Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 129d | — | — | — |
Unverified Signal
|
— | npm | latest | Abdul Kareem | — | 🪝 🌐 | |
|
Package purpose: Madarx OS — Next.js product with SQLite-backed runtime, scheduled cron daemon, and approval-gated local runners.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 130d | — | — | — |
Unverified Signal
|
— | npm | latest | FJRG2007 | — | 🪝 🌐 | |
|
Package purpose: Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 130d | — | — | — |
SUSPICIOUS
|
— | npm | latest | mumulinya167 | — | 🪝 🌐 | |
|
Package purpose: 本地优先的多 Agent 协作与自动开发工作区，集成任务编排、记忆上下文、MCP/Skill、TestAgent、Git、飞书、知识库和终端
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 132d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: local-first CLI for reviewing, navigating, and discussing git diffs with AI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 134d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Use Claude Code from your browser. Runs a local server that connects your browser tools to the Claude CLI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 135d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Unified Payment Gateway SDK for Node.js & TypeScript — 21 providers (Midtrans, Xendit, Duitku, Stripe, PayPal, Adyen, Razorpay, Square, Checkout.com, PayU, Braintree, 2Checkout, DOKU, iPaymu, PrismaLink, Faspay, Finpay, Nicepay, OY!, SumoPod, Xenith) with
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 136d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 🐛 | |
|
Package purpose: Bluerouter CLI - Start and manage Bluerouter server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 137d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Andrew Ge Wu | — | 🪝 🌐 | |
|
Package purpose: Jarela — local chat interface for LangGraph agents (multi-provider, single-process, SQLite-backed).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 139d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: GSD Pi local-first coding agent
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 141d | 144 | 198 | ↑1.0/day |
Very Risky
|
webnori | npm | 0.15.1 | psmon | — | 🪝 🌐 | |
|
Package purpose: CLI/TUI/GUI source-code scanner with FTS5 search and git blame. (npm wrapper around the prebuilt CodeScan binary.)
Claimed homepage: https://github.com/psmon/CodeScan
Matched naming pattern: node-webnori-codescan-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 141
Registry downloads: 144/month, 36/week (MODERATE_USAGE)
Codebase size: 198 lines, 8.1 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 142d | — | — | — |
Unverified Signal
|
— | npm | latest | tapflow contributors | — | 🪝 🌐 | |
|
Package purpose: iOS simulator agent for tapflow — xcrun simctl control and screen streaming
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 143d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Saluzi CLI - interactive AI coding assistant in the terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 147d | — | — | — |
Very Risky
|
— | npm | latest | robit-man | — | 🪝 🌐 | |
|
Package purpose: AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 149d | — | — | — |
Unverified Signal
|
— | npm | latest | leviyuan | — | 🪝 🌐 | |
|
Package purpose: Lodestar (夜航星) — IM-native frontend for Codex, Claude Agent SDK and DeepSeek Harness via Feishu Card Kit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 149d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: CLI for Amp, the frontier agent and development environment.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 153d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: APX — unified CLI + daemon for the Agent Project Context (APC) standard.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 155d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Multi-channel AI gateway with extensible messaging integrations
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 156d | — | — | — |
Unverified Signal
|
— | npm | latest | Griffin Long | — | 🪝 🌐 | |
|
Package purpose: Open-source coding-agent harness you can actually change — own the loop (prompts, gates, routing, skills, terminal states), use any model, run long tasks while you're away.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 156d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AI coding agent for Aexol with relay-based browser access.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 156d | — | — | — |
Very Risky
|
— | npm | latest | Christian Egger | — | 🪝 🌐 | |
|
Package purpose: AWS Lambda-specific Node.js runtime wrapper for the Obscura browser binary.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 159d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Bob Frankston | — | 🪝 🌐 | |
|
Package purpose: Local-first email client with IMAP sync and standalone native app
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 161d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Bridge between Gemini CLI and Antigravity iOS app via Supabase
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 166d | — | — | — |
Unverified Signal
|
— | npm | latest | LIFEAI | — | 🪝 🌐 | |
|
Package purpose: RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 166d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 167d | — | — | — |
Unverified Signal
|
— | npm | latest | DeepPulse | — | 🪝 🌐 | |
|
Package purpose: Legacy name of sprag-cli (Sprag) - same tool, kept publishing so existing installs stay current. Prefer: npm i -g sprag-cli
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 167d | — | — | — |
Unverified Signal
|
— | npm | latest | Hanzla Habib | — | 🪝 🌐 | |
|
Package purpose: rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 168d | — | — | — |
Unverified Signal
|
— | npm | latest | Oskar Freye | — | 🪝 🌐 | |
|
Package purpose: Draht GSD, multi-agent, TDD and DDD workflows as a Claude Code plugin. Install with `npx draht-claude install`.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 170d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MulmoClaude — GUI-chat with Claude Code + long-term memory. One command to start.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 170d | 4,001 | 493 | ↑23.5/day |
Very Risky
|
xkat | npm | 3.1.15 | SomiLab contact@somilab.com | somilab.com | 🪝 🌐 | |
|
Package purpose: xkat-cli - an AI agent that securely connects your browser to your machine
Claimed homepage: https://xkat.space
Matched naming pattern: npm-xkat-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 170
Registry downloads: 4001/month, 1000/week (ACTIVE_COMMUNITY_USE)
Codebase size: 493 lines, 19.0 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Claude Code Node.js restored — android-arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Claude Code Node.js restored — win32-arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Claude Code Node.js restored — linux-arm64-musl
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Claude Code Node.js restored — linux-arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Claude Code Node.js restored — darwin-x64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
Unverified Signal
|
— | npm | latest | Phoenix Labs | — | 🪝 🌐 | |
|
Package purpose: One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Atoll CLI — project management from the terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 172d | — | — | — |
Unverified Signal
|
— | npm | latest | CI&T Flow Team | — | 🪝 🌐 | |
|
Package purpose: Claude Code hooks for Langfuse OTLP tracing — cross-platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 172d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Agentic software development platform — AI-driven PRD, implementation, and beyond
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 172d | — | — | — |
Unverified Signal
|
— | npm | latest | Andrei Hasna | — | 🪝 🌐 | |
|
Package purpose: High-level project management CLI, MCP server, SDK, and AI SDK agent loop for coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 172d | — | — | — |
Unverified Signal
|
— | npm | latest | Lincoln Deen | — | 🪝 🌐 | |
|
Package purpose: Web research for your agents with smart and safe tooling + knowledge store
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 173d | — | — | — |
Unverified Signal
|
— | npm | latest | Quo / クオ at kitepon.dev | kitepon.dev | 🪝 🌐 | |
|
Package purpose: Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 173d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 173d | — | — | — |
Unverified Signal
|
— | npm | latest | Alexander Velikiy | — | 🪝 🌐 | |
|
Package purpose: One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 175d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server for iOS Simulator and Android Emulator control
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 179d | — | — | — |
SUSPICIOUS
|
— | npm | latest | bilkobibitkov | — | 🪝 🌐 | |
|
Package purpose: Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 179d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Code intelligence graph — MCP server + AI agent skills + visualization UI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 181d | — | — | — |
Very Risky
|
— | npm | latest | Edgar Durand | — | 🪝 🌐 | |
|
Package purpose: Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 181d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Jerico Team | — | 🪝 🌐 | |
|
Package purpose: Bridge local agent — connects your AI tools to Jerico
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 181d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 181d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||