🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 743 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 752 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: okta-okta-breki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 751 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 753 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 8 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 733 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 11 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 742 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 9 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 744 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: okta-okta-kyuki
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 751 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 9 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: higgs-google-warp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 454 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'higgs-avior-warp-google' matches AI hallucination template [higgs] + [google] + [warp].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 748 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 454 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 11 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: exec-gemini-hydra
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'exec-gemini-hydra-hapi' matches AI hallucination template [exec] + [gemini] + [hydra].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 745 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 9 12 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: nightwatch-google-postcss
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 500 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'nightwatch-transhumanism-postcss-loader-google' matches AI hallucination template [nightwatch] + [google] + [postcss].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 745 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 500 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 6 12 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-request
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 482 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 739 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 482 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 8 12 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: dotenv-auth0-variables
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 488 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'dotenv-parse-variables-csrf-auth0-adonis' matches AI hallucination template [dotenv] + [auth0] + [variables].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 746 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 488 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 11 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: darkenergy-gemini-gemini
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 476 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'darkenergy-native-gemini-resolvers' matches AI hallucination template [darkenergy] + [gemini] + [gemini].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 749 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 476 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 9 12 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: spinner-auth0-auth0
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 480 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'spinner-dendrochronology-auth0-mensa' matches AI hallucination template [spinner] + [auth0] + [auth0].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 753 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 480 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 7 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: sagitta-jupiter-jupiter
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sagitta-hexo-jupiter-gacrux' matches AI hallucination template [sagitta] + [jupiter] + [jupiter].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 739 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 14 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: auth0-auth0-quantumfoam
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 747 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 9 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: sagitta-gemini-nashira
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 466 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sagitta-gemini-nashira-thuban' matches AI hallucination template [sagitta] + [gemini] + [nashira].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 752 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 466 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 11 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: miranda-auth0-saturnology
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'miranda-auth0-saturnology-zenith' matches AI hallucination template [miranda] + [auth0] + [saturnology].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 750 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 11 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: javascript-auth0-selenology
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'javascript-auth0-selenology-blaze' matches AI hallucination template [javascript] + [auth0] + [selenology].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 744 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 17 12 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: janus-gemini-gemini
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 486 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'janus-scorpius-gemini-gravitationalwave' matches AI hallucination template [janus] + [gemini] + [gemini].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 749 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 486 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 3 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: holography-jupiter-restart
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 3/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'holography-ursa-restart-jupiter' matches AI hallucination template [holography] + [jupiter] + [restart].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 742 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 15 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: duplex-gemini-resolvers
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 466 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'duplex-gemini-resolvers-norma' matches AI hallucination template [duplex] + [gemini] + [resolvers].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 744 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 466 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 6 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: phenomic-gemini-gemini
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 476 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'phenomic-polaris-gemini-playwright' matches AI hallucination template [phenomic] + [gemini] + [gemini].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 735 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 476 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 13 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: gemini-gemini-hologram
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 478 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 754 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 478 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 759d 10 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: cybernetics-gemini-boson
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 759
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'cybernetics-gemini-boson-centauri' matches AI hallucination template [cybernetics] + [gemini] + [boson].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 744 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 8 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: mineralogy-gemini-remark
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'mineralogy-gemini-remark-phoebe' matches AI hallucination template [mineralogy] + [gemini] + [remark].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 736 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 8 12 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: hawkingradiation-gemini-perseus
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 494 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'hawkingradiation-saturnology-perseus-gemini' matches AI hallucination template [hawkingradiation] + [gemini] + [perseus].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 743 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 494 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 12 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security.1 — —
Package purpose: security holding package
Matched naming pattern: cygnus-gemini-xanthus
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 458 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'cygnus-gemini-xanthus-pm2' matches AI hallucination template [cygnus] + [gemini] + [xanthus].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 754 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 458 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 12 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: procyon-jupiter-meteor
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 458 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'procyon-xo-meteor-jupiter' matches AI hallucination template [procyon] + [jupiter] + [meteor].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 747 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 458 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 7 13 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-bootstrap
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 13 lines, 520 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 734 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (13 LOC, 2 file(s), 520 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 8 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: gemini-gemini-server
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 478 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 738 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 478 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 7 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: exoplanet-auth0-sagitta
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'exoplanet-hexo-sagitta-auth0' matches AI hallucination template [exoplanet] + [auth0] + [sagitta].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 737 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 15 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: gemini-gemini-superagent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 476 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 756 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 476 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 9 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: auth0-auth0-proxima
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 737 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 11 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: css-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 466 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'css-loader-google-jabbah-orbit' matches AI hallucination template [css] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 745 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 466 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 14 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: writable-gemini-pavo
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'writable-gemini-pavo-jabbah' matches AI hallucination template [writable] + [gemini] + [pavo].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 754 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 4 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: whitedwarf-auth0-auth0
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 466 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'whitedwarf-kaus-auth0-membrane' matches AI hallucination template [whitedwarf] + [auth0] + [auth0].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 742 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 466 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 8 12 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: sass-jupiter-jupiter
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 502 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sass-loader-jupiter-coronalmassejection-filament' matches AI hallucination template [sass] + [jupiter] + [jupiter].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 750 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 502 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 9 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: mantle-auth0-mira
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'mantle-paleoceanography-mira-auth0' matches AI hallucination template [mantle] + [auth0] + [mira].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 752 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 10 12 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-corvus
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 490 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 751 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 490 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 7 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: hologram-auth0-lightyear
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'hologram-taurus-lightyear-auth0' matches AI hallucination template [hologram] + [auth0] + [lightyear].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 741 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 8 12 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: geochronology-jupiter-jupiter
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 512 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'geochronology-markdown-jupiter-dotenv-parse-variables' matches AI hallucination template [geochronology] + [jupiter] + [jupiter].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 750 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 512 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 9 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: auth0-auth0-mutation
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 743 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 8 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: seismology-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'seismology-unuk-google-eleventy' matches AI hallucination template [seismology] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 754 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 12 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-loop
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 754 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 10 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: vulcan-jupiter-scripts
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 464 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'vulcan-jupiter-scripts-module' matches AI hallucination template [vulcan] + [jupiter] + [scripts].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 751 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 464 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 18 11 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: postcss-gemini-sedna
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'postcss-gemini-sedna-markdownlint' matches AI hallucination template [postcss] + [gemini] + [sedna].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 756 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 5 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: vortex-google-plugin
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'vortex-eslint-plugin-google-janus' matches AI hallucination template [vortex] + [google] + [plugin].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 739 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 760d 6 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: uglify-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 760
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'uglify-js-google-rimraf-panspermia' matches AI hallucination template [uglify] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 734 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD