🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Growing Packages Fastest-adopted since publish Top Emails Accounts most linked to flagged findings About What Sentinel does & why

Sorted by risk score. Filter with email:, domain:, keyword:, or version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d for how recently a package was published (combine both for a range, e.g. age:>1h age:<6h), or a bare word for a package-name search. Click a package to see the signals behind its score before opening its registry page.

Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
95 98d 12 30 ↑0.1/day SUSPICIOUS aws pypi 1.0.1 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github4-chn.cisco.com/c8kv-aws/c8kv_aws_ha
Matched naming pattern: c8kv-aws-ha
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 98
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 12/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 30 lines, 1.2 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'c8kv-aws-ha' matches AI hallucination template [c8kv] + [aws] + [ha].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 2 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (97 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
22 3202d 26 776 ↑0.0/day BENIGN_COMMUNITY azure pypi 1.1.4 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github4-chn.cisco.com/csr1000v-azure/csr_azure_guestshell
Matched naming pattern: csr-azure-guestshell
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3202
Registry downloads: 26/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 776 lines, 34.7 kB across 16 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'csr-azure-guestshell' matches AI hallucination template [csr] + [azure] + [guestshell].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 3201 days ago (predates modern AI hallucination waves).
  • HIGHSYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/csr_azure_guestshell.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 147)
  • HIGHSYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/bin/capture-interface.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 34)
  • HIGHSYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/bin/get-metadata.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 22)
  • HIGHSYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/bin/save-config-to-storage.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 19)
Static code signals:
  • SYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/csr_azure_guestshell.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 147)
  • SYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/bin/capture-interface.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 34)
  • SYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/bin/get-metadata.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 22)
  • SYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/csr_azure_guestshell/bin/save-config-to-storage.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 19)
  • SYNTAX_ERROR_IN_csr_azure_guestshell-1.1.4/setup.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 21)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
18 98d 10 1,749 ↑0.1/day BENIGN_COMMUNITY aws pypi 1.0.0 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github4-chn.cisco.com/c8kv-aws/c8kv_aws_utils
Matched naming pattern: c8kv-aws-utils
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 98
Registry downloads: 10/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1749 lines, 89.0 kB across 5 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'c8kv-aws-utils' matches AI hallucination template [c8kv] + [aws] + [utils].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • HIGHPackage registered recently (96 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOSubstantial functional codebase (1749 LOC across 5 file(s)).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
16 3011d 23 960 ↑0.0/day BENIGN_COMMUNITY azure pypi 1.0.7 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github4-chn.cisco.com/csr1000v-azure/csr_azure_scripts.git
Matched naming pattern: csr-azure-scripts
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3011
Registry downloads: 23/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 960 lines, 45.4 kB across 12 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'csr-azure-scripts' matches AI hallucination template [csr] + [azure] + [scripts].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 3010 days ago (predates modern AI hallucination waves).
  • HIGHSYNTAX_ERROR_IN_csr_azure_scripts-1.0.7/bin/get-stat-drop.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 20)
  • HIGHSYNTAX_ERROR_IN_csr_azure_scripts-1.0.7/bin/get-cli-cmds.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 38)
  • HIGHSYNTAX_ERROR_IN_csr_azure_scripts-1.0.7/bin/capture-interface.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 34)
  • INFOSubstantial functional codebase (960 LOC across 12 file(s)).
Static code signals:
  • SYNTAX_ERROR_IN_csr_azure_scripts-1.0.7/bin/get-stat-drop.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 20)
  • SYNTAX_ERROR_IN_csr_azure_scripts-1.0.7/bin/get-cli-cmds.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 38)
  • SYNTAX_ERROR_IN_csr_azure_scripts-1.0.7/bin/capture-interface.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 34)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
10 2702d 58 33 ↑0.0/day BENIGN_COMMUNITY aws pypi 3.1.0 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github4-chn.cisco.com/csr1000v-aws/csr_aws_ha
Matched naming pattern: django-aws-auth
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2702
Registry downloads: 58/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 33 lines, 1.2 kB across 1 file (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'csr-aws-ha' matches AI hallucination template [django] + [aws] + [auth].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 2701 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
10 2702d 69 1,746 ↑0.0/day BENIGN_COMMUNITY aws pypi 2.0.1 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github4-chn.cisco.com/csr1000v-aws/csr_aws_utils
Matched naming pattern: csr-aws-utils
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2702
Registry downloads: 69/month, 6/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1746 lines, 88.8 kB across 5 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'csr-aws-utils' matches AI hallucination template [csr] + [aws] + [utils].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • MEDIUMPackage has empty or near-zero description (potential reservation stub).
  • INFOEstablished pre-AI legacy package registered 2701 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOSubstantial functional codebase (1746 LOC across 5 file(s)).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
10 2950d 25 15,235 ↑0.0/day BENIGN_COMMUNITY azure pypi 0.0.5 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github4-chn.cisco.com/csr1000v-azure/csr_azure_agent
Matched naming pattern: csr-azure-agent
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 2950
Registry downloads: 25/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 15235 lines, 786.7 kB across 117 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'csr-azure-agent' matches AI hallucination template [csr] + [azure] + [agent].
  • HIGHClaims critical enterprise brand identity ('AZURE').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 2949 days ago (predates modern AI hallucination waves).
  • HIGHSYNTAX_ERROR_IN_csr_azure_agent-0.0.5/setup.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 10)
  • INFOSubstantial functional codebase (15235 LOC across 117 file(s)).
Static code signals:
  • SYNTAX_ERROR_IN_csr_azure_agent-0.0.5/setup.py: Missing parentheses in call to 'print'. Did you mean print(...)? (<unknown>, line 10)

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
7 3379d 44 768 ↑0.0/day BENIGN_COMMUNITY aws pypi 0.0.19.dev0 Christopher Reder creder@cisco.com cisco.com
Claimed homepage: https://github.com/CiscoDevNet/csr_aws_guestshell
Matched naming pattern: csr-aws-guestshell
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 3379
Registry downloads: 44/month, 7/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 768 lines, 31.4 kB across 13 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'csr-aws-guestshell' matches AI hallucination template [csr] + [aws] + [guestshell].
  • HIGHClaims critical enterprise brand identity ('AWS').
  • HIGHPublisher email 'creder@cisco.com' is not affiliated with official vendor domain.
  • INFOEstablished pre-AI legacy package registered 3377 days ago (predates modern AI hallucination waves).
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOSubstantial functional codebase (768 LOC across 13 file(s)).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
LINK COPIED TO CLIPBOARD