Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 90d | — | — | — |
SUSPICIOUS
|
— | npm | latest | wangjs-jacky | — | 🪝 🌐 | |
|
Package purpose: Mobile and Web client for Claude Code and Codex
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 92d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Multi-account proxy server for OpenAI Codex CLI with Claude API compatibility
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 92d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: All-in-one multi-agent orchestration for the Pi coding agent — parallel teammate dispatch, goals, plans, knowledge system, MCP/LSP/browser, and cockpit visualization in a single install
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 93d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Human control plane for agent execution — queue, plan approval, audit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 94d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: DurinDoor CLI - Start and manage DurinDoor server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 99d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: ERD Builder Pro CLI — one command to start your database design workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 99d | — | — | — |
Unverified Signal
|
— | npm | latest | re77 | — | 🪝 🌐 | |
|
Package purpose: ETTORE - Advanced AI CLI Assistant
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 100d | — | — | — |
Very Risky
|
— | npm | latest | MooCoding | — | 🪝 🌐 | |
|
Package purpose: [BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 100d | — | — | — |
Unverified Signal
|
— | npm | latest | Junghan Kim | — | 🪝 🌐 | |
|
Package purpose: Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 100d | 6,035 | 249,980 | ↑60.4/day |
Very Risky
|
tianshu | npm | 3.20.0 | — | — | 🪝 🗄️ | |
|
Package purpose: Cognitive runtime (CVM) for coding agents — stable, evidence-gated delivery; prefix cache works with all models (98–99% hit rate)
Claimed homepage: https://github.com/huiliyi37/Tianshu-Tui#readme
Matched naming pattern: node-tianshu-tui
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 100
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 6035/month, 1508/week (ACTIVE_COMMUNITY_USE)
Codebase size: 249980 lines, 10.5 MB across 195 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 102d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AWS adapters for Reventless
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 104d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: cc-code — Terminal coding agent powered by open-source models — Rust-built, Claude Code compatible
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 104d | — | — | — |
Very Risky
|
— | npm | latest | Meta Open Source | — | 🪝 🌐 | |
|
Package purpose: Scaffold projects, browse templates, generate themes, and get agent-ready docs from the command line.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 106d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Edward Becker | — | 🪝 🌐 | |
|
Package purpose: Multi-agent orchestration for AI coding assistants (Claude Code, Codex, Cursor, Gemini CLI)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 110d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Kirill Dubovitskiy | — | 🪝 🌐 | |
|
Package purpose: Remote multi-agent workspace CLI with deep Claude integration, native terminal streaming, and self-hosting.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 110d | — | — | — |
Unverified Signal
|
— | npm | latest | Zhachory Volker | — | 🪝 🌐 | |
|
Package purpose: Me Write Code — a terminal coding agent
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 110d | — | — | — |
Unverified Signal
|
— | npm | latest | Ronen Mars | — | 🪝 🌐 | |
|
Package purpose: PTY session management, WebSocket streaming, and REST API server for Claude Code conversations
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 111d | — | — | — |
Unverified Signal
|
— | npm | latest | Mohit Aggarwal | — | 🪝 🌐 | |
|
Package purpose: 1174 professional Agent Skills (SKILL.md) + subagents + slash commands for Claude, ChatGPT, Gemini, Cursor, Codex & Hermes. It's a CLI, not a library: run `npx pm-claude-skills add --agent <tool>` to install into your AI tool — no `npm install` needed. Or
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 112d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: ChatGPT Plus/Pro OAuth support for [OpenCode](https://opencode.ai).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 112d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Standalone mixdog coding-agent CLI/TUI workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 112d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 114d | — | — | — |
SUSPICIOUS
|
— | npm | latest | staqs | — | 🪝 🌐 | |
|
Package purpose: Developer jobs and paid bounties, matched in the terminal — ambient matches in the Claude Code spinner. Claim a scoped bounty and get paid when the poster accepts it.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Fleet Console — sole owner of the fleet and fleet-console bins, Console web surface, and thin Claude Code launcher.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 115d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Infinite | — | 🪝 🌐 | |
|
Package purpose: Founder-run installer that adds analytics (the Infinite first-party pixel, Google Analytics 4, PostHog, X/Twitter Pixel, Meta Pixel) to your web app — public keys only, idempotent, and reversible. --server-lane adds the lossless server lane: every HTML do
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 116d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLI coding agent with read, bash, edit, write tools and session management. Supports DashScope and Ali Token Plan. Persona-based identity and built-in decision skills.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 116d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: UnDercontrol backend server - self-hosted task & knowledge management
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 117d | — | — | — |
Unverified Signal
|
— | npm | latest | Roarpeng | — | 🪝 🌐 | |
|
Package purpose: Local-first memory & context harness for coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 118d | 950 | 244 | ↑8.1/day |
Very Risky
|
pi | npm | 0.1.21 | lucasvidela94 | — | 🪝 🌐 | |
|
Package purpose: Google Calendar & Gmail MCP server for Pi — login once, manage your calendar and emails from your AI agent.
Claimed homepage: https://github.com/lucasvidela94/pi-google-services
Matched naming pattern: pi-pi-services
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 118
Registry downloads: 950/month, 237/week (MODERATE_USAGE)
Codebase size: 244 lines, 8.5 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 118d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AI-native notebook computing environment — real Jupyter kernels, real filesystem, built to be driven by agents (Claude Code / Codex) via MCP
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 118d | — | — | — |
Unverified Signal
|
— | npm | latest | HYVE | — | 🪝 🌐 | |
|
Package purpose: HYVE CLI — instala, autentica e mantém o HYVE System atualizado
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 118d | — | — | — |
Unverified Signal
|
— | npm | latest | Christian Wagner | — | 🪝 🌐 | |
|
Package purpose: Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 118d | — | — | — |
Unverified Signal
|
— | npm | latest | Mehmood Ur Rehman Qureshi | — | 🪝 🌐 | |
|
Package purpose: Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 120d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Cotal connector for Claude Code: an installed plugin that joins a session to the mesh.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 120d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 123d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 124d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Install and run AgentsCommander, the local terminal session manager for AI coding agent teams with Claude Code, Codex, Hermes, Cursor CLI, OpenCode, and more to come.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 125d | — | — | — |
Very Risky
|
— | npm | latest | Orchard AI | — | 🪝 🌐 | |
|
Package purpose: Installer and launcher for the Orchard CLI native binary.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 126d | 4,186 | 53,468 | ↑33.2/day |
Very Risky
|
@sokdak/happy | npm | 1.2.0-main.30 | Kirill Dubovitskiy | — | 🪝 🗄️ | |
|
Package purpose: Mobile and Web client for Claude Code and Codex
Claimed homepage: https://happy.engineering
Matched naming pattern: node-@sokdak/happy-happy
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 126
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 4186/month, 1046/week (ACTIVE_COMMUNITY_USE)
Codebase size: 53468 lines, 1.9 MB across 37 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 127d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Abdul Kareem | — | 🪝 🌐 | |
|
Package purpose: Madarx OS — Next.js product with SQLite-backed runtime, scheduled cron daemon, and approval-gated local runners.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 128d | — | — | — |
Unverified Signal
|
— | npm | latest | FJRG2007 | — | 🪝 🌐 | |
|
Package purpose: Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 129d | — | — | — |
SUSPICIOUS
|
— | npm | latest | mumulinya167 | — | 🪝 🌐 | |
|
Package purpose: 本地优先的多 Agent 协作与自动开发工作区，集成任务编排、记忆上下文、MCP/Skill、TestAgent、Git、飞书、知识库和终端
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 130d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: local-first CLI for reviewing, navigating, and discussing git diffs with AI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 133d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Use Claude Code from your browser. Runs a local server that connects your browser tools to the Claude CLI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 133d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Unified Payment Gateway SDK for Node.js & TypeScript — 21 providers (Midtrans, Xendit, Duitku, Stripe, PayPal, Adyen, Razorpay, Square, Checkout.com, PayU, Braintree, 2Checkout, DOKU, iPaymu, PrismaLink, Faspay, Finpay, Nicepay, OY!, SumoPod, Xenith) with
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 134d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: Bluerouter CLI - Start and manage Bluerouter server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 136d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Andrew Ge Wu | — | 🪝 🌐 | |
|
Package purpose: Jarela — local chat interface for LangGraph agents (multi-provider, single-process, SQLite-backed).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 137d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: GSD Pi local-first coding agent
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 139d | 144 | 198 | ↑1.0/day |
Very Risky
|
webnori | npm | 0.15.1 | psmon | — | 🪝 🌐 | |
|
Package purpose: CLI/TUI/GUI source-code scanner with FTS5 search and git blame. (npm wrapper around the prebuilt CodeScan binary.)
Claimed homepage: https://github.com/psmon/CodeScan
Matched naming pattern: node-webnori-codescan-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 139
Registry downloads: 144/month, 36/week (MODERATE_USAGE)
Codebase size: 198 lines, 8.1 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 141d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Saluzi CLI - interactive AI coding assistant in the terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 145d | — | — | — |
Very Risky
|
— | npm | latest | robit-man | — | 🪝 🌐 | |
|
Package purpose: AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||