abstractcore

v2.13.31 suspicious
5.0
Medium Risk

Unified interface to all LLM providers with essential infrastructure for tool calling, streaming, and model management

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits moderate risks due to potential shell and network vulnerabilities, despite having no clear signs of malicious intent or obfuscation.

  • Shell risk due to subprocess calls
  • Network risk from httpx usage
Per-check LLM notes
  • Network: The use of httpx for network calls is common but may indicate external resource access which could be unexpected.
  • Shell: Subprocess calls to pip install other packages might be legitimate for dependency management, but direct execution of other modules (like 'abstractvoi') can pose risks if not properly documented.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The author's details are incomplete and the account seems new or inactive, raising some concerns but not definitive evidence of malice.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 4.5

Found 3 network call pattern(s)

  • port httpx resp = httpx.get(url, timeout=3.0) if resp.status_code < 500:
  • httpx resp = httpx.get(f"{base.rstrip('/')}{probe_path}", timeout=3.0)
  • try: async with httpx.AsyncClient(timeout=None) as client: async with client.strea
✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 8.0

Found 4 shell execution pattern(s)

  • and dependencies subprocess.check_call([sys.executable, "-m", "pip", "install", "transformers", "to
  • dings]"') subprocess.run( [sys.executable, "-m", "pip", "inst
  • t small") subprocess.run( [sys.executable, "-m", "abstractvoi
  • iper en") subprocess.run( [sys.executable, "-m", "abstractvoi
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: abstractcore.ai>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository lpalbou/AbstractCore appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with abstractcore 
Create a mini-application named 'LLMToolbox' that leverages the 'abstractcore' package to provide users with a unified interface to interact with various Large Language Models (LLMs) from different providers such as Anthropic, Anthropic-Proxy, Azure, Cohere, HuggingFace, OpenAI, and Vicuna. The application should allow users to easily switch between different models and providers without needing to change their code or configuration.

Step 1: Set up the project environment by installing the 'abstractcore' package along with any other necessary dependencies.
Step 2: Design a user-friendly command-line interface (CLI) that allows users to:
- List available LLM providers and models.
- Select a provider and model to use for generating text.
- Send prompts to the selected model and receive responses.
- Manage streaming of the response generation process.
Step 3: Implement functionality to manage models within the application, including the ability to:
- Load and unload models dynamically.
- Cache model outputs to improve performance.
- Monitor model usage statistics.
Step 4: Ensure the application supports error handling and logging to capture any issues encountered during execution.
Step 5: Document the project thoroughly, explaining how each feature works and how users can contribute to or extend the application.

Utilize the 'abstractcore' package's core features throughout the development process, focusing on its capabilities for tool calling, streaming, and model management to streamline the interaction with LLMs.