🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Taken Down Flagged, then pulled by the registry About What Sentinel does & why

Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →

Search & filter syntax reference
Filter with verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…), ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors), email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d (combine both for a range), state:live / state:taken_down (registry liveness — the feed defaults to state:live), lead:>7d (days we had a since-removed package flagged while it was still up), or a bare word for a package-name search.
Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
97 47d 118 93 ↑2.5/day
Very Risky
bl4ze npm latest — — 🪝 🌐
Package purpose: A terminal coding agent that runs unattended, with a remote console you can drive from your phone.
Claimed homepage: https://bl4ze.net
Matched naming pattern: node-bl4ze-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 47
Registry downloads: 118/month, 29/week (MODERATE_USAGE)
Codebase size: 93 lines, 3.8 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (44 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.cjs'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.cjs:20
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.cjs:95
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.cjs:17
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.cjs:31
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.cjs'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.cjs:20
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.cjs:95
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.cjs:17
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.cjs:31
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.cjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 52d 548 108 ↑10.5/day
Very Risky
renview npm latest — — 🪝 🌐 📦
Package purpose: 帮助人类降低认知负担的代码审核工具
Claimed homepage: https://view.bandwidth.ren
Matched naming pattern: node-renview-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 52
Registry downloads: 548/month, 137/week (MODERATE_USAGE)
Codebase size: 108 lines, 4.4 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHPackage registered recently (45 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node ./postinstall.mjs'
  • HIGHBUNDLED_NATIVE_BINARY: Unexpected compiled binary 'package/bin/renview.exe' in npm tarball
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/postinstall.mjs:85
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/postinstall.mjs:65
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/postinstall.mjs:62
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node ./postinstall.mjs'
  • BUNDLED_NATIVE_BINARY: Unexpected compiled binary 'package/bin/renview.exe' in npm tarball
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/postinstall.mjs:85
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/postinstall.mjs:65
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/postinstall.mjs:62
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/postinstall.mjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 52d 2,551 150 ↑49.1/day
Very Risky
llm npm 14.0.0 ypollak2 — 🪝 🌐
Package purpose: Stop hitting the limit on your Claude Pro or Max plan. Routes routine prompts to free and cheap models so your subscription quota is there when you need it. No API keys.
Claimed homepage: https://github.com/ypollak2/llm-router#readme
Matched naming pattern: node-llm-routing
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 52
Registry downloads: 2551/month, 637/week (ACTIVE_COMMUNITY_USE)
Codebase size: 150 lines, 6.0 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (38 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHPackage registered with suspiciously high major version (v15.4.0, major 15) despite recent registration (38 days ago, 16 release(s)), indicating potential dependency confusion attack to shadow internal organization builds.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:19 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:92 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:18
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:19 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:92 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:18
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 62d 566 66,385 ↑9.1/day
Very Risky
@xiaobuyu/nodesign npm 0.0.10 — — 🪝 🗄️
Package purpose: NoDesign: an infinite canvas workbench for independent creators. An agent builds sites, decks, documents, images and video as real files, on your machine, with your own model key.
Claimed homepage: https://github.com/Xiaokebuyu/Nodesign#readme
Matched naming pattern: node-@xiaobuyu/nodesign-nodesign
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 62
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 566/month, 141/week (MODERATE_USAGE)
Codebase size: 66385 lines, 8.4 MB across 402 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (42 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node server/ops/fix-sdk-musl.mjs'
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/server/engine/stage/display/app.js:43 (+14 more occurrence(s) elsewhere)
  • HIGHCREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/server/engine/agent/auto-mode-rules.js:68
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/server/engine/mcp/tools/browse.js:81 (+60 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/server/engine/browse/capture.js:423 (+7 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/web/dist/assets/cytoscape.esm-BjAbmLdb.js:331 (+1 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node server/ops/fix-sdk-musl.mjs'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/server/engine/stage/display/app.js:43 (+14 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/server/engine/agent/auto-mode-rules.js:68
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/server/engine/mcp/tools/browse.js:81 (+60 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/server/engine/browse/capture.js:423 (+7 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/web/dist/assets/cytoscape.esm-BjAbmLdb.js:331 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/server/engine/mcp/tools/list-pages.js:90
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/server/engine/mcp/tools/helpers/motion-lab.js:278

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 77d 555 17,209 ↑7.2/day
Very Risky
@aidotnet/opencowork npm 1.4.0 — — 🪝 🌐 📦
Package purpose: OpenCowork command-line interface
Claimed homepage: https://github.com/AIDotNet/OpenCowork/tree/main/cli
Matched naming pattern: node-@aidotnet/opencowork-opencowork
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 77
Registry downloads: 555/month, 138/week (MODERATE_USAGE)
Codebase size: 17209 lines, 798.6 kB across 70 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (75 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node ./scripts/install-native-worker.mjs'
  • HIGHBUNDLED_NATIVE_BINARY: Unexpected compiled binary 'package/native-workers/linux-x64/codegraph-worker/grammars/libtree-sitter.so' in npm tarball
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/app.js:1302 (+12 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/lib/clipboard-image.js:113
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/dist/runtime/mcp-host.js:81
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install-native-worker.mjs:111
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node ./scripts/install-native-worker.mjs'
  • BUNDLED_NATIVE_BINARY: Unexpected compiled binary 'package/native-workers/linux-x64/codegraph-worker/grammars/libtree-sitter.so' in npm tarball
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/app.js:1302 (+12 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/lib/clipboard-image.js:113
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/dist/runtime/mcp-host.js:81
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install-native-worker.mjs:111
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/install-native-worker.mjs:61
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install-native-worker.mjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 182d 18 1,410 ↑0.1/day
Very Risky
claude npm 0.2.0 — — 🪝
Package purpose: One-command installer for Claude Code auto logs and daily reports.
Claimed homepage: https://github.com/FALLENONEa/claude-auto-log#readme
Matched naming pattern: claude-claude-log
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 182
Registry downloads: 18/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1410 lines, 59.8 kB across 7 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (167 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/plugin/scripts/auto-log.js:6 (+4 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/src/codex-installer.js:4 (+2 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/codex-installer.js:29 (+2 more occurrence(s) elsewhere)
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/src/codex-installer.js:358 (+1 more occurrence(s) elsewhere)
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Cron Job Installation / Tampering' found in package/src/codex-installer.js:378 (+1 more occurrence(s) elsewhere)
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/plugin/scripts/auto-log.js:6 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/src/codex-installer.js:4 (+2 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/src/codex-installer.js:29 (+2 more occurrence(s) elsewhere)
  • SYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/src/codex-installer.js:358 (+1 more occurrence(s) elsewhere)
  • SYSTEM_PERSISTENCE_TAMPERING: 'Cron Job Installation / Tampering' found in package/src/codex-installer.js:378 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/src/codex-installer.js (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/plugin/scripts/daily-report.js:4

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 217d 23 137 ↑0.1/day
Very Risky
claude npm 2.0.6 — — 🪝 🌐
Package purpose: Interactive CLI tool to configure Claude Code statusline
Claimed homepage: https://github.com/LokiQ0713/claude-statusline-config
Matched naming pattern: claude-claude-config
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 217
Registry downloads: 23/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 137 lines, 5.3 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 194 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node postinstall.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/cli.js:2 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/cli.js:16 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/postinstall.js:2
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/postinstall.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node postinstall.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/cli.js:2 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/cli.js:16 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/postinstall.js:2
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/postinstall.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 229d 24 28,876 ↑0.1/day
Very Risky
claude npm 1.1.15 — — 🪝 🗄️
Package purpose: Run Claude Code in isolated Docker containers
Claimed homepage: https://github.com/Luxusio/claude-code-container#readme
Matched naming pattern: claude-claude-container
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 229
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 24/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 28876 lines, 1.0 MB across 44 files (LARGE_CODEBASE)
Automated signals flagged:
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 227 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js --postinstall'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/clean.js:7 (+12 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/clipboard-server.js:135
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/clipboard-server.js:58 (+8 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/dist/container-runtime.js:386 (+1 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js --postinstall'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/clean.js:7 (+12 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/clipboard-server.js:135
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/clipboard-server.js:58 (+8 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/dist/container-runtime.js:386 (+1 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'Registry / Git Configuration (~/.yarnrc, ~/.gitconfig)' found in package/dist/docker.js:360
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Sensitive Token Harvesting' found in package/scripts/install.js:115
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/x11-mcp/server.mjs:2942

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 252d 31 152 ↑0.1/day
Very Risky
claude npm 1.0.3 — — 🪝
Package purpose: CLI tool to setup Claude Code with Zeno360 configuration
Matched naming pattern: zeno360-claude-installer
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 252
Registry downloads: 31/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 152 lines, 6.1 kB across 1 file (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'zeno360-claude-installer' matches AI hallucination template [zeno360] + [claude] + [installer].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 227 days ago within the 1-year AI tool proliferation window.
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/index.js:73
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'Shell Profile Backdoor Injection' found in package/index.js:82
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/index.js
Static code signals:
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/index.js:73
  • SYSTEM_PERSISTENCE_TAMPERING: 'Shell Profile Backdoor Injection' found in package/index.js:82
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/index.js

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 267d 310 61,201 ↑1.2/day
Very Risky
deepseek npm 1.0.13 — — 🪝 🗄️
Package purpose: DeepSeek AI-powered CLI agent for code assistance and automation
Claimed homepage: https://github.com/username-secret/deepseek-cli#readme
Matched naming pattern: node-deepseek-coder
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 267
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 310/month, 77/week (MODERATE_USAGE)
Codebase size: 61201 lines, 2.3 MB across 334 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'deepseek-coder' matches AI hallucination template [node] + [deepseek] + [coder].
  • HIGHClaims critical enterprise brand identity ('DEEPSEEK').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage registered 242 days ago within the 1-year AI tool proliferation window.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node -e "const fs=require('fs');['dist/bin/deepseek.js'].forEach(f=>{try{fs.chmodSync(f,0o755)}catch{}})" || true'
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/core/agent.js:1342 (+34 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/core/balanceTracker.js:25 (+4 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/tools/diffUtils.js:304 (+4 more occurrence(s) elsewhere)
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node -e "const fs=require('fs');['dist/bin/deepseek.js'].forEach(f=>{try{fs.chmodSync(f,0o755)}catch{}})" || true'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/core/agent.js:1342 (+34 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/core/balanceTracker.js:25 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/tools/diffUtils.js:304 (+4 more occurrence(s) elsewhere)
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/core/hooks.js:19
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in package/dist/headless/interactiveShell.js:1197
  • CREDENTIAL_PATH_HARVESTING: 'macOS Keychain Dump' found in package/dist/headless/interactiveShell.js:1426
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in package/dist/ui/outputMode.js:47 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
97 2086d 152 46 ↑0.1/day
Very Risky
ethereum npm 7.0.0 Animoca Brands — 🪝
Package purpose: REVV Solidity Contracts
Claimed homepage: https://github.com/animoca/revv-ethereum-contracts#readme
Matched naming pattern: node-ethereum-revv-ethereum-contracts
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2086
Registry downloads: 152/month, 38/week (MODERATE_USAGE)
Codebase size: 46 lines, 1.5 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@animoca/revv-ethereum-contracts' matches AI hallucination template [node] + [ethereum] + [revv-ethereum-contracts].
  • HIGHClaims critical enterprise brand identity ('ETHEREUM').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 2070 days ago (predates modern AI hallucination waves).
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'bash -c 'for cfg in .vscode/settings.json .vscode/extensions.json .vscode/launch.json; do cp -n ${cfg}.default ${cfg} || :; done''
  • CRITICALSUSPICIOUS_SHELL_COMMAND: Pattern 'bash' in 'postinstall' script
  • CRITICALSUSPICIOUS_SHELL_COMMAND: Pattern 'sh -c' in 'postinstall' script
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'bash -c 'for cfg in .vscode/settings.json .vscode/extensions.json .vscode/launch.json; do cp -n ${cfg}.default ${cfg} || :; done''
  • SUSPICIOUS_SHELL_COMMAND: Pattern 'bash' in 'postinstall' script
  • SUSPICIOUS_SHELL_COMMAND: Pattern 'sh -c' in 'postinstall' script

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 62h — — —
Unverified Signal
— pypi 0.3.0 — — 🪝
Package purpose: Verfy: guard coding-agent tool calls, scan and lock MCP tools, and sign a verifiable receipt for every action.
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in verfy-0.3.0/src/verfy/cli.py:831
  • CREDENTIAL_PATH_HARVESTING: 'SSH Directory / Private Keys (~/.ssh)' found in verfy-0.3.0/src/verfy/cli.py:831
  • CREDENTIAL_PATH_HARVESTING: 'Cloud Instance Metadata (AWS/GCP/Azure IMDS)' found in verfy-0.3.0/src/verfy/cli.py:833
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in verfy-0.3.0/src/verfy/cli.py:1026
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in verfy-0.3.0/src/verfy/cli.py:843
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in verfy-0.3.0/src/verfy/cli.py:31
  • ANTI_ANALYSIS_EVASION: 'CI/CD & Sandbox Environment Detection' found in verfy-0.3.0/src/verfy/cli.py:575
  • CREDENTIAL_PATH_HARVESTING: 'SSH Private Keys (~/.ssh)' found in verfy-0.3.0/src/verfy/demo_server.py:28

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 18d 101 23 ↑5.6/day
SUSPICIOUS
google pypi 1.0.0 — — 🪝
Package purpose: MCP server for Google Flights Deals through HasData's hosted API. No Google account.
Claimed homepage: https://pypi.org/project/hasdata-google-flights-deals-mcp/
Matched naming pattern: hasdata-google-flights
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 18
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 101/month, 34/week (MODERATE_USAGE)
Codebase size: 23 lines, 930 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'hasdata-google-flights-deals-mcp' matches AI hallucination template [hasdata] + [google] + [flights].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (10 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_flights_deals_mcp-1.0.0/hasdata_google_flights_deals_mcp/__init__.py:26
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_flights_deals_mcp-1.0.0/hasdata_google_flights_deals_mcp/__init__.py:14
  • INFOModerate community usage with 101 monthly downloads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_flights_deals_mcp-1.0.0/hasdata_google_flights_deals_mcp/__init__.py:26
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_flights_deals_mcp-1.0.0/hasdata_google_flights_deals_mcp/__init__.py:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 18d 0 125 ↑0.0/day
Very Risky
@ziuus/orbit npm 0.11.3 zius — 🪝 🌐
Package purpose: Aesthetic Rust TUI system dashboard — CPU, memory, disk, network, GPU, processes, now-playing, clock, file manager, notes and visualizer in one terminal pane
Claimed homepage: https://github.com/ziuus/orbit#readme
Matched naming pattern: npm-@ziuus/orbit-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 18
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 125 lines, 5.2 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (0 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:9 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:97 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:8
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
  • INFOPackage affiliated with trusted vendor '@ziuus/orbit' (provenance:npm_slsa_sigstore). Applied 50% threat score dampening (140 -> 70) to reduce false positives while retaining hijack/takeover detection.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:9 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:97 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:8
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 25d 119 169 ↑4.8/day
Very Risky
@nightlylabs/electron npm 44.4.5-hybrid.1 — — 🪝 🌐
Package purpose: Locally built Electron with opt-in native phone passkeys
Claimed homepage: https://github.com/nightly-labs/electron-hybrid#readme
Matched naming pattern: node-@nightlylabs/electron-electron-hybrid
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 25
Registry downloads: 119/month, 29/week (MODERATE_USAGE)
Codebase size: 169 lines, 9.5 kB across 8 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (20 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHPackage registered with suspiciously high major version (v44.4.5-hybrid.1, major 44) despite recent registration (20 days ago, 1 release(s)), indicating potential dependency confusion attack to shadow internal organization builds.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node runtime/install.mjs'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/common.mjs:11
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/common.mjs:7 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/runtime/install.mjs:24
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/runtime/install.mjs, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node runtime/install.mjs'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/common.mjs:11
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/common.mjs:7 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/runtime/install.mjs:24
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/runtime/install.mjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 28d 1,159 204 ↑41.4/day
Very Risky
@webnori/agent npm 0.5.0 psmon — 🪝 🌐
Package purpose: A coding agent for your terminal in one native binary: reads your code, writes files, runs commands behind an approval gate, and remembers each project in a knowledge graph. Works with any OpenAI-compatible model, hosted or local (Ollama, LM Studio, vLLM)
Claimed homepage: https://github.com/psmon/AgentZeroLite/tree/main/Project/AgentOne
Matched naming pattern: node-@webnori/agent-agent-one
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 28
Registry downloads: 1159/month, 289/week (ACTIVE_COMMUNITY_USE)
Codebase size: 204 lines, 8.6 kB across 3 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • INFOLegitimate documentation effort (255 chars with homepage link).
  • HIGHPackage registered recently (24 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • HIGHLIFECYCLE_SCRIPT: 'preuninstall' -> 'node scripts/uninstall.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/agent-one.js:14 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/agent-one.js:29 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/install.js:16
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • LIFECYCLE_SCRIPT: 'preuninstall' -> 'node scripts/uninstall.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/agent-one.js:14 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/agent-one.js:29 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/scripts/install.js:16
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/install.js:20
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 29d 0 123 ↑0.0/day
Very Risky
@bunrumz/rotor npm 2.3.1 — — 🪝 🌐
Package purpose: All-in-one Roblox toolchain: native roblox-ts compiler, Luau bundler, minifier, dev loop, and packer. This package downloads the prebuilt rotor binary from GitHub Releases.
Claimed homepage: https://github.com/uproot/rotor#readme
Matched naming pattern: node-@bunrumz/rotor-rotor
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 29
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 123 lines, 4.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (20 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/install.js:69
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/install.js:47
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/rotor.js:9
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/rotor.js:18
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install.js'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/install.js:69
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/install.js:47
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/rotor.js:9
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/bin/rotor.js:18
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 31d — — —
Unverified Signal
— npm latest — — 🪝
Package purpose: HarmonyOS application development command line tool
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/cli.js:5 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli.js:2 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/lib/better-sqlite3-vendor.mjs:61 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 32d — — —
Unverified Signal
— npm latest — — 🪝
Package purpose: HarmonyOS application development command line tool
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.mjs'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/cli.js:1279
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/cli.js:2 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/lib/better-sqlite3-vendor.mjs:61 (+1 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 36d 410 23 ↑11.4/day
SUSPICIOUS
google pypi 1.0.2 — — 🪝
Package purpose: MCP server for Google Hotels through HasData's hosted API. No Google account.
Claimed homepage: https://pypi.org/project/hasdata-google-hotels-mcp/
Matched naming pattern: hasdata-google-hotels
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 36
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 410/month, 43/week (MODERATE_USAGE)
Codebase size: 23 lines, 916 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'hasdata-google-hotels-mcp' matches AI hallucination template [hasdata] + [google] + [hotels].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (27 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_hotels_mcp-1.0.2/hasdata_google_hotels_mcp/__init__.py:26
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_hotels_mcp-1.0.2/hasdata_google_hotels_mcp/__init__.py:14
  • INFOModerate community usage with 410 monthly downloads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_hotels_mcp-1.0.2/hasdata_google_hotels_mcp/__init__.py:26
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_hotels_mcp-1.0.2/hasdata_google_hotels_mcp/__init__.py:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 39d 414 23 ↑10.6/day
SUSPICIOUS
google pypi 1.0.2 — — 🪝
Package purpose: MCP server for Google Scholar through HasData's hosted API. 1,000 free credits every month.
Claimed homepage: https://pypi.org/project/hasdata-google-scholar-mcp/
Matched naming pattern: hasdata-google-scholar
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 39
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 414/month, 37/week (MODERATE_USAGE)
Codebase size: 23 lines, 911 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'hasdata-google-scholar-mcp' matches AI hallucination template [hasdata] + [google] + [scholar].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (30 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_scholar_mcp-1.0.2/hasdata_google_scholar_mcp/__init__.py:26
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_scholar_mcp-1.0.2/hasdata_google_scholar_mcp/__init__.py:14
  • INFOModerate community usage with 414 monthly downloads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_scholar_mcp-1.0.2/hasdata_google_scholar_mcp/__init__.py:26
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_scholar_mcp-1.0.2/hasdata_google_scholar_mcp/__init__.py:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 39d 460 23 ↑11.8/day
SUSPICIOUS
google pypi 1.0.3 — — 🪝
Package purpose: MCP server for Google Images through HasData's hosted API. 1,000 free credits every month.
Claimed homepage: https://pypi.org/project/hasdata-google-images-mcp/
Matched naming pattern: hasdata-google-images
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 39
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 460/month, 37/week (MODERATE_USAGE)
Codebase size: 23 lines, 909 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'hasdata-google-images-mcp' matches AI hallucination template [hasdata] + [google] + [images].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (30 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_images_mcp-1.0.3/hasdata_google_images_mcp/__init__.py:26
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_images_mcp-1.0.3/hasdata_google_images_mcp/__init__.py:14
  • INFOModerate community usage with 460 monthly downloads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_google_images_mcp-1.0.3/hasdata_google_images_mcp/__init__.py:26
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_google_images_mcp-1.0.3/hasdata_google_images_mcp/__init__.py:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 42d — — —
Very Risky
— npm latest Colin Murphy — 🪝 🌐
Package purpose: Node.js bindings for C2PA
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.cjs'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.cjs:92
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/postinstall.cjs:204 (+1 more occurrence(s) elsewhere)
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/postinstall.cjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 42d — — —
Very Risky
— npm latest Aliyun Model Studio — 🪝 🌐
Package purpose: CLI for Aliyun Model Studio (DashScope) AI Platform.
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node postinstall.js'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/postinstall.js:102
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/postinstall.js:60
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/postinstall.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 43d 249 105 ↑5.8/day
SUSPICIOUS
microsoft pypi 1.0.1 — —
Package purpose: AIGP governance adapter for Microsoft Agent Framework (MAF) — the converged Semantic Kernel + AutoGen SDK (GA 2026-04-03)
Claimed homepage: https://pypi.org/project/maigp-microsoft-agent-framework/
Matched naming pattern: maigp-microsoft-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 43
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 249/month, 13/week (MODERATE_USAGE)
Codebase size: 105 lines, 5.7 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'maigp-microsoft-agent-framework' matches AI hallucination template [maigp] + [microsoft] + [agent].
  • HIGHClaims critical enterprise brand identity ('MICROSOFT').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (30 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOModerate community usage with 249 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 43d 391 29 ↑9.1/day
SUSPICIOUS
ledger pypi 0.1.0 MJ —
Package purpose: An amount-based bookkeeping policy for johnnybt's account walk: netted funding, a money sellable budget, two-pass sizing.
Claimed homepage: https://pypi.org/project/johnnybt-ledger-polars/
Matched naming pattern: johnnybt-ledger-polars
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 43
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 391/month, 20/week (MODERATE_USAGE)
Codebase size: 29 lines, 1.4 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'johnnybt-ledger-polars' matches AI hallucination template [johnnybt] + [ledger] + [polars].
  • HIGHClaims critical enterprise brand identity ('LEDGER').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (30 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOModerate community usage with 391 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 44d 473 23 ↑10.8/day
SUSPICIOUS
amazon pypi 1.0.3 — — 🪝
Package purpose: MCP server for Amazon through HasData's hosted API. 1,000 free credits every month.
Claimed homepage: https://pypi.org/project/hasdata-amazon-mcp/
Matched naming pattern: hasdata-amazon-mcp
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 44
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 473/month, 44/week (MODERATE_USAGE)
Codebase size: 23 lines, 895 Bytes across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'hasdata-amazon-mcp' matches AI hallucination template [hasdata] + [amazon] + [mcp].
  • HIGHClaims critical enterprise brand identity ('AMAZON').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (37 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_amazon_mcp-1.0.3/hasdata_amazon_mcp/__init__.py:26
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_amazon_mcp-1.0.3/hasdata_amazon_mcp/__init__.py:14
  • INFOModerate community usage with 473 monthly downloads.
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in hasdata_amazon_mcp-1.0.3/hasdata_amazon_mcp/__init__.py:26
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in hasdata_amazon_mcp-1.0.3/hasdata_amazon_mcp/__init__.py:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 45d 86 133 ↑1.9/day
Very Risky
summary npm 1.0.1 saimakramai11 — 🪝 🌐
Package purpose: Install the transcript-summary agent skill for Grok, Claude Code, Copilot, Gemini CLI, and Codex.
Claimed homepage: https://github.com/saimakramai11/Ai11-Transcript-Summary-Skill
Matched naming pattern: transcript-summary-skill
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 45
Registry downloads: 86/month, 21/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 133 lines, 4.8 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (45 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node cli.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/cli.js:8
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/cli.js:73
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/cli.js:5
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/cli.js:13
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/cli.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node cli.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/cli.js:8
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/cli.js:73
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/cli.js:5
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/cli.js:13
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/cli.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 48d — — —
Very Risky
— npm latest sheehanmunim — 🪝 🌐
Package purpose: Fast FFmpeg and FFprobe for Expo and React Native, powered by Nitro Modules
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/fetch-binaries.mjs'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/fetch-binaries.mjs:50
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/fetch-binaries.mjs:75
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/fetch-binaries.mjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 49d 30 111 ↑0.6/day
Very Risky
provalot npm 0.1.2 Prarambh LLC — 🪝 🌐
Package purpose: Deterministic evidence gate for coding agents (Claude Code, Codex CLI)
Claimed homepage: https://github.com/prarambh-labs/provalot#readme
Matched naming pattern: node-provalot-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 49
Registry downloads: 30/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 111 lines, 4.4 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (45 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:7 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:96 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:31
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node install.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/install.js:7 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/install.js:96 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/install.js:5
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/install.js:31
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/install.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 49d 26 1,970 ↑0.5/day
Very Risky
gallerydl npm 1.0.0 Cem — 🪝 🌐
Package purpose: A powerful gallery-dl wrapper for Node.js to fetch image galleries, metadata, and more.
Matched naming pattern: node-gallerydl-api
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 49
Registry downloads: 26/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1970 lines, 73.8 kB across 8 files (LARGE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (45 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install-gallery-dl.js'
  • HIGHMISSING_SOURCE_REPOSITORY_URL
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/index.js:107 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/dist/index.js:111 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install-gallery-dl.js:46
  • CRITICALINSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install-gallery-dl.js, which makes network calls and executes/decodes/reads secrets
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install-gallery-dl.js'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/dist/index.js:107 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'require('http(s)')' found in package/dist/index.js:111 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/install-gallery-dl.js:46
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install-gallery-dl.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 50d — — —
Very Risky
— npm latest maojindao55 — 🪝 🌐
Package purpose: Custom Agent Client Protocol adapter for Google Antigravity CLI using native JSON output
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/install-antigravity.mjs'
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/agyArgs.js:13 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/dist/modelCache.js:13 (+1 more occurrence(s) elsewhere)
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/install-antigravity.mjs, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 52d 29 25 ↑0.6/day
SUSPICIOUS
llamaindex pypi 0.1.2 U.CASH u.cash
Package purpose: LlamaIndex tools for U.CASH agent monetization over HTTP-402.
Claimed homepage: https://pypi.org/project/llamaindex-ucash/
Matched naming pattern: python-llamaindex-ucash
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 52
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 29/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 25 lines, 1.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'llamaindex-ucash' matches AI hallucination template [python] + [llamaindex] + [ucash].
  • HIGHClaims critical enterprise brand identity ('LLAMAINDEX').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (45 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 52d 35 26 ↑0.7/day
SUSPICIOUS
langchain pypi 0.1.3 U.CASH u.cash
Package purpose: LangChain tools for U.CASH agent monetization over HTTP-402.
Claimed homepage: https://pypi.org/project/langchain-ucash/
Matched naming pattern: python-langchain-ucash
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 52
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 35/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 26 lines, 1.2 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-ucash' matches AI hallucination template [python] + [langchain] + [ucash].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (45 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 52d 35 34 ↑0.7/day
SUSPICIOUS
crewai pypi 0.1.2 U.CASH u.cash
Package purpose: crewAI tools for U.CASH agent monetization over HTTP-402.
Claimed homepage: https://pypi.org/project/crewai-ucash/
Matched naming pattern: python-crewai-ucash
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 52
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 35/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 34 lines, 1.6 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'crewai-ucash' matches AI hallucination template [python] + [crewai] + [ucash].
  • HIGHClaims critical enterprise brand identity ('CREWAI').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (45 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 53d — — —
Unverified Signal
— npm latest — — 🪝 🌐
Package purpose: AI Agent Platform — multi-repo agent management based on OpenCode
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node postinstall.js'
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/public/assets/index-DP_wGOuZ.js:1
  • SUSPICIOUS_OBFUSCATION: 'Invisible Unicode Steganography / Bidi Override' found in package/public/assets/index-DP_wGOuZ.js:635
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/postinstall.js:46

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 63d 22 33 ↑0.3/day
SUSPICIOUS
huggingface pypi 0.1.0 — leonardofurnielis@outlook.com outlook.com
Package purpose: parakeet-index embeddings huggingface integration
Claimed homepage: https://pypi.org/project/parakeet-index-embeddings-huggingface/
Matched naming pattern: parakeet-huggingface-embeddings
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 63
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 22/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 33 lines, 1.6 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'parakeet-index-embeddings-huggingface' matches AI hallucination template [parakeet] + [huggingface] + [embeddings].
  • HIGHClaims critical enterprise brand identity ('HUGGINGFACE').
  • HIGHPublisher email 'leonardofurnielis@outlook.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (50 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 64d 18 106 ↑0.3/day
SUSPICIOUS
google pypi 0.1.0 — mijael.gara@gmail.com gmail.com
Package purpose: A Python client for Google Maps Geocoding and Weather forecast APIs
Claimed homepage: https://pypi.org/project/skycast-google/
Matched naming pattern: python-google-skycast
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 64
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 18/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 106 lines, 5.6 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'skycast-google' matches AI hallucination template [python] + [google] + [skycast].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'mijael.gara@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (53 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 85d 43 148 ↑0.5/day
SUSPICIOUS
google pypi 0.1.0a4 Blazing Customs —
Package purpose: Google ADK (Agent Development Kit) integration for the Preference Profile Exchange (PPX).
Claimed homepage: https://pypi.org/project/ppx-google-adk/
Matched naming pattern: ppx-google-adk
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 85
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 43/month, 13/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 148 lines, 6.3 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'ppx-google-adk' matches AI hallucination template [ppx] + [google] + [adk].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (58 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 86d 20 30 ↑0.2/day
SUSPICIOUS
google pypi 0.0.0 sc —
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/shopee-skynet-shopee-noc-google-mcp-server/
Matched naming pattern: shopee-google-shopee
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 86
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 20/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 30 lines, 1.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'shopee-skynet-shopee-noc-google-mcp-server' matches AI hallucination template [shopee] + [google] + [shopee].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHPackage registered recently (60 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 89d 16 61 ↑0.2/day
SUSPICIOUS
vllm pypi 0.1.0 — your.email@example.com example.com 🪝
Package purpose: A utility to automatically kill vLLM processes and release GPU memory.
Claimed homepage: https://pypi.org/project/vllm-cleaner/
Matched naming pattern: python-vllm-cleaner
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 89
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 16/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 61 lines, 2.8 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'vllm-cleaner' matches AI hallucination template [python] + [vllm] + [cleaner].
  • HIGHClaims critical enterprise brand identity ('VLLM').
  • HIGHPublisher email 'your.email@example.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (64 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in vllm_cleaner-0.1.0/vllm_cleaner/__init__.py:14
Static code signals:
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in vllm_cleaner-0.1.0/vllm_cleaner/__init__.py:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 90d 15 30 ↑0.2/day
SUSPICIOUS
langgraph pypi 0.0.0 sc —
Package purpose: A small example package
Claimed homepage: https://pypi.org/project/sea-autodev-langgraph-server-sdk/
Matched naming pattern: sea-langgraph-langgraph
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 90
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 15/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 30 lines, 1.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'sea-autodev-langgraph-server-sdk' matches AI hallucination template [sea] + [langgraph] + [langgraph].
  • HIGHClaims critical enterprise brand identity ('LANGGRAPH').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHPackage registered recently (67 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 91d 45 26 ↑0.5/day
SUSPICIOUS
langchain pypi 0.1.2 U.CASH u.cash
Package purpose: LangChain tools for U.CASH agent monetization over HTTP-402.
Claimed homepage: https://pypi.org/project/langchain-ucashpay/
Matched naming pattern: python-langchain-ucashpay
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 91
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 45/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 26 lines, 1.2 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'langchain-ucashpay' matches AI hallucination template [python] + [langchain] + [ucashpay].
  • HIGHClaims critical enterprise brand identity ('LANGCHAIN').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5+ versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (69 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 92d 14 92 ↑0.2/day
SUSPICIOUS
google pypi 0.1.3 — amit.vervebot@gmail.com gmail.com
Package purpose: NeuralCleave plugin — list upcoming Google Calendar events.
Claimed homepage: https://pypi.org/project/neuralcleave-google-calendar/
Matched naming pattern: neuralcleave-google-calendar
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 92
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 14/month, 11/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 92 lines, 4.2 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'neuralcleave-google-calendar' matches AI hallucination template [neuralcleave] + [google] + [calendar].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'amit.vervebot@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (69 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSYNTAX_ERROR_IN_neuralcleave_google_calendar-0.1.3/src/neuralcleave_google_calendar/__init__.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • HIGHSYNTAX_ERROR_IN_neuralcleave_google_calendar-0.1.3/src/neuralcleave_google_calendar/plugin.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • HIGHSYNTAX_ERROR_IN_neuralcleave_google_calendar-0.1.3/src/neuralcleave_google_calendar/tool.py: invalid non-printable character U+FEFF (<unknown>, line 1)
Static code signals:
  • SYNTAX_ERROR_IN_neuralcleave_google_calendar-0.1.3/src/neuralcleave_google_calendar/__init__.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • SYNTAX_ERROR_IN_neuralcleave_google_calendar-0.1.3/src/neuralcleave_google_calendar/plugin.py: invalid non-printable character U+FEFF (<unknown>, line 1)
  • SYNTAX_ERROR_IN_neuralcleave_google_calendar-0.1.3/src/neuralcleave_google_calendar/tool.py: invalid non-printable character U+FEFF (<unknown>, line 1)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 92d 2,195 492 ↑23.9/day
Very Risky
@term npm 0.6.0 Aayush Gour ag14906@gmail.com gmail.com 🪝 🌐
Package purpose: Terminal Hub — capture every terminal you open and manage them all from one window. One-command cross-platform install (macOS / Linux / Windows).
Claimed homepage: https://github.com/AayushGour/terminal-hub-releases#readme
Matched naming pattern: npm-@term-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 92
Registry downloads: 2195/month, 548/week (ACTIVE_COMMUNITY_USE)
Codebase size: 492 lines, 21.6 kB across 6 files (MODERATE_CODEBASE)
Automated signals flagged:
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (60 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHLIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • HIGHLIFECYCLE_SCRIPT: 'preuninstall' -> 'node scripts/preuninstall.js'
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/hub.js:6 (+3 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall.js:159 (+1 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.js:127
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/preuninstall.js:82
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node scripts/postinstall.js'
  • LIFECYCLE_SCRIPT: 'preuninstall' -> 'node scripts/preuninstall.js'
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'require('child_process')' found in package/bin/hub.js:6 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/postinstall.js:159 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/postinstall.js:127
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/preuninstall.js:82
  • INSTALL_TIME_NETWORK_SOCKET: 'postinstall' script runs package/scripts/postinstall.js, which makes network calls and executes/decodes/reads secrets

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 93d — — —
Unverified Signal
— npm latest — — 🪝
Package purpose: Native Messaging Host for Mearl — bridges Chrome Extension and local socket server
Static code signals:
  • LIFECYCLE_SCRIPT: 'postinstall' -> 'node dist/index.js --init || true'
  • MISSING_SOURCE_REPOSITORY_URL
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/install.js:6 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/dist/install.js:6 (+3 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'new Function()' found in package/dist/plugin-task-host.js:612 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/dist/plugin-task-host.js:624
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/dist/plugin-task-host.js:607 (+1 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Bulk Environment Harvesting' found in package/dist/plugin-task-host.js:993

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 96d 22 67 ↑0.2/day
SUSPICIOUS
llama pypi 0.10434.0 — — 🪝 📦
Package purpose: Pinned Vulkan llama-server build for Skulk's served GGUF engine (Linux x86_64)
Claimed homepage: https://pypi.org/project/skulk-llama-server-vulkan/
Matched naming pattern: skulk-llama-server
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 96
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 22/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 67 lines, 3.1 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'skulk-llama-server-vulkan' matches AI hallucination template [skulk] + [llama] + [server].
  • HIGHClaims critical enterprise brand identity ('LLAMA').
  • HIGHPublisher email 'None' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (76 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHSOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in skulk_llama_server_vulkan/__init__.py:52
  • HIGHBUNDLED_NATIVE_BINARY: Unexpected compiled binary 'skulk_llama_server_vulkan/bin/libggml-base.so' in wheel archive
Static code signals:
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in skulk_llama_server_vulkan/__init__.py:52
  • BUNDLED_NATIVE_BINARY: Unexpected compiled binary 'skulk_llama_server_vulkan/bin/libggml-base.so' in wheel archive

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 99d 21 1,785 ↑0.2/day
Very Risky
cursor npm 0.2.0 Aiden Hadisi aiden@hadisi.com hadisi.com 🪝 🗄️
Package purpose: Automatically distill your Cursor agent transcripts into rules, skills, and subagents
Claimed homepage: https://github.com/AidenHadisi/cursor-distill#readme
Matched naming pattern: node-cursor-distill
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 99
Registry downloads: 21/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1785 lines, 84.6 kB across 26 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'cursor-distill' matches AI hallucination template [node] + [cursor] + [distill].
  • HIGHClaims critical enterprise brand identity ('CURSOR').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (79 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHCREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/agent.js:224 (+4 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/agent.js:92 (+1 more occurrence(s) elsewhere)
  • HIGHSYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/dist/scheduler.js:35
  • CRITICALSOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/dist/scheduler.js
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in package/dist/agent.js:224 (+4 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/dist/agent.js:92 (+1 more occurrence(s) elsewhere)
  • SYSTEM_PERSISTENCE_TAMPERING: 'System Persistence Implant (systemd/cron/registry)' found in package/dist/scheduler.js:35
  • SOURCE_CODE_PERSISTENT_BACKDOOR: persistence mechanism combined with execution/network in package/dist/scheduler.js

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 101d 55 302,767 ↑0.5/day
Very Risky
claude npm 0.8.0 — — 🪝 📡
Package purpose: AI Traffic Control — inspect and govern AI prompts in Claude Code
Claimed homepage: https://github.com/akasecurity/ai-tc/tree/main/plugins/claude-code
Matched naming pattern: node-claude-plugin-claude-code
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 101
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 55/month, 13/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 302767 lines, 11.7 MB across 14 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name '@akasecurity/plugin-claude-code' matches AI hallucination template [node] + [claude] + [plugin-claude-code].
  • HIGHClaims critical enterprise brand identity ('CLAUDE').
  • INFOPackage release verified with cryptographic build provenance (npm_slsa_sigstore). Guarantees authentic repository build pipeline and eliminates publisher domain spoofing risk.
  • HIGHPackage registered recently (82 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHEXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in package/scripts/backfill.js:24258 (+9 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/scripts/backfill.js:22890 (+9 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/backfill.js:22658 (+10 more occurrence(s) elsewhere)
  • HIGHSOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in package/scripts/backfill.js:22677 (+9 more occurrence(s) elsewhere)
Static code signals:
  • EXFILTRATION_DESTINATION_DETECTED: 'Hardcoded GitHub Personal Access Token' found in package/scripts/backfill.js:24258 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'eval()' found in package/scripts/backfill.js:22890 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'execSync/spawnSync' found in package/scripts/backfill.js:22658 (+10 more occurrence(s) elsewhere)
  • SOURCE_CODE_DYNAMIC_EXECUTION: 'Python Subprocess / OS Execution' found in package/scripts/backfill.js:22677 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'Buffer.from(..., 'base64')' found in package/scripts/backfill.js:22085 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENCODED_PAYLOAD: 'atob()' found in package/scripts/backfill.js:1990 (+12 more occurrence(s) elsewhere)
  • SOURCE_CODE_NETWORK_CALL: 'fetch/axios/XMLHttpRequest' found in package/scripts/backfill.js:23097 (+9 more occurrence(s) elsewhere)
  • SOURCE_CODE_ENV_VARS_ACCESS: 'Environment Variable Access (process.env / os.environ)' found in package/scripts/backfill.js:22217 (+10 more occurrence(s) elsewhere)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on npm →
95 118d 33 78 ↑0.3/day
SUSPICIOUS
alchemy pypi 0.1.1 — fernforgehq@gmail.com gmail.com 🪝 🗄️
Package purpose: Turn AI prose into human-quality writing. A drop-in ruleset that stops your coding agent from writing like an LLM.
Claimed homepage: https://pypi.org/project/alchemy-writing/
Matched naming pattern: python-alchemy-writing
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 118
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 33/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 78 lines, 3.3 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'alchemy-writing' matches AI hallucination template [python] + [alchemy] + [writing].
  • HIGHClaims critical enterprise brand identity ('ALCHEMY').
  • HIGHPublisher email 'fernforgehq@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (112 days ago) during the active AI hallucination slopsquatting wave.
  • HIGHCREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in alchemy_writing-0.1.1/src/alchemy_writing/cli.py:14
Static code signals:
  • CREDENTIAL_PATH_HARVESTING: 'IDE / AI Agent Configuration Hijacking' found in alchemy_writing-0.1.1/src/alchemy_writing/cli.py:14

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
« Prev Next »
LINK COPIED TO CLIPBOARD