Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 73d | — | — | — |
SUSPICIOUS
|
— | npm | latest | https://github.com/underpostnet | github.com | 🪝 🌐 | |
|
Package purpose: Cyberia CLI — toolchain for the Cyberia MMO data layer, content pipeline, persistence, gRPC services, and ERC-1155 lifecycle on Hyperledger Besu.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 73d | — | — | — |
Unverified Signal
|
— | npm | latest | shadok-ai-dev | — | 🪝 🌐 | |
|
Package purpose: Web cockpit that drives multiple real Claude Code TUI sessions in parallel, with Telegram control
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 73d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Native Messaging Host for Mearl — bridges Chrome Extension and local socket server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 73d | — | — | — |
Unverified Signal
|
— | npm | latest | Gutierrez Henrique | — | 🪝 🌐 | |
|
Package purpose: MCP server and installer for Vault Memory: search, capture, and use account memory across AI clients.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 75d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Cloudflare plugin for Vite (with updated dependencies)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 75d | — | — | — |
Very Risky
|
— | npm | latest | Vexify | — | 🪝 🌐 | |
|
Package purpose: JSQL-NEO — Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 76d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Kirill Dubovitskiy | — | 🪝 🌐 | |
|
Package purpose: A+ Dev Studio fork of slopus/happy. Mobile and Web client for Claude Code and Codex.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 76d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CTRL+SPC — minimal, reliable per-machine agent presence. Sign-in, auto-start, agent detection, heartbeat presence, and ping acknowledgement.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 77d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Run coding agents on machines you own. Open-source, self-hostable agent workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 77d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A complete web-based terminal application with modern UI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 78d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLI coding agent. Requires **Node.js 22** or newer (`engines.node`).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 79d | — | — | — |
Unverified Signal
|
— | npm | latest | vanillagreen, maintained by fractaal | — | 🪝 🌐 | |
|
Package purpose: Pi provider bridge that runs Claude Code through the Claude Agent SDK.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 80d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Build, test, and deploy BDK bots and agents as code on Cursor's agent harness.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 81d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Install the Negotium multi-agent runtime and CLI with one package
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 81d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AI Traffic Control — inspect and govern AI prompts in Claude Code
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 83d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 84d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: Search GitHub from your terminal — repo search, trending repos, npm package search, bookmarks, deep-dive, compare, export. Keyboard-driven TUI + pipeable CLI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 87d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Kirill Dubovitskiy | — | 🪝 🌐 | |
|
Package purpose: Mobile and Web client for Claude Code and Codex (fork of happy)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 88d | — | — | — |
SUSPICIOUS
|
— | npm | latest | wangjs-jacky | — | 🪝 🌐 | |
|
Package purpose: Mobile and Web client for Claude Code and Codex
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 89d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Multi-account proxy server for OpenAI Codex CLI with Claude API compatibility
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 89d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: All-in-one multi-agent orchestration for the Pi coding agent — parallel teammate dispatch, goals, plans, knowledge system, MCP/LSP/browser, and cockpit visualization in a single install
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 90d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Human control plane for agent execution — queue, plan approval, audit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 91d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: DurinDoor CLI - Start and manage DurinDoor server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 92d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Nolgia CLI: generate images, video, and audio on the Nolgia platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 96d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: ERD Builder Pro CLI — one command to start your database design workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 97d | — | — | — |
Unverified Signal
|
— | npm | latest | re77 | — | 🪝 🌐 | |
|
Package purpose: ETTORE - Advanced AI CLI Assistant
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 97d | — | — | — |
Very Risky
|
— | npm | latest | MooCoding | — | 🪝 🌐 | |
|
Package purpose: [BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 97d | — | — | — |
Unverified Signal
|
— | npm | latest | Junghan Kim | — | 🪝 🌐 | |
|
Package purpose: Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 97d | 6,035 | 249,980 | ↑62.2/day |
Very Risky
|
tianshu | npm | 3.20.0 | — | — | 🪝 🗄️ | |
|
Package purpose: Cognitive runtime (CVM) for coding agents — stable, evidence-gated delivery; prefix cache works with all models (98–99% hit rate)
Claimed homepage: https://github.com/huiliyi37/Tianshu-Tui#readme
Matched naming pattern: node-tianshu-tui
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 97
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6035/month, 1508/week (ACTIVE_COMMUNITY_USE)
Codebase size: 249980 lines, 10.5 MB across 195 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 101d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: cc-code — Terminal coding agent powered by open-source models — Rust-built, Claude Code compatible
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 102d | — | — | — |
Very Risky
|
— | npm | latest | Meta Open Source | — | 🪝 🌐 | |
|
Package purpose: Scaffold projects, browse templates, generate themes, and get agent-ready docs from the command line.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 104d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Edward Becker | — | 🪝 🌐 | |
|
Package purpose: Multi-agent orchestration for AI coding assistants (Claude Code, Codex, Cursor, Gemini CLI)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 107d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Kirill Dubovitskiy | — | 🪝 🌐 | |
|
Package purpose: Remote multi-agent workspace CLI with deep Claude integration, native terminal streaming, and self-hosting.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 108d | — | — | — |
Unverified Signal
|
— | npm | latest | Zhachory Volker | — | 🪝 🌐 | |
|
Package purpose: Me Write Code — a terminal coding agent
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 108d | — | — | — |
Unverified Signal
|
— | npm | latest | Ronen Mars | — | 🪝 🌐 | |
|
Package purpose: PTY session management, WebSocket streaming, and REST API server for Claude Code conversations
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 108d | — | — | — |
Unverified Signal
|
— | npm | latest | Mohit Aggarwal | — | 🪝 🌐 | |
|
Package purpose: 1174 professional Agent Skills (SKILL.md) + subagents + slash commands for Claude, ChatGPT, Gemini, Cursor, Codex & Hermes. It's a CLI, not a library: run `npx pm-claude-skills add --agent <tool>` to install into your AI tool — no `npm install` needed. Or
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 109d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: ChatGPT Plus/Pro OAuth support for [OpenCode](https://opencode.ai).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 109d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Standalone mixdog coding-agent CLI/TUI workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 110d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 111d | — | — | — |
SUSPICIOUS
|
— | npm | latest | staqs | — | 🪝 🌐 | |
|
Package purpose: Developer jobs and paid bounties, matched in the terminal — ambient matches in the Claude Code spinner. Claim a scoped bounty and get paid when the poster accepts it.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 112d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Fleet Console — sole owner of the fleet and fleet-console bins, Console web surface, and thin Claude Code launcher.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 113d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: UnDercontrol backend server - self-hosted task & knowledge management
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | — | — | — |
Unverified Signal
|
— | npm | latest | Roarpeng | — | 🪝 🌐 | |
|
Package purpose: Local-first memory & context harness for coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | 950 | 244 | ↑8.3/day |
Very Risky
|
pi | npm | 0.1.21 | lucasvidela94 | — | 🪝 🌐 | |
|
Package purpose: Google Calendar & Gmail MCP server for Pi — login once, manage your calendar and emails from your AI agent.
Claimed homepage: https://github.com/lucasvidela94/pi-google-services
Matched naming pattern: pi-pi-services
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 115
Registry downloads: 950/month, 237/week (MODERATE_USAGE)
Codebase size: 244 lines, 8.5 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AI-native notebook computing environment — real Jupyter kernels, real filesystem, built to be driven by agents (Claude Code / Codex) via MCP
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | — | — | — |
Unverified Signal
|
— | npm | latest | HYVE | — | 🪝 🌐 | |
|
Package purpose: HYVE CLI — instala, autentica e mantém o HYVE System atualizado
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | — | — | — |
Unverified Signal
|
— | npm | latest | Christian Wagner | — | 🪝 🌐 | |
|
Package purpose: Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | — | — | — |
Unverified Signal
|
— | npm | latest | Mehmood Ur Rehman Qureshi | — | 🪝 🌐 | |
|
Package purpose: Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 117d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Cotal connector for Claude Code: an installed plugin that joins a session to the mesh.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 117d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||