🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
llama npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: relative-llama-llama
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'relative-gray-llama' matches AI hallucination template [relative] + [llama] + [llama].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 308 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'llama' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: secret-azure-eel
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'secret-azure-eel' matches AI hallucination template [secret] + [azure] + [eel].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: sick-azure-canid
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sick-azure-canid' matches AI hallucination template [sick] + [azure] + [canid].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 312 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 318 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 300 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: liable-azure-dragon
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'liable-azure-dragon' matches AI hallucination template [liable] + [azure] + [dragon].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 313 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 7 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 304 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 300 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: zesty-azure-hedgehog
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'zesty-azure-hedgehog' matches AI hallucination template [zesty] + [azure] + [hedgehog].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 303 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 7 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: western-azure-bee
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'western-azure-bee' matches AI hallucination template [western] + [azure] + [bee].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: fast-azure-parrotfish
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'fast-azure-parrotfish' matches AI hallucination template [fast] + [azure] + [parrotfish].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 323 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 305 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 322 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 310 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 311 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 14 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-gado47
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 311 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 310 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 14 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: remote-azure-magpie
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'remote-azure-magpie' matches AI hallucination template [remote] + [azure] + [magpie].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 305 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sukiwir
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 315 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 14 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: alert-azure-hookworm
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'alert-azure-hookworm' matches AI hallucination template [alert] + [azure] + [hookworm].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 301 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: underlying-azure-cheetah
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'underlying-azure-cheetah' matches AI hallucination template [underlying] + [azure] + [cheetah].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 302 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 16 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-devapp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: willing-azure-elephant
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'willing-azure-elephant' matches AI hallucination template [willing] + [azure] + [elephant].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 318 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: uneven-azure-egret
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'uneven-azure-egret' matches AI hallucination template [uneven] + [azure] + [egret].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 302 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: possible-azure-bass
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'possible-azure-bass' matches AI hallucination template [possible] + [azure] + [bass].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 320 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 310 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 300 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 301 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 313 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 300 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: automatic-azure-python
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'automatic-azure-python' matches AI hallucination template [automatic] + [azure] + [python].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 316 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 16 11 ↑0.0/day
Possible Squatted Stub
llama npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: willing-llama-llama
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'willing-lavender-llama' matches AI hallucination template [willing] + [llama] + [llama].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'llama' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 7 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: sweet-azure-pigeon
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sweet-azure-pigeon' matches AI hallucination template [sweet] + [azure] + [pigeon].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 319 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: beneficial-azure-constrictor
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 464 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'beneficial-azure-constrictor' matches AI hallucination template [beneficial] + [azure] + [constrictor].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 464 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 14 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: educational-azure-carp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'educational-azure-carp' matches AI hallucination template [educational] + [azure] + [carp].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 306 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 8 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: foolish-azure-pig
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'foolish-azure-pig' matches AI hallucination template [foolish] + [azure] + [pig].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 308 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-miaww
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 14 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: distinguished-azure-damselfly
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 466 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'distinguished-azure-damselfly' matches AI hallucination template [distinguished] + [azure] + [damselfly].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 307 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 466 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (85 -> 42) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-devapp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 315 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-devapp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 310 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 14 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-ruro
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 321 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-riris
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 312 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 326d 13 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-sluey
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 326
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • MEDIUMPackage registered 310 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (60 -> 30) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD