🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows moderate risk due to network and shell execution vulnerabilities, despite having low risks in credential harvesting and obfuscation. The metadata quality is poor, raising concerns about the package's legitimacy.

High shell risk due to Popen usage
Poor metadata quality and lack of GitHub repository

Per-check LLM notes

Network: Network calls could be legitimate for API interactions but require scrutiny to ensure no unauthorized data transmission.
Shell: Executing scripts via Popen is high risk as it can lead to arbitrary code execution and potential system compromise.
Obfuscation: No obfuscation patterns detected, indicating low risk.
Credentials: No credential harvesting patterns detected, indicating low risk.
Metadata: High risk due to lack of GitHub repo, single release, new maintainer account, and low metadata quality.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 1.5

Found 1 network call pattern(s)

} try: async with httpx.AsyncClient(timeout=20) as client: if normalized_method == "

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 2.0

Found 1 shell execution pattern(s)

ed_env.update(env) return subprocess.Popen( [sys.executable, script], cwd=Path(__file__

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

⚠ Suspicious Page Links score 2.0

Found 1 suspicious link(s) on the package page

Non-HTTPS external link: http://custom-server:8000

✓ Git Repository History

No GitHub repository linked

No GitHub repository link found

⚠ Maintainer History score 8.0

4 maintainer concern(s) found

Only one version has ever been released — brand new package
Package uploaded less than 24 hours ago (2026-06-05T06:56:50.000Z)
Author "sinhpham" appears to have only 1 package on PyPI (new or inactive account)
Package has no PyPI classifiers (low effort / metadata quality)