AI Analysis
Final verdict: SUSPICIOUS
The package shows some level of obfuscation through the use of dynamic imports and version fetching, raising concerns about its true purpose. Additionally, the minimal history and single version release suggest caution.
- moderate obfuscation risk
- minimal package history
Per-check LLM notes
- Network: No network calls detected, which is normal if the package does not require internet access.
- Shell: No shell execution patterns detected, indicating no immediate signs of executing system commands.
- Obfuscation: The use of __import__ and dynamic version fetching suggests some level of obfuscation, but it's not clear if this is intended to hide malicious code or simply to implement a non-standard import mechanism.
- Credentials: No clear patterns indicative of credential harvesting were found in the provided snippet.
- Metadata: The package is newly created with minimal history and only one version released, raising concerns about potential malicious intent.
Heuristic Checks
Outbound Network Calls
No suspicious network call patterns found
Code Obfuscation
score 2.0
Found 1 obfuscation pattern(s)
n-openapi-prod-sdk" VERSION = __import__(PACKAGE).__version__ REQUIRES = [ "antchain_alipay_util>=1.0.1,
Shell / Subprocess Execution
No shell execution patterns detected
Credential Harvesting
No credential harvesting patterns detected
Typosquatting
No typosquatting candidates detected
Registered Email Domain
Email domain looks legitimate: alibabacloud.com
Suspicious Page Links
score 2.0
Found 1 suspicious link(s) on the package page
Non-HTTPS external link: http://www.apache.org/licenses/LICENSE-2.0
Git Repository History
Repository alipay/antchain-openapi-prod-sdk appears legitimate
Maintainer History
score 6.0
3 maintainer concern(s) found
Only one version has ever been released — brand new packagePackage uploaded less than 24 hours ago (2026-06-05T02:06:26.000Z)Author "Ant Chain SDK" appears to have only 1 package on PyPI (new or inactive account)