Reporting and moderation
How to report a package, what happens next, and what moderators can do.
Reporting a package
Every package page has a Report button. You do not need an account to use it, because requiring one to report malware protects the malware. If you are signed in, the report is attached to your account so a moderator can follow up; if you are not, leave an email if you want a reply.
| Category | Use it when |
|---|---|
malware | The package steals data, installs something else, or does damage. |
security | A vulnerability in the package, or a dependency with a known one. |
license | Copied code, a missing or contradictory licence, or a licence violation. |
spam | Empty, duplicated, or published to occupy a name. |
impersonation | Presents itself as someone else's project, or as an official one. |
other | Anything the categories above do not cover. Say what it is. |
Be specific. "This looks sketchy" cannot be acted on; "version 1.4.2 declares no network access but posts the contents of ~/.aws/credentials to paste.example.com" can be checked in a minute.
For anything not tied to a package — including a vulnerability in SenClaw itself — use contact instead.
What happens next
A report goes into a moderation queue and moves through four states:
| State | Means |
|---|---|
open | Received, not yet looked at |
reviewing | A moderator has picked it up |
resolved | Acted on — the note records what was done |
dismissed | No action, with a reason |
Every decision is recorded in an append-only audit log with the moderator who made it and their reason. There is no delete path for that log in the code or the UI: an audit log the audited can edit is decoration.
What moderators can do
- Block a package. It disappears from browse, search, the API and
marketplace.json at once. Reversible.
- Yank a version. Excluded from range resolution; exact pins still resolve, so
an existing lockfile keeps working. Reversible.
- Remove a package. Admin-only and permanent. The rows stay so version numbers
stay burned.
- Ban an account. Every session is revoked immediately.
Stored blobs are deliberately left in place on removal. They are content-addressed and may be shared with a package nobody asked to remove, so deleting one here could pull the bytes out from under an innocent version.
If your package was actioned
Contact us with the package name. Blocking is reversible and is the option moderators reach for first precisely so that a mistake can be undone.