Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 40 | 408d | — | — | — |
Unverified Signal
|
— | npm | latest | LiveKit | — | 🪝 🌐 | |
|
Package purpose: Google Gemini plugin for LiveKit Node Agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 438d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 439d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 439d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 442d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 526d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: [한국어](https://github.com/akan-team/akanjs/blob/main/pkgs/create-akan-workspace/README.ko.md) | [Docs](https://akanjs.com/docs/intro/quickstart) | [npm](https://www.npmjs.com/package/create-akan-workspace)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 542d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Rikka | — | 🪝 | |
|
Package purpose: A React-based geospatial visualization template integrating Three.js, Deck.gl, and MapLibre for 3D map interactions and rich geospatial data rendering.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 557d | — | — | — |
Unverified Signal
|
— | pypi | 1.2.1 | — | — | 🪝 | |
|
Package purpose: Easy AWS MFA authentication and role assuming
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 568d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Mastra OpenAI Realtime API integration
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 572d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 683d | — | — | — |
Unverified Signal
|
— | npm | latest | MemberJunction.com | memberjunction.com | 🪝 | |
|
Package purpose: Base Classes for MemberJunction Actions. This library is used on both server and network nodes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 705d | — | — | — |
Unverified Signal
|
— | npm | latest | InjectiveLabs | — | 🪝 🌐 | |
|
Package purpose: Ledger wallet strategy for use with @injectivelabs/wallet-core.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 711d | — | — | — |
Unverified Signal
|
— | npm | latest | Wolfram Sokollek | — | 🪝 | |
|
Package purpose: Nx plugin to generate, synthesize, deploy and destroy AWS CDK v2 applications inside an Nx workspace.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 716d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 745d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 835d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Dynamic Labs, Inc. | — | 🪝 🌐 | |
|
Package purpose: A React SDK for implementing wallet web3 authentication and authorization to your website.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 866d | — | — | — |
Unverified Signal
|
— | npm | latest | LiveKit | — | 🪝 🌐 | |
|
Package purpose: ElevenLabs plugin for LiveKit Node Agents
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 896d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: <a name="readmemd"></a>
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 912d | — | — | — |
Unverified Signal
|
— | pypi | 1.8.0 | — | — | 🪝 | |
|
Package purpose: An integration package connecting AWS and LangChain
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 915d | — | — | — |
Unverified Signal
|
— | pypi | 1.13.0.dev32 | — | — | 🪝 | |
|
Package purpose: A Python package with a built-in web application
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 949d | — | — | — |
Unverified Signal
|
— | npm | latest | MemberJunction.com | memberjunction.com | 🪝 🌐 | |
|
Package purpose: MemberJunction Wrapper for OpenAI AI Models
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 949d | — | — | — |
Unverified Signal
|
— | npm | latest | MemberJunction.com | memberjunction.com | 🪝 🌐 | |
|
Package purpose: MemberJunction Wrapper for Google Gemini AI Models
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1117d | — | — | — |
Unverified Signal
|
— | pypi | 0.3.0 | — | — | 🪝 | |
|
Package purpose: Azure Resource Detector for OpenTelemetry
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 1224d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: The library handles merging JSON objects and arrays.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1228d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Race Team | — | 🪝 🌐 | |
|
Package purpose: The Solana support for Race SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1636d | — | — | — |
Unverified Signal
|
— | npm | latest | Massa Labs | — | 🪝 🌐 | |
|
Package purpose: massa's web3 sdk client
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1679d | — | — | — |
Unverified Signal
|
— | npm | latest | zanechua | — | 🪝 | |
|
Package purpose: List of EVM Chains
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1798d | — | — | — |
Unverified Signal
|
— | npm | latest | Ari Palo | — | 🪝 | |
|
Package purpose: CDK constructs to use OpenID Connect for authenticating your Github Action workflow with AWS IAM
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 1881d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | Thorbjorn Kappel Davis | — | 🪝 🌐 | |
|
Package purpose: Extension package to enable maintenance on Pluss Communities Platform
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2123d | — | — | — |
Unverified Signal
|
— | npm | latest | Amazon Web Services | — | 🪝 | |
|
Package purpose: Version 2 of the AWS Cloud Development Kit library
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2141d | — | — | — |
Unverified Signal
|
— | npm | latest | Justin Ramsey | — | 🪝 | |
|
Package purpose: Serverless Framework Plugin for interacting with AWS Batch
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2182d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A simple way to create a startup Discord bot.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2266d | — | — | — |
Unverified Signal
|
— | npm | latest | Tiago Siebler | — | 🪝 🌐 | |
|
Package purpose: Complete & robust Node.js SDK for Bybit's REST APIs and WebSockets, with TypeScript & strong end to end tests.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2574d | — | — | — |
Unverified Signal
|
— | npm | latest | Auth0 | — | 🪝 🌐 | |
|
Package purpose: Auth0 Next.js SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2715d | — | — | — |
Unverified Signal
|
— | npm | latest | heartyoh | — | 🪝 🌐 | |
|
Package purpose: Server-side module for handling authentication.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2773d | — | — | — |
Unverified Signal
|
— | npm | latest | Victor Savkin | — | 🪝 | |
|
Package purpose: Smart Monorepos · Fast Builds
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 2913d | — | — | — |
Unverified Signal
|
— | npm | latest | Microsoft | — | 🪝 | |
|
Package purpose: Azure Pipelines Task SDK
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 40 | 3065d | — | — | — |
Unverified Signal
|
— | pypi | 38.4.0 | — | — | 🪝 | |
|
Package purpose: The Datadog Check Toolkit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 40 | 3065d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A simple way to create a startup Discord bot.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 6h | — | — | — |
Unverified Signal
|
— | npm | latest | Rojão Studio | — | 🪝 | |
|
Package purpose: CLI do Rojão DS — `npx rojao-ds init` gera o tema da sua marca e o arquivo de regras para a IA (CLAUDE.md, .cursorrules, AGENTS.md).
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 11h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: ImageMagick v7 compiled to WebAssembly for browsers, with CLI and programmatic APIs
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 12h | — | — | — |
Unverified Signal
|
— | npm | latest | moo-m | — | 🪝 🌐 | |
|
Package purpose: In-browser developer tools: Console, Elements, Application and Sources in floating windows. Built with TypeScript and Shadow DOM, no framework.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 12h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: CLI for DesignX UI — add accessible, motion-first components to your React app.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 14h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Expo modules as Solid services for solidnative, plus registerExpoView for a module's native view.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 14h | — | — | — |
Unverified Signal
|
— | npm | latest | John Henry | — | 🪝 🌐 | |
|
Package purpose: Framework-agnostic Web Components for rendering HTML-like source into live DOM only after applying an explicit versioned security profile -- never innerHTML/insertAdjacentHTML on untrusted input.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 16h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Typed TypeScript client for the Tablation API
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 19h | — | — | — |
Unverified Signal
|
— | npm | latest | IamCaptainPepe | — | 🪝 🌐 | |
|
Package purpose: Stream .torrent / magnet to VLC or browser — torrent streaming for macOS/Linux without a torrent client. Стрим торрентов в VLC или браузер.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 20h | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Isomorphic core for Hodios: parse, validate, compile entries to every AI tool, and search the catalog index.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 21h | — | — | — |
Unverified Signal
|
— | pypi | 0.1.0 | — | — | 🪝 | |
|
Package purpose: Fast CLI tool & Python client for searching, filtering, and extracting Jabama accommodation listings
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 35 | 24h | — | — | — |
Unverified Signal
|
— | npm | latest | Dean Hiller | — | 🪝 | |
|
Package purpose: Agent hook protocol, normalized events, and fail-closed application boundary.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||