hooks@iainmaitland.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 80 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	445d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/src/index.js:43 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	451d	—	—	—	Unverified Signal	—	npm	latest	calladodan	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	477d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:44 SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/src/index.js:59 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:5 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:5 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:44 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	493d	—	—	—	Unverified Signal	—	pypi	0.10.9	—	—	🪝
Package purpose: The GSC 'Intel Engine' for the evolving search landscape. Authoritative visibility governance and AI overview citation analysis via Model Context Protocol. Static code signals: SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in google_search_console_mcp-0.10.9/gsc_mcp_server.py:32 ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in google_search_console_mcp-0.10.9/gsc_mcp_server.py:457 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in google_search_console_mcp-0.10.9/gsc_setup_flow.py:104 SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in google_search_console_mcp-0.10.9/gsc_telemetry.py:206 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in google_search_console_mcp-0.10.9/gsc_telemetry.py:27 ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in google_search_console_mcp-0.10.9/gsc_telemetry.py:221 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in google_search_console_mcp-0.10.9/run_queries.py:7 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	526d	31	2	↑0.1/day	Possible Squatted Stub	gemini	pypi	1.1	SoftwareApkDev softwareapkdev2022@gmail.com	gmail.com
Package purpose: This package contains implementation of Geometry Wars game with Google Gemini AI integrated into it. Claimed homepage: https://github.com/SoftwareApkDev/gemini_geometry_wars Matched naming pattern: gemini-gemini-wars Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 526 Registry downloads: 31/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 2 lines, 37 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('GEMINI'). HIGHPublisher email 'softwareapkdev2022@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 37 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	528d	59	2	↑0.1/day	Possible Squatted Stub	gemini	pypi	1.12	SoftwareApkDev softwareapkdev2022@gmail.com	gmail.com
Package purpose: This package contains implementation of an app store used to download any applications integrated with Google Gemini AI. Claimed homepage: https://github.com/SoftwareApkDev/gemini_ai_app_store Matched naming pattern: gemini-gemini-app Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 528 Registry downloads: 59/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 2 lines, 37 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('GEMINI'). HIGHPublisher email 'softwareapkdev2022@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 37 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	528d	31	2	↑0.1/day	Possible Squatted Stub	gemini	pypi	1.3	SoftwareApkDev softwareapkdev2022@gmail.com	gmail.com
Package purpose: This package contains implementation of an application where the user can chat with Google Gemini AI. Claimed homepage: https://github.com/SoftwareApkDev/gemini_chat_app Matched naming pattern: gemini-gemini-app Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 528 Registry downloads: 31/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 2 lines, 37 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('GEMINI'). HIGHPublisher email 'softwareapkdev2022@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 37 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	551d	10	0	↑0.0/day	Possible Squatted Stub	aws	pypi	0.1.1	Vedant Chavan cvedant136@gmail.com	gmail.com
Package purpose: A helper library for AWS services like SNS, SQS, Lambda, DynamoDB, and S3 Claimed homepage: https://github.com/yourusername/aws-services Matched naming pattern: aws-aws-services Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 551 Registry downloads: 10/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 0 lines, 0 Bytes across 4 files (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('AWS'). HIGHPublisher email 'cvedant136@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (0 LOC, 4 file(s), 0 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	560d	33	22	↑0.1/day	Possible Squatted Stub	google	pypi	0.6	Sai Kiran Kyama saikiran41101@gmail.com	gmail.com
Package purpose: A Python package for Google Drive integration Claimed homepage: https://pypi.org/project/google-drive-connector/ Matched naming pattern: google-google-connector Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 560 Registry downloads: 33/month, 11/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 22 lines, 665 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('GOOGLE'). HIGHPublisher email 'saikiran41101@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (22 LOC, 1 file(s), 665 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	607d	11	20	↑0.0/day	Possible Squatted Stub	circle	pypi	0.1.0	Your Name your.email@example.com	example.com
Package purpose: A simple package to calculate circle area. Claimed homepage: https://github.com/yourusername/circle_area Matched naming pattern: circle-circle-opamv1 Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 607 Registry downloads: 11/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 20 lines, 983 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('CIRCLE'). HIGHPublisher email 'your.email@example.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (20 LOC, 1 file(s), 983 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	622d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	685d	11	0	↑0.0/day	Possible Squatted Stub	llama	pypi	0.2.0	shloimy wiesel w63071@gmail.com	gmail.com
Package purpose: A streamlined collection of essential LlamaIndex packages for lightweight and efficient usage. Claimed homepage: https://pypi.org/project/llama-index-collection/ Matched naming pattern: llama-llama-collection Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 685 Registry downloads: 11/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 0 lines, 0 Bytes across 2 files (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('LLAMA'). HIGHPublisher email 'w63071@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (0 LOC, 2 file(s), 0 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	695d	26	4	↑0.0/day	Possible Squatted Stub	uniswap	pypi	0.1.11	venus1004@proton.me venus1004@proton.me	proton.me
Package purpose: A Rust-based library to fetch and decode Uniswap V3 pool events, designed to be used as a Python module. Claimed homepage: https://github.com/analyzify360/uniswap-fetcher-rs Matched naming pattern: uniswap-uniswap-rs Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 695 Registry downloads: 26/month, 15/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 4 lines, 155 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('UNISWAP'). HIGHPublisher email 'venus1004@proton.me' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (4 LOC, 1 file(s), 155 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	697d	0	21	↑0.0/day	Possible Squatted Stub	llama	pypi	1.0.0	Aryan agarwalaryan139@gmail.com	gmail.com
Package purpose: A Python SDK for the Llama Chat API Claimed homepage: https://github.com/thearyanag/llama-chat-sdk Matched naming pattern: llama-llama-sdk Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 697 Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 21 lines, 658 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('LLAMA'). HIGHPublisher email 'agarwalaryan139@gmail.com' is not affiliated with official vendor domain. INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (21 LOC, 1 file(s), 658 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	758d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:43 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:43 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:43 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	765d	25	1	↑0.0/day	Possible Squatted Stub	amazon	pypi	0.0.0	—	—
Package purpose: # Amazon SageMaker HyperPod Amazon SageMaker Jupyter extension which provides HyperPod cluster discovery Claimed homepage: https://pypi.org/project/amazon-sagemaker-hyperpod/ Matched naming pattern: amazon-amazon-hyperpod Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 765 Registry downloads: 25/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 1 lines, 20 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('AMAZON'). HIGHPublisher email 'None' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 755 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (1 LOC, 1 file(s), 20 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	850d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	859d	75	11	↑0.1/day	Possible Squatted Stub	azure	pypi	0.0.0.1	—	—
Package purpose: # Security Holding Package This is a security holding package, a placeholder for a deleted package susceptible to hijacking. (The package is completely empty) For inquiries: [sec_reporting@service.jfrog.com](mailto:sec_reporting@service.jfrog.com) Claimed homepage: https://pypi.org/project/azure-iot-provisioning-device-client/ Matched naming pattern: azure-azure-provisioning Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 859 Registry downloads: 75/month, 21/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 11 lines, 426 Bytes across 2 files (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('AZURE'). HIGHPublisher email 'None' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 851 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 426 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	922d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:44 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:5 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:5 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:44 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	936d	8	11	↑0.0/day	Possible Squatted Stub	web3	pypi	0.1	rockroll zzzmengkai1234@gmail.com	gmail.com
Package purpose: web3-rockroll-package Claimed homepage: https://github.com/zzzmengkai123/web3-rockroll-package.git Matched naming pattern: web3-web3-package Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 936 Registry downloads: 8/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 11 lines, 353 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('WEB3'). HIGHPublisher email 'zzzmengkai1234@gmail.com' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 924 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (11 LOC, 1 file(s), 353 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	979d	25	24	↑0.0/day	Possible Squatted Stub	langchain	pypi	0.0.1	Lior Strugach liliyanoffical@gmail.com	gmail.com
Package purpose: Vision tools for langchain Claimed homepage: https://pypi.org/project/langchain-vision-tools/ Matched naming pattern: langchain-langchain-tools Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 979 Registry downloads: 25/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 24 lines, 1.1 kB across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('LANGCHAIN'). HIGHPublisher email 'liliyanoffical@gmail.com' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 971 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (24 LOC, 1 file(s), 1122 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1046d	—	—	—	Unverified Signal	—	npm	latest	Rainer Simon	—	🪝 🌐
Package purpose: Annotorious storage plugin for Recogito's Supabase backend Static code signals: MISSING_SOURCE_REPOSITORY_URL SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/annotorious-supabase.umd.cjs:6 (+1 more occurrence(s) elsewhere) SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/annotorious-supabase.umd.cjs:1 (+2 more occurrence(s) elsewhere) SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/annotorious-supabase.umd.cjs:30 (+1 more occurrence(s) elsewhere) Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	1049d	236	0	↑0.2/day	Possible Squatted Stub	langchain	pypi	0.0.1	Yi ZHANG yizhang.dev@gmail.com	gmail.com
Package purpose: LangChain interface for Zhipu AI Claimed homepage: https://pypi.org/project/langchain-zhipuai Matched naming pattern: python-langchain-zhipuai Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1049 Registry downloads: 236/month, 40/week (MODERATE_USAGE) Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: MEDIUMPackage name 'langchain-zhipuai' matches AI hallucination template [python] + [langchain] + [zhipuai]. HIGHClaims critical enterprise brand identity ('LANGCHAIN'). HIGHPublisher email 'yizhang.dev@gmail.com' is not affiliated with official vendor domain. INFOEstablished pre-AI legacy package registered 1042 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes). INFOModerate community usage with 236 monthly downloads. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1059d	13	15	↑0.0/day	Possible Squatted Stub	openai	pypi	0.1.1	—	—
Package purpose: Openai integration providing updates utility for Openai Claimed homepage: https://pypi.org/project/openai-blog-updates/ Matched naming pattern: openai-openai-updates Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1059 Registry downloads: 13/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 15 lines, 336 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('OPENAI'). HIGHPublisher email 'None' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 1050 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (15 LOC, 1 file(s), 336 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1094d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:44 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:5 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:5 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:44 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	1103d	173	10	↑0.2/day	Possible Squatted Stub	aws	pypi	0.1	VMware, Inc.	—
Package purpose: Client bindings for VMware Cloud on AWS Claimed homepage: https://pypi.org/project/vmwarecloud-aws/ Matched naming pattern: python-aws-vmwarecloud Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1103 Registry downloads: 173/month, 41/week (MODERATE_USAGE) Codebase size: 10 lines, 294 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: MEDIUMPackage name 'vmwarecloud-aws' matches AI hallucination template [python] + [aws] + [vmwarecloud]. HIGHClaims critical enterprise brand identity ('AWS'). HIGHPublisher email 'None' is not affiliated with official vendor domain. INFOEstablished pre-AI legacy package registered 1096 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (10 LOC, 1 file(s), 294 bytes). INFOModerate community usage with 173 monthly downloads. Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1110d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/src/index.js:20 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:7 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:92 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:24 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	1111d	28	8	↑0.0/day	Possible Squatted Stub	aws	pypi	0.0.1	—	—
Package purpose: aws-c-http Claimed homepage: https://pypi.org/project/aws-c-http/ Matched naming pattern: aws-aws-http Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1111 Registry downloads: 28/month, 18/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 8 lines, 239 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('AWS'). HIGHPublisher email 'None' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 1104 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 239 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1143d	14	8	↑0.0/day	Possible Squatted Stub	openai	pypi	0.1	—	—
Package purpose: Openai integration providing wrapper utility for Openai Claimed homepage: https://pypi.org/project/openAI-chat-wrapper/ Matched naming pattern: openai-openai-wrapper Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1143 Registry downloads: 14/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 8 lines, 209 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('OPENAI'). HIGHPublisher email 'None' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 1135 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 209 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1178d	18	0	↑0.0/day	Possible Squatted Stub	aws	pypi	0.0.1	Florian Kaiser florian.kaiser@fnkr.net	fnkr.net
Package purpose: Aws integration providing flags utility for Aws Claimed homepage: https://www.fnkr.net Matched naming pattern: aws-aws-flags Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1178 Registry downloads: 18/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 0 lines, 0 Bytes across 4 files (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('AWS'). HIGHPublisher email 'florian.kaiser@fnkr.net' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 1170 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (0 LOC, 4 file(s), 0 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1208d	3	13	↑0.0/day	Possible Squatted Stub	midjourney	pypi	1.1	Igor Vasilev va1ngvarr@gmail.com	gmail.com
Package purpose: Midjourney integration providing API client & connector for Midjourney Claimed homepage: https://github.com/va1ngvarr/midjourney_api Matched naming pattern: midjourney-midjourney-api Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1208 Registry downloads: 3/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 13 lines, 429 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('MIDJOURNEY'). HIGHPublisher email 'va1ngvarr@gmail.com' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 1197 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (13 LOC, 1 file(s), 429 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	1242d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	1285d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:41 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:2 SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:41 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:41 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	1308d	—	—	—	Unverified Signal	—	npm	latest	—	—	🪝 🌐
Static code signals: MISSING_SOURCE_REPOSITORY_URL ANTI_ANALYSIS_EVASION: 'TLS / SSL Verification Bypass (Defense Evasion)' found in package/src/index.js:40 SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/src/index.js:1 SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/index.js:40 SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/index.js:40 Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →
	55	1545d	5	0	↑0.0/day	Possible Squatted Stub	sol	pypi	0.4.0	— sol_metaplex_fan@proton.me	proton.me
Package purpose: sol metaplex utils Claimed homepage: https://pypi.org/project/sol-metaplex-utils/ Matched naming pattern: sol-sol-utils Official vendor account: No — publisher domain doesn't match the brand it names Days since publish: 1545 Registry downloads: 5/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE) Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB) Automated signals flagged: HIGHClaims critical enterprise brand identity ('SOL'). HIGHPublisher email 'sol_metaplex_fan@proton.me' is not affiliated with official vendor domain. MEDIUMPackage has empty or near-zero description (potential reservation stub). INFOEstablished pre-AI legacy package registered 1534 days ago (predates modern AI hallucination waves). INFONo malicious install-time hooks or shell cradles detected in package AST. MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes). Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI →
	55	2920d	—	—	—	Unverified Signal	—	npm	latest	ModusBox	—	🪝
Package purpose: Central ledger hosted by a scheme to record and settle transfers Static code signals: SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/_wait4_all.js:3 SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/_wait4_all.js:104 (+1 more occurrence(s) elsewhere) SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/src/cryptoConditions/index.js:24 (+2 more occurrence(s) elsewhere) SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/testing/harness.ts:165 (+4 more occurrence(s) elsewhere) Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm →

Package: npm · 0.1.0

Author: Unknown

Package purpose: Copilot integration providing agent utility for Node

Official vendor account: No

Days since publish: 193

Registry downloads: 12/month

Codebase size: 5 lines (EMPTY_STUB)

Automated signals flagged:

MEDIUMPackage name 'agent-copilot' matches AI hallucination template [node] + [copilot] + [agent].
HIGHClaims critical enterprise brand identity ('COPILOT').
INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
HIGHPackage registered recently (167 days ago) during the active AI hallucination slopsquatting wave.
HIGHMISSING_SOURCE_REPOSITORY_URL
MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 89 bytes).
INFOPackage affiliated with trusted vendor 'copilot' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (110 -> 55) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →

Package: pypi · 0.0.0

Author: Unknown

Package purpose: # Amazon SageMaker HyperPod Amazon SageMaker Jupyter extension which provides HyperPod cluster discovery

Claimed homepage: https://pypi.org/project/amazon-sagemaker-hyperpod/

Official vendor account: No

Days since publish: 765

Registry downloads: 25/month

Codebase size: 1 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('AMAZON').
HIGHPublisher email 'None' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 755 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (1 LOC, 1 file(s), 20 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.0.0.1

Author: Unknown

Package purpose: # Security Holding Package This is a security holding package, a placeholder for a deleted package susceptible to hijacking. (The package is completely empty) For inquiries: [sec_reporting@service.jfrog.com](mailto:sec_reporting@service.jfrog.com)

Claimed homepage: https://pypi.org/project/azure-iot-provisioning-device-client/

Official vendor account: No

Days since publish: 859

Registry downloads: 75/month

Codebase size: 11 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('AZURE').
HIGHPublisher email 'None' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 851 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 426 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.1

Author: rockroll (zzzmengkai1234@gmail.com)

Package purpose: web3-rockroll-package

Claimed homepage: https://github.com/zzzmengkai123/web3-rockroll-package.git

Official vendor account: No

Days since publish: 936

Registry downloads: 8/month

Codebase size: 11 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('WEB3').
HIGHPublisher email 'zzzmengkai1234@gmail.com' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 924 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (11 LOC, 1 file(s), 353 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.0.1

Author: Lior Strugach (liliyanoffical@gmail.com)

Package purpose: Vision tools for langchain

Claimed homepage: https://pypi.org/project/langchain-vision-tools/

Official vendor account: No

Days since publish: 979

Registry downloads: 25/month

Codebase size: 24 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('LANGCHAIN').
HIGHPublisher email 'liliyanoffical@gmail.com' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 971 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (24 LOC, 1 file(s), 1122 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.0.1

Author: Yi ZHANG (yizhang.dev@gmail.com)

Package purpose: LangChain interface for Zhipu AI

Claimed homepage: https://pypi.org/project/langchain-zhipuai

Official vendor account: No

Days since publish: 1049

Registry downloads: 236/month

Codebase size: 0 lines (EMPTY_STUB)

Automated signals flagged:

MEDIUMPackage name 'langchain-zhipuai' matches AI hallucination template [python] + [langchain] + [zhipuai].
HIGHClaims critical enterprise brand identity ('LANGCHAIN').
HIGHPublisher email 'yizhang.dev@gmail.com' is not affiliated with official vendor domain.
INFOEstablished pre-AI legacy package registered 1042 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
INFOModerate community usage with 236 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.1.1

Author: Unknown

Package purpose: Openai integration providing updates utility for Openai

Claimed homepage: https://pypi.org/project/openai-blog-updates/

Official vendor account: No

Days since publish: 1059

Registry downloads: 13/month

Codebase size: 15 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('OPENAI').
HIGHPublisher email 'None' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 1050 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (15 LOC, 1 file(s), 336 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.1

Author: VMware, Inc.

Package purpose: Client bindings for VMware Cloud on AWS

Claimed homepage: https://pypi.org/project/vmwarecloud-aws/

Official vendor account: No

Days since publish: 1103

Registry downloads: 173/month

Codebase size: 10 lines (EMPTY_STUB)

Automated signals flagged:

MEDIUMPackage name 'vmwarecloud-aws' matches AI hallucination template [python] + [aws] + [vmwarecloud].
HIGHClaims critical enterprise brand identity ('AWS').
HIGHPublisher email 'None' is not affiliated with official vendor domain.
INFOEstablished pre-AI legacy package registered 1096 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (10 LOC, 1 file(s), 294 bytes).
INFOModerate community usage with 173 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.1

Author: Unknown

Package purpose: Openai integration providing wrapper utility for Openai

Claimed homepage: https://pypi.org/project/openAI-chat-wrapper/

Official vendor account: No

Days since publish: 1143

Registry downloads: 14/month

Codebase size: 8 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('OPENAI').
HIGHPublisher email 'None' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 1135 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 209 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.0.1

Author: Florian Kaiser (florian.kaiser@fnkr.net)

Package purpose: Aws integration providing flags utility for Aws

Claimed homepage: https://www.fnkr.net

Official vendor account: No

Days since publish: 1178

Registry downloads: 18/month

Codebase size: 0 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('AWS').
HIGHPublisher email 'florian.kaiser@fnkr.net' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 1170 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (0 LOC, 4 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 1.1

Author: Igor Vasilev (va1ngvarr@gmail.com)

Package purpose: Midjourney integration providing API client & connector for Midjourney

Claimed homepage: https://github.com/va1ngvarr/midjourney_api

Official vendor account: No

Days since publish: 1208

Registry downloads: 3/month

Codebase size: 13 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('MIDJOURNEY').
HIGHPublisher email 'va1ngvarr@gmail.com' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 1197 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (13 LOC, 1 file(s), 429 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

Package: pypi · 0.4.0

Author: Unknown (sol_metaplex_fan@proton.me)

Package purpose: sol metaplex utils

Claimed homepage: https://pypi.org/project/sol-metaplex-utils/

Official vendor account: No

Days since publish: 1545

Registry downloads: 5/month

Codebase size: 0 lines (EMPTY_STUB)

Automated signals flagged:

HIGHClaims critical enterprise brand identity ('SOL').
HIGHPublisher email 'sol_metaplex_fan@proton.me' is not affiliated with official vendor domain.
MEDIUMPackage has empty or near-zero description (potential reservation stub).
INFOEstablished pre-AI legacy package registered 1534 days ago (predates modern AI hallucination waves).
INFONo malicious install-time hooks or shell cradles detected in package AST.
MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →

SHARE INTELLIGENCE WIRE