🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 302 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 314 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 7 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 306 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 6 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 301 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 15 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: adverse-azure-mosquito
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'adverse-azure-mosquito' matches AI hallucination template [adverse] + [azure] + [mosquito].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 16 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: amused-azure-leopard
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'amused-azure-leopard' matches AI hallucination template [amused] + [azure] + [leopard].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 312 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: grieving-azure-piranha
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'grieving-azure-piranha' matches AI hallucination template [grieving] + [azure] + [piranha].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 324 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 308 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 322 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 314 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 302 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 314 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 306 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
llama npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: passing-llama-llama
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'passing-green-llama' matches AI hallucination template [passing] + [llama] + [llama].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 310 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'llama' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 313 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 303 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 15 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 304 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 316 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 311 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 319 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: youngest-azure-silkworm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 454 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'youngest-azure-silkworm' matches AI hallucination template [youngest] + [azure] + [silkworm].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 301 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 454 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: drab-azure-mosquito
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'drab-azure-mosquito' matches AI hallucination template [drab] + [azure] + [mosquito].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 305 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 309 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 316 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: sweet-azure-finch
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sweet-azure-finch' matches AI hallucination template [sweet] + [azure] + [finch].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 316 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: definite-azure-bandicoot
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'definite-azure-bandicoot' matches AI hallucination template [definite] + [azure] + [bandicoot].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 318 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 14 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 312 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 308 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 311 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 322 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 23 11 ↑0.1/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 23/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 313 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 6 11 ↑0.0/day
Possible Squatted Stub
llama npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: ill-llama-llama
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'ill-chocolate-llama' matches AI hallucination template [ill] + [llama] + [llama].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 306 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'llama' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 6 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: worldwide-azure-blackbird
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 458 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'worldwide-azure-blackbird' matches AI hallucination template [worldwide] + [azure] + [blackbird].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 325 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 458 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: striking-azure-sole
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'striking-azure-sole' matches AI hallucination template [striking] + [azure] + [sole].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: distinctive-azure-python
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'distinctive-azure-python' matches AI hallucination template [distinctive] + [azure] + [python].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 316 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 315 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 305 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 304 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 314 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD