javascript Fallout

@khoralabs/memories-service Multi-tenant memory service: lifecycle, HTTP, auth, storage. ./storage/sqlite requires Bun; ./storage/libsql and ./storage/turso-serverless… 58m ago javascript

4b299bcd50304cfe41d0bdbcf0c81d54427820e2471ca290a345c48e3cc2701a O(S)H₅(Cm₅Cr₂Db₈FOs)Md(Pa₂)

30% Undeclared dependency loader detected

@distilled.cloud/mongodb-atlas Effect-native MongoDB Atlas SDK generated from the [MongoDB Atlas Administration API specification](https://www.mongodb.com/docs/atlas/refe… 1h ago javascript

915488c3788ef32450db840a187a0c042eb8349731ab10b58c69e3fff18489f8 H₃(Cm₆Db₃U)Md(Pa₃)

80% Unverified publisher, incomplete metadata

olivergraph Oliver CLI — capture local Claude Code & Codex agent activity into your Oliver workspace. 3h ago javascript

b23f6c025d7c758731d3c068ab1898c03cca7182e67491ada453cdb32825fb0d O(Ca)H₇(Cm₁₂Cr₂Db₃F₇Os₃Po₅U)

80% Unlisted publisher, fresh release

@stacksjs/composables Stacks composables powered by stx reactivity. 3h ago javascript

7a1b416cd7869f396792c7175be5928d7689216aaeb80467dab3607a806dc7b3 O₂(CS)H₅(Cm₁₂Db₆OsPo₃U₄)Md(Pa₄)

80% README suggests remote shell installer

@sig-net/midnight-contract The central signet Compact contract on Midnight: the MPC posts signature responses (unauthenticated counted log, verified off-chain) and re… 4h ago javascript

14d288feff3a421d6e9c844961bc5ced64a41e8a78686656141f82fc5474d260 H₂(Db₂F)Md(Pa₅)

80% Unlisted publisher, potential takeover

@authagonal/bff Backend-for-Frontend for SPAs using Authagonal. Runs the OIDC auth-code + PKCE flow server-side, holds tokens in a server-side session, and… 6h ago javascript

328d4000d9dbb63592601c94ec399d703796eee857fff426dea2922774f563ff H₃(Cm₈Cr₂Db₆)Md(Pa₃)

80% New package, suspected publisher takeover

@prisma-next/sql-lane-query-builder SQL query builder lane for Prisma Next 6h ago javascript

92eacf95593c50c46177e3593d6f5816e918698c86b9f08c63ea096464950b07 H₃(Db₂FOs)Md(Pa₃)

80% Unverified publisher, fresh package

@the42sync/imap IMAP mail-store provider for @the42sync (Dovecot reference) 6h ago javascript

da8b6378a2645e97d1732b601347609e82defa273ba7990a09b21d7b8b0e3093 H₃(Cm₂DbF)Md₂(Pa₆)

80% Unlisted publisher, potential takeover

@vibe-cafe/vibe-usage 0.10.1 Track your AI coding tool token usage and sync to vibecafe.ai 7h ago javascript

3b35e3fdb0fbefe0dfa2656098d6bd96c127b639c188268c8855dc8528432ce4 K₂(Am₂Li)O(P)H₇(Cm₁₀Cr₂Db₁₀F₈Os₈Po₈U)Md₂(Pt)

80% Accesses local secrets and system processes

@bolttech/ob-theme-generator 9h ago javascript

30adcc38e2bb243a39ce8fc9755a0402f360c23fe1a58f69d3b28ac75fb9b390 H₅(Cm₅Db₃FOsU)Md₂(Pa)

80% New package, rapid releases, API access

@modyra/angular Type-safe Angular forms built entirely on native Signals. 9h ago javascript

a8afe3bb9614219c08f0c65fc8086878d11d08ef354f2228f6e028082ec1567d O(S)H₃(CmOs₂U₃)Md₂(Pa₄)

80% Unlisted publisher, potential takeover

llm-fingerprint Identify LLMs by behavioral fingerprint — send simple questions, match answer distributions against 176+ models using Jensen-Shannon Diverg… 9h ago javascript

7d759a6c4fa13202abbb23ec7e62b4d219fb84c0e37dc2701f865a403db63a2a H₅(Cm₉Db₂F₃Os₂Po₂)Md₂(Pa)

80% New package with postinstall hook

@cyberace/n8n-nodes-qr Generate and read PNG QR codes locally in n8n workflows. 9h ago javascript

4b5d69d2b30959260f10de3917ac5b89f893344283ba128f64fdbbc3ff3da8ab H₂(Db₃Po)Md(Pa₃)

80% New package, unlisted publisher, impersonation risk

arch_ang_paul Cross-platform DRM video player SDK for React Native with online and offline playback. 9h ago javascript

8dbc49645f8b30cde892374e14651e174b83653a173a962ccea873654c5f03e1 H₃(CmDb₂Os₃)Md(Pa₄)

80% iOS jailbreak references in DRM SDK

@getpipher/armory-todo Global, cross-session TODO for pi — persists across all sessions and is auto-injected into every prompt. The disk-backed counterpart to bra… 9h ago javascript

0bea4d2eebfd16b26d2a9e93328663b212f3286c6d08530919d636826f67c511 H₅(CmCrDb₂F₄Po₃)Md(Pt)

80% Wipe alert implies destructive capability

create-webiu CLI tool to generate, configure, and deploy Webiu community portal applications 9h ago javascript

9db1f9867dc46217403c2f8397712db4ed104b609232d47b785144279d2b3381 H₄(CmDbOsPo₂)Md(Pa₂)

80% New package, rapid releases, unusual hooks

@apmantza/greedysearch-pi Headless multi-engine AI search (Perplexity, Google AI, ChatGPT, Gemini) via browser automation. NO API KEYS needed. Grounded all-engine se… 10h ago javascript

aaa4a7411fd168adf1fbc2912acf9a2ebf0bc9cd555f0a3b68942fcc309a02f0 O₂(AsEr)H₈(Cm₂₁Db₈F₆Os₇Po₁₃TiU₅)Md₃(LiPa₅)

97% Browser automation stealth evasion techniques

@darklylaunch/sdk-js Browser client SDK for DarklyLaunch feature flags. 20h ago javascript

680f29172253c19ad3c749588465866f68d7fe8e4dd446bb2d2047aefc07a239 H₂(Cm₃Po)Md(Pa₄)

80% Fresh, unestablished npm package

@sanity/cli-build Internal Sanity package for building studios and apps 21h ago javascript

ab38456216851175a40f192c7f2414081652256bc2895ab5df40aadd3cefaac8 H₅(Cm₄DbFPo₂U₂)Md₃(LiPa₃)

80% Dependency flagged for stealthy exfiltration

webcrypt-kit webcrypt-kit es un wrapper sobre la [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API), pensado para simplif… 21h ago javascript

d81d5917f5d9b02ab03cf637d79df12b73fc90ba9b3b8eaf35ddaccb11a32b79 H(Cr)Md₂(Pa₆Pt)

80% New package, publisher takeover signals

pi-mega-compact Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall. 1d ago javascript

e9fe22bf643c5b4a59b9f663be8d8d92a34e5cddc1a477ec646392fd97a4da77 K(Am)O₂(AsP)H₇(Cm₇Cr₂Db₇F₅Os₄Po₆U)Md₃(Pa₂Pt)

80% New package with install hook

geolibre-wasm Pure-Rust geospatial toolkit (whitebox_next_gen) compiled to WebAssembly (WASI) for GeoLibre's in-browser tool execution 1d ago javascript

95130d241cd84f393fe228218e71cc61239aedd967e74388f614b8db54e4a30a H₅(Cm₆Cr₂Db₂FPo)Md(Pa₂)

80% Unlisted publisher, potential takeover

meowcaller-js WhatsApp VoIP library for Baileys — call signaling, SRTP media, and audio/video adapters 1d ago javascript

151dd03c87adb64706fe32ab4b0b1430788c0359cc33de8ee40e8dfff69b6199 O(As₂)H₇(CmCr₄Db₄FHfOsPo)Md₂(Pa₄)

80% New package, obfuscation, unused deps

@foldkit/markdown Write markdown files, get Foldkit views with live islands. 1d ago javascript

9f124056af4f1094a5b21d2eecdab9925a552f3a73c13ab4115982b0a108f83a H(Db₂)Md(Pa₄)

80% Unlisted publisher, potential takeover

@theholocron/doppler-client A TypeScript client for the Doppler API 1d ago javascript

20a11306ada3f818aa117a9974ef8b89f837a7ab6783cebcdd95f5e173175db5 H(Cm₃)Md(Pa₄)

80% New package, rapid releases, unknown publisher

pi-skill-playbook Pi extension for passive, human-mediated Agent Skill playbooks. 1d ago javascript

b2bc14a7352d640f620bf4c1e31e12e62da2f01628783919560dde4366763081 H₅(Cm₂Db₂FOs₂Po)Md(Pa₂)

80% Unlisted publisher, potential takeover

pi-localgpt Pi extension for LocalGPT — unified MCP bridge. 51 curated tools for design-log + Gen 3D world building. 1d ago javascript

cde82ef1308a374f46761121e4cec3fec756c8ec1bf5b92cd0957ed451e79f16 H₅(Cm₃Db₂F₃Os₂Po₂)Md₂(Pa₃)

80% Unlisted publisher, potential takeover

@milaboratories/pl-drivers Drivers and a low-level clients for log streaming, downloading and uploading files from and to pl 1d ago javascript

8156bba9e67ee42e79796adfdba4906474df82e8f968f067883074a75c729bca K(Mc)O₂(AlAs)H₆(Cm₆Cr₂Db₇F₄OsPo₃)Md₂(Pa₅)

80% WMIC disk enumeration in npm package

ai-document-parser Parse, convert, surgically edit, and write office documents for AI agents and Node apps — permissive deps only 1d ago javascript

b6c42b72581fdcc9aa3aff9fb8ebcd49c439687f6e18c2570529610315681184 H₅(Cm₂Db₅FOsPo)Md₂(Pa₄)

80% New package, rapid releases, unusual scripts

@tenonhq/sincronia-core Next-gen file syncer 1d ago javascript

8e53e0a09f758217467cf3cbbcd772371f7a3d4e2fc123104a478c556d9f2dad O(As)H₆(Cm₂Db₈F₈OsPo₇Ti)Md(Pa₄)

80% Executes external AI CLI via shell

@jfdevelops/react-layout A React library for creating layout components. 1d ago javascript

883fa7cc2105afc0ff6f0cbeb31584cadba3dfcd48333520d45a81eaf80f6f3d H(Db)Md₂(Pa₅)

80% Unlisted publisher, fresh release

@supernovae-st/qrcode-ai-scanner-linux-arm64-gnu QR decoding + scannability scoring for artistic and AI-generated QR codes — async native bindings (Rust) 1d ago javascript

98ebf7ac6b84fa85a5c51bdd3c0fc9dc52fa5bbe92fc282513fe2eeabb489540 Md(Pa₄)

80% Native addon with ransomware vocabulary

@kaleido-io/workflow-engine-sdk TypeScript SDK for Kaleido Workflow Engine 1d ago javascript

91257573aa68bb5c28db8ea077512ed0896461955d87d65134f791281346a86f H₃(Cm₉Db₅F₂)Md₂(Pa₃)

80% Unlisted publisher, potential supply chain risk

trivela-ui A React component library with one consistent variant and colour system, built on Tailwind CSS 1d ago javascript

b25e337f9660b75e2075c4ba58a8f160b9c43e88cf56d4ef06aa6e759a612ffc H₃(DbPoU₂)Md(Pa₄)

80% New package, rapid publish burst

@graphorin/channels Channel SPI for the Graphorin framework. Defines the vendor-neutral adapter contract for messenger front doors (inbound normalization, iden… 1d ago javascript

6261cd0ca7f12b9e5101f25666520c1bbd9278164188963101e64c2be1b752d1 H(Db)Md₂(Pa₄)

80% Unlisted publisher, potential takeover

@graphorin/mcp Model Context Protocol client for the Graphorin framework: stdio + Streamable HTTP + SSE transports, typed `MCPClient` (`listTools` / `list… 1d ago javascript

9a5686d4f478df95c7948ebab9c13537e2342e563bf5ed85111aeb6f83b5586e H₄(Cr₂Db₃OsPo)Md₂(Pa₃)

80% Unlisted publisher, potential takeover

@graphorin/evals Eval framework for the Graphorin framework. Ships scorer libraries (`code/` exact-match, regex, JSON path, predicates; `llm/` LLM-judge; `p… 1d ago javascript

572a3c6aed2e1a791ff13ff1e607eac7ee05fd40b3e2128077e157448259e51a H₂(Db₂F)Md₃(Pa₄Pt)

80% Unlisted publisher, potential takeover

@graphorin/cli Operator CLI for the Graphorin framework. The `graphorin` binary covers the standalone server and the local stores end to end: `start`, `in… 1d ago javascript

d52875e501ed540fcec11b74ee1f0b6293ad8099f69683bbe64d5d9da73ef278 H₅(Cm₅Db₂FOs₃Po)Md₃(Pa₃Pt)

80% Unlisted publisher, potential takeover

@graphorin/agent Agent runtime for the Graphorin framework: createAgent({...}) factory, the typed model -> tool calls -> model loop, the AgentEvent<TOutput>… 1d ago javascript

f22e07173c9909eeccb48683954ed07161d681834820f0ba5989646bdf12bccf H₆(Cm₂Cr₂Db₃FOs₂Po)Md₂(Pa₃)

80% Registry takeover, sandbox evasion, shell execution

@graphorin/proactive Proactivity layer for the Graphorin framework: heartbeat runner (checklist-driven periodic agent beats with sentinel suppression, busy-defe… 1d ago javascript

5c1403d555f90f6bd3b72a2fa20eb8734dcb4d933089c0a7c1174a639f2245d8 H(Db₂)Md₂(Pa₃)

80% Supply chain takeover indicators present

@graphorin/protocol Wire protocol contract for the Graphorin framework: Zod schemas + TypeScript types for the WebSocket subprotocol `graphorin.protocol.v1`. D… 1d ago javascript

22c38e4ee6109896e9838144c4a0e22f17b2598b1bd519031f9d39235aa3148a H(Db₂)Md₂(Pa₄)

80% Publisher takeover indicators present

@graphorin/reranker-llm LLM-as-reranker adapter for the Graphorin framework. Asks the configured `Provider` to score `(query, passage)` pairs against an English (d… 1d ago javascript

76c2bdc4f00320e8f16ed9ba3f21c7aefd88c0f355427377204b44d10b5b927d H₂(DbPo)Md₂(Pa₄)

80% Unlisted publisher, potential takeover

@graphorin/provider-llamacpp-node In-process GGUF execution adapter for the Graphorin framework. Wraps node-llama-cpp@^3.5 to load .gguf model files directly into the same N… 1d ago javascript

691c050fa05256d752e4538574962ea70c642fe76386c358af52ab550d1ebfff O(Ca)H₂(Db₃Os)Md₂(Pa₃)

80% Unlisted publisher, potential supply chain risk

@graphorin/reranker-transformersjs Cross-encoder reranker adapter for the Graphorin framework. Wraps `@huggingface/transformers@^4.1.0` to score query / passage pairs in-proc… 1d ago javascript

72aa815c1f80a408db3820b0ad3cb34eb2f29df98ade39ae443c7876195baf2f H₂(DbOs)Md₂(Pa₄)

80% Unlisted publisher, potential takeover

@graphorin/secret-1password Reference 1Password secret-resolver adapter for the Graphorin framework. Registers the `op://` scheme on top of `@graphorin/security`'s plu… 1d ago javascript

20c4c6627d67ab55c919237e68803067aa7b2354d539040113a7dc2ed38c6f79 H₃(CmDbPo₃)Md₂(Pa₄)

80% Unlisted publisher, potential takeover

@graphorin/sessions Hybrid facade-with-state session module for the Graphorin framework: createSessionManager() facade that wraps @graphorin/memory.session for… 1d ago javascript

25e143567eda781f561e336580ef0d6a3c42a25d213795f9c695bdf86c829468 O(S)H₄(Cr₃Db₄FOs)Md₂(Pa₃)

80% Unlisted publisher, potential takeover

@graphorin/store-sqlite-encrypted Optional encryption-at-rest sub-pack for the Graphorin framework's default SQLite store. Pulls in `better-sqlite3-multiple-ciphers@^12.9.0`… 1d ago javascript

8b25b8056dc6060c6815936d4c9ead4aa92f55759f5b75d44660adbb1c416307 H₄(CrDbOsPo)Md₂(Pa₃)

80% Unlisted publisher, potential takeover

@graphorin/server Standalone server runtime for the Graphorin framework: createServer({...}) factory, Hono HTTP app, REST endpoints (agents / workflows / ses… 1d ago javascript

99e95ae01a1f24cc7711e39ee647ddb4f24f19694d32eae629d69a2f319418b7 K(Mc)O(Ca)H₅(Cm₈Cr₄Db₅OsPo)Md₃(LiPa₃)

80% Registry publisher takeover indicators

@graphorin/workflow Step-graph workflow engine for the Graphorin framework: createWorkflow({...}) factory, Workflow.execute / resume / getState / listCheckpoin… 1d ago javascript

61b6a86c50149665ad986594e11ef6b9e77fd39e803bcdb7f69f83cde18e2d2b H₃(Db₂OsPo)Md₂(Pa₃)

80% Unlisted publisher, potential takeover

@tchori-labs/fusion-mcp Governed Model Context Protocol server for a Fusion agent board 1d ago javascript

ab12f881c44b7cdf9bd0c9d2be8787ddee49e71af6d6cf7f37ccaaa32008773e H₃(Cm₆Db₃Po)Md(Pa₂)

80% New package, rapid releases, unlisted publisher

@insignary/clarity-mcp-linux-x64 linux/x64 binaries for @insignary/clarity-mcp 1d ago javascript

70c907ca2ab16a2843bbd259740c0b19228dea9baee6a94f4ee55e07c65b7425 O(Er)H₃(Cm₅Cr₄F₂)Md(Pa₂)

80% New package, binary crypto, HTTP

sliftutils A build system and utility library for MobX + Preact projects. 1d ago javascript

7ae72f06362a5976a3a13cc7e66b8ed36f91cd50f5b4211e24f49c767b0ae61a K(Li)O₅(AsCDyEr₂S₂)H₉(Cm₂₆Cr₂Db₁₆F₁₁Os₉Po₁₁TiU₂)Md₆(InPa₃Pt₂)

80% Supply chain risks, eval, remote deps

halo-theme-dream2.0-plus 梦之城，童话梦境，动漫类型博客主题。 1d ago javascript

bdc62ba4985e53b9288791ebe63fd8f736277193b785a998509435255af1023a K(Li)O₂(AlS)H₈(Cm₁₅Db₁₁F₂Hf₂Os₂Po₅TiU₄)Md₆(BkLiPa₃Pt)

94% Anti-debugging code blocks developer tools

@heartlandone/vega-angular-sandbox-pr-3178-42149b91b1891c656f8299a7715f470bac4ba02a Angular specific wrapper for @globalpayments/vega 1d ago javascript

8a60eb51a90334c76091d24aeac835279641e47c3eef646f9d4c4d7145ebe3a6 O(S)H₅(CmDb₂F₂OsPo₃)Md₃(Pa₄)

80% Typosquatting package name with PR hash

alado Extremely fast, lightweight, robust framework for HTTP applications written in Node.js 1d ago javascript

815ea8a94f4f7740a0d93ea47c593e587a63c40faee99894cd6a65232ba77f24 K(Li)O(S)H₄(F₆Cm₄Db₂Po₂)Md₂(InPa₃)

80% Dangerous postinstall permissions and scripts

e02677a974156dcb7abc01062dfd71cc9a705360a5eb24805a708666c9d79d6d 1d ago javascript

e02677a974156dcb7abc01062dfd71cc9a705360a5eb24805a708666c9d79d6d O₃(As₂XeC)H₂(Db₅F)Md

75% payload.jscriptactivex.com

banyancode 1d ago javascript

67d996dfd519b408bb31c431e0585a398dfb9cb9ca10f823b7b0b3a5368fd737 O₂(ErS)H₃(DsF₇Po₃)Md(Pa₄)

80% New package with native binaries

@interop/did-web-resolver A did:web method Decentralized Identifier (DID) resolver for the did-io library. 1d ago javascript

6036e12a1a10c5ee09414de728aa1b23da375fac594d0c58aba984f520acaa95 O(Er)H₃(CmDbPo)Md(Pa₅)

80% Supply chain impersonation indicators present

@alicloud/smqproxy20260409 English | [简体中文](README-CN.md)  1d ago javascript

a73b624b0b2f300e772d3b4482000dcd9eaf30a2501f5c3ac4235ce9adc4f23a H₂(Cm₃Db)Md₃(Pa₃)

80% Typosquatting Alibaba Cloud SDK package

@sovovs/bycli Make any website or Electron App your CLI. AI-powered. 1d ago javascript

44d8b14ac765b8791b25961583584d57a0d0fcc8feec37be098d39e086566e88 K₃(AmLiTe)O₆(C₆ErEuS₅DyXe)H₁₀(Cm₃₅Cr₂Db₁₈F₁₁HfOs₈Po₁₆TiU₆)Md₄(LiPa₆)

30% Automation stealth and credential handling

vue-ssr-lite Vue 3 SSR runtime with routing, generic plugin hydration, Vite, and Node server lifecycle. 1d ago javascript

f276473f37766abd01f309a65b6100f19a01c04fd490e57084f5a5952acaf4cd H₄(Cm₇OsPoU)Md(Pa₃)

80% New package, rapid releases, registry flags

signalk-siparu Kept aboard, proven ashore. An impartial, timestamped record of every voyage: position, wind, depth and logbook, written on the boat and re… 1d ago javascript

631304d8b7fedd81d15be45ac59448e370124b2568b2f7589258599f57a60de6 O(As)H₇(Cm₁₃Db₈F₃OsPoTiU₃)Md₃(Pa)

80% New package, rapid releases, obfuscated assets

eshoplogistic-react React-компонент выбора доставки EShopLogistic и серверная функция создания заказа. 1d ago javascript

ce516483ffdae1fd67fabb4102188023017e4b8dc81da12a7a4b8167c351b99b H₅(Cm₈Db₂OsPoU₂)Md₂(Pa₃)

80% New package, burst publishes, external API calls

devfuel DevFuel CLI and agent integrations for qualified sponsor ads. 1d ago javascript

79491a80cdfef4c6ca030a57cdf9ed686a43cb9e5463c06b941873f7c22aa4b6 K(Am)O₂(DyS)H₈(Cm₉Cr₄Db₃F₄Os₄Po₉TiU₂)Md(Pa₅)

80% New package with aggressive install hooks

@maincode-ai/channel-base Base infrastructure for building Matilda Code channel adapters. Provides the abstract base class, access control, session routing, and the… 1d ago javascript

1d04200a75d08856a2fac9bf24a388ad7e83dffeedf3455a710a36b603be84c8 H₄(Cm₂DbF₄Po₃)Md(Pa₂)

80% Typosquatting, rapid releases, suspicious publisher

@sniipwebmaster/kyc-client-grpcweb kyc-client-grpcweb 1d ago javascript

118a30079d4a132bfc81297be03660182d781b54e97c087bfce6f2145bdd935a H(Po)Md(Pa)

80% Typosquatting package with unusual publisher

@wordkey/sdk Add the Word? button to your site in one afternoon. One word. Every door. 1d ago javascript

4d19fe005418227eb95e043c4c9033be18acf1a1095f78366641b6a6f1722d22 H₅(Cm₇Cr₂Db₈OsU₂)Md(Pa₅)

80% New package, rapid publish burst

@voyant-travel/operator-settings 1d ago javascript

b9a5a39bf0346c17e14e90335045d1751b432d1d7cccef270f246cfd43c06835 H₆(CmCrDbFOsPo)Md(Pa₆)

80% Registry impersonation and publisher takeover signals

@voyant-travel/legal-react The legal client tier: headless data hooks/clients plus the styled UI components and page-level compositions (formerly `@voyant-travel/lega… 1d ago javascript

13e9f814d02e17c1c0aacaf236f58948d7c7956429df3f9914a623feeac99ee3 H₄(Cm₅FOsU₂)Md(Pa₅)

80% Unlisted publisher, potential supply chain risk

docana 1d ago javascript

118a7619b5cd269b24d13f4faaa025c6543f95238e2c4fb73d34e8d22f7eb81a O(S)Md(Pa₂)

80% Hollow package impersonation indicator

@transmitt0r/openclaw-plugin-paperless-ngx OpenClaw plugin for paperless-ngx 1d ago javascript

696d454008ac4377933f4a73aeaeb4810136f05ac5acfce6f1dd04da68bccc0d H(Cm₂)Md(Pa₄)

80% New package, publisher takeover suspicion

@schemd/core Zero-dependency text-to-SVG compiler for schematics and UML. 1d ago javascript

0f2ed9518b667bc5bcaf2405f71531a4f4aca3be1aeeb67e5cd3ea30c169f979 O(S)H(Po)Md(Pa₃)

80% Unlisted publisher, potential takeover

@1mpactin9/cited cli for cited 1d ago javascript

2985844c552028f65fe857d774cbd17e097cfae7efb8229c12bdecfcf2398935 H₅(Cm₅DbFOsPo₂)Md(Pa₂)

80% New package, rapid releases, unverified publisher

react-calendar-time Accessible React date and time picker component 1d ago javascript

b11249289f92b8fd86f267231df82405b9d8fbebad3d6356d3208a50250ded32 H(Po)Md(Pa₅)

80% New package with rapid release burst

agentic-kdd Autonomous development pipeline — aa: · ag: · audit: · AST graph · Harness · Specs · Impact analysis · Decision trail · Metrics · MCP serve… 1d ago javascript

958e26773946000db9df8e1618dbe5d9bb8eda054de2a6257c99ed6324ffd7ed K₃(AmLiTe)O₄(PS₄AsC)H₇(Cm₁₉Cr₂Db₈F₁₄Os₉Po₈U₂)Md₄(InPa₂Pt)

80% Runtime installs, git hooks, hidden paths

@theholocron/clerk-client A TypeScript client for the Clerk Backend API 1d ago javascript

a2e563f01d49f2548134e76b81abc14616d0af76cc2d5bc2eff1e1393fa77ac1 H₂(Cm₄Os)Md(Pa₄)

80% New package with rapid release churn

@theholocron/doppler-client A TypeScript client for the Doppler API 1d ago javascript

408e6d5c666d68666287659342331cb991045d14a4e4811017efa8c2f3477a63 H₂(Cm₃Os)Md(Pa₄)

80% New package with rapid release churn

@theholocron/github-client A TypeScript client for the GitHub REST API 1d ago javascript

7fffb85c0c5b1af720054ed282f8a557165d44f6e8ffe7a95313975d0ef85a05 H₃(Cm₄DbOs)Md(Pa₄)

80% New package with rapid release churn

@theholocron/neon-client A TypeScript client for the Neon API 1d ago javascript

70c37d4a22752c58026bd9fb1084df0e5df34a78681fe36b099be3e601514688 H₂(Cm₃Db)Md(Pa₄)

80% New package with rapid release churn

@aceshooting/lyra-ui Free, independent Lit web components: an open-source alternative to Shoelace and Web Awesome with accessible forms, dashboards, charts, and… 1d ago javascript

36228c41961d219ab16edf767cbb290afa41b31b2ce7bfa4e6ffbfe343839fc3 K(Li)O(S)H₆(Cm₈Db₁₀Hf₂Os₃PoU₄)Md₂(BkPa₅)

80% Embedded base64 ZIP payload

glyph-compress Semantic compression for IDE↔LLM communication using radical glyphs — CLI, MCP server, and VS Code extension, with a Context Router, team-s… 1d ago javascript

a05cb6c22cb2359584efd7a54a97df28126de0c61a8ec39fad89974ba1d8fe65 K(Li)O(C)H₇(Cm₉Cr₂Db₄F₉Os₂Po₅U)Md₅(InLiPa₄)

80% Typosquatting, proxy, clipboard access

@kontourai/forage Safe, replayable web crawling for review pipelines — a crawler for untrusted URLs. 1d ago javascript

2665d550f8dbec67039496bce3195b87c7081056bcc19b19f7c2c0167d3dbac8 H₇(Cm₉CrDb₃FOs₂Po)Md₂(Pa₄Pt)

80% New package, unlisted publisher, scraping claims

aiguru Guru AI developer CLI — an agentic terminal companion for your codebase, models, and MCPs. 1d ago javascript

52d559ae15df2078c35ba4d662b6332b0f9e4c1bddddbfa1806433eb7e6f6b4b K(Te)O₃(AsCS₂)H₅(Cm₁₀Db₂F₆Os₃Po₇)Md₂(LiPa)

80% New package with postinstall hook

@cplieger/actions 3.1.1 Declarative async UI-action framework for TypeScript with retry, debounce, polling, optimistic updates, scope serialization, dedupe collaps… 1d ago javascript

8a06249b11dc3e465a6a08372a9d1c156a59766df7a49b2d4120e3266ab564af H₂(Cm₄U)Md(Pa)

80% Suspected publisher takeover

@bielu/scalar-signalr Interactive SignalR console plugin for the Scalar API Reference. Reads SignalR AsyncAPI bindings and lets you connect to hubs, invoke metho… 1d ago javascript

29ff3269bfdc4f0e2c31cade2bac93940ed816bfc415d9d9965e9d72ec56cec4 H₅(Cm₉Db₂PoTiU₂)Md₂(Pa₃)

80% New package, unusual local dependencies

on-zero A typed layer over @rocicorp/zero with queries, mutations, and permissions 1d ago javascript

ae255a7ffdaf426f701dfcbcc43ddb232bc6a88f4fa9dd36d5b1c81baeb58a98 K(Mc)O(Er)H₆(Cm₈Cr₂Db₆F₅OsPo₅)Md₄(BkInPa₄)

80% TLS bypass and shell execution

@vnejs/contracts.canvas.layers.bl Contracts for @vnejs/plugins.canvas.layers.bl 1d ago javascript

b1f1e158ddb7ed1390a638ec5279f0c0fa5111d212dfb2e517c93e54d161ca0e H(Os)Md(Pa₃)

80% Brand new package with publish burst

@habemus-papadum/aiui-claude-plugin A Claude plugin (skills, commands, scripts) with a CLI for configuration info. 2d ago javascript

44e37f7a89bf806f6baf5fad218239451c5db4fe0a644d2ef6c95fd9d29c595d Md₂(Pa₄)

80% Unlisted publisher, potential takeover

banyancode 2d ago javascript

dd9c4689b5e6e115f874c51c37527b128592e6bf6eb829f2b48116624f7f84ce O₂(ErS)H₃(DsF₇Po₃)Md(Pa₄)

80% New package with native binaries

@habemus-papadum/aiui-intent-client The greenfield intent client: a detached plain-page panel on the mode engine — agent-drivable, HMR-native; the MV3 extension is a shell add… 2d ago javascript

401aee27aa8fc39b923cf87de321d449659dd5f253bf5349f7161873f307fc2a K₂(LiTe)O₂(CaC)H₈(Cm₁₂Db₈Hf₃Os₃Po₂TiU₃)Md₆(BkPa₃Pt)

80% New package, unlisted publisher, broad permissions

@habemus-papadum/aiui-intent-runtime The intent client's host-agnostic capture + transport runtime: mic/screen capture, the frame sampler, the selection watcher, and the channe… 2d ago javascript

c0a2b4163b3107b1e15d7658105cab735aba274955724fb3ba45ebfa98ef27f3 H₄(Cm₃Db₂Hf₂Po)Md₃(LiPa₃)

80% Unlisted publisher, fresh package

@habemus-papadum/aiui-pencil A pencil: pressure/tilt/azimuth-driven textured strokes, erasing, and vanishing ink, on a three-tier raster surface. 2d ago javascript

454fb20ea510970ed68ff22cd04f1eed110f1ef7aa14f6f3d8fcada580471ea7 H₄(Cm₄Db₃Os₂U₃)Md₄(LiPa₃)

80% Unlisted publisher, potential takeover

@habemus-papadum/aiui-remote-bar The command bar as its own channel: a mode engine projected over a websocket, mounted as a channel sidecar, with a Solid client that render… 2d ago javascript

cb76eb58bc621f821eeb4ccaeaa543eb9ef35fdd486a173646f898c71eb500f3 H(Cm₂)Md₂(Pa₃)

80% Unlisted publisher, potential takeover

@habemus-papadum/aiui-source-processor The aiui source processor: the compile-time Babel pass that injects factory identity (name/loc/description for cell/control/action) and dev… 2d ago javascript

6273071af26ea562a6e1d0943ec086bc567667b0dc993acfa9f3e4fa165915a8 H(Os)Md₂(Pa₃)

80% Unlisted publisher, fresh package

@habemus-papadum/aiui-viz Reactive scientific-visualization utilities for agent-written frontends: Observable-style async cells for SolidJS 2.0, worker streaming, du… 2d ago javascript

d6a848be472575d60751e1d5a5eb7854719abac57f347a16f8bd6f3488b7ea09 H₄(Cm₅OsPo₂U₂)Md₂(Pa₃)

80% Unlisted publisher, potential takeover

@habemus-papadum/create-aiui Scaffold a SolidJS + aiui starter app: pnpm create @habemus-papadum/aiui 2d ago javascript

b3f2d8b29ea859ad9deb712be5e338a0862d24d5a7a59463c9d46879dfbb4410 H₃(FOs₂Po₂)Md₂(Pa₅)

80% Unlisted publisher, potential takeover

kernelpm-broker kernelpm broker — bridges the app (WebSocket) to each server's kernelpm daemon over SSH. 2d ago javascript

b128435d047e8707b85684b27501fd704ed9677f22f49ca60e7976a51d2bfe8b O₂(SC)H₆(Cm₅Cr₃DbF₆OsPo₃)Md(Pa₂)

80% New package, aggressive shell provisioning

@cheela/cli CLI for initializing and deploying Cheela runtimes. 2d ago javascript

af5a77b07602570d58016f52a195fd5789ab718f40df0551b5d729883d0702c9 H₃(Cm₄Os₂Po)Md₂(Pa₅)

80% New package, unknown publisher, API key handling

atria-code Coding agent CLI with read, bash, edit, write tools and session management 2d ago javascript

2035e40366da67971f94e6744b3fc65df13810c3269eb81688ef5171107b73cc O(S)H₄(CmF₄OsPo₃)Md(Pa₅)

80% New package with native binaries

@gregori/orchestrated-squad Portable multi-runtime agent squad installer 2d ago javascript

33ea6987676c44093e6a0fe9b7643990263e58bc9680f336be61877085a154df H₆(Cm₄Cr₂Db₂F₂Os₂Po₅)Md(Pa₄)

80% New package, unlisted publisher, telemetry