🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 768d 7 11 ↑0.0/day
Possible Squatted Stub
alchemy npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: nymph-alchemy-pnwb0
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'nymph-j9yhw-pnwb0-alchemy-project' matches AI hallucination template [nymph] + [alchemy] + [pnwb0].
  • HIGHClaims critical enterprise brand identity ('ALCHEMY').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 748 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'alchemy' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 9 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-lkr586
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 758 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 6 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: jasmine-azure-ljr88
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'jasmine-95hol-ljr88-azure-project' matches AI hallucination template [jasmine] + [azure] + [ljr88].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 742 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 4 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: honeycomb-ripple-rmo970
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'honeycomb-ripple-rmo970-project' matches AI hallucination template [honeycomb] + [ripple] + [rmo970].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 743 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 11 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: acorn-jupiter-0uhr
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'acorn-jupiter-0uhr' matches AI hallucination template [acorn] + [jupiter] + [0uhr].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 761 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 7 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-qqy6v
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 752 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 12 11 ↑0.0/day
Possible Squatted Stub
alchemy npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: alchemy-alchemy-8o61m
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ALCHEMY').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 760 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'alchemy' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 9 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: zenith-ripple-wvk687
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'zenith-ripple-wvk687-project' matches AI hallucination template [zenith] + [ripple] + [wvk687].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 752 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 8 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: sapphire-ripple-yhd286
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 466 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'sapphire-ripple-yhd286-project' matches AI hallucination template [sapphire] + [ripple] + [yhd286].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 747 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 466 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 8 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-cal129
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 761 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 3 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-u8axy
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 3/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 743 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 6 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-7smw
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 744 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 12 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-39yk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 758 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 14 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: peony-ripple-fll511
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'peony-ripple-fll511-project' matches AI hallucination template [peony] + [ripple] + [fll511].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 762 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 9 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: lichen-ripple-k4zcj
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'lichen-1iocs-k4zcj-ripple-project' matches AI hallucination template [lichen] + [ripple] + [k4zcj].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 752 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 17 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-p75nc
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 761 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: aurora-azure-xp8fs
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'aurora-fnr1z-xp8fs-azure-project' matches AI hallucination template [aurora] + [azure] + [xp8fs].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 760 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 5 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: yeti-ripple-5h44y
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'yeti-i22dp-5h44y-ripple-project' matches AI hallucination template [yeti] + [ripple] + [5h44y].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 750 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 5 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: xanadu-ripple-e5wnw
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'xanadu-bnklw-e5wnw-ripple-project' matches AI hallucination template [xanadu] + [ripple] + [e5wnw].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 742 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 8 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-r1w2v
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 757 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 3 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-rnc131
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 3/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 458 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 745 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 458 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 5 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: vista-ripple-fcc476
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'vista-ripple-fcc476-project' matches AI hallucination template [vista] + [ripple] + [fcc476].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 759 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 13 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-274n
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 756 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 15 11 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: jupiter-jupiter-9ldu
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 759 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-yokie
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 743 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 13 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-lxz68
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 759 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 7 11 ↑0.0/day
Possible Squatted Stub
alchemy npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: alchemy-alchemy-dbli8
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ALCHEMY').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 744 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'alchemy' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 5 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: vortex-ripple-cnn444
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'vortex-ripple-cnn444-project' matches AI hallucination template [vortex] + [ripple] + [cnn444].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 747 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 11 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-mdp191
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 464 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 763 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 464 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 7 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-z4jwe
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 750 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 5 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-gkc204
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 5/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 747 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 14 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-s8wxk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 763 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 10 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ripple-ripple-12q0i
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 760 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 13 11 ↑0.0/day
Possible Squatted Stub
ripple npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: everest-ripple-sla471
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 464 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'everest-ripple-sla471-project' matches AI hallucination template [everest] + [ripple] + [sla471].
  • HIGHClaims critical enterprise brand identity ('RIPPLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 763 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 464 bytes).
  • INFOPackage affiliated with trusted vendor 'ripple' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 12 11 ↑0.0/day
Possible Squatted Stub
alchemy npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: alchemy-alchemy-k62ml
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ALCHEMY').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 757 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'alchemy' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 768d 10 11 ↑0.0/day
Possible Squatted Stub
alchemy npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: alchemy-alchemy-ac151
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 768
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ALCHEMY').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 745 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'alchemy' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 769d 9 11 ↑0.0/day
Possible Squatted Stub
solana npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: solana-solana-contracts
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 769
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 448 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('SOLANA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 760 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 448 bytes).
  • INFOPackage affiliated with trusted vendor 'solana' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 811d 4 11 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: img-aws-s3
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 811
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'img-aws-s3-object-multipart-copy' matches AI hallucination template [img] + [aws] + [s3].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 791 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 823d 10 11 ↑0.0/day
Possible Squatted Stub
auth0 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: auth0-auth0-export
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 823
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 816 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'auth0' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 829d 4 5 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.0 — —
Package purpose: This is work in progress, stay tuned...
Matched naming pattern: node-aws-vike
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 829
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 193 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'vike-aws' matches AI hallucination template [node] + [aws] + [vike].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOEstablished pre-AI legacy package registered 812 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 2 file(s), 193 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 843d 10 11 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: legacyreact-aws-s3
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 843
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 464 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'legacyreact-aws-s3-typescript' matches AI hallucination template [legacyreact] + [aws] + [s3].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 834 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 464 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 843d 8 10 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-aws-check
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 843
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 424 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'aws-check' matches AI hallucination template [node] + [aws] + [check].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 819 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 424 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 843d 7 10 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-aws-public
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 843
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 426 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'aws-public' matches AI hallucination template [node] + [aws] + [public].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 826 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 426 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 843d 13 10 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-aws-logs
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 843
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 422 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'aws-logs' matches AI hallucination template [node] + [aws] + [logs].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 823 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 422 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 850d 18 5 ↑0.0/day
Possible Squatted Stub
ethereum npm 0.0.0 — —
Package purpose: Ethereum integration providing chainfile utility for Node
Matched naming pattern: node-ethereum-chainfile
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 850
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 91 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'chainfile-ethereum' matches AI hallucination template [node] + [ethereum] + [chainfile].
  • HIGHClaims critical enterprise brand identity ('ETHEREUM').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 844 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 91 bytes).
  • INFOPackage affiliated with trusted vendor 'ethereum' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 858d 52 2 ↑0.1/day
Possible Squatted Stub
aws pypi 1.0.13 Yiskaneto —
Package purpose: "Contains helper functions for the AWS Python sdk (Boto3) package."
Claimed homepage: https://pypi.org/project/aws-boto3-sdk-helpers/
Matched naming pattern: aws-aws-sdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 858
Registry downloads: 52/month, 12/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2 lines, 38 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 849 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (2 LOC, 1 file(s), 38 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 866d 10 20 ↑0.0/day
Possible Squatted Stub
llama pypi 0.1.3 Your Name your.email@example.com example.com
Package purpose: A custom LlamaIndex Llms integration for UnionLLM
Claimed homepage: https://github.com/yourusername/llama-index-llms-unionllm
Matched naming pattern: llama-llama-llms
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 866
Registry downloads: 10/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 20 lines, 683 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'your.email@example.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 854 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (20 LOC, 1 file(s), 683 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 888d 10 11 ↑0.0/day
Possible Squatted Stub
ethers npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-ethers-transactions
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 888
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'ethers-transactions' matches AI hallucination template [node] + [ethers] + [transactions].
  • HIGHClaims critical enterprise brand identity ('ETHERS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 877 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'ethers' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 945d 15 8 ↑0.0/day
Possible Squatted Stub
amazon pypi 0.3 Aby Varghese —
Package purpose: A Python library designed to simplify the process of converting Amazon India URLs into affiliate links. This library is not affiliated with Amazon or its official services.
Claimed homepage: https://pypi.org/project/amazon-india-affiliate/
Matched naming pattern: amazon-amazon-affiliate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 945
Registry downloads: 15/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 8 lines, 364 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 935 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 364 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 945d 14 8 ↑0.0/day
Possible Squatted Stub
amazon pypi 0.2 Aby Varghese —
Package purpose: A Python library designed to simplify the process of converting Amazon India URLs into affiliate links. This library is not affiliated with Amazon or its official services.
Claimed homepage: https://pypi.org/project/amazon-india-affilate/
Matched naming pattern: amazon-amazon-affilate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 945
Registry downloads: 14/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 8 lines, 363 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 934 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 363 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
« Prev Next »
LINK COPIED TO CLIPBOARD