Reporting and moderation

How to report a package, what happens next, and what moderators can do.

Reporting a package

Every package page has a Report button. You do not need an account to use it, because requiring one to report malware protects the malware. If you are signed in, the report is attached to your account so a moderator can follow up; if you are not, leave an email if you want a reply.

CategoryUse it when
malwareThe package steals data, installs something else, or does damage.
securityA vulnerability in the package, or a dependency with a known one.
licenseCopied code, a missing or contradictory licence, or a licence violation.
spamEmpty, duplicated, or published to occupy a name.
impersonationPresents itself as someone else's project, or as an official one.
otherAnything the categories above do not cover. Say what it is.

Be specific. "This looks sketchy" cannot be acted on; "version 1.4.2 declares no network access but posts the contents of ~/.aws/credentials to paste.example.com" can be checked in a minute.

For anything not tied to a package — including a vulnerability in SenClaw itself — use contact instead.

What happens next

A report goes into a moderation queue and moves through four states:

StateMeans
openReceived, not yet looked at
reviewingA moderator has picked it up
resolvedActed on — the note records what was done
dismissedNo action, with a reason

Every decision is recorded in an append-only audit log with the moderator who made it and their reason. There is no delete path for that log in the code or the UI: an audit log the audited can edit is decoration.

What moderators can do

  • Block a package. It disappears from browse, search, the API and

marketplace.json at once. Reversible.

  • Yank a version. Excluded from range resolution; exact pins still resolve, so

an existing lockfile keeps working. Reversible.

  • Remove a package. Admin-only and permanent. The rows stay so version numbers

stay burned.

  • Ban an account. Every session is revoked immediately.

Stored blobs are deliberately left in place on removal. They are content-addressed and may be shared with a package nobody asked to remove, so deleting one here could pull the bytes out from under an innocent version.

If your package was actioned

Contact us with the package name. Blocking is reversible and is the option moderators reach for first precisely so that a mistake can be undone.