anemoi-utils

v0.5.4 suspicious
6.0
Medium Risk

A package to hold various functions to support training of ML models on ECMWF data.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits multiple signs of potential risk, including the use of subprocess calls, base64 decoding, and handling of AWS credentials. While there is no definitive evidence of malicious intent, the combination of these factors warrants further scrutiny.

  • High shell risk due to subprocess usage
  • Potential obfuscation techniques employed
Per-check LLM notes
  • Network: The network calls appear to be fetching data from a legitimate source, suggesting normal package functionality.
  • Shell: The use of subprocess.Popen and subprocess.check_call indicates potential execution of external commands, which could be risky if not properly sanitized or controlled.
  • Obfuscation: The use of base64 decoding and dynamic imports suggests potential obfuscation or evasion techniques.
  • Credentials: The mention of AWS credentials and endpoint_url indicates that sensitive information handling is involved, which may pose a risk.
  • Metadata: The maintainer's author information is incomplete, suggesting a potential lack of transparency or a newly created account.

📦 Package Quality Overall: Medium (7.0/10)

✦ High Test Suite 9.0

Test suite present — 17 test file(s) found

  • Test runner config found: pyproject.toml
  • 17 test file(s) detected (e.g. __init__.py)
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://anemoi-utils.readthedocs.io/
  • 1 documentation file(s) (e.g. conf.py)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 356 type-annotated function signatures detected in source
✦ High Multiple Contributors 10.0

Active multi-contributor project

  • 21 unique contributor(s) across 100 commits in ecmwf/anemoi-utils
  • Active community — 5 or more distinct contributors

🔬 Heuristic Checks

⚠ Outbound Network Calls score 6.0

Found 4 network call pattern(s)

  • their names. """ r = requests.get("https://codes.ecmwf.int/parameter-database/api/v1/unit/")
  • eter details. """ r = requests.get( f"https://codes.ecmwf.int/parameter-database/api/v1
  • ame = re.escape(name) r = requests.get("https://codes.ecmwf.int/parameter-database/api/v1/origin/")
  • from %s", url) response = requests.get(url) response.raise_for_status() return response.con
⚠ Code Obfuscation score 10.0

Found 5 obfuscation pattern(s)

  • yload) % 4) decoded = base64.b64decode(padded).decode("utf-8") data = json.loads(decoded)
  • mes: try: __import__(name) except ImportError: return False re
  • mes: try: __import__(name) except ImportError: missing.append(name
  • , ".") COMMANDS = getattr(__import__(f"{package}.commands", fromlist=["COMMANDS"]), "COMMANDS") version = getattr(__import__(f"{package}._
  • MANDS") version = getattr(__import__(f"{package}._version", fromlist=["__version__"]), "__version__", "0.1.0") from anemoi.utils.cli import
⚠ Shell / Subprocess Execution score 4.0

Found 2 shell execution pattern(s)

  • ta, f, **kwargs) subprocess.check_call([cmd, *EDITOR_OPTIONS.get(cmd, []), path]) if n
  • exit code. """ proc = subprocess.Popen( args, stdout=subprocess.PIPE, stder
⚠ Credential Harvesting score 2.5

Found 1 credential access pattern(s)

  • variables or by creating a `~/.aws/credentials` file. It is also possible to set the `endpoint_url` in the
✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: ecmwf.int>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository ecmwf/anemoi-utils appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with anemoi-utils 
Create a weather prediction mini-application using the 'anemoi-utils' Python package. This application will leverage machine learning models trained on European Centre for Medium-Range Weather Forecasts (ECMWF) data to predict short-term weather conditions. Here’s a detailed plan for building this application:

1. **Setup Environment**: Start by setting up your Python environment. Ensure you have installed 'anemoi-utils', as well as other necessary libraries such as numpy, pandas, matplotlib, and scikit-learn.

2. **Data Acquisition**: Use 'anemoi-utils' to fetch preprocessed ECMWF data relevant for weather predictions. This might include temperature, humidity, wind speed, and precipitation levels.

3. **Data Preprocessing**: Apply transformations and preprocessing steps to the fetched data using functions provided by 'anemoi-utils'. This could involve normalization, feature scaling, and handling missing values.

4. **Model Training**: Train a machine learning model using the preprocessed data. 'anemoi-utils' offers utilities specifically designed for training models on ECMWF datasets, which you should utilize here.

5. **Prediction Module**: Implement a module within your application that allows users to input specific geographical coordinates and dates. Based on these inputs, the application should predict the weather conditions for the specified location and time period.

6. **Visualization**: Integrate visualization tools to display the predicted weather conditions graphically. Use matplotlib to plot graphs showing trends in temperature, humidity, etc., over time.

7. **User Interface**: Develop a simple command-line interface (CLI) for interacting with the application. Users should be able to easily input their queries and view the results.

8. **Documentation**: Write comprehensive documentation detailing how to install and use the application, including explanations of each step from data acquisition to prediction.

The goal of this project is not only to create a functional application but also to showcase the capabilities of 'anemoi-utils' in facilitating the process of working with complex weather data through machine learning.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!