🤖 AI Analysis

Final verdict: SUSPICIOUS

While the package does not exhibit high-risk behaviors like shell execution or overt credential harvesting, its reliance on external network calls and base64 encoded API keys, coupled with the lack of a Git repository and low maintainer activity, raise concerns about its legitimacy and potential for supply-chain attacks.

network calls to external services
base64 encoded API keys
lack of Git repository
low maintainer activity

Per-check LLM notes

Network: The package makes network calls to external services which could be legitimate if the package is intended to fetch data from an API or web service.
Shell: No shell execution patterns were detected, indicating no immediate risk from shell command execution.
Obfuscation: The use of base64 encoding for decoding an API key suggests some level of obfuscation but is not uncommon in legitimate software.
Credentials: No clear evidence of credential harvesting observed.
Metadata: The maintainer has a new or low activity account and there's no Git repository found, which may indicate low effort or inactivity.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 3.0

Found 2 network call pattern(s)

R': 1.0} try: r = requests.get(ECB_EUROFXREF_URL) root = ET.fromstring(r.text)
send(self, msg): r = requests.post("%s/%s/messages.mime" % (self.options.get('mailgun_api_url',

⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

api_key = base64.b64decode(authz[6:]).decode('utf-8').split(':')[0]

✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 3.0

Repository not found (deleted or private)

Repository not found (deleted or private)

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

Author "Maxime Bouroumeau-Fuseau" appears to have only 1 package on PyPI (new or inactive account)
Package has no PyPI classifiers (low effort / metadata quality)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with Frasco

Create a simple SaaS application using Flask and the Frasco package to manage user subscriptions. This application will allow users to sign up, log in, manage their subscription plans, and access exclusive content based on their subscription level. Here’s a step-by-step guide to building this application:

1. **Setup**: Install Flask and Frasco. Configure your Flask app to use Frasco's extensions for handling user authentication, billing, and plan management.
2. **User Authentication**: Implement user registration and login functionalities using Frasco's built-in support for OAuth providers like Google and Facebook, as well as traditional email/password authentication.
3. **Subscription Management**: Utilize Frasco's billing integration to set up different subscription tiers (e.g., Free, Basic, Pro). Users should be able to upgrade/downgrade their plans and view pricing details.
4. **Content Access**: Restrict access to certain pages or features based on the user's subscription level. For example, only 'Pro' subscribers can access advanced features.
5. **Admin Dashboard**: Develop an admin dashboard where you can manage users, view subscription statistics, and handle customer support queries.
6. **Notifications**: Integrate email notifications for account activation, subscription renewals, and payment failures.
7. **Testing**: Thoroughly test the application to ensure all functionalities work correctly and securely.

Suggested Features:
- Multi-language support
- Social media sharing for subscription plans
- Analytics dashboard for users
- Customizable subscription plans
- Integration with third-party services for enhanced functionality

How Frasco is Utilized:
- For authentication, Frasco simplifies the process of integrating various OAuth providers.
- Billing and plan management are streamlined through Frasco's billing extensions.
- Content restriction and user management leverage Frasco's security and database management capabilities.

This project will demonstrate the power and flexibility of Flask combined with Frasco in developing robust SaaS applications.