🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits moderate risks due to its obfuscated code and potential for direct shell execution. While there is no clear evidence of malicious intent, the incomplete metadata and use of obfuscation techniques warrant further scrutiny.

High obfuscation risk
Potential for shell command misuse

Per-check LLM notes

Network: The network call pattern suggests the package may be checking for updates or version information from a remote server, which is not inherently malicious but should be verified.
Shell: Direct shell execution can pose risks if misused; the observed clear command and pip install actions seem benign but could potentially be used for more harmful purposes.
Obfuscation: The code shows signs of obfuscation with base64 and zlib compression, which could be used to hide logic or data.
Credentials: No clear patterns of credential harvesting were detected.
Metadata: The maintainer's author information is incomplete, suggesting a potential lack of transparency.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 3.0

Found 2 network call pattern(s)

ry: Version = requests.get("https://raw.githubusercontent.com/TechnoIndian/ApkPatcher/m
Name}') with requests.get(File_URL, stream=True) as response: if r

⚠ Code Obfuscation score 10.0

Found 6 obfuscation pattern(s)

print(f"{M.zlib.decompress(M.base64.b64decode(b64)).decode('utf-8').rstrip('\n')} | {C.B}{Date}{C.CC}") pr
f.startswith(b'-----'): f = M.base64.b64decode(''.join(f.decode().splitlines()[1:-1])) CERT = x509.
red_modules: try: __import__(module) except ImportError: print(f"{C.S} Installing {C
try: mp = __import__('multiprocess') except ImportError: mp = __import__('mu
ImportError: mp = __import__('multiprocessing') # ————— 𝐋𝐢𝐛𝐫𝐚𝐫𝐢𝐞𝐬 𝐈𝐦𝐩𝐨𝐫𝐭 —————
��𝐫𝐭 ————— self.re = __import__('re') self.os = __import__('os') self.sys = __imp

⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

Manifest def Clear(): M.os.system('cls' if M.os.name == 'nt' else 'clear') Clear() # -------
] ) M.os.system('cls' if M.os.name == 'nt' else 'clear') # -----------
M.os.system('cls' if M.os.name == 'nt' else 'clear')
") try: M.subprocess.check_call([M.sys.executable, "-m", "pip", "install", module])
dencies(): try: M.subprocess.run(['java', '-version'], stdout=M.subprocess.PIPE, stderr=M.sub
: try: result = M.subprocess.run(['pkg', 'list-installed'], stdout=M.subprocess.PIPE, stderr=

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository TechnoIndian/ApkPatcher appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

Author name is missing or very short
Author "" appears to have only 1 package on PyPI (new or inactive account)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with ApkPatcherX

Build a simple Python application using the ApkPatcherX package to demonstrate its core features.