Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 169d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: AgentsWorkStudio runtime bridge service for machine-level agent runtime integration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 171d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Language-agnostic linter for repository structure, file existence, filename conventions, and file content rules. This package downloads and wraps the platform-matched native alint binary.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 173d | — | — | — |
Very Risky
|
— | npm | latest | 苑广山 | — | 🪝 🌐 | |
|
Package purpose: 一键生成项目代码快照，为 AI 辅助开发与架构审计而生。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 173d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 175d | — | — | — |
Unverified Signal
|
— | npm | latest | Hanzla Habib | — | 🪝 🌐 | |
|
Package purpose: rcode — the AI team that never forgets. Persistent memory, specialist agents, and slash commands for AI IDEs. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 175d | — | — | — |
Unverified Signal
|
— | npm | latest | Oskar Freye | — | 🪝 🌐 | |
|
Package purpose: Draht GSD, multi-agent, TDD and DDD workflows as a Claude Code plugin. Install with `npx draht-claude install`.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 177d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MulmoClaude — GUI-chat with Claude Code + long-term memory. One command to start.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 177d | 2,832 | 493 | ↑16.0/day |
Very Risky
|
xkat | npm | 3.1.15 | SomiLab contact@somilab.com | somilab.com | 🪝 🌐 | |
|
Package purpose: xkat-cli - an AI agent that securely connects your browser to your machine
Claimed homepage: https://xkat.space
Matched naming pattern: node-xkat-cli
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 177
Registry downloads: 2832/month, 708/week (ACTIVE_COMMUNITY_USE)
Codebase size: 493 lines, 19.0 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 179d | — | — | — |
Unverified Signal
|
— | npm | latest | Phoenix Labs | — | 🪝 🌐 | |
|
Package purpose: One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 179d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Atoll CLI — project management from the terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 179d | — | — | — |
Unverified Signal
|
— | npm | latest | CI&T Flow Team | — | 🪝 🌐 | |
|
Package purpose: Claude Code hooks for Langfuse OTLP tracing — cross-platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 179d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Agentic software development platform — AI-driven PRD, implementation, and beyond
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 180d | — | — | — |
Unverified Signal
|
— | npm | latest | Andrei Hasna | — | 🪝 🌐 | |
|
Package purpose: High-level project management CLI, MCP server, SDK, and AI SDK agent loop for coding agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 180d | — | — | — |
Unverified Signal
|
— | npm | latest | Lincoln Deen | — | 🪝 🌐 | |
|
Package purpose: Web research for your agents with smart and safe tooling + knowledge store
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 180d | — | — | — |
Unverified Signal
|
— | npm | latest | Quo / クオ at kitepon.dev | kitepon.dev | 🪝 🌐 | |
|
Package purpose: Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 180d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 180d | — | — | — |
Unverified Signal
|
— | npm | latest | Alexander Velikiy | — | 🪝 🌐 | |
|
Package purpose: One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 181d | — | — | — |
Very Risky
|
— | npm | latest | Bitsocial Labs | — | 🪝 🌐 | |
|
Package purpose: Command line interface to Bitsocial API
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 181d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Cross-platform Computer Use MCP server launcher. After install, configure open-computer-use mcp.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 182d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Solve it once. From then on, your AI knows. Experience for coding agents, EU-hosted: an MCP server for Claude Code, Cursor, Copilot & Windsurf. Learns from every bug fix, commit and CI run.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 182d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server for iOS Simulator and Android Emulator control
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 183d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 186d | — | — | — |
SUSPICIOUS
|
— | npm | latest | bilkobibitkov | — | 🪝 🌐 | |
|
Package purpose: Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 188d | — | — | — |
Very Risky
|
— | npm | latest | Edgar Durand | — | 🪝 🌐 | |
|
Package purpose: Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 188d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Jerico Team | — | 🪝 🌐 | |
|
Package purpose: Bridge local agent — connects your AI tools to Jerico
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 188d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 189d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 189d | — | — | — |
Unverified Signal
|
— | npm | latest | lennix1337 | — | 🪝 🌐 | |
|
Package purpose: GeneXus 16, GeneXus 17, GeneXus 18 MCP server with native SDK support; basic legacy compatibility for GeneXus Evolution 3, GeneXus Evolution 2, GeneXus Evolution 1, GeneXus 15, GeneXus 9.0, GeneXus 8.0 via com-gxpublic and dotnet-reflection drivers — read
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 192d | — | — | — |
Unverified Signal
|
— | npm | latest | mvschwarz | — | 🪝 🌐 | |
|
Package purpose: Local control plane for multi-agent coding topologies
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 194d | — | — | — |
Very Risky
|
— | npm | latest | Yaver | — | 🪝 🌐 | |
|
Package purpose: Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 195d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Nikolai Vysotskyi | — | 🪝 🌐 | |
|
Package purpose: Framework-aware code intelligence MCP server — 88 framework integrations, 81 languages, 72.7% fewer input tokens to review a pull request, comprehension at parity
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 195d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Open source agentic coding CLI with verified nightly upstream analysis
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 197d | — | — | — |
Very Risky
|
— | npm | latest | Andre Figueira | — | 🪝 🌐 | |
|
Package purpose: LCARS-inspired operations dashboard for Claude Code. See every skill, agent, hook, MCP server, plugin, and memory file you've built, click into any of them and read the full content like a Star Trek PADD. Zero config, zero dependencies, just npx claude-hu
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 199d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Developer CLI for Lovrabet apps, datasets, pages, SQL, Backend Function, database connections, skills, and AI agent workflows.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 201d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Browse local folders and git repositories in your browser
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 203d | — | — | — |
Unverified Signal
|
— | npm | latest | Primo | — | 🪝 🌐 | |
|
Package purpose: Local development CLI for Primo
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 205d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A full-stack TypeScript framework for shipping production web apps: Node + React + Postgres, type-safe RPC over WebSocket and HTTP, real-time doc subscriptions, built-in auth, AI generation, storage, cron / workers, and a CLI for every workflow.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 206d | — | — | — |
SUSPICIOUS
|
— | npm | latest | wendongfly | — | 🪝 🌐 | |
|
Package purpose: Web-based terminal sharing with chat UI — control your terminal from phone via LAN/Tailscale
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 207d | — | — | — |
Very Risky
|
— | npm | latest | Muggle AI | — | 🪝 🌐 | |
|
Package purpose: Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 207d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Autonomous parallel coding - plan and execute with AI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 211d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Browser-based coding agent with thin CLI server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 211d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A chat interface for AI coding agents — control Claude Code, Codex, Gemini CLI, OpenCode from browser and mobile
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 212d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server exposing Telora product operations to Claude Code
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 213d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Robin Norberg | — | 🪝 🌐 | |
|
Package purpose: Multi-agent orchestration system for Copilot CLI - Inspired by oh-my-opencode
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 213d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLI for agent-managed onchain vaults — strategies, depositors, and XMTP chat
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 213d | — | — | — |
Unverified Signal
|
— | npm | latest | Okan Turan | — | 🪝 🌐 | |
|
Package purpose: Opinionated, adaptive block-based status line for Claude Code with bin-packing layout, rate limit tracking, and campaign monitoring
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 215d | — | — | — |
Unverified Signal
|
— | npm | latest | IronBee | — | 🪝 🌐 | |
|
Package purpose: The CLI for IronBee — Verification and Intelligence Layer for Agentic Development
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 219d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Volcengine CLI npm installer
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 219d | — | — | — |
SUSPICIOUS
|
— | npm | latest | ChainlessChain Team | — | 🪝 🌐 | |
|
Package purpose: CLI for ChainlessChain - install, configure, and manage your personal AI management system
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 219d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: akm (Agent Knowledge Manager) — a portable, local-first capability library for AI agents. Discover, load, share, and improve reusable skills, scripts, workflows, and knowledge across any shell-capable coding agent, including Claude Code, OpenCode, and Cur
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||