🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits several concerning behaviors including executing external binaries and code obfuscation, which may indicate attempts to conceal malicious activities. While there is no definitive proof of malice, these indicators warrant caution.

Executing external binaries via subprocess
Signs of code obfuscation

Per-check LLM notes

Network: The use of urllib to make network calls could be legitimate depending on the package's functionality, but requires further investigation into the endpoints it communicates with.
Shell: Executing external binaries via subprocess can pose significant risks if not properly controlled, suggesting potential for unauthorized operations or execution of malicious code.
Obfuscation: The code shows signs of obfuscation with import statements split and reassembled, suggesting an attempt to hide the true nature of the imports.
Credentials: There is a pattern that resembles credential harvesting but lacks context; it could be part of a legitimate operation such as file handling or testing.
Metadata: The maintainer has only one package, which might indicate a new or less active account.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 3.0

Found 2 network call pattern(s)

ia SSLContext. req = urllib.request.Request( # noqa: S310 — endpoint is caller-controlled, by d
lf._ssl_context with urllib.request.urlopen(req, **open_kwargs) as resp: # noqa: S310 — same ju

⚠ Code Obfuscation score 10.0

Found 5 obfuscation pattern(s)

not_valid_before( __import__("datetime").datetime.now(tz=__import__("datetime").UTC) )
_("datetime").datetime.now(tz=__import__("datetime").UTC) ) .not_valid_after( __impo
.not_valid_after( __import__("datetime").datetime.now(tz=__import__("datetime").UTC) + _
_("datetime").datetime.now(tz=__import__("datetime").UTC) + __import__("datetime").timedelta(days=1)
datetime").UTC) + __import__("datetime").timedelta(days=1) ) .sign(key, hashes.SHA25

⚠ Shell / Subprocess Execution score 2.0

Found 1 shell execution pattern(s)

} self._proc = subprocess.Popen( [ _DAEMON_BIN,

⚠ Credential Harvesting score 2.5

Found 1 credential access pattern(s)

, input='{"path":"/etc/hosts"}', output='{"bytes":42}', ) as

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository agent-receipts/ar appears legitimate

⚠ Maintainer History score 2.0

1 maintainer concern(s) found

Author "Otto Jongerius" appears to have only 1 package on PyPI (new or inactive account)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agent-receipts

Create a mini-app called 'ReceiptTracker' using the Python package 'agent-receipts'. This app will allow users to manage their receipts efficiently by uploading them, categorizing them, and tracking expenses over time. Here’s a detailed breakdown of what the app should include:

1. **User Authentication**: Implement a simple user authentication system where users can sign up, log in, and log out.
2. **Receipt Upload**: Allow users to upload images of their receipts. Use OCR technology to extract text from these images, which can then be processed by the 'agent-receipts' package to identify items and costs.
3. **Categorization**: Automatically categorize each item on the receipt into predefined categories like groceries, utilities, entertainment, etc., based on the extracted data. Users should also have the option to manually adjust these categories if necessary.
4. **Expense Tracking**: Track monthly and yearly expenses per category. Provide visual representations such as charts and graphs to help users understand their spending patterns.
5. **Budget Management**: Enable users to set budgets for different categories and receive alerts when they are close to exceeding these limits.
6. **Report Generation**: Generate comprehensive reports at the end of each month summarizing total expenses, highlighting areas of high spending, and offering suggestions for cost-saving.
7. **Integration with 'agent-receipts'**: Utilize the 'agent-receipts' package to handle the receipt processing logic, including parsing receipts, categorizing expenses, and managing receipt data securely.
8. **Security Measures**: Ensure all user data, including uploaded receipts and personal information, is stored securely and complies with GDPR standards.

The goal is to create a user-friendly interface where users can easily manage their financial records and gain insights into their spending habits.