Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 100 | 215d | — | — | — |
Unverified Signal
|
— | npm | latest | Haider Lasani | — | 🪝 🌐 | |
|
Package purpose: Spec-driven development framework — AI agents that think before they type
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 216d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Robin Norberg | — | 🪝 🌐 | |
|
Package purpose: Multi-agent orchestration system for Copilot CLI - Inspired by oh-my-opencode
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 216d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLI for agent-managed onchain vaults — strategies, depositors, and XMTP chat
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 216d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: OpenAI-compatible proxy for Cursor CLI — use Cursor models from any LLM client on localhost
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 216d | — | — | — |
Unverified Signal
|
— | npm | latest | Okan Turan | — | 🪝 🌐 | |
|
Package purpose: Opinionated, adaptive block-based status line for Claude Code with bin-packing layout, rate limit tracking, and campaign monitoring
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 218d | — | — | — |
Unverified Signal
|
— | npm | latest | IronBee | — | 🪝 🌐 | |
|
Package purpose: The CLI for IronBee — Verification and Intelligence Layer for Agentic Development
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 222d | — | — | — |
Very Risky
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Volcengine CLI npm installer
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 222d | — | — | — |
SUSPICIOUS
|
— | npm | latest | ChainlessChain Team | — | 🪝 🌐 | |
|
Package purpose: CLI for ChainlessChain - install, configure, and manage your personal AI management system
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 222d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: akm (Agent Knowledge Manager) — a portable, local-first capability library for AI agents. Discover, load, share, and improve reusable skills, scripts, workflows, and knowledge across any shell-capable coding agent, including Claude Code, OpenCode, and Cur
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 224d | — | — | — |
Unverified Signal
|
— | npm | latest | JakobWl | — | 🪝 🌐 | |
|
Package purpose: Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 224d | — | — | — |
SUSPICIOUS
|
— | npm | latest | tangojet | — | 🪝 🌐 | |
|
Package purpose: Ozaiya agent daemon - server management and terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 225d | — | — | — |
SUSPICIOUS
|
— | npm | latest | YeonGyu-Kim | — | 🪝 🌐 | |
|
Package purpose: The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 226d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Give AI agents full access to the Harness.io platform — manage pipelines, deployments, cloud costs, chaos engineering, feature flags, SEI, and 125+ resource types through 11 MCP tools
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 227d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Cognium Labs | — | 🪝 🌐 | |
|
Package purpose: LLM-enhanced SAST analysis built on circle-ir
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 229d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 230d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Nadav | — | 🪝 🌐 | |
|
Package purpose: IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 233d | — | — | — |
Unverified Signal
|
— | npm | latest | arkon | — | 🪝 🌐 | |
|
Package purpose: Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 233d | — | — | — |
SUSPICIOUS
|
— | npm | latest | ndycode | — | 🪝 🌐 | |
|
Package purpose: Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 234d | — | — | — |
Very Risky
|
— | npm | latest | MindStudio | — | 🪝 🌐 | |
|
Package purpose: TypeScript SDK for MindStudio direct step execution
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 236d | — | — | — |
SUSPICIOUS
|
— | npm | latest | CLI-JAW Contributors | — | 🪝 🌐 | |
|
Package purpose: Personal AI assistant powered by Pi, Antigravity, Claude, Codex, Codex App, Cursor, Grok, Kiro, OpenCode, and Copilot — Web, Terminal, Slack, Telegram, and Discord interfaces with 33 skills active by default from a 230-skill reference library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 237d | — | — | — |
Unverified Signal
|
— | npm | latest | Elad Shaham | — | 🪝 🌐 | |
|
Package purpose: Scrape transactions from all 18 Israeli banks with Cloudflare WAF bypass (Camoufox + Playwright)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 237d | — | — | — |
Unverified Signal
|
— | npm | latest | Charles Sebold | — | 🪝 🌐 | |
|
Package purpose: Self-hosted AI workspace for writers, worldbuilders, and roleplayers. Run with npx quilltap.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 241d | — | — | — |
Unverified Signal
|
— | npm | latest | Rohan Muppa | — | 🪝 🌐 | |
|
Package purpose: MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 241d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Steve Huang | — | 🪝 🌐 | |
|
Package purpose: Multi-agent orchestration platform for AI coding teams — coordinates Claude Code, Gemini CLI, and Codex agents with a real-time web dashboard
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 241d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Solid# | — | 🪝 🌐 | |
|
Package purpose: Be There — the system that answers, books, and takes payment when you can't. CLI + SDK + MCP tools for SMBs, agencies, and AI agents. solid clone plumber → working business in 30 seconds.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 242d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Route/action layer for AI agents: one call (unbrowse "task" --url) reuses first-party site routes instead of browser loops. In-process CLI + Agent Skill + SDK. Bee aliases: @unbrowse/pollen-cli.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 242d | — | — | — |
Unverified Signal
|
— | npm | latest | BabelCloud | — | 🪝 🌐 | |
|
Package purpose: A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 242d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 242d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Private GrepRAG client for existing Claude Code, Codex, OpenCode, and Grok Build tenants.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 245d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Vibgrate | — | 🪝 🌐 | |
|
Package purpose: vg — local codebase intelligence CLI + MCP server for AI coding agents: deterministic code graph, drift reporting, and version-correct library docs (Apache-2.0)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 245d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Shipyard daemon - collaborative coding agents with Loro CRDT sync
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 246d | — | — | — |
Unverified Signal
|
— | npm | latest | Andrei Hasna | — | 🪝 🌐 | |
|
Package purpose: Universal task management for AI coding agents - CLI + MCP server + interactive TUI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 247d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 251d | — | — | — |
SUSPICIOUS
|
— | npm | latest | animeshkundu | — | 🪝 🌐 | |
|
Package purpose: A reverse proxy that exposes GitHub Copilot as OpenAI and Anthropic compatible API endpoints.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 254d | — | — | — |
Unverified Signal
|
— | npm | latest | NikiforovAll | — | 🪝 🌐 | |
|
Package purpose: A web-based Kanban board for viewing Claude Code tasks with agent teams support
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 258d | — | — | — |
Unverified Signal
|
— | npm | latest | CoWork OS Contributors | — | 🪝 🌐 | |
|
Package purpose: Free, open-source AI super app and multi-provider agent harness for coding, knowledge work, documents, communication, automation, and everyday tasks
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 259d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Michael Kyriacou | — | 🪝 🌐 | |
|
Package purpose: Trustworthy memory and security for AI agents. Memory firewall for any host that writes through it; runtime tool gates on Claude Code, OpenClaw, and Hermes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 261d | — | — | — |
Unverified Signal
|
— | npm | latest | OpenClaw Foundation | — | 🪝 🌐 | |
|
Package purpose: OpenClaw 汉化发行版（稳定版）- 武汉晴辰天下网络科技有限公司
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 263d | — | — | — |
Unverified Signal
|
— | npm | latest | OpenClaw Foundation | — | 🪝 🌐 | |
|
Package purpose: Multi-channel AI gateway with extensible messaging integrations
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 265d | 57 | 22,192 | ↑0.2/day |
Very Risky
|
web3 | npm | 0.1.6 | nich nich@lyra.works | lyra.works | 🪝 | |
|
Package purpose: Lyra Web3 Playground - Learn blockchain development with interactive examples. Compile and deploy Solidity in your browser. Built by nich.
Claimed homepage: https://github.com/nirholas/lyra-web3-playground#readme
Matched naming pattern: lyra-web3-playground
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 265
Registry downloads: 57/month, 14/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 22192 lines, 770.4 kB across 88 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 269d | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Remote terminal access from anywhere
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 274d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Cody Swann | — | 🪝 🌐 | |
|
Package purpose: Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 283d | — | — | — |
SUSPICIOUS
|
— | npm | latest | Yeachan Heo | — | 🪝 🌐 | |
|
Package purpose: Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 285d | — | — | — |
SUSPICIOUS
|
— | npm | latest | RuvNet | — | 🪝 🌐 | |
|
Package purpose: Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 287d | — | — | — |
🐛 Potential Cross-Ecosystem Worm
Very Risky
|
— | npm | latest | William Zujkowski | — | 🪝 🌐 🐛 | |
|
Package purpose: Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, tamper-evident audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 300d | — | — | — |
Unverified Signal
|
— | npm | latest | Bike4Mind | — | 🪝 🌐 | |
|
Package purpose: Interactive CLI tool for Bike4Mind with ReAct agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 301d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Build Databricks Apps faster with a Node.js + React SDK. Built for humans and AI.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 306d | — | — | — |
Unverified Signal
|
— | npm | latest | FJH | — | 🪝 🌐 | |
|
Package purpose: 一个在 Apify/Crawlee Actor 中启用实时截图视图的实用工具库。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 310d | — | — | — |
Unverified Signal
|
— | npm | latest | Mark Jaquith | — | 🪝 🌐 | |
|
Package purpose: Manage agentic work across repositories with durable workbases
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 100 | 318d | — | — | — |
SUSPICIOUS
|
— | npm | latest | YeonGyu-Kim | — | 🪝 🌐 | |
|
Package purpose: The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||