🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 1340d 10 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-h
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1340
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-h' matches AI hallucination template [node] + [google] + [nolb-google-h].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1315 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1340d 10 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-g
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1340
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-g' matches AI hallucination template [node] + [google] + [nolb-google-g].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1327 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1347d 10 11 ↑0.0/day
Possible Squatted Stub
okta npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-okta-idm-okta-sdk-js
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1347
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@blk/idm-okta-sdk-js' matches AI hallucination template [node] + [okta] + [idm-okta-sdk-js].
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1341 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'okta' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1349d 15 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-u
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1349
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-u' matches AI hallucination template [node] + [google] + [nolb-google-u].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1346 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1349d 9 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-s
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1349
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-s' matches AI hallucination template [node] + [google] + [nolb-google-s].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1329 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1349d 13 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-n
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1349
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-n' matches AI hallucination template [node] + [google] + [nolb-google-n].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1334 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1349d 13 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-k
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1349
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-k' matches AI hallucination template [node] + [google] + [nolb-google-k].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1323 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1349d 13 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-i
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1349
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-i' matches AI hallucination template [node] + [google] + [nolb-google-i].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1344 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1349d 10 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-e
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1349
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-e' matches AI hallucination template [node] + [google] + [nolb-google-e].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1328 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1349d 13 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-google-nolb-google-c
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1349
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-google-c' matches AI hallucination template [node] + [google] + [nolb-google-c].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1340 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1350d 14 11 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-aws-nolb-aws
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1350
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@zalastax/nolb-aws' matches AI hallucination template [node] + [aws] + [nolb-aws].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1329 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1353d 27 8 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1 Amazon Web Services —
Package purpose: Passwordless authentication with AWS Cognito
Matched naming pattern: node-aws-passwordless
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1353
Registry downloads: 27/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 8 lines, 354 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'aws-passwordless' matches AI hallucination template [node] + [aws] + [passwordless].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOEstablished pre-AI legacy package registered 1340 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (8 LOC, 1 file(s), 354 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1436d 9 0 ↑0.0/day
Possible Squatted Stub
stripe pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-stripe/
Matched naming pattern: python-stripe-source
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-stripe' matches AI hallucination template [python] + [stripe] + [source].
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 6 0 ↑0.0/day
Possible Squatted Stub
okta pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-okta/
Matched naming pattern: python-okta-source
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 6/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-okta' matches AI hallucination template [python] + [okta] + [source].
  • HIGHClaims critical enterprise brand identity ('OKTA').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 8 0 ↑0.0/day
Possible Squatted Stub
microsoft pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-microsoft-teams/
Matched naming pattern: source-microsoft-teams
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-microsoft-teams' matches AI hallucination template [source] + [microsoft] + [teams].
  • HIGHClaims critical enterprise brand identity ('MICROSOFT').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 0 0 ↑0.0/day
Possible Squatted Stub
google pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-google-workspace-admin-reports/
Matched naming pattern: source-google-workspace
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-google-workspace-admin-reports' matches AI hallucination template [source] + [google] + [workspace].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 9 0 ↑0.0/day
Possible Squatted Stub
google pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-google-sheets/
Matched naming pattern: source-google-sheets
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 9/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-google-sheets' matches AI hallucination template [source] + [google] + [sheets].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 8 0 ↑0.0/day
Possible Squatted Stub
google pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-google-search-console/
Matched naming pattern: source-google-search
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-google-search-console' matches AI hallucination template [source] + [google] + [search].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 13 0 ↑0.0/day
Possible Squatted Stub
google pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-google-directory/
Matched naming pattern: source-google-directory
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 13/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-google-directory' matches AI hallucination template [source] + [google] + [directory].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 10 0 ↑0.0/day
Possible Squatted Stub
google pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-google-analytics-v4/
Matched naming pattern: source-google-analytics
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 10/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-google-analytics-v4' matches AI hallucination template [source] + [google] + [analytics].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 4 0 ↑0.0/day
Possible Squatted Stub
google pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-google-ads/
Matched naming pattern: source-google-ads
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 4/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-google-ads' matches AI hallucination template [source] + [google] + [ads].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 6 0 ↑0.0/day
Possible Squatted Stub
azure pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-azure-table/
Matched naming pattern: source-azure-table
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-azure-table' matches AI hallucination template [source] + [azure] + [table].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1428 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 8 0 ↑0.0/day
Possible Squatted Stub
aws pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-aws-cloudtrail/
Matched naming pattern: source-aws-cloudtrail
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 8/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-aws-cloudtrail' matches AI hallucination template [source] + [aws] + [cloudtrail].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1428 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 0 0 ↑0.0/day
Possible Squatted Stub
auth0 pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-auth0/
Matched naming pattern: python-auth0-source
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-auth0' matches AI hallucination template [python] + [auth0] + [source].
  • HIGHClaims critical enterprise brand identity ('AUTH0').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 6 0 ↑0.0/day
Possible Squatted Stub
amazon pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-amazon-sqs/
Matched naming pattern: source-amazon-sqs
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-amazon-sqs' matches AI hallucination template [source] + [amazon] + [sqs].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1426 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 0 0 ↑0.0/day
Possible Squatted Stub
amazon pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-amazon-seller-partner/
Matched naming pattern: source-amazon-seller
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-amazon-seller-partner' matches AI hallucination template [source] + [amazon] + [seller].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 6 0 ↑0.0/day
Possible Squatted Stub
amazon pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/source-amazon-ads/
Matched naming pattern: source-amazon-ads
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'source-amazon-ads' matches AI hallucination template [source] + [amazon] + [ads].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 0 0 ↑0.0/day
Possible Squatted Stub
google pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/destination-google-sheets/
Matched naming pattern: destination-google-sheets
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'destination-google-sheets' matches AI hallucination template [destination] + [google] + [sheets].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 13 0 ↑0.0/day
Possible Squatted Stub
aws pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/destination-aws-datalake/
Matched naming pattern: destination-aws-datalake
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 13/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'destination-aws-datalake' matches AI hallucination template [destination] + [aws] + [datalake].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1428 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1436d 14 0 ↑0.0/day
Possible Squatted Stub
amazon pypi 1.0.0 — author@example.com example.com
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/destination-amazon-sqs/
Matched naming pattern: destination-amazon-sqs
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1436
Registry downloads: 14/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'destination-amazon-sqs' matches AI hallucination template [destination] + [amazon] + [sqs].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • INFOPackage lineage verified as trusted vendor 'python' via repo:github.com/pypa.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 1 file(s), 0 bytes).
  • INFOPackage affiliated with trusted vendor 'python' (repo:github.com/pypa). Applied 50% threat score dampening (15 -> 7) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1438d 11 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-web3-update
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1438
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 428 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-update' matches AI hallucination template [node] + [web3] + [update].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1425 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 428 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1469d 14 11 ↑0.0/day
Possible Squatted Stub
aws pypi 0.0.0 Matthew Belisle matthew.belisle@workiva.com workiva.com
Package purpose: Placeholder to prevent dependency confusion
Claimed homepage: https://github.com/Workiva/
Matched naming pattern: aws-aws-sdk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1469
Registry downloads: 14/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 408 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'matthew.belisle@workiva.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1461 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 408 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1500d 13 10 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: google-google-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1500
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1485 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1532d 10 12 ↑0.0/day
Possible Squatted Stub
ethereum npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ethereum-ethereum-bridge
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1532
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 482 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('ETHEREUM').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1523 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 482 bytes).
  • INFOPackage affiliated with trusted vendor 'ethereum' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1532d 8 12 ↑0.0/day
Possible Squatted Stub
stripe npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: stripe-stripe-connect
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1532
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 490 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1507 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 490 bytes).
  • INFOPackage affiliated with trusted vendor 'stripe' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1534d 18 5 ↑0.0/day
Possible Squatted Stub
ethereum npm 1.0.0 Y0moo —
Package purpose: Ethereum integration providing dapp utility for Create
Matched naming pattern: create-ethereum-dapp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1534
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 129 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-ethereum-dapp' matches AI hallucination template [create] + [ethereum] + [dapp].
  • HIGHClaims critical enterprise brand identity ('ETHEREUM').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1514 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 2 file(s), 129 bytes).
  • INFOPackage affiliated with trusted vendor 'ethereum' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1534d 23 5 ↑0.0/day
Possible Squatted Stub
solana npm 1.0.0 Y0moo —
Package purpose: Solana integration providing app utility for Create
Matched naming pattern: create-solana-app
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1534
Registry downloads: 23/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 126 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-solana-app' matches AI hallucination template [create] + [solana] + [app].
  • HIGHClaims critical enterprise brand identity ('SOLANA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1525 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 2 file(s), 126 bytes).
  • INFOPackage affiliated with trusted vendor 'solana' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1534d 15 5 ↑0.0/day
Possible Squatted Stub
ethereum npm 1.0.0 Y0moo —
Package purpose: Ethereum integration providing app utility for Create
Matched naming pattern: create-ethereum-app
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1534
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 128 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-ethereum-app' matches AI hallucination template [create] + [ethereum] + [app].
  • HIGHClaims critical enterprise brand identity ('ETHEREUM').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1522 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 128 bytes).
  • INFOPackage affiliated with trusted vendor 'ethereum' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1536d 13 11 ↑0.0/day
Possible Squatted Stub
ledger npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ledger-ledger-assets
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1536
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('LEDGER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1526 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'ledger' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1542d 28 0 ↑0.0/day
Possible Squatted Stub
azure pypi 0.2.0 Mike Foster i.am.mike.foster@gmail.com gmail.com
Package purpose: Utilities to automate things in ADO
Claimed homepage: https://dev.azure.com/MusicalNinjas/_git/ADO
Matched naming pattern: azure-azure-automation
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1542
Registry downloads: 28/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 0 lines, 0 Bytes across 11 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'i.am.mike.foster@gmail.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 1533 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (0 LOC, 11 file(s), 0 bytes).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
45 1552d 9 5 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.0 — —
Package purpose: This is a placeholder
Matched naming pattern: create-web3-app
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1552
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 118 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'create-web3-app' matches AI hallucination template [create] + [web3] + [app].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1539 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 2 file(s), 118 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 13 11 ↑0.0/day
Possible Squatted Stub
metamask npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: metamask-metamask-log
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('METAMASK').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1546 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'metamask' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 9 10 ↑0.0/day
Possible Squatted Stub
eth npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-eth-faucet
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 426 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'eth-faucet' matches AI hallucination template [node] + [eth] + [faucet].
  • HIGHClaims critical enterprise brand identity ('ETH').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1556 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 426 bytes).
  • INFOPackage affiliated with trusted vendor 'eth' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 10 10 ↑0.0/day
Possible Squatted Stub
metamask npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-metamask-docs
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 432 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'metamask-docs' matches AI hallucination template [node] + [metamask] + [docs].
  • HIGHClaims critical enterprise brand identity ('METAMASK').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1556 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 432 bytes).
  • INFOPackage affiliated with trusted vendor 'metamask' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 11 10 ↑0.0/day
Possible Squatted Stub
matic npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-matic-docs
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 426 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'matic-docs' matches AI hallucination template [node] + [matic] + [docs].
  • HIGHClaims critical enterprise brand identity ('MATIC').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1553 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 426 bytes).
  • INFOPackage affiliated with trusted vendor 'matic' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 39 11 ↑0.0/day
Possible Squatted Stub
crypto-com npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: crypto-crypto-com-chain
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 39/month, 9/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'crypto-com-chain-wallet' matches AI hallucination template [crypto] + [crypto-com] + [chain].
  • HIGHClaims critical enterprise brand identity ('CRYPTO-COM').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1557 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'crypto-com' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 9 11 ↑0.0/day
Possible Squatted Stub
opensea npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: opensea-opensea-log
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('OPENSEA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1548 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'opensea' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 11 10 ↑0.0/day
Possible Squatted Stub
opensea npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-opensea-erc1155
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'opensea-erc1155' matches AI hallucination template [node] + [opensea] + [erc1155].
  • HIGHClaims critical enterprise brand identity ('OPENSEA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1556 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 436 bytes).
  • INFOPackage affiliated with trusted vendor 'opensea' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1567d 15 11 ↑0.0/day
Possible Squatted Stub
opensea npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-opensea-creatures
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1567
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'opensea-creatures' matches AI hallucination template [node] + [opensea] + [creatures].
  • HIGHClaims critical enterprise brand identity ('OPENSEA').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1550 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'opensea' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1572d 22 22 ↑0.0/day
Possible Squatted Stub
web3 npm 1.0.0 — —
Package purpose: Can log "hello world" and "goodbye world" to the console!
Matched naming pattern: node-web3-easy-web3
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1572
Registry downloads: 22/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 22 lines, 885 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name '@easy-web3/easy-web3' matches AI hallucination template [node] + [web3] + [easy-web3].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOEstablished pre-AI legacy package registered 1571 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (22 LOC, 2 file(s), 885 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD