Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.
Sorted by risk score. Cleared packages hidden by default — add verdict:benign_community to include. Packages the registry has since removed are hidden too — see them on the Taken Down tab or add state:taken_down. Very risky packages require manual human audit. • Tag & Signal Legend →
verdict: (malicious, suspicious, unverified_high_signal, squatted_stub…),
ecosystem: (pypi/npm), hook: (install, network, pth, gyp, worm, c2, creds, binary, env, stealer, any — malicious hooks & behaviors),
email:, domain:, keyword:, version: (comma = OR within a field, space = AND across fields),
age:<6h / age:>90d (combine both for a range),
state:live / state:taken_down (registry liveness — the feed defaults to state:live),
lead:>7d (days we had a since-removed package flagged while it was still up),
or a bare word for a package-name search.
| Package | Score ▼ | Age | Users | Lines | Growth | Verdict | Targeted | Ecosystem | Version | Author | Email domain | Signals |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 35 | 34d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Treeship CLI binary for darwin x64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 34d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Treeship CLI binary for darwin arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 34d | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Treeship CLI binary for linux arm64
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 59d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 69d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: @agentproto/adapter-gemini — AIP-45 AGENT-CLI adapter for Google's Gemini CLI in ACP mode (`gemini --experimental-acp`). Native billing-auth: "use my existing Gemini login".
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 111d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Claude Code host adapter for agent-harness-generator (MCP + hooks + .claude/settings.json)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 133d | — | — | — |
Unverified Signal
|
— | npm | latest | vLannaAi | — | 🪝 | |
|
Package purpose: AWS KMS sealing key provider for noy-db managed-secret mode — seal/unseal via KMS Encrypt/Decrypt, with KMS access logs.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 199d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Copilot SDK powered evaluation plugin for Fusion Framework CLI
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 260d | 24 | 15 | ↑0.1/day |
Possible Squatted Stub
|
addon | pypi | 19.0.1.0.0.8 | HAV Media GmbH, Odoo Community Association (OCA) support@odoo-community.org | odoo-community.org | ||
|
Package purpose: Sale Portal Debranding
Claimed homepage: https://github.com/OCA/server-brand
Matched naming pattern: odoo-addon-sale
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 260
Registry downloads: 24/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15 lines, 436 Bytes across 2 files (EMPTY_STUB)
Automated signals flagged:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 35 | 277d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: n8n community node for Claude Code CLI integration - execute AI-assisted coding tasks
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 653d | — | — | — |
Unverified Signal
|
— | npm | latest | Constructive | — | 🪝 | |
|
Package purpose: interchain-kit wallet connector for leap cosmos extension metamask
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 682d | — | — | — |
Unverified Signal
|
— | npm | latest | Constructive | — | 🪝 | |
|
Package purpose: interchain-kit wallet connector for cosmos extension metamask
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 841d | — | — | — |
Unverified Signal
|
— | npm | latest | Filip Dupanović | — | 🪝 | |
|
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 899d | 170 | 212 | ↑0.2/day |
SUSPICIOUS
|
safe | pypi | 1.5.1 | — ronan@boiteau.eu | boiteau.eu | 🪝 | |
|
Package purpose: A Django template engine to render untrusted template code
Claimed homepage: https://pypi.org/project/django-safe-template-engine/
Matched naming pattern: django-safe-template
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 899
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 170/month, 16/week (MODERATE_USAGE)
Codebase size: 212 lines, 6.3 kB across 7 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 35 | 988d | 11 | 378 | ↑0.0/day |
SUSPICIOUS
|
coder | pypi | 0.0.0 | Shahaf Frank-Shapir shahaffrs@gmail.com | gmail.com | 🪝 | |
|
Package purpose: A QR handling module for writing and reading QR.
Claimed homepage: https://github.com/Shahaf-F-S/project-template
Matched naming pattern: python-coder-qr
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 988
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 11/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 378 lines, 15.2 kB across 4 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 35 | 1176d | 19 | 582 | ↑0.0/day |
SUSPICIOUS
|
base | pypi | 0.1.2 | — sgelias@outlook.com | outlook.com | 🪝 | |
|
Package purpose: A simple and lighweight package tor clean softwares.
Claimed homepage: https://pypi.org/project/clean-base/
Matched naming pattern: python-base-clean
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 1176
Code-only verdict: Very Risky (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 19/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 582 lines, 23.9 kB across 7 files (MODERATE_CODEBASE)
Automated signals flagged:
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on PyPI → |
||||||||||||
| 35 | 1798d | — | — | — |
Unverified Signal
|
— | npm | latest | Romain Casati | — | 🪝 🌐 | |
|
Package purpose: Basthon - Base Kernel
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 1802d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Verdaccio authentication plugin using Okta OAuth
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 2467d | — | — | — |
Unverified Signal
|
— | npm | latest | heartyoh | — | 🪝 🌐 | |
|
Package purpose: Module for managing integration scenario.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 35 | 4198d | — | — | — |
Unverified Signal
|
— | npm | latest | — | — | 🪝 🌐 | |
|
Package purpose: Check, compile, optimize and compress Javascript with Closure-Compiler
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 0h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: TazzieDevil 2.0 core TypeScript SDK — transport, SSE parser, types, errors, and the media API contract.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 0h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: TazzieDevil 2.0 command line — chat with your AI operator and drive the media engine from the terminal
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 2h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: MCP server yang menjembatani AI assistant ke Shopee lewat browser extension pendamping (cek login, cari produk, bandingkan harga, verifikasi varian). Butuh extension pendamping (lihat README) agar bisa berfungsi.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 2h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: The single catalog-driven command line for StarCi apps and runtimes.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 4h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Next.js Static Forms adapter for 200stack build-time materialization.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 4h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Unified Doca materials, collections and templates management
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 8h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: MCP server: point your agent here, fund its wallet, launch memecoins on Ink. Dry-run-first, human-approved, ERC-8004 gated.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 8h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Build and publish three.js games on Dewdrop.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 9h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Command-line interface for the Tilcayo framework
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 9h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Telegram MTProto media bucket and chunked JSON storage for Node.js
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 9h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Rawlog CLI, MCP server and Claude Code hooks. Your agents work. You live.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 9h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Motion-first React UI primitives — zero runtime, OKLCH-themed, SSR-safe.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 9h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Give your agent a test world before it touches the real one.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 11h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Shared contracts for the M3R developer platform.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 11h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Typed SDK for writing M3R extensions.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 12h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Ask Lucidrail before a consequential tool call: authorize, wait for a person, report the outcome.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 14h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Seguridad de la capa web sin dependencias: CSP con hashes, cabeceras, cookies firmadas y defensa contra CSRF.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 14h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Standalone Knowledge MCP, JavaScript client and opt-in Eve extension
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 14h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Typed Wacom STU device control, WebHID and Web Serial capture, image transfer and signature exports.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 14h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | ScuderiaTech | — | 🪝 | |
|
Package purpose: Pipa no Ar: updates OTA para React Native sem operar infraestrutura. Preset do hot-updater.config.ts e helper do app.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 14h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Independent TypeScript WhatsApp bot toolkit
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 14h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: The Groundwork agent loop: any model (Claude Code, Codex, or an API model) behind one seam, driving only our own tools with schema-constrained output.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 15h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Collect and organize reusable Pi coding-agent resources
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 16h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: gage's MCP server for agents with their own wallet: `npx -y gage-mcp init`, then borrow and earn on gage. Robinhood Chain testnet.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 17h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Ghostty desktop notifications with sound and response previews when Pi finishes out of focus
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 18h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Official MCP client for BacklinkHelper SEO link and backlink management tools.
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 18h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: A tiny local Neon-shaped SQLite development server
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 19h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Shared Vue 3 UI component library with a DSM 7 inspired application theme
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 19h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: JitaSpace change-history database (standalone, isolated from @jitaspace/db)
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||
| 30 | 19h | — | — | — |
Possible Squatted Stub
|
— | npm | latest | — | — | 🪝 | |
|
Package purpose: Crudy UI — shared React components (data-table, primitives) consumed by host frontend and modules
Static code signals:
Signals reflect what our detector observed, not a confirmed determination of wrongdoing. View package on npm → |
||||||||||||