🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
170 27d 801 6,866 ↑29.7/day
Very Risky
poppy pypi 0.5.1 dbmrq — 🪝
Package purpose: Turn coding-agent session history into reviewed skills, memories, and rules.
Claimed homepage: https://pypi.org/project/poppy-ai/
Matched naming pattern: python-poppy-ai
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 27
Registry downloads: 801/month, 32/week (MODERATE_USAGE)
Codebase size: 6866 lines, 295.5 kB across 27 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (20 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in poppy_ai-0.5.1/src/poppy/agent.py:102
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in poppy_ai-0.5.1/src/poppy/agent.py:92
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in poppy_ai-0.5.1/src/poppy/demo.py:462
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in poppy_ai-0.5.1/src/poppy/library.py:347
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in poppy_ai-0.5.1/src/poppy/mailer.py:53
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in poppy_ai-0.5.1/src/poppy/schedule.py:132
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in poppy_ai-0.5.1/src/poppy/agent.py:102
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in poppy_ai-0.5.1/src/poppy/agent.py:92
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in poppy_ai-0.5.1/src/poppy/demo.py:462
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in poppy_ai-0.5.1/src/poppy/library.py:347
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in poppy_ai-0.5.1/src/poppy/mailer.py:53
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in poppy_ai-0.5.1/src/poppy/schedule.py:132
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in poppy_ai-0.5.1/src/poppy/schedule.py:186
  • SYSTEM_PERSISTENCE_TAMPERING: 'Cron Job Installation / Tampering' found in poppy_ai-0.5.1/src/poppy/schedule.py:389

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
170 40d 920 12,231 ↑23.0/day
Very Risky
xbrowser pypi 0.6.2 — devkurox@pm.me pm.me 🪝 📡
Package purpose: Stealth Chromium that passes every bot detection test. Drop-in Playwright replacement with source-level fingerprint patches. Linux x86_64 only.
Claimed homepage: https://pypi.org/project/xbrowser/
Matched naming pattern: python-xbrowser-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 40
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 920/month, 104/week (MODERATE_USAGE)
Codebase size: 12231 lines, 604.9 kB across 23 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (39 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xbrowser-0.6.2/bin/fetch-widevine.py:236
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xbrowser-0.6.2/browser-manager/image/root/opt/xbrowser-py/launch_browser.py:42
  • HIGHANTI_ANALYSIS_EVASION: 'Extended Scanner Timeout Stall' found in xbrowser-0.6.2/browser-manager/image/root/opt/xbrowser-py/launch_browser.py:71
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in xbrowser-0.6.2/mcp/server.py:232
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in xbrowser-0.6.2/mcp/server.py:3223
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in xbrowser-0.6.2/mcp/server.py:2774
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xbrowser-0.6.2/bin/fetch-widevine.py:236
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xbrowser-0.6.2/browser-manager/image/root/opt/xbrowser-py/launch_browser.py:42
  • ANTI_ANALYSIS_EVASION: 'Extended Scanner Timeout Stall' found in xbrowser-0.6.2/browser-manager/image/root/opt/xbrowser-py/launch_browser.py:71
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in xbrowser-0.6.2/mcp/server.py:232
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in xbrowser-0.6.2/mcp/server.py:3223
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in xbrowser-0.6.2/mcp/server.py:2774
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in xbrowser-0.6.2/mcp/server.py:44
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in xbrowser-0.6.2/xbrowser/__main__.py:89

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
165 5d 0 587 ↑0.0/day
Very Risky
hdmi pypi 1.0.0 — prospermagara@gmail.com gmail.com 🪝
Package purpose: Use your laptop as a monitor for another computer through a USB HDMI capture card - low latency, full screen, with audio.
Claimed homepage: https://pypi.org/project/hdmi-monitor/
Matched naming pattern: python-hdmi-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 5
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 587 lines, 29.1 kB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSYNTAX_ERROR_IN_hdmi_monitor-1.0.0/src/hdmi_monitor/app.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py:45
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py:27
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py:40
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py
  • INFOSubstantial functional codebase (587 LOC across 4 file(s)).
Static code signals:
  • SYNTAX_ERROR_IN_hdmi_monitor-1.0.0/src/hdmi_monitor/app.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py:45
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py:27
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py:40
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in hdmi_monitor-1.0.0/src/hdmi_monitor/shortcuts.py

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
165 11d 0 3,771 ↑0.0/day
Very Risky
mcp pypi 0.1.0 Ulrich Bryand Tamouffe Teyo — 🪝 📡 🗄️
Package purpose: Static and semantic security scanner for Model Context Protocol servers
Claimed homepage: https://pypi.org/project/mcp-scrutiny/
Matched naming pattern: python-mcp-scrutiny
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 11
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 0/month, 22/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3771 lines, 181.2 kB across 24 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (10 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:113
  • HIGHCREDENTIAL_PATH_HARVESTING: 'AWS Credentials (~/.aws/credentials)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:65
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:54
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:54
  • HIGHCREDENTIAL_PATH_HARVESTING: 'Kube / Docker Credentials' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:71
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:69
Static code signals:
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:113
  • CREDENTIAL_PATH_HARVESTING: 'AWS Credentials (~/.aws/credentials)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:65
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:54
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:54
  • CREDENTIAL_PATH_HARVESTING: 'Kube / Docker Credentials' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:71
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in mcp_scrutiny-0.1.0/mcp_scrutiny/corpus.py:69
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in mcp_scrutiny-0.1.0/mcp_scrutiny/collectors/config.py:43
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in mcp_scrutiny-0.1.0/mcp_scrutiny/collectors/probe.py:113

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
165 14d 0 1,182 ↑0.0/day
Very Risky
emit pypi 1.0.0 Convalesce — 🪝 ⚡
Package purpose: Report a PySpark driver to Convalesce: what it ran, and whether it failed in Python.
Claimed homepage: https://pypi.org/project/convalesce-emit-pyspark/
Matched naming pattern: convalesce-emit-pyspark
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 14
Registry downloads: 0/month, 38/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1182 lines, 53.8 kB across 4 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (13 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/_env.py:26
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/convalesce_emit_pyspark.pth: 'import os; exec("try:\n import convalesce_emit_pyspark\n convalesce_emit_pyspark.install()\nexcept Exception:\n pass") i'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/convalesce_emit_pyspark.pth: 'import os; exec("try:\n import convalesce_emit_pyspark\n convalesce_emit_pyspark.install()\nexcept Exception:\n pass") i'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/driver.py:937
  • INFOSubstantial functional codebase (1182 LOC across 4 file(s)).
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/_env.py:26
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/convalesce_emit_pyspark.pth: 'import os; exec("try:\n import convalesce_emit_pyspark\n convalesce_emit_pyspark.install()\nexcept Exception:\n pass") i'
  • PYTHON_PTH_CODE_EXECUTION: Startup execution call 'exec()' in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/convalesce_emit_pyspark.pth: 'import os; exec("try:\n import convalesce_emit_pyspark\n convalesce_emit_pyspark.install()\nexcept Exception:\n pass") i'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in convalesce_emit_pyspark-1.0.0/src/convalesce_emit_pyspark/driver.py:937

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
165 105d 20 2,675 ↑0.2/day
Very Risky
skillwatch pypi 0.4.1 Kuziva Muzondo — 🪝
Package purpose: Monitor external URLs referenced by AI agent skills and MCP tools for bait-and-switch content changes
Claimed homepage: https://pypi.org/project/skillwatch/
Matched naming pattern: python-skillwatch-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 105
Registry downloads: 20/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2675 lines, 143.2 kB across 13 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHPackage registered recently (102 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in skillwatch-0.4.1/skillwatch/anchoring.py:194
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in skillwatch-0.4.1/skillwatch/detector.py:93
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in skillwatch-0.4.1/skillwatch/detector.py:94
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in skillwatch-0.4.1/skillwatch/detector.py:93
  • CRITICALSOURCE_CODE_DYNAMIC_CODE_LOADER: execution primitive combined with decode/network/obfuscation call in skillwatch-0.4.1/skillwatch/detector.py
  • INFOSubstantial functional codebase (2675 LOC across 13 file(s)).
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in skillwatch-0.4.1/skillwatch/anchoring.py:194
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in skillwatch-0.4.1/skillwatch/detector.py:93
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in skillwatch-0.4.1/skillwatch/detector.py:94
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in skillwatch-0.4.1/skillwatch/detector.py:93
  • SOURCE_CODE_DYNAMIC_CODE_LOADER: execution primitive combined with decode/network/obfuscation call in skillwatch-0.4.1/skillwatch/detector.py

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
165 269d 544 101,045 ↑2.0/day
Very Risky
claude npm 2.10.2 Jurgen Calleja — 🪝 🗄️
Package purpose: TLC - Test Led Coding for Claude Code
Claimed homepage: https://github.com/jurgencalleja/TLC#readme
Matched naming pattern: tlc-claude-code
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 269
Registry downloads: 544/month, 136/week (MODERATE_USAGE)
Codebase size: 101045 lines, 3.7 MB across 702 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'tlc-claude-code' matches AI hallucination template [tlc] + [claude] + [code].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 255 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node bin/postinstall.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/server/lib/access-control.js:320 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/server/lib/agent-persistence.js:28 (+31 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/server/lib/api-provider.js:45 (+22 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node bin/postinstall.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/server/lib/access-control.js:320 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/server/lib/agent-persistence.js:28 (+31 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/server/lib/api-provider.js:45 (+22 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/server/lib/audit-attribution.js:5 (+26 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/server/lib/audit-attribution.js:18 (+15 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/server/lib/security/auth-security.js:91 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/server/lib/security/compose-templates.js:53 (+4 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
165 302d 22 186,936 ↑0.1/day
Very Risky
claude npm 2.1.36 — — 🪝 🗄️
Package purpose: Open source AI coding platform with 37+ tools, Web IDE, multi-agent system, and MCP protocol support
Claimed homepage: https://github.com/kill136/claude-code-open#readme
Matched naming pattern: claude-claude-open
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 302
Registry downloads: 22/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 186936 lines, 7.1 MB across 884 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 298 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js || true'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/tools/agent.js:429 (+131 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/web/server/routes/ai-editor.js:1626 (+41 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/mcp/auto-discovery.js:141 (+22 more occurrence(s) elsewhere)
  • HIGHCREDENTIAL_PATH_HARVESTING: 'Shell Command History (~/.bash_history, ~/.zsh_history)' found in package/dist/tools/bash-history.js:35 (+3 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js || true'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/tools/agent.js:429 (+131 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/web/server/routes/ai-editor.js:1626 (+41 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/mcp/auto-discovery.js:141 (+22 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Shell Command History (~/.bash_history, ~/.zsh_history)' found in package/dist/tools/bash-history.js:35 (+3 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/tools/bash.js:682 (+21 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/blueprint/browser-test-tools.js:478 (+5 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'Extended Scanner Timeout Stall' found in package/dist/auth/index.js:797

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
162 79d 386 6,430 ↑4.9/day
Very Risky
claude npm 2.46.0 open-claude-code — 🪝 🌐 📡 🗄️
Package purpose: Community edition of the Anthropic Claude Code CLI — a reverse-engineered restoration with community optimizations; interactive AI coding assistant in the terminal
Claimed homepage: https://github.com/sweetcornna/open-claude-code#readme
Matched naming pattern: node-claude-open-claude-code
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 79
Registry downloads: 386/month, 96/week (MODERATE_USAGE)
Codebase size: 6430 lines, 8.5 MB across 670 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@sweetcornna/open-claude-code' matches AI hallucination template [node] + [claude] + [open-claude-code].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (76 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.cjs'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/postinstall.cjs:23
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall.cjs:146 (+4 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.cjs:174 (+11 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.cjs'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/postinstall.cjs:23
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall.cjs:146 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.cjs:174 (+11 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/postinstall.cjs:42 (+129 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/chunks/auth-uXIJcoGG.js:1 (+4 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/chunks/claudeDesktop-Cdvs6bq6.js:1 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Cloud Instance Metadata (AWS/GCP/Azure IMDS)' found in package/dist/chunks/dist-es-BojmTNsk2.js:1 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
160 227d 11 727 ↑0.0/day
Very Risky
langchain pypi 0.1.0 — sophia.eagent@gmail.com gmail.com 🪝 📡
Package purpose: LangChain + CrewAI tools for RustChain blockchain and BoTTube video platform
Claimed homepage: https://pypi.org/project/rustchain-langchain/
Matched naming pattern: python-langchain-rustchain
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 227
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 727 lines, 32.6 kB across 5 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'rustchain-langchain' matches AI hallucination template [python] + [langchain] + [rustchain].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'sophia.eagent@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 199 days ago within the 1-year AI tool proliferation window.
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in rustchain_langchain-0.1.0/evangelist_agent.py:31
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in rustchain_langchain-0.1.0/evangelist_agent.py:30
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in rustchain_langchain-0.1.0/rustchain_langchain/tools.py:31
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in rustchain_langchain-0.1.0/rustchain_langchain/tools.py:31
Static code signals:
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in rustchain_langchain-0.1.0/evangelist_agent.py:31
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in rustchain_langchain-0.1.0/evangelist_agent.py:30
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in rustchain_langchain-0.1.0/rustchain_langchain/tools.py:31
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in rustchain_langchain-0.1.0/rustchain_langchain/tools.py:31
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in rustchain_langchain-0.1.0/rustchain_mcp/server.py:28
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in rustchain_langchain-0.1.0/rustchain_mcp/server.py:27

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
160 284d 27 7,610 ↑0.1/day
Very Risky
claude pypi 0.1.5 — — 🪝
Package purpose: TUI manager for Claude Code sessions - browse, search, and teleport across time
Claimed homepage: https://pypi.org/project/one_claude/
Matched naming pattern: python-claude-one
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 284
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 27/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 7610 lines, 346.6 kB across 42 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'one-claude' matches AI hallucination template [python] + [claude] + [one].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage registered 271 days ago within the 1-year AI tool proliferation window.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in one_claude-0.1.5/one_claude/cli.py:221
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in one_claude-0.1.5/one_claude/cli.py:356
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'GitHub Gists API Exfiltration (Dead Drop)' found in one_claude-0.1.5/one_claude/gist/api.py:9
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in one_claude-0.1.5/one_claude/gist/api.py:10
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in one_claude-0.1.5/one_claude/cli.py:221
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in one_claude-0.1.5/one_claude/cli.py:356
  • EXFILTRATION_DESTINATION_DETECTED: 'GitHub Gists API Exfiltration (Dead Drop)' found in one_claude-0.1.5/one_claude/gist/api.py:9
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in one_claude-0.1.5/one_claude/gist/api.py:10
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in one_claude-0.1.5/one_claude/gist/exporter.py:36
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in one_claude-0.1.5/one_claude/teleport/sandbox.py:30
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in one_claude-0.1.5/one_claude/tui/screens/gist_modals.py:123
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in one_claude-0.1.5/one_claude/tui/screens/home.py:603

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 41d 465 5,718 ↑11.3/day
Very Risky
itaca pypi 0.8.0 Leopoldo Pla Sempere — 🪝
Package purpose: Convierte localmente listados PDF de alumnado de ITACA a XLSX preparados para importar en iDoceo
Claimed homepage: https://pypi.org/project/itaca-idoceo/
Matched naming pattern: python-itaca-idoceo
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 41
Registry downloads: 465/month, 14/week (MODERATE_USAGE)
Codebase size: 5718 lines, 237.5 kB across 18 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (30 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in itaca_idoceo-0.8.0/src/itaca_idoceo/gui.py:724
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in itaca_idoceo-0.8.0/src/itaca_idoceo/integrations.py:95
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in itaca_idoceo-0.8.0/src/itaca_idoceo/integrations.py:131
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in itaca_idoceo-0.8.0/src/itaca_idoceo/integrations.py
  • INFOSubstantial functional codebase (5718 LOC across 18 file(s)).
  • INFOModerate community usage with 465 monthly downloads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in itaca_idoceo-0.8.0/src/itaca_idoceo/gui.py:724
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in itaca_idoceo-0.8.0/src/itaca_idoceo/integrations.py:95
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in itaca_idoceo-0.8.0/src/itaca_idoceo/integrations.py:131
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in itaca_idoceo-0.8.0/src/itaca_idoceo/integrations.py

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 52d 229 2,389 ↑4.4/day
Very Risky
arcaeon pypi 0.0.15 Arcaeon — 🪝 📡 🗄️
Package purpose: An open, re-testable static checker for MCP server source. Not a vetting authority.
Claimed homepage: https://pypi.org/project/arcaeon-mcp-vet/
Matched naming pattern: arcaeon-arcaeon-vet
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 52
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 229/month, 21/week (MODERATE_USAGE)
Codebase size: 2389 lines, 147.3 kB across 8 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (44 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in arcaeon_mcp_vet-0.0.15/mcp_vet/badge.py:169
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in arcaeon_mcp_vet-0.0.15/mcp_vet/checks.py:262
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in arcaeon_mcp_vet-0.0.15/mcp_vet/checks.py:186
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:290
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:330
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:330
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in arcaeon_mcp_vet-0.0.15/mcp_vet/badge.py:169
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in arcaeon_mcp_vet-0.0.15/mcp_vet/checks.py:262
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in arcaeon_mcp_vet-0.0.15/mcp_vet/checks.py:186
  • EXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:290
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:330
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:330
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:340
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in arcaeon_mcp_vet-0.0.15/mcp_vet/grade.py:321

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 193d 12 3,248 ↑0.1/day
🐛 Potential Cross-Ecosystem Worm Very Risky
langchain pypi 0.6.0 — — 🪝 🐛
Package purpose: Production HTTP server for LangChain/LangGraph agents — OpenAI-compatible API, streaming, session memory and agent discovery
Claimed homepage: https://pypi.org/project/fast-langchain-server/
Matched naming pattern: fast-langchain-server
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 193
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3248 lines, 161.7 kB across 15 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'fast-langchain-server' matches AI hallucination template [fast] + [langchain] + [server].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (164 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fast_langchain_server-0.6.0/fast_langchain_server/auth.py:155
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fast_langchain_server-0.6.0/fast_langchain_server/server.py:749
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fast_langchain_server-0.6.0/fast_langchain_server/telemetry.py:48
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in fast_langchain_server-0.6.0/scripts/publish.py:39
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fast_langchain_server-0.6.0/fast_langchain_server/auth.py:155
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fast_langchain_server-0.6.0/fast_langchain_server/server.py:749
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fast_langchain_server-0.6.0/fast_langchain_server/telemetry.py:48
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in fast_langchain_server-0.6.0/scripts/publish.py:39
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in fast_langchain_server-0.6.0/scripts/publish.py:118
  • CROSS_ECOSYSTEM_WORM_PROPAGATION: 'PyPI Registry Upload Endpoint (Worm Replication)' found in fast_langchain_server-0.6.0/scripts/publish.py:97

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 310d 33 56,373 ↑0.1/day
Very Risky
alexasomba pypi 1.1.6 OpenAPI Generator community techsupport@paystack.com paystack.com 🪝
Package purpose: Paystack
Claimed homepage: https://pypi.org/project/alexasomba-paystack/
Matched naming pattern: python-alexasomba-paystack
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 310
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 33/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 56373 lines, 2.9 MB across 485 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPublisher email domain '@paystack.com' matches package identifier token 'paystack', verifying identifiable third-party organization ownership.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 296 days ago within the 1-year AI tool proliferation window.
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/customer_api.py:671
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/plan_api.py:214
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/split_api.py:70
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/subaccount_api.py:212
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/subscription_api.py:509
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/customer_api.py:671
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/plan_api.py:214
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/split_api.py:70
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/subaccount_api.py:212
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/subscription_api.py:509
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in alexasomba_paystack-1.1.6/alexasomba_paystack/api/transaction_api.py:720
  • OBFUSCATED_DYNAMIC_ACCESS: __import__() dynamic loading 'os' detected in alexasomba_paystack-1.1.6/setup.py:50

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 3394d 35 334 ↑0.0/day
Very Risky
base pypi 10.0.1.0.0 Tecnativa, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: NUTS Regions
Claimed homepage: https://www.tecnativa.com
Matched naming pattern: odoo10-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3394
Registry downloads: 35/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 334 lines, 14.4 kB across 8 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3379 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_location_nuts-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • SYNTAX_ERROR_IN_odoo/addons/base_location_nuts/wizard/nuts_import.py: multiple exception types must be parenthesized (<unknown>, line 122)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 3480d 32 116 ↑0.0/day
Very Risky
base pypi 9.0.1.0.0.99.dev37 Akretion,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Attachment Base Synchronize
Claimed homepage: http://www.akretion.com/
Matched naming pattern: odoo9-base-attachment
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 32/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 116 lines, 4.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3466 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_attachment_base_synchronize-9.0.1.0.0.99.dev37-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_attachment_base_synchronize-9.0.1.0.0.99.dev37-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • HIGHSYNTAX_ERROR_IN_odoo_addons/attachment_base_synchronize/models/attachment.py: multiple exception types must be parenthesized (<unknown>, line 79)
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_attachment_base_synchronize-9.0.1.0.0.99.dev37-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_attachment_base_synchronize-9.0.1.0.0.99.dev37-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • SYNTAX_ERROR_IN_odoo_addons/attachment_base_synchronize/models/attachment.py: multiple exception types must be parenthesized (<unknown>, line 79)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 3480d 66 543 ↑0.0/day
Very Risky
base pypi 8.0.0.1.0.99.dev56 Akretion,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Validate phone numbers
Claimed homepage: http://www.akretion.com/
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 66/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 543 lines, 34.2 kB across 8 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3466 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_phone-8.0.0.1.0.99.dev56-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_phone-8.0.0.1.0.99.dev56-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • HIGHSYNTAX_ERROR_IN_odoo_addons/base_phone/base_phone.py: multiple exception types must be parenthesized (<unknown>, line 109)
  • HIGHSYNTAX_ERROR_IN_odoo_addons/base_phone/wizard/reformat_all_phonenumbers.py: multiple exception types must be parenthesized (<unknown>, line 70)
  • INFOSubstantial functional codebase (543 LOC across 8 file(s)).
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_phone-8.0.0.1.0.99.dev56-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_phone-8.0.0.1.0.99.dev56-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • SYNTAX_ERROR_IN_odoo_addons/base_phone/base_phone.py: multiple exception types must be parenthesized (<unknown>, line 109)
  • SYNTAX_ERROR_IN_odoo_addons/base_phone/wizard/reformat_all_phonenumbers.py: multiple exception types must be parenthesized (<unknown>, line 70)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
155 3481d 54 471 ↑0.0/day
Very Risky
base pypi 10.0.0.1.0 — — 🪝 ⚡
Package purpose: Validate phone numbers
Claimed homepage: http://www.akretion.com/
Matched naming pattern: odoo10-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3481
Registry downloads: 54/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 471 lines, 24.1 kB across 12 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3467 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo',));ie = os.path.exists(os.path.joi'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo',));ie = os.path.exists(os.path.joi'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo', 'addons'));ie = os.path.exists(os'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo', 'addons'));ie = os.path.exists(os'
  • HIGHSYNTAX_ERROR_IN_odoo/addons/base_phone/wizard/number_not_found.py: multiple exception types must be parenthesized (<unknown>, line 64)
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo',));ie = os.path.exists(os.path.joi'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo',));ie = os.path.exists(os.path.joi'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo', 'addons'));ie = os.path.exists(os'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_phone-10.0.0.1.0-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo', 'addons'));ie = os.path.exists(os'
  • SYNTAX_ERROR_IN_odoo/addons/base_phone/wizard/number_not_found.py: multiple exception types must be parenthesized (<unknown>, line 64)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
152 138d 19 128,665 ↑0.1/day
Very Risky
claude npm 0.2.14 — — 🪝 📡 🗄️
Package purpose: DeepSeek-flavored Claude Code launcher (bnpm-installable, one-command CLI)
Matched naming pattern: node-claude-hzk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 138
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 128665 lines, 5.0 MB across 1358 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'hzk-claude' matches AI hallucination template [node] + [claude] + [hzk].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (116 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/hzk-claude.cjs:7
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/hzk-claude.cjs:124 (+141 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/hzk-claude.cjs:7
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/bin/hzk-claude.cjs:124 (+141 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall.mjs:42 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/src/utils/ansiToPng.ts:61 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/src/commands/remote-setup/api.ts:141 (+24 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'System Credentials (/etc/shadow, /etc/passwd)' found in package/src/utils/bash/ast.ts:1576 (+2 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
150 192d 15 5,100 ↑0.1/day
Very Risky
clawmeter pypi 0.7.4 Daniel Thomas — 🪝
Package purpose: Monitor LLM service usage across providers from the CLI
Claimed homepage: https://pypi.org/project/clawmeter/
Matched naming pattern: python-clawmeter-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 192
Registry downloads: 15/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5100 lines, 217.4 kB across 22 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHPackage registered recently (177 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in clawmeter-0.7.4/src/clawmeter/cli.py:1085
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/cli.py:46
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in clawmeter-0.7.4/src/clawmeter/cli.py:1122
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in clawmeter-0.7.4/src/clawmeter/cli.py
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/config.py:75
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/daemon.py:162
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/migrate.py:36
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in clawmeter-0.7.4/src/clawmeter/cli.py:1085
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/cli.py:46
  • SYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in clawmeter-0.7.4/src/clawmeter/cli.py:1122
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in clawmeter-0.7.4/src/clawmeter/cli.py
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/config.py:75
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/daemon.py:162
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in clawmeter-0.7.4/src/clawmeter/migrate.py:36
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in clawmeter-0.7.4/src/clawmeter/security.py:123

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
147 188d 52 564,021 ↑0.3/day
Very Risky
claude npm 2.1.88-cgg.0.1 CGG CODE — 🪝 📡 🗄️
Package purpose: Reverse-engineered Anthropic Claude Code CLI — interactive AI coding assistant in the terminal
Claimed homepage: https://github.com/toby1123yjh/claude-code-cgg#readme
Matched naming pattern: claude-claude-cgg
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 188
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 52/month, 13/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 564021 lines, 21.0 MB across 520 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (178 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.cjs'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/postinstall-lib.cjs:2 (+8 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall-lib.cjs:31 (+9 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall-lib.cjs:75 (+14 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/postinstall-lib.cjs:8 (+117 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.cjs'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/postinstall-lib.cjs:2 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall-lib.cjs:31 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall-lib.cjs:75 (+14 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/postinstall-lib.cjs:8 (+117 more occurrence(s) elsewhere)
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in package/dist/chunk-2n46ajnx.js:180
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/dist/chunk-2n46ajnx.js:294 (+5 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/chunk-34vw67jc.js:389 (+8 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
145 202d 986 3,440 ↑4.9/day
Very Risky
monitor pypi 2.7.0 audi63 — 🪝
Package purpose: Real-time Claude Pro/Max usage monitor — tray icon, overlay widget, notifications, mini mode, sparklines
Claimed homepage: https://pypi.org/project/claude-monitor-usage/
Matched naming pattern: claude-monitor-usage
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 202
Registry downloads: 986/month, 30/week (MODERATE_USAGE)
Codebase size: 3440 lines, 158.4 kB across 21 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • MEDIUMPackage registered 189 days ago within the 1-year AI tool proliferation window.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/api.py:297
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/api.py:54
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py:76
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py:30
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py:67
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/api.py:297
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/api.py:54
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py:76
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py:30
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shortcut Hijacking (.lnk Rewrite / Browser Extension Sideload)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py:67
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in claude_monitor_usage-2.7.0/src/claude_usage_monitor/autostart.py
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/cache.py:24
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in claude_monitor_usage-2.7.0/src/claude_usage_monitor/config.py:37

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
145 3393d 140 119 ↑0.0/day
Very Risky
base pypi 10.0.1.0.0.99.dev15 Akretion,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Attachment Base Synchronize
Claimed homepage: https://www.akretion.com
Matched naming pattern: odoo10-base-attachment
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3393
Registry downloads: 140/month, 7/week (MODERATE_USAGE)
Codebase size: 119 lines, 4.6 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3378 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_attachment_base_synchronize-10.0.1.0.0.99.dev15-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • SYNTAX_ERROR_IN_odoo/addons/attachment_base_synchronize/models/attachment.py: multiple exception types must be parenthesized (<unknown>, line 79)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
142 23d 184 7,990 ↑8.0/day
🐛 Potential Cross-Ecosystem Worm Very Risky
palladium npm 0.5.91 Palladium — 🪝 🐛 🗄️
Package purpose: Palladium Router CLI - Start and manage the Palladium Router server. A fork of 9Router (https://github.com/decolua/9router), MIT licensed.
Matched naming pattern: palladium-palladium-app
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 23
Registry downloads: 184/month, 46/week (MODERATE_USAGE)
Codebase size: 7990 lines, 11.0 MB across 795 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (20 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/static/chunks/124.c092990b4bdb9713.js:1 (+79 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+58 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+1 more occurrence(s) elsewhere)
  • HIGHANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+2 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/static/chunks/124.c092990b4bdb9713.js:1 (+79 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+58 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+1 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/app/.next-cli-build/server/chunks/2430.js:2 (+10 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/app/.next-cli-build/server/chunks/2430.js:121 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
142 24d 230 7,988 ↑9.6/day
🐛 Potential Cross-Ecosystem Worm Very Risky
67gateway npm 0.5.91 — — 🪝 🐛 🗄️
Package purpose: 67Gateway CLI - Start and manage 67Gateway server
Matched naming pattern: node-67gateway-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 24
Registry downloads: 230/month, 57/week (MODERATE_USAGE)
Codebase size: 7988 lines, 11.2 MB across 785 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (20 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/static/chunks/124.c092990b4bdb9713.js:1 (+79 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+58 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+1 more occurrence(s) elsewhere)
  • HIGHANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+2 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/static/chunks/124.c092990b4bdb9713.js:1 (+79 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+58 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+1 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/app/.next-cli-build/server/chunks/2220.js:1 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/app/.next-cli-build/server/chunks/2430.js:2 (+10 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/app/.next-cli-build/server/chunks/2430.js:121 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
142 25d 212 7,565 ↑8.5/day
🐛 Potential Cross-Ecosystem Worm Very Risky
k npm 1.0.0 TienKhang — 🪝 🐛 🗄️
Package purpose: K-spinning — local AI routing gateway that rotates your AI provider accounts (one OpenAI-compatible endpoint, dashboard included)
Matched naming pattern: node-k-spinning
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 25
Registry downloads: 212/month, 53/week (MODERATE_USAGE)
Codebase size: 7565 lines, 9.7 MB across 669 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (20 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+54 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/app/.next-cli-build/server/chunks/1679.js:1 (+1 more occurrence(s) elsewhere)
  • HIGHANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/app/.next-cli-build/server/chunks/1679.js:1 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/server/chunks/1856.js:7 (+73 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+54 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/app/.next-cli-build/server/chunks/1679.js:1 (+1 more occurrence(s) elsewhere)
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/app/.next-cli-build/server/chunks/1679.js:1 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/server/chunks/1856.js:7 (+73 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/app/.next-cli-build/server/chunks/2430.js:2 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/app/.next-cli-build/server/chunks/2430.js:121 (+5 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
142 45d 512 8,375 ↑11.4/day
🐛 Potential Cross-Ecosystem Worm Very Risky
krouter9 npm 1.0.0 — — 🪝 🐛 🗄️
Package purpose: KRouter9 CLI - Start and manage KRouter9 server
Matched naming pattern: node-krouter9-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 45
Registry downloads: 512/month, 128/week (MODERATE_USAGE)
Codebase size: 8375 lines, 10.1 MB across 791 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (37 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1004.js:1 (+53 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/server/chunks/1082.js:1 (+75 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/app/.next-cli-build/server/chunks/2409.js:1 (+4 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/app/.next-cli-build/server/chunks/2430.js:2 (+7 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1004.js:1 (+53 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/server/chunks/1082.js:1 (+75 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/app/.next-cli-build/server/chunks/2409.js:1 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/app/.next-cli-build/server/chunks/2430.js:2 (+7 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/app/.next-cli-build/server/chunks/318.js:9 (+4 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/app/.next-cli-build/server/chunks/3193.js:1 (+3 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
142 68d 51 4,203 ↑0.8/day
Very Risky
claude npm 1.3.1 — — 🪝 🗄️
Package purpose: Dashboard quản lý Claude CLI sessions + Hermes chat + agy-proxy
Claimed homepage: https://github.com/mvng267/control-center#readme
Matched naming pattern: claude-claude-center
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 68
Registry downloads: 51/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4203 lines, 1.9 MB across 17 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (66 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/web-next/out/_next/static/chunks/0cz1d0mv5g_q7.js:1 (+3 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/web-next/out/_next/static/chunks/1dx9d_ic1g1cw.js:1 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/web-next/out/_next/static/chunks/3thp5hmq33yks.js:31
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/server/config.js:6 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/control.js:51 (+1 more occurrence(s) elsewhere)
Static code signals:
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/web-next/out/_next/static/chunks/0cz1d0mv5g_q7.js:1 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/web-next/out/_next/static/chunks/1dx9d_ic1g1cw.js:1 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/web-next/out/_next/static/chunks/3thp5hmq33yks.js:31
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/src/server/config.js:6 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/control.js:51 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/control.js:51 (+1 more occurrence(s) elsewhere)
  • SYSTEM_PERSISTENCE_TAMPERING: 'Systemd / macOS LaunchAgent Persistence' found in package/bin/control.js:49
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/bin/control.js

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
142 179d 141 574,162 ↑0.8/day
Very Risky
claude npm 1.10.2 Oublie-le — 🪝 📡 🗄️
Package purpose: Claude Code CLI 中文汉化版 — 支持界面语言切换（中文/英文/自动），覆盖欢迎界面、命令菜单、快捷键提示、引导流程等所有 UI 文字 | Claude Code CLI with Chinese UI localization
Claimed homepage: https://github.com/Oublie-le/claude-code-chinese#readme
Matched naming pattern: claude-claude-zh
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 179
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 141/month, 35/week (MODERATE_USAGE)
Codebase size: 574162 lines, 21.2 MB across 621 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (166 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/postinstall.cjs:16 (+3 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall.cjs:109 (+14 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.cjs:130 (+33 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/postinstall.cjs:33 (+138 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/scripts/postinstall.cjs:16 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall.cjs:109 (+14 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.cjs:130 (+33 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/postinstall.cjs:33 (+138 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/dist/chunks/axios-Dxak1ccZ.js:8899 (+2 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/chunks/claudeDesktop-0XnpCfxX.js:17 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/chunks/dist-BggZlhqS.js:274 (+7 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
140 20d 209 5,597 ↑10.4/day
Very Risky
koolie pypi 2.2.0 — — 🪝 🗄️
Package purpose: Rules, skills and a protective hook for AI coding assistants - one rule source, installed per project.
Claimed homepage: https://pypi.org/project/koolie/
Matched naming pattern: python-koolie-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 20
Registry downloads: 209/month, 13/week (MODERATE_USAGE)
Codebase size: 5597 lines, 340.8 kB across 13 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHPackage registered recently (15 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in koolie/baum/.koolie/core/banner.py:368
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/build/assemble.py:101
  • CRITICALMODULE_TOPLEVEL_EXECUTION: 'subprocess.run' executed at module scope (runs on import) in koolie/baum/.koolie/core/build/build-docx.py:163
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/build/build-docx.py:118
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/clientmap.py:509
  • HIGHCREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in koolie/baum/.koolie/core/install.py:1003
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/install.py:939
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in koolie/baum/.koolie/core/banner.py:368
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/build/assemble.py:101
  • MODULE_TOPLEVEL_EXECUTION: 'subprocess.run' executed at module scope (runs on import) in koolie/baum/.koolie/core/build/build-docx.py:163
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/build/build-docx.py:118
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/clientmap.py:509
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in koolie/baum/.koolie/core/install.py:1003
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/install.py:939
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in koolie/baum/.koolie/core/install_dialog.py:238

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 23d 465 4,519 ↑20.2/day
Very Risky
agent pypi 1.0.5 minecraftbefile-maker — 🪝 📡
Package purpose: Local AI agent with headless browser, sandboxed shell, and plug-and-play skills
Claimed homepage: https://pypi.org/project/agent-code/
Matched naming pattern: python-agent-code
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 23
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 465/month, 89/week (MODERATE_USAGE)
Codebase size: 4519 lines, 204.5 kB across 11 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (21 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSYNTAX_ERROR_IN_agent_code-1.0.5/src/agent_code/__main__.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in agent_code-1.0.5/src/agent_code/agent.py:223
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in agent_code-1.0.5/src/agent_code/agent.py:746
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in agent_code-1.0.5/src/agent_code/agent.py:68
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in agent_code-1.0.5/src/agent_code/cli.py:42
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in agent_code-1.0.5/src/agent_code/data/skills/filesystem/skill.py:15
Static code signals:
  • SYNTAX_ERROR_IN_agent_code-1.0.5/src/agent_code/__main__.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • EXFILTRATION_DESTINATION_DETECTED: 'Raw Public IP Endpoint' found in agent_code-1.0.5/src/agent_code/agent.py:223
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in agent_code-1.0.5/src/agent_code/agent.py:746
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in agent_code-1.0.5/src/agent_code/agent.py:68
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in agent_code-1.0.5/src/agent_code/cli.py:42
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in agent_code-1.0.5/src/agent_code/data/skills/filesystem/skill.py:15
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in agent_code-1.0.5/src/agent_code/data/skills/public_api/skill.py:15
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in agent_code-1.0.5/src/agent_code/data/skills/temp_mail/skill.py:81

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 43d 88 8,082 ↑2.0/day
🐛 Potential Cross-Ecosystem Worm Very Risky
nzrouter npm 0.5.63 — — 🪝 🐛 🗄️
Package purpose: NzRouter CLI by N4tzzOfficial - Start and manage NzRouter server
Claimed homepage: https://github.com/N4tzzOfficial/NzRouter#readme
Matched naming pattern: node-nzrouter-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 43
Registry downloads: 88/month, 22/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 8082 lines, 10.2 MB across 702 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (35 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+48 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/static/chunks/1321-b5c4451ab1fc0ff0.js:1 (+75 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/app/.next-cli-build/server/chunks/2430.js:2 (+7 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/app/.next-cli-build/server/chunks/2430.js:121 (+4 more occurrence(s) elsewhere)
  • HIGHSUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/app/.next-cli-build/server/chunks/318.js:9 (+4 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node hooks/postinstall.js'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/app/.next-cli-build/server/chunks/1260.js:1 (+48 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/app/.next-cli-build/static/chunks/1321-b5c4451ab1fc0ff0.js:1 (+75 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/app/.next-cli-build/server/chunks/2430.js:2 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/app/.next-cli-build/server/chunks/2430.js:121 (+4 more occurrence(s) elsewhere)
  • SUSPICIOUS_OBFUSCATION: 'Layered Base64 and Decompress Pipeline' found in package/app/.next-cli-build/server/chunks/318.js:9 (+4 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/app/.next-cli-build/server/chunks/3193.js:1 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'process.binding/mainModule' found in package/app/.next-cli-build/static/chunks/3794-a6cbe3f16d804637.js:1 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
140 1368d 3 0 ↑0.0/day
Very Risky
base pypi 1.0.1 Siva Cn cnsiva@protonmail.com protonmail.com 🪝 ⚡
Package purpose: A simple framework for wrapping any ORM.
Claimed homepage: https://pypi.org/project/orm.base/
Matched naming pattern: python-base-orm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1368
Registry downloads: 3/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 16 files (EMPTY_STUB)
Automated signals flagged:
  • INFOEstablished pre-AI legacy package registered 1339 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • MEDIUMPackage is an empty placeholder (0 LOC, 16 file(s), 0 bytes).
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in ./home/sivacn/BUILDS/pyspace/lib/python3.7/site-packages/orm.base-1.0.1-py3.7-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('orm''

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 1789d 9 90 ↑0.0/day
Very Risky
base pypi 10.0.1.0.0.99.dev3 Open Source Integrators, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: User roles by company
Claimed homepage: https://github.com/OCA/server-backend
Matched naming pattern: odoo10-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1789
Registry downloads: 9/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 90 lines, 3.9 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1761 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_user_role_company-10.0.1.0.0.99.dev3-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 2943d 7 443 ↑0.0/day
Very Risky
base pypi 10.0.2.0.0 ACSONE SA/NV, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Demo addon for Base REST
Claimed homepage: https://acsone.eu/
Matched naming pattern: odoo10-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2943
Registry downloads: 7/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 443 lines, 16.0 kB across 9 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 2914 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_rest_demo-10.0.2.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3290d 0 149 ↑0.0/day
Very Risky
base pypi 10.0.1.0.0 AvanzOSC, Tecnativa, Odoo Community Association (OCA), support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Report qweb auto generation
Claimed homepage: https://github.com/OCA/server-tools
Matched naming pattern: odoo10-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3290
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 149 lines, 6.8 kB across 6 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3261 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_report_auto_create_qweb-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3318d 0 68 ↑0.0/day
Very Risky
base pypi 10.0.1.0.0 Eficent,SerpentCS,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Base Search Mail Content
Claimed homepage: https://github.com/OCA/social
Matched naming pattern: odoo10-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3318
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 68 lines, 3.6 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3289 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo10_addon_base_search_mail_content-10.0.1.0.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo''

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 17 135 ↑0.0/day
Very Risky
base pypi 9.0.1.0.0.99.dev30 ABF OSIELL, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: User roles
Claimed homepage: http://www.osiell.com
Matched naming pattern: odoo9-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 17/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 135 lines, 5.3 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_base_user_role-9.0.1.0.0.99.dev30-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_base_user_role-9.0.1.0.0.99.dev30-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_base_user_role-9.0.1.0.0.99.dev30-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_base_user_role-9.0.1.0.0.99.dev30-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 40 154 ↑0.0/day
Very Risky
base pypi 9.0.1.0.0.99.dev28 AvanzOSC, Tecnativa, Odoo Community Association (OCA), support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Report qweb auto generation
Claimed homepage: https://github.com/OCA/server-tools
Matched naming pattern: odoo9-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 40/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 154 lines, 7.1 kB across 6 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_base_report_auto_create_qweb-9.0.1.0.0.99.dev28-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_base_report_auto_create_qweb-9.0.1.0.0.99.dev28-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_base_report_auto_create_qweb-9.0.1.0.0.99.dev28-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_base_report_auto_create_qweb-9.0.1.0.0.99.dev28-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 29 160 ↑0.0/day
Very Risky
base pypi 9.0.1.0.1 Daniel Reis,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: External Database Sources
Claimed homepage: https://github.com/OCA/server-tools
Matched naming pattern: odoo9-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 29/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 160 lines, 6.7 kB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_base_external_dbsource-9.0.1.0.1-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_addons',));ie = os.path.exists(os.p'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_base_external_dbsource-9.0.1.0.1-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_addons',));ie = os.path.exists(os.p'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in odoo_addons/base_external_dbsource/models/base_external_dbsource.py:93
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo9_addon_base_external_dbsource-9.0.1.0.1-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_addons',));ie = os.path.exists(os.p'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo9_addon_base_external_dbsource-9.0.1.0.1-py2.7-nspkg.pth: 'import sys, types, os;p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_addons',));ie = os.path.exists(os.p'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in odoo_addons/base_external_dbsource/models/base_external_dbsource.py:93

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 41 38 ↑0.0/day
Very Risky
base pypi 8.0.0.1.0.99.dev11 OpenERP Italian Community,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Italian Localisation - Base
Claimed homepage: http://www.openerp-italia.org
Matched naming pattern: odoo8-base-l10n
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 41/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 38 lines, 5.3 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3452 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_l10n_it_base-8.0.0.1.0.99.dev11-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_l10n_it_base-8.0.0.1.0.99.dev11-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_l10n_it_base-8.0.0.1.0.99.dev11-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_l10n_it_base-8.0.0.1.0.99.dev11-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 11 179 ↑0.0/day
Very Risky
base pypi 8.0.1.2.0 ABF OSIELL, Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: User roles
Claimed homepage: http://www.osiell.com
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 179 lines, 7.4 kB across 9 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_user_role-8.0.1.2.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_user_role-8.0.1.2.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_user_role-8.0.1.2.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_user_role-8.0.1.2.0-py2.7-nspkg.pth: 'import sys, types, os;pep420 = sys.version_info > (3, 3);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo_'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 14 443 ↑0.0/day
Very Risky
base pypi 8.0.0.2.0.99.dev35 Agile Business Group & Domsense, Pegueroles SCP, NaN,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Report to printer
Claimed homepage: http://www.agilebg.com
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 443 lines, 30.6 kB across 10 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_report_to_printer-8.0.0.2.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_report_to_printer-8.0.0.2.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_report_to_printer-8.0.0.2.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_report_to_printer-8.0.0.2.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 0 157 ↑0.0/day
Very Risky
base pypi 8.0.1.0.0.99.dev34 OdooMRP team, AvanzOSC, Serv. Tecnol. Avanzados - Pedro M. Baeza, Odoo Community Association (OCA), support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Report qweb auto generation
Claimed homepage: http://www.odoomrp.com
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 157 lines, 8.8 kB across 6 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3452 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_report_auto_create_qweb-8.0.1.0.0.99.dev34-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_report_auto_create_qweb-8.0.1.0.0.99.dev34-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_report_auto_create_qweb-8.0.1.0.0.99.dev34-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_report_auto_create_qweb-8.0.1.0.0.99.dev34-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 6 87 ↑0.0/day
Very Risky
base pypi 8.0.1.0.0.99.dev4 Camptocamp,Sunflower IT,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Deduplicate Contacts (OCA)
Claimed homepage: https://pypi.org/project/odoo8-addon-base-partner-merge/
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 87 lines, 4.5 kB across 8 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_partner_merge-8.0.1.0.0.99.dev4-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_partner_merge-8.0.1.0.0.99.dev4-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_partner_merge-8.0.1.0.0.99.dev4-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_partner_merge-8.0.1.0.0.99.dev4-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 31 803 ↑0.0/day
Very Risky
base pypi 8.0.1.0.0.99.dev38 OpenERP SA,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Modules Technical Guides in RST and Relationship Graphs
Claimed homepage: https://odoo-community.org/
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 31/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 803 lines, 37.3 kB across 9 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOEstablished pre-AI legacy package registered 3466 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_module_doc_rst-8.0.1.0.0.99.dev38-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_module_doc_rst-8.0.1.0.0.99.dev38-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in odoo_addons/base_module_doc_rst/base_module_doc_rst.py:173
  • HIGHSYNTAX_ERROR_IN_odoo_addons/base_module_doc_rst/wizard/tech_rst_guide.py: multiple exception types must be parenthesized (<unknown>, line 76)
  • INFOSubstantial functional codebase (803 LOC across 9 file(s)).
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_module_doc_rst-8.0.1.0.0.99.dev38-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_module_doc_rst-8.0.1.0.0.99.dev38-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in odoo_addons/base_module_doc_rst/base_module_doc_rst.py:173
  • SYNTAX_ERROR_IN_odoo_addons/base_module_doc_rst/wizard/tech_rst_guide.py: multiple exception types must be parenthesized (<unknown>, line 76)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 14 174 ↑0.0/day
Very Risky
base pypi 8.0.1.3.0.99.dev35 Daniel Reis,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: External Database Sources
Claimed homepage: http://launchpad.net/addons-tko
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 14/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 174 lines, 10.0 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_external_dbsource-8.0.1.3.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_external_dbsource-8.0.1.3.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in odoo_addons/base_external_dbsource/base_external_dbsource.py:107
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_external_dbsource-8.0.1.3.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_external_dbsource-8.0.1.3.0.99.dev35-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in odoo_addons/base_external_dbsource/base_external_dbsource.py:107

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 18 131 ↑0.0/day
Very Risky
base pypi 8.0.1.0.0.99.dev46 Antiun Ingeniería S.L., Incaser Informatica S.L., Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Add custom field in models
Claimed homepage: http://www.antiun.com
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 18/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 131 lines, 5.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3451 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_custom_info-8.0.1.0.0.99.dev46-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_custom_info-8.0.1.0.0.99.dev46-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_custom_info-8.0.1.0.0.99.dev46-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_custom_info-8.0.1.0.0.99.dev46-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
140 3480d 10 117 ↑0.0/day
Very Risky
base pypi 8.0.1.1.0.99.dev22 Camptocamp,Odoo Community Association (OCA) support@odoo-community.org odoo-community.org 🪝 ⚡
Package purpose: Base Concurrency
Claimed homepage: http://camptocamp.com
Matched naming pattern: odoo8-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3480
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 117 lines, 8.2 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 3452 days ago (predates modern AI hallucination waves).
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_concurrency-8.0.1.1.0.99.dev22-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • CRITICALPYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_concurrency-8.0.1.1.0.99.dev22-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
Static code signals:
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'sys' imported in odoo8_addon_base_concurrency-8.0.1.1.0.99.dev22-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'
  • PYTHON_PTH_CODE_EXECUTION: Dangerous startup module 'os' imported in odoo8_addon_base_concurrency-8.0.1.1.0.99.dev22-py3.8-nspkg.pth: 'import sys, types, os;has_mfs = sys.version_info > (3, 5);p = os.path.join(sys._getframe(1).f_locals['sitedir'], *('odoo'

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
« Prev Next »
LINK COPIED TO CLIPBOARD