🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 945d 15 8 ↑0.0/day
Possible Squatted Stub
amazon pypi 0.3 Aby Varghese —
Package purpose: A Python library designed to simplify the process of converting Amazon India URLs into affiliate links. This library is not affiliated with Amazon or its official services.
Claimed homepage: https://pypi.org/project/amazon-india-affiliate/
Matched naming pattern: amazon-amazon-affiliate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 945
Registry downloads: 15/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 8 lines, 364 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 935 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 364 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 945d 14 8 ↑0.0/day
Possible Squatted Stub
amazon pypi 0.2 Aby Varghese —
Package purpose: A Python library designed to simplify the process of converting Amazon India URLs into affiliate links. This library is not affiliated with Amazon or its official services.
Claimed homepage: https://pypi.org/project/amazon-india-affilate/
Matched naming pattern: amazon-amazon-affilate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 945
Registry downloads: 14/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 8 lines, 363 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 934 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 363 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1024d 9 11 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: web3-web3-subscription
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1024
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1018 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1025d 22 1 ↑0.0/day
Possible Squatted Stub
langchain pypi 0.0.2 — —
Package purpose: This package is deprecated. Please use langchain-nvidia-ai-endpoints instead.
Claimed homepage: https://github.com/langchain-ai/langchain/tree/master/libs/partners/nvidia-ai-endpoints
Matched naming pattern: langchain-langchain-aiplay
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1025
Registry downloads: 22/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 44 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • INFOPackage lineage verified as trusted vendor 'langchain' via repo:github.com/langchain-ai.
  • HIGHPackage claims legitimate high-profile upstream repository 'langchain-ai/langchain' (langchain) in metadata to artificially inflate trust / SourceRank.
  • INFOEstablished pre-AI legacy package registered 1016 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (1 LOC, 1 file(s), 44 bytes).
  • INFOPackage affiliated with trusted vendor 'langchain' (repo:github.com/langchain-ai). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1031d 12 5 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.0 — —
Package purpose: Gemini integration providing gemini utility for React
Matched naming pattern: react-gemini-gemini
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1031
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 58 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'react-native-gemini' matches AI hallucination template [react] + [gemini] + [gemini].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1028 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 58 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1031d 11 5 ↑0.0/day
Possible Squatted Stub
gemini npm 0.0.0 — —
Package purpose: Gemini integration providing expo utility for Node
Matched naming pattern: node-gemini-expo
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1031
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 50 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'expo-gemini' matches AI hallucination template [node] + [gemini] + [expo].
  • HIGHClaims critical enterprise brand identity ('GEMINI').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1022 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 50 bytes).
  • INFOPackage affiliated with trusted vendor 'gemini' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1062d 10 11 ↑0.0/day
Possible Squatted Stub
stripe npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: stripe-stripe-react
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1062
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 478 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1036 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 478 bytes).
  • INFOPackage affiliated with trusted vendor 'stripe' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1069d 16 10 ↑0.0/day
Possible Squatted Stub
kraken npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-kraken-frontend
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1069
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'kraken-frontend' matches AI hallucination template [node] + [kraken] + [frontend].
  • HIGHClaims critical enterprise brand identity ('KRAKEN').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1061 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'kraken' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1115d 2 24 ↑0.0/day
Possible Squatted Stub
polygon pypi 1.1 Dr. Sebastian M. Gaebel gaebel.sebastian@gmail.com gmail.com
Package purpose: CPython extension for checking if a polygon contains a given point.
Claimed homepage: https://github.com/sgaebel/point_in_polygon
Matched naming pattern: polygon-polygon-point
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1115
Registry downloads: 2/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 24 lines, 1.2 kB across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('POLYGON').
  • HIGHPublisher email 'gaebel.sebastian@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1103 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (24 LOC, 1 file(s), 1175 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1119d 4 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: web3-web3-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1119
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1096 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1119d 9 10 ↑0.0/day
Possible Squatted Stub
eth npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: eth-eth-tx
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1119
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 428 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ETH').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1097 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 428 bytes).
  • INFOPackage affiliated with trusted vendor 'eth' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1125d 9 10 ↑0.0/day
Possible Squatted Stub
jupiter npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-jupiter-opensdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1125
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'jupiter-opensdk' matches AI hallucination template [node] + [jupiter] + [opensdk].
  • HIGHClaims critical enterprise brand identity ('JUPITER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1114 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'jupiter' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1164d 14 10 ↑0.0/day
Possible Squatted Stub
coinbase npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-coinbase-mobile
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1164
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'coinbase-mobile' matches AI hallucination template [node] + [coinbase] + [mobile].
  • HIGHClaims critical enterprise brand identity ('COINBASE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1150 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'coinbase' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1175d 11 10 ↑0.0/day
Possible Squatted Stub
btc npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-btc-web3
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1175
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 422 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'btc-web3' matches AI hallucination template [node] + [btc] + [web3].
  • HIGHClaims critical enterprise brand identity ('BTC').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1155 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 422 bytes).
  • INFOPackage affiliated with trusted vendor 'btc' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1175d 15 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-web3-other
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1175
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 426 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'other-web3' matches AI hallucination template [node] + [web3] + [other].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1168 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 426 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1177d 6 10 ↑0.0/day
Possible Squatted Stub
binance npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-binance-prices
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1177
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 434 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'binance-prices' matches AI hallucination template [node] + [binance] + [prices].
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1154 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 434 bytes).
  • INFOPackage affiliated with trusted vendor 'binance' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1199d 11 5 ↑0.0/day
Possible Squatted Stub
openai pypi 0.1.0 Talor Anderson talor@replit.com replit.com
Package purpose: this package is a PoC exploit of a common ChatGPT hallucination. it does nothing, and you should use the openai package instead!
Claimed homepage: https://replit.com/@TalorAnderson/openaisecretsmanager#setup.py
Matched naming pattern: openai-openai-manager
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1199
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 177 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OPENAI').
  • HIGHPublisher email 'talor@replit.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1191 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 177 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1227d 9 10 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-bard724
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1227
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 434 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'google-bard724' matches AI hallucination template [node] + [google] + [bard724].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1218 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 434 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1228d 12 5 ↑0.0/day
Possible Squatted Stub
eth npm 1.0.0 — —
Package purpose: Eth integration providing Software Development Kit (SDK) for Eth
Matched naming pattern: eth-eth-sdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1228
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 57 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ETH').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1225 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 57 bytes).
  • INFOPackage affiliated with trusted vendor 'eth' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (45 -> 22) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1229d 15 5 ↑0.0/day
Possible Squatted Stub
langchain npm 0.0.0 — —
Package purpose: Langchain integration providing API client & connector for Node
Matched naming pattern: node-langchain-api
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1229
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 52 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-api' matches AI hallucination template [node] + [langchain] + [api].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1220 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 52 bytes).
  • INFOPackage affiliated with trusted vendor 'langchain' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1236d 24 18 ↑0.0/day
Possible Squatted Stub
okx npm 0.0.0 scriptpower —
Package purpose: Okx integration providing Command-line interface tool for Node
Matched naming pattern: node-okx-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1236
Registry downloads: 24/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 18 lines, 746 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'okx-cli' matches AI hallucination template [node] + [okx] + [cli].
  • HIGHClaims critical enterprise brand identity ('OKX').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1220 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (18 LOC, 1 file(s), 746 bytes).
  • INFOPackage affiliated with trusted vendor 'okx' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1244d 11 11 ↑0.0/day
Possible Squatted Stub
microsoft npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: react-microsoft-ui
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1244
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'react-microsoft-ui' matches AI hallucination template [react] + [microsoft] + [ui].
  • HIGHClaims critical enterprise brand identity ('MICROSOFT').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1238 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'microsoft' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1266d 7 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: dreamteam11-google-tech
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1266
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'dreamteam11-google-tech' matches AI hallucination template [dreamteam11] + [google] + [tech].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1242 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1266d 6 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: dreamteam11-google-oast
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1266
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'dreamteam11-google-oast' matches AI hallucination template [dreamteam11] + [google] + [oast].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1241 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1285d 11 11 ↑0.0/day
Possible Squatted Stub
stripe npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: firestore-stripe-payments
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1285
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'firestore-stripe-payments' matches AI hallucination template [firestore] + [stripe] + [payments].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1274 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'stripe' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1285d 33 6 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.0 Kamat, Trivikram trivikr.dev@gmail.com gmail.com
Package purpose: Benchmarking AWS SDKs on Lambda
Matched naming pattern: aws-aws-lambda
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1285
Registry downloads: 33/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 6 lines, 255 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOEstablished pre-AI legacy package registered 1260 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (6 LOC, 1 file(s), 255 bytes).
  • INFOPackage affiliated with trusted vendor 'gmail.com' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1291d 35 6 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.0 Kamat, Trivikram trivikr.dev@gmail.com gmail.com
Package purpose: Placeholder for AWS Lambda benchmarking
Matched naming pattern: aws-aws-benchmark
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1291
Registry downloads: 35/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 6 lines, 254 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOEstablished pre-AI legacy package registered 1289 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (6 LOC, 1 file(s), 254 bytes).
  • INFOPackage affiliated with trusted vendor 'gmail.com' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1291d 27 6 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.0 Kamat, Trivikram trivikr.dev@gmail.com gmail.com
Package purpose: Placeholder for benchmarking SDKs on AWS Lambda
Matched naming pattern: aws-aws-sdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1291
Registry downloads: 27/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 6 lines, 266 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOEstablished pre-AI legacy package registered 1286 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (6 LOC, 1 file(s), 266 bytes).
  • INFOPackage affiliated with trusted vendor 'gmail.com' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1298d 8 10 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-fly
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1298
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 432 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1288 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 432 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1299d 19 5 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1 Y0moo —
Package purpose: Web3 integration providing dapp utility for Node
Matched naming pattern: node-web3-dapp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1299
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 118 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-dapp' matches AI hallucination template [node] + [web3] + [dapp].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1292 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 118 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1313d 15 5 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1 Y0moo —
Package purpose: Web3 integration providing boilerplate utility for Create
Matched naming pattern: create-web3-boilerplate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1313
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 132 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-web3-boilerplate' matches AI hallucination template [create] + [web3] + [boilerplate].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1287 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 132 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1313d 13 5 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1 Y0moo —
Package purpose: Web3 integration providing starter utility for Create
Matched naming pattern: create-web3-starter
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1313
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 128 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-web3-starter' matches AI hallucination template [create] + [web3] + [starter].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1307 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 128 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1313d 11 11 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: hardhat-web3-utility
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1313
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'hardhat-web3-utility' matches AI hallucination template [hardhat] + [web3] + [utility].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1301 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1318d 10 10 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-azure-sp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1318
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 422 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'azure-sp' matches AI hallucination template [node] + [azure] + [sp].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1316 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 422 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 11 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security.0 — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1308 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 9 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1314 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 8 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1293 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 15 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1315 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 12 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: check-google-play
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'check-google-play-card-balance127' matches AI hallucination template [check] + [google] + [play].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1302 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 10 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1313 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 8 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 458 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1306 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 458 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 9 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1296 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 10 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1306 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 8 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1299 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 11 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1313 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 11 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1308 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 10 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: check-google-play
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'check-google-play-card-balance031' matches AI hallucination template [check] + [google] + [play].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1310 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 11 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1310 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1319d 13 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-card
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1319
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1310 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1340d 10 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-v
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1340
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-v' matches AI hallucination template [node] + [google] + [nolb-google-v].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1314 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD