Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 95 | 916d | 27 | 124 | ↑0.0/day |
SUSPICIOUS
|
stripe | npm | 1.3.0 | — | — | 🪝 | |
|
Package purpose: A Directus extension that supports building flows for Stripe webhooks
Matched naming pattern: directus-stripe-stripe
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 916
Registry downloads: 27/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 124 lines, 695.1 kB across 2 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 95 | 998d | 19 | 110 | ↑0.0/day |
SUSPICIOUS
|
tron | npm | 0.28.0 | — | — | 🪝 🗄️ | |
|
Package purpose: Tron integration providing provider-tron-link utility for Node
Matched naming pattern: node-tron-provider-tron-link
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 998
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 110 lines, 5.7 kB across 7 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 95 | 1148d | 13 | 10 | ↑0.0/day |
SUSPICIOUS
|
solana | npm | 0.0.4 | Muckee muckee@thugnerdz.com | thugnerdz.com | 🪝 | |
|
Package purpose: Solana integration providing react-components-web3-solana utility for Node
Claimed homepage: https://github.com/muckee/react-components-web3-solana#readme
Matched naming pattern: node-solana-react-components-web3-solana
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1148
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 10 lines, 693.7 kB across 8 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 95 | 1214d | 81 | 116 | ↑0.1/day |
SUSPICIOUS
|
web3 | npm | 1.1.12 | — | — | 🪝 | |
|
Package purpose: A react web3 starter kit
Claimed homepage: https://github.com/ARi2692/create-react-web3-app#readme
Matched naming pattern: node-web3-create-react-web3-app
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1214
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 81/month, 20/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 116 lines, 3.9 kB across 9 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 95 | 1293d | 13 | 1 | ↑0.0/day |
SUSPICIOUS
|
cursor | npm | 0.0.2 | — | — | 🪝 | |
|
Package purpose: A portable mouse animation package.
Matched naming pattern: node-cursor-animate
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1293
Code-only verdict: Possible Squatted Stub (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 13/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1 lines, 561.5 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 95 | 1685d | 42 | 45 | ↑0.0/day |
SUSPICIOUS
|
walletconnect | npm | 1.3.1 | https://nuzzlet.com | nuzzlet.com | 🪝 | |
|
Package purpose: WalletConnect Provider browser pre-built usable in rollup bundles.
Claimed homepage: https://github.com/nuzzlet/prebuilt-walletconnect-provider#readme
Matched naming pattern: prebuilt-walletconnect-provider
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1685
Registry downloads: 42/month, 10/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 45 lines, 880.5 kB across 3 files (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 95 | 2252d | 72 | 77 | ↑0.0/day |
SUSPICIOUS
|
npm | 0.3.0 | undefined i@undefined.moe | undefined.moe | 🪝 | ||
|
Package purpose: Google integration providing login-with-google utility for Node
Matched naming pattern: node-google-login-with-google
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2252
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 72/month, 18/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 77 lines, 3.7 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 95 | 2481d | — | — | — |
Very Risky
|
— | npm | latest | smapiot | — | 🪝 🌐 | |
|
Package purpose: The base library for creating a Piral instance.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 12d | 118 | 27,499 | ↑9.8/day |
Very Risky
|
@hivecast/canvas | npm | 0.1.18 | — | — | 🪝 | |
|
Package purpose: HiveCast live-component canvas package: `application`.
Matched naming pattern: node-@hivecast/canvas-canvas
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 12
Registry downloads: 118/month, 29/week (MODERATE_USAGE)
Codebase size: 27499 lines, 1.1 MB across 13 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 27d | 1,488 | 93 | ↑55.1/day |
Very Risky
|
bl4ze | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: A terminal coding agent that runs unattended, with a remote console you can drive from your phone.
Claimed homepage: https://bl4ze.net
Matched naming pattern: node-bl4ze-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 27
Registry downloads: 1488/month, 372/week (ACTIVE_COMMUNITY_USE)
Codebase size: 93 lines, 3.8 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 27d | 2,338 | 10,380 | ↑86.6/day |
Very Risky
|
omliteroute | npm | 1.0.14 | Adam Hasani adamhasani018@gmail.com | gmail.com | 🪝 🗄️ | |
|
Package purpose: OmliteRoute — Ultra-lightweight AI Gateway & Model Router. Low-RAM (~120MB), 356 providers, auto-fallback, and zero-bloat.
Claimed homepage: https://github.com/adamhasani/omliteroute#readme
Matched naming pattern: node-omliteroute-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 27
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 2338/month, 584/week (ACTIVE_COMMUNITY_USE)
Codebase size: 10380 lines, 6.1 MB across 16324 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 32d | 1,584 | 108 | ↑49.5/day |
Very Risky
|
renview | npm | latest | — | — | 🪝 🌐 📦 | |
|
Package purpose: 帮助人类降低认知负担的代码审核工具
Claimed homepage: https://view.bandwidth.ren
Matched naming pattern: node-renview-core
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 32
Registry downloads: 1584/month, 396/week (ACTIVE_COMMUNITY_USE)
Codebase size: 108 lines, 4.4 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 34d | 2,283 | 42,745 | ↑67.1/day |
Very Risky
|
fabmem | npm | 1.1.13 | — | — | 🪝 🗄️ 📦 | |
|
Package purpose: One local MCP server that gives your AI coding agents (Claude Code, Codex, Cursor, Gemini, Copilot) per-project memory and cross-repo code search over your code, docs, tickets, and past sessions.
Claimed homepage: https://github.com/ainakwalamonk/fabmem#readme
Matched naming pattern: npm-fabmem-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 34
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 2283/month, 570/week (ACTIVE_COMMUNITY_USE)
Codebase size: 42745 lines, 2.3 MB across 1017 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 40d | 3,270 | 188 | ↑81.8/day |
Very Risky
|
@yuanjielab/cli | npm | 0.4.5 | — | — | 🪝 🌐 | |
|
Package purpose: 原界 CLI —— 让外部 AI 工具读写原界云文档（含 stdio MCP 面）
Matched naming pattern: npm-@yuanjielab/cli-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 40
Registry downloads: 3270/month, 817/week (ACTIVE_COMMUNITY_USE)
Codebase size: 188 lines, 9.4 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 50d | 1,231 | 339 | ↑24.6/day |
Very Risky
|
cc | npm | 0.3.0 | cc-connect-next contributors | — | 🪝 🌐 | |
|
Package purpose: Privacy-first AI agent bridge with native Feishu Card 2.0 streaming
Claimed homepage: https://github.com/timmyagentic/cc-connect-next
Matched naming pattern: npm-cc-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 50
Registry downloads: 1231/month, 307/week (ACTIVE_COMMUNITY_USE)
Codebase size: 339 lines, 13.0 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 57d | 1,805 | 17,209 | ↑31.7/day |
Very Risky
|
@aidotnet/opencowork | npm | 1.4.0 | — | — | 🪝 🌐 📦 | |
|
Package purpose: OpenCowork command-line interface
Claimed homepage: https://github.com/AIDotNet/OpenCowork/tree/main/cli
Matched naming pattern: node-@aidotnet/opencowork-opencowork
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 57
Registry downloads: 1805/month, 451/week (ACTIVE_COMMUNITY_USE)
Codebase size: 17209 lines, 798.6 kB across 70 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 64d | 9,027 | 734 | ↑141.0/day |
Very Risky
|
fourth | npm | 0.11.27 | — | — | 🪝 🌐 | |
|
Package purpose: AI Agent Platform — multi-repo agent management based on OpenCode
Claimed homepage: https://github.com/kinminghao/fourth-spark#readme
Matched naming pattern: node-fourth-spark
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 64
Registry downloads: 9027/month, 2256/week (ACTIVE_COMMUNITY_USE)
Codebase size: 734 lines, 1.6 MB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 108d | 19 | 3,087 | ↑0.2/day |
Very Risky
|
claude | npm | 1.0.2 | Eduardo Montilva | — | 🪝 📡 🗄️ | |
|
Package purpose: Two-way notifications for Claude Code via Telegram, Discord, and Slack
Claimed homepage: https://github.com/edumntg/claude-beep#readme
Matched naming pattern: node-claude-beep
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 108
Code-only verdict: Unverified Signal (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 3087 lines, 120.7 kB across 45 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 114d | 5,033 | 363 | ↑44.1/day |
Very Risky
|
@seemseam/ccb | npm | 8.6.19 | — | — | 🪝 🌐 | |
|
Package purpose: Lightweight multi-agent TUI and stable cross-provider collaboration layer for Codex, Claude, Gemini, Grok, Kimi, and other CLI agents.
Claimed homepage: https://github.com/SeemSeam/claude_codex_bridge#readme
Matched naming pattern: npm-@seemseam/ccb-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 114
Registry downloads: 5033/month, 1258/week (ACTIVE_COMMUNITY_USE)
Codebase size: 363 lines, 11.0 kB across 6 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 159d | 1,191 | 194 | ↑7.5/day |
Very Risky
|
@asamarts/alint | npm | 0.17.0 | — | — | 🪝 🌐 | |
|
Package purpose: Language-agnostic linter for repository structure, file existence, filename conventions, and file content rules. This package downloads and wraps the platform-matched native alint binary.
Claimed homepage: https://github.com/asamarts/alint
Matched naming pattern: npm-@asamarts/alint-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 159
Registry downloads: 1191/month, 297/week (ACTIVE_COMMUNITY_USE)
Codebase size: 194 lines, 7.6 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 181d | 2,215 | 314 | ↑12.2/day |
Very Risky
|
@bifrost | npm | 0.0.195 | — | — | 🪝 🌐 | |
|
Package purpose: High-performance HTTP/HTTPS/SOCKS5 proxy server written in Rust
Claimed homepage: https://github.com/bifrost-proxy/bifrost
Matched naming pattern: npm-@bifrost-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 181
Registry downloads: 2215/month, 553/week (ACTIVE_COMMUNITY_USE)
Codebase size: 314 lines, 11.0 kB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 190d | 28 | 4,885 | ↑0.1/day |
Very Risky
|
claude | npm | 0.4.1 | choiwon | — | 🪝 | |
|
Package purpose: Claude Code headless daemon controller — FIFO-based async task dispatch, Git Worktree isolation, auto-checkpointing, and a web dashboard
Claimed homepage: https://github.com/k984530/controller#readme
Matched naming pattern: node-claude-controller
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 190
Code-only verdict: SUSPICIOUS (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 28/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 4885 lines, 234.1 kB across 23 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 92 | 235d | 861 | 81 | ↑3.7/day |
Very Risky
|
@agora | npm | 0.6.5 | Agora Build build@agora.io | agora.io | 🪝 🌐 | |
|
Package purpose: A terminal that connects people, Agora platform, and AI agents.
Claimed homepage: https://github.com/Agora-Build/Atem#readme
Matched naming pattern: npm-@agora-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 235
Registry downloads: 861/month, 215/week (MODERATE_USAGE)
Codebase size: 81 lines, 2.9 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 1h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: The Groundwork daemon: runs your agents on your own machine, through our harness, on your Claude Code or Codex subscription or any AI SDK provider key, with a packaged signed-out browser.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 7h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Security scanner for vibe-coded Next.js / Vite + Supabase apps: leaked keys, public env secrets, .env in git, missing RLS
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 10h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Embedded CLIProxyAPI accounts, quota observations, and model access for Gestaltrun
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 12h | — | — | — |
Unverified Signal
|
— | npm | latest | Aizat | — | 🪝 🌐 | |
|
Package purpose: WhatsApp Web multi-device library for bots & automation — Aizat's build of Baileys v7: interactive messages, albums, newsletters, pairing codes
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 14h | — | — | — |
Unverified Signal
|
— | npm | latest | Dmytro Klymentiev | — | 🪝 🌐 | |
|
Package purpose: A lightweight AI agent for the terminal that works with any LLM, free tiers included: files, commands, web, MCP
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 15h | — | — | — |
Unverified Signal
|
— | npm | latest | Allison Coleman | — | 🪝 | |
|
Package purpose: The daggler CLI — run Daggler's static analysis and security policies over GitHub Actions workflows from the terminal.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 16h | — | — | — |
SUSPICIOUS
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: 手机访问网关：局域网扫码 + 公网隧道，把电脑上的 DSH 实时同步到手机（含设置页）。
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 18h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Expert Code — an autonomous coding agent in your terminal. BYOK (your own AI provider key) or managed hosted sign-in.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 18h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Run one DeepSeek Harness web server per project inside WSL2, managed from the Windows dsh app: each project gets its own service, port and dsh home.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 23h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Click any element on your site during development, leave a comment, and turn it into a GitHub issue an agent can pick up with full context.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 26h | — | — | — |
Unverified Signal
|
— | npm | latest | 小红书号 4190947207 | — | 🪝 🌐 | |
|
Package purpose: DSHLive2D — DeepSeek Harness Live2D 桌面角色、动作预览与 Agent 动作控制
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 27h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: MCP server for Resolve402: French company directors with their probable business email, and hiring signals of any company from public ATS job boards. Paid per call with x402 (USDC on Base or Solana).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 29h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Fast, disk space efficient package manager
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 31h | — | — | — |
Unverified Signal
|
— | npm | latest | Perpixel Kft. | — | 🪝 | |
|
Package purpose: Offline ProtoPie CLI and MCP server: precise scene context, authored motion, assets and comparisons for AI agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 33h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A minimal Bun CLI starter built with Commander
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 33h | — | — | — |
Unverified Signal
|
— | npm | latest | Ismail | — | 🪝 | |
|
Package purpose: PathLens — understand why code reached the browser.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 34h | — | — | — |
Very Risky
|
— | pypi | 0.8.0.214 | — | — | 🪝 | |
|
Package purpose: Fast, efficient, and differentiable time-varying LPC filtering in PyTorch.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 90 | 34h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Trace coding-agent sessions to Traccia. Cursor is the first adapter.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 37h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Workspace-owning coding agent providers for Promptfoo
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 39h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Local MCP bridge for the official Antigravity CLI, with isolated project copies and reviewed integration.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 41h | 0 | 9,058 | ↑0.0/day |
Very Risky
|
smoothness | npm | 1.0.0 | Den Odell | — | 🪝 | |
|
Package purpose: The measuring engine behind playwright-smoothness: frame, input and long-list smoothness checks in Chromium, driven through a small adapter interface.
Claimed homepage: https://github.com/denodell/playwright-smoothness#readme
Matched naming pattern: npm-smoothness-general
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 9058 lines, 458.1 kB across 3 files (LARGE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 44h | — | — | — |
Unverified Signal
|
— | npm | latest | Parx | — | 🪝 🌐 | |
|
Package purpose: WhatsApp Web API Library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 46h | — | — | — |
Unverified Signal
|
— | npm | latest | Pedro Moreira | — | 🪝 | |
|
Package purpose: localctl - local Kubernetes dev platform CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 49h | — | — | — |
Very Risky
|
— | pypi | 0.5.0.dev1 | Crowded Kingdoms | — | 🪝 | |
|
Package purpose: Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 90 | 53h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Jhermes：可自我进化的 AI Agent 命令行工具（Java fat-jar 的 npm 分发壳）
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 54h | — | — | — |
Unverified Signal
|
— | npm | latest | yoStoobie | — | 🪝 🌐 | |
|
Package purpose: Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 90 | 56h | — | — | — |
Unverified Signal
|
— | npm | latest | Ketchsoft | — | 🪝 | |
|
Package purpose: Release Android & iOS apps to Google Play and the App Store from a single config, powered by fastlane.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||