🛡️ FlagThis : Sentinel Review

Automated package-squatting & slopsquatting detection signals across PyPI and npm — these are automated, unconfirmed signals. Use them to find candidates to investigate, but don't automatically assume they're malicious.

Threat Feed Flagged packages, sorted by risk score Growing Packages Fastest-adopted since publish Top Emails Accounts most linked to flagged findings About What Sentinel does & why

Sorted by risk score. Filter with email:, domain:, keyword:, or version: (comma = OR within a field, space = AND across fields), age:<6h / age:>90d for how recently a package was published (combine both for a range, e.g. age:>1h age:<6h), or a bare word for a package-name search. Click a package to see the signals behind its score before opening its registry page.

Package Score ▼ Age Users Lines Growth Verdict Targeted Ecosystem Version Author Email domain Signals
95 50d 51 44 ↑1.0/day SUSPICIOUS huggingface pypi 0.0.5 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/aibusy-runtime-huggingface/
Matched naming pattern: aibusy-huggingface-huggingface
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 50
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 51/month, 8/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 44 lines, 1.5 kB across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'aibusy-runtime-huggingface' matches AI hallucination template [aibusy] + [huggingface] + [huggingface].
  • HIGHClaims critical enterprise brand identity ('HUGGINGFACE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (49 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 126d 8 29 ↑0.1/day SUSPICIOUS base pypi 0.0.2 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-fastapi-docker-base/
Matched naming pattern: yta-base-docker
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 126
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 8/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 29 lines, 842 Bytes across 4 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-fastapi-docker-base' matches AI hallucination template [yta] + [base] + [docker].
  • HIGHClaims critical enterprise brand identity ('BASE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 2 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (125 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
95 239d 27 157 ↑0.1/day SUSPICIOUS ollama pypi 0.0.6 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-docker-ollama/
Matched naming pattern: yta-ollama-ollama
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 239
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 27/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 157 lines, 5.8 kB across 7 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-docker-ollama' matches AI hallucination template [yta] + [ollama] + [ollama].
  • HIGHClaims critical enterprise brand identity ('OLLAMA').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 6 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • MEDIUMPackage registered 238 days ago within the 1-year AI tool proliferation window.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 56d 31 110 ↑0.6/day SUSPICIOUS huggingface pypi 0.0.3 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/ai-simple-engine-backend-huggingface/
Matched naming pattern: ai-huggingface-engine
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 56
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 31/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 110 lines, 3.4 kB across 7 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'ai-simple-engine-backend-huggingface' matches AI hallucination template [ai] + [huggingface] + [engine].
  • HIGHClaims critical enterprise brand identity ('HUGGINGFACE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (54 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
90 66d 9 71 ↑0.1/day SUSPICIOUS google pypi 0.0.2 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-fastapi-docker-tts-google/
Matched naming pattern: yta-google-docker
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 66
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 9/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 71 lines, 2.2 kB across 5 files (TINY_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-fastapi-docker-tts-google' matches AI hallucination template [yta] + [google] + [docker].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (65 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
65 421d 20 167 ↑0.0/day SUSPICIOUS microsoft pypi 0.1.1 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-audio-narration-microsoft/
Matched naming pattern: yta-microsoft-narration
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 421
Code-only verdict: BENIGN_COMMUNITY (the score above also weighs naming and publisher-domain signals, not just the code itself)
Registry downloads: 20/month, 4/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 167 lines, 6.5 kB across 1 file (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-audio-narration-microsoft' matches AI hallucination template [yta] + [microsoft] + [narration].
  • HIGHClaims critical enterprise brand identity ('MICROSOFT').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
21 121d 38 260 ↑0.3/day BENIGN_COMMUNITY ollama pypi 0.0.5 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-fastapi-docker-ollama/
Matched naming pattern: yta-ollama-docker
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 121
Registry downloads: 38/month, 5/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 260 lines, 8.8 kB across 11 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-fastapi-docker-ollama' matches AI hallucination template [yta] + [ollama] + [docker].
  • HIGHClaims critical enterprise brand identity ('OLLAMA').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 5 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (119 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
19 20d 802 388 ↑40.1/day BENIGN_COMMUNITY google pypi 0.0.6 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://github.com/Implosiv3/google-auth-easy
Matched naming pattern: google-google-easy
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 20
Registry downloads: 802/month, 28/week (MODERATE_USAGE)
Codebase size: 388 lines, 11.6 kB across 8 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'google-auth-easy' matches AI hallucination template [google] + [google] + [easy].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 6 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • HIGHPackage registered recently (18 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOModerate community usage with 802 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
18 114d 7 220 ↑0.1/day BENIGN_COMMUNITY base pypi 0.0.2 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-llm-base/
Matched naming pattern: yta-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 114
Registry downloads: 7/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 220 lines, 8.0 kB across 8 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-llm-base' matches AI hallucination template [yta] + [base] + [base].
  • HIGHClaims critical enterprise brand identity ('BASE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (113 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
16 19d 858 302 ↑45.2/day BENIGN_COMMUNITY google pypi 0.0.3 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://github.com/Implosiv3/google-drive-easy
Matched naming pattern: google-google-easy
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 19
Registry downloads: 858/month, 11/week (MODERATE_USAGE)
Codebase size: 302 lines, 9.7 kB across 11 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'google-drive-easy' matches AI hallucination template [google] + [google] + [easy].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • HIGHPackage registered recently (18 days ago) during the active AI hallucination slopsquatting wave.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOModerate community usage with 858 monthly downloads.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
16 482d 15 404 ↑0.0/day BENIGN_COMMUNITY google pypi 0.3.3 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-google-drive-downloader/
Matched naming pattern: yta-google-drive
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 482
Registry downloads: 15/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 404 lines, 15.5 kB across 8 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-google-drive-downloader' matches AI hallucination template [yta] + [google] + [drive].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 16 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
13 407d 10 1,195 ↑0.0/day BENIGN_COMMUNITY base pypi 0.0.23 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-video-base/
Matched naming pattern: yta-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 407
Registry downloads: 10/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1195 lines, 95.0 kB across 8 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-video-base' matches AI hallucination template [yta] + [base] + [base].
  • HIGHClaims critical enterprise brand identity ('BASE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 22 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOSubstantial functional codebase (1195 LOC across 8 file(s)).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
13 421d 16 394 ↑0.0/day BENIGN_COMMUNITY google pypi 0.2.2 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-audio-narration-google/
Matched naming pattern: yta-google-narration
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 421
Registry downloads: 16/month, 3/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 394 lines, 9.2 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-audio-narration-google' matches AI hallucination template [yta] + [google] + [narration].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
13 451d 0 2,153 ↑0.0/day BENIGN_COMMUNITY base pypi 0.1.6 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-audio-base/
Matched naming pattern: yta-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 451
Registry downloads: 0/month, 0/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 2153 lines, 87.2 kB across 15 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-audio-base' matches AI hallucination template [yta] + [base] + [base].
  • HIGHClaims critical enterprise brand identity ('BASE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • MEDIUMPackage published 14 versions in rapid succession (< 24h) to mimic mature open source maintenance.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOSubstantial functional codebase (2153 LOC across 15 file(s)).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
13 728d 15 280 ↑0.0/day BENIGN_COMMUNITY google pypi 0.1.1 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-google-api/
Matched naming pattern: yta-google-api
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 728
Registry downloads: 15/month, 2/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 280 lines, 13.0 kB across 2 files (MODERATE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-google-api' matches AI hallucination template [yta] + [google] + [api].
  • HIGHClaims critical enterprise brand identity ('GOOGLE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
10 436d 11 1,321 ↑0.0/day BENIGN_COMMUNITY base pypi 0.0.9 danialcala94 danielalcalavalera@gmail.com gmail.com
Claimed homepage: https://pypi.org/project/yta-image-base/
Matched naming pattern: yta-base-base
Official vendor account: No — publisher domain doesn't match the brand it names
Days since publish: 436
Registry downloads: 11/month, 1/week (NEGLIGIBLE_OR_ZERO_USAGE)
Codebase size: 1321 lines, 56.5 kB across 11 files (LARGE_CODEBASE)
Automated signals flagged:
  • MEDIUMPackage name 'yta-image-base' matches AI hallucination template [yta] + [base] + [base].
  • HIGHClaims critical enterprise brand identity ('BASE').
  • HIGHPublisher email 'danielalcalavalera@gmail.com' is not affiliated with official vendor domain.
  • INFONo malicious install-time hooks or shell cradles detected in package AST.
  • INFOSubstantial functional codebase (1321 LOC across 11 file(s)).

Signals reflect what our detector observed, not a confirmed determination of wrongdoing.

View package on PyPI →
LINK COPIED TO CLIPBOARD