🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 691d 10 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: web3-web3-checker
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 691
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 438 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 438 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 691d 6 10 ↑0.0/day
Possible Squatted Stub
ethers npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-ethers-test
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 691
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 428 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'ethers-test' matches AI hallucination template [node] + [ethers] + [test].
  • HIGHClaims critical enterprise brand identity ('ETHERS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 428 bytes).
  • INFOPackage affiliated with trusted vendor 'ethers' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 691d 7 10 ↑0.0/day
Possible Squatted Stub
ethers npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-ethers-aaa
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 691
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 426 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'ethers-aaa' matches AI hallucination template [node] + [ethers] + [aaa].
  • HIGHClaims critical enterprise brand identity ('ETHERS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 426 bytes).
  • INFOPackage affiliated with trusted vendor 'ethers' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 691d 8 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-web3-helpers.js
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 691
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-helpers.js' matches AI hallucination template [node] + [web3] + [helpers.js].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 691d 9 11 ↑0.0/day
Possible Squatted Stub
solana npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: solana-solana-helpers
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 691
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('SOLANA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'solana' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 691d 7 11 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: web3-web3-helper.js
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 691
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 695d 13 10 ↑0.0/day
Possible Squatted Stub
eth npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-eth-cmeta
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 695
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 424 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'eth-cmeta' matches AI hallucination template [node] + [eth] + [cmeta].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 424 bytes).
  • INFOPackage affiliated with trusted vendor 'eth' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 695d 12 10 ↑0.0/day
Possible Squatted Stub
eth npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-eth-cripto
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 695
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 426 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'eth-cripto' matches AI hallucination template [node] + [eth] + [cripto].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 426 bytes).
  • INFOPackage affiliated with trusted vendor 'eth' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 696d 7 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-web3-toekn
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 696
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 426 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-toekn' matches AI hallucination template [node] + [web3] + [toekn].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 426 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 696d 10 10 ↑0.0/day
Possible Squatted Stub
eth npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-eth-rperrors
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 696
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 430 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'eth-rperrors' matches AI hallucination template [node] + [eth] + [rperrors].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 430 bytes).
  • INFOPackage affiliated with trusted vendor 'eth' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 702d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-bundles
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 702
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 723d 12 10 ↑0.0/day
Possible Squatted Stub
gcp npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: gcp-gcp-prod
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 723
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 438 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GCP').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 438 bytes).
  • INFOPackage affiliated with trusted vendor 'gcp' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 724d 9 10 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ig-aws-aws
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 724
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 434 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'ig-release-aws' matches AI hallucination template [ig] + [aws] + [aws].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 434 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 724d 14 10 ↑0.0/day
Possible Squatted Stub
eth npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-eth-austt
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 724
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 424 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'eth-austt' matches AI hallucination template [node] + [eth] + [austt].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 424 bytes).
  • INFOPackage affiliated with trusted vendor 'eth' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 725d 12 10 ↑0.0/day
Possible Squatted Stub
openai npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-openai-examples
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 725
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'openai-examples' matches AI hallucination template [node] + [openai] + [examples].
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'openai' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 725d 8 10 ↑0.0/day
Possible Squatted Stub
openai npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: openai-openai-test
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 725
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'openai' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 725d 15 11 ↑0.0/day
Possible Squatted Stub
opensea npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: buy-opensea-opensea
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 725
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'buy-sell-opensea-sdk-demo' matches AI hallucination template [buy] + [opensea] + [opensea].
  • HIGHClaims critical enterprise brand identity ('OPENSEA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'opensea' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 10 11 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: aws-aws-ceshi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 731 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 10 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-de
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 492 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 492 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 11 12 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: mianxiang-aws-kaifazhe
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 512 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'mianxiang-ios-kaifazhe-de-aws-he-devops-rumen-zhinan' matches AI hallucination template [mianxiang] + [aws] + [kaifazhe].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 512 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 7 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: kubernetes-azure-shiyong
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'kubernetes-azure-shiyong-zhinan' matches AI hallucination template [kubernetes] + [azure] + [shiyong].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 9 11 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: kubernetes-aws-shouce
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'kubernetes-aws-shouce' matches AI hallucination template [kubernetes] + [aws] + [shouce].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 5 11 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: docker-aws-jiaocheng
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'docker-aws-jiaocheng' matches AI hallucination template [docker] + [aws] + [jiaocheng].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 9 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-de
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 476 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 476 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 8 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-shiyong
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 14 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-fuwuqi
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 498 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 498 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 14 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-fuwu
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 12 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-net
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 466 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 466 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 6 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-shiyong
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 13 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: azure-azure-kubernetes
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 488 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 488 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 9 10 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: tujie-google-v8
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'tujie-google-v8' matches AI hallucination template [tujie] + [google] + [v8].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 732d 10 11 ↑0.0/day
Possible Squatted Stub
chainlink npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: chainlink-chainlink-zh
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 732
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CHAINLINK').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'chainlink' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 733d 10 11 ↑0.0/day
Possible Squatted Stub
gcp npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: handson-gcp-gcp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 733
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'handson-ai-gcp-zh' matches AI hallucination template [handson] + [gcp] + [gcp].
  • HIGHClaims critical enterprise brand identity ('GCP').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'gcp' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 733d 11 11 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: apachecn-web3-wiki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 733
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'apachecn-web3-wiki' matches AI hallucination template [apachecn] + [web3] + [wiki].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 745d 9 5 ↑0.0/day
Possible Squatted Stub
copilot npm 0.0.0 Gregor Martynus —
Package purpose: Copilot integration providing agent utility for Create
Matched naming pattern: create-copilot-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 745
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 116 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-copilot-agent' matches AI hallucination template [create] + [copilot] + [agent].
  • HIGHClaims critical enterprise brand identity ('COPILOT').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 734 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 116 bytes).
  • INFOPackage affiliated with trusted vendor 'copilot' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 745d 15 5 ↑0.0/day
Possible Squatted Stub
copilot npm 0.0.0 Gregor Martynus —
Package purpose: Copilot integration providing extension utility for Create
Matched naming pattern: create-copilot-extension
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 745
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 120 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-copilot-extension' matches AI hallucination template [create] + [copilot] + [extension].
  • HIGHClaims critical enterprise brand identity ('COPILOT').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 742 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 120 bytes).
  • INFOPackage affiliated with trusted vendor 'copilot' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 747d 8 10 ↑0.0/day
Possible Squatted Stub
stripe npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: stripe-stripe-v3
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 747
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 438 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 739 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 438 bytes).
  • INFOPackage affiliated with trusted vendor 'stripe' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 749d 10 5 ↑0.0/day
Possible Squatted Stub
stripe npm 0.0.0 — —
Package purpose: Stripe integration providing setup utility for Node
Matched naming pattern: node-stripe-setup
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 749
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 51 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'setup-stripe' matches AI hallucination template [node] + [stripe] + [setup].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 743 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 51 bytes).
  • INFOPackage affiliated with trusted vendor 'stripe' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 8 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 737 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 753 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 5 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 734 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 10 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 438 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 753 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 438 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 2 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-gado45
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 2/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 741 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 756 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 748 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 748 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 12 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 755 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 741 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 750 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 750 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD