🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
45 1574d 13 10 ↑0.0/day
Possible Squatted Stub
ledger npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-ledger-brave
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1574
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 430 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'brave-ledger' matches AI hallucination template [node] + [ledger] + [brave].
  • HIGHClaims critical enterprise brand identity ('LEDGER').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1565 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 430 bytes).
  • INFOPackage affiliated with trusted vendor 'ledger' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1579d 13 10 ↑0.0/day
Possible Squatted Stub
aws npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: ai-aws-manager
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1579
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 434 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'ai-aws-manager' matches AI hallucination template [ai] + [aws] + [manager].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1575 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 434 bytes).
  • INFOPackage affiliated with trusted vendor 'aws' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1579d 14 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-web3-upgrade
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1579
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 430 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-upgrade' matches AI hallucination template [node] + [web3] + [upgrade].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1568 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 430 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1586d 15 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-dependency
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1586
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1580 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1587d 17 11 ↑0.0/day
Possible Squatted Stub
stripe npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: stripe-stripe-rocketrides
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1587
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 458 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('STRIPE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1580 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 458 bytes).
  • INFOPackage affiliated with trusted vendor 'stripe' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1587d 7 11 ↑0.0/day
Possible Squatted Stub
trezor npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: trezor-trezor-manager
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1587
Registry downloads: 7/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('TREZOR').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1575 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'trezor' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1587d 40 10 ↑0.0/day
Possible Squatted Stub
trezor npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-trezor-wallet
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1587
Registry downloads: 40/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 432 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'trezor-wallet' matches AI hallucination template [node] + [trezor] + [wallet].
  • HIGHClaims critical enterprise brand identity ('TREZOR').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1576 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 432 bytes).
  • INFOPackage affiliated with trusted vendor 'trezor' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1602d 41 11 ↑0.0/day
Possible Squatted Stub
binance npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: binance-binance-node
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1602
Registry downloads: 41/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 450 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('BINANCE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1592 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 450 bytes).
  • INFOPackage affiliated with trusted vendor 'binance' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1622d 12 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: snyk-azure-pipelines
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1622
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 456 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'snyk-azure-pipelines-task' matches AI hallucination template [snyk] + [azure] + [pipelines].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1600 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 456 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1623d 22 5 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.0 — —
Package purpose: Web3 integration providing contractor utility for Node
Matched naming pattern: node-web3-contractor
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1623
Registry downloads: 22/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 5 lines, 96 Bytes across 1 file (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-contractor' matches AI hallucination template [node] + [web3] + [contractor].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1612 days ago (predates modern AI hallucination waves).
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • MEDIUMPackage is an empty placeholder (5 LOC, 1 file(s), 96 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (70 -> 35) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1629d 6 11 ↑0.0/day
Possible Squatted Stub
workspace npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: workspace-workspace-all
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1629
Registry downloads: 6/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 444 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('WORKSPACE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1606 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 444 bytes).
  • INFOPackage affiliated with trusted vendor 'workspace' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1629d 9 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-tools
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1629
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 440 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1611 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 440 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1629d 11 10 ↑0.0/day
Possible Squatted Stub
web3 npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: node-web3-0.20.7
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1629
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 428 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'web3-0.20.7' matches AI hallucination template [node] + [web3] + [0.20.7].
  • HIGHClaims critical enterprise brand identity ('WEB3').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1621 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (10 LOC, 2 file(s), 428 bytes).
  • INFOPackage affiliated with trusted vendor 'web3' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1647d 12 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-configuration
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1647
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1640 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1648d 12 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-administration
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1648
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 484 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1645 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 484 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1648d 9 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-certificates
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1648
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 482 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1639 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 482 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 15 11 ↑0.0/day
Possible Squatted Stub
google npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: meliuz-google-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 442 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • MEDIUMPackage name 'meliuz-card-google' matches AI hallucination template [meliuz] + [google] + [google].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1629 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 442 bytes).
  • INFOPackage affiliated with trusted vendor 'google' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (55 -> 27) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 17 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-powerbidedicated
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 480 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 480 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 12 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-device
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1638 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 11 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-managementpartner
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 482 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 482 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 18 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-device
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1645 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 19 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-storagecache
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1645 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 13 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-peering
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1641 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 9 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-servicemap
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 9/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 478 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1640 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 478 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 15 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-signalr
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1647 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 15 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-reservations
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1645 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 15 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-visualstudio
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 482 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1643 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 482 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-support
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 13 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-support
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 462 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1646 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 462 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 15 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-storsimple8000series
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 488 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1645 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 488 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 13 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-phone
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 494 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1638 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 494 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 13 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-document
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 484 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1625 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 484 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 18 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-storagesync
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 470 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1645 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 470 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 17 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-resourcemover
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1646 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 14 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-resourcegraph
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 484 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 484 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 13 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-resourcegraph
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 484 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1632 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 484 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 15 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-resourcemover
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 474 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1623 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 474 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 17 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-privatedns
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 468 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1645 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 468 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 10 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-servicefabricmesh
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 10/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 492 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1639 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 492 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 14 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-policyinsights
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 476 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 476 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 14 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-storageimportexport
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 486 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1647 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 486 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 12 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-storageimportexport
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 12/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 486 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1642 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 486 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 13 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-deviceprovisioningservices
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 500 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1634 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 500 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 16 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-deviceprovisioningservices
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 500 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1640 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 500 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 15 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-analyzer
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 15/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 446 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1627 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 446 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 14 12 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-servicefabricmesh
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 14/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 12 lines, 492 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (12 LOC, 2 file(s), 492 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 11 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-samples
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 11/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 452 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1637 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 452 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 17 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-netapp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 17 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-iothub
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 17/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 460 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 460 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
45 1649d 13 11 ↑0.0/day
Possible Squatted Stub
azure npm 0.0.1-security — —
Package purpose: security holding package
Matched naming pattern: azure-azure-parser
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1649
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 11 lines, 472 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 1644 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • MEDIUMPackage is an empty placeholder (11 LOC, 2 file(s), 472 bytes).
  • INFOPackage affiliated with trusted vendor 'azure' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (30 -> 15) to reduce false positives while retaining hijack/takeover detection.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
« Prev Next »
LINK COPIED TO CLIPBOARD