AI Analysis
Final verdict: SUSPICIOUS
The package shows high credential risk and significant obfuscation, raising concerns about its true intentions. The lack of maintainer metadata and low repository engagement further add to the suspicion.
- High credential risk due to checks for sensitive filenames
- Significant obfuscation techniques observed
Per-check LLM notes
- Network: No network calls detected, which is normal unless the package requires external services.
- Shell: No shell execution patterns detected, indicating no direct system command invocations.
- Obfuscation: The observed base64 decoding and bitwise operation on the last byte of the decoded payload suggests an attempt to obfuscate the underlying logic, which could be indicative of malicious activity.
- Credentials: The assertion checks for filenames that are commonly used to access sensitive system files like /etc/passwd, indicating potential intent to harvest credentials or other sensitive information.
- Metadata: The maintainer's author name is missing, and the repository lacks engagement, suggesting potential risk.
Heuristic Checks
Outbound Network Calls
No suspicious network call patterns found
Code Obfuscation
score 4.0
Found 2 obfuscation pattern(s)
key: bytes) -> str: raw = base64.b64decode(payload) if len(raw) < 1 + 32 + 32: raise ValueEn_key=ck) raw = bytearray(base64.b64decode(payload)) raw[-1] ^= 0x01 # flip a MAC bit bad = ba
Shell / Subprocess Execution
No shell execution patterns detected
Credential Harvesting
score 2.5
Found 1 credential access pattern(s)
assert sanitize_filename("../etc/passwd") is None assert sanitize_filename("/abs/path") is None
Typosquatting
No typosquatting candidates detected
Registered Email Domain
Email domain looks legitimate: slingshot.xyz>
Suspicious Page Links
All external links appear legitimate
Git Repository History
score 2.5
Git history flags: Repository has zero stars and zero forks
Repository has zero stars and zero forks
Maintainer History
score 4.0
2 maintainer concern(s) found
Author name is missing or very shortAuthor "" appears to have only 1 package on PyPI (new or inactive account)
Known CVE Vulnerabilities
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Use this prompt to build a project with agent-wormhole
Build a simple Python application using the agent-wormhole package to demonstrate its core features.