AI Analysis
The package exhibits high obfuscation risk due to the use of eval() with untrusted input, which can lead to code injection attacks. Additionally, the metadata risk is moderate due to non-HTTPS links and a single-package author, raising concerns about the authenticity and trustworthiness of the package.
- High obfuscation risk due to eval() usage.
- Moderate metadata risk due to non-HTTPS links and single-package author.
Per-check LLM notes
- Network: The use of requests.Session() indicates the package makes network calls, which could be for legitimate purposes like API interactions.
- Shell: No shell execution patterns were detected, suggesting no immediate risk from command execution.
- Obfuscation: The use of eval() with untrusted input is highly suspicious and poses significant security risks.
- Credentials: No clear evidence of credential harvesting patterns detected.
- Metadata: Suspicious non-HTTPS links and an author with only one package suggest potential risk.
Package Quality Overall: Low (3.8/10)
Partial test coverage signals detected
2 test file(s) detected (e.g. Tools.py)
Some documentation present
Detailed PyPI description (17269 chars)
No contributing guide or governance files found
No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
Partial type annotation coverage
3 type-annotated function signatures (partial)
Unable to verify contributor count: no GitHub repository found
No GitHub repository linked — contributor count unavailable
Heuristic Checks
Found 1 network call pattern(s)
elf): self.session = requests.Session() def __run_script(self, data): # 执行前后置脚本，可以
Found 2 obfuscation pattern(s)
func_args = eval(f"[{func_args_str}]") except Exception as e:try: return eval(data_str) except (SyntaxError, NameError, TypeError
No shell execution patterns detected
No credential harvesting patterns detected
No typosquatting candidates detected
Email domain looks legitimate: xiaoh.com
Found 2 suspicious link(s) on the package page
Non-HTTPS external link: http://121.43.169.97:8081Non-HTTPS external link: http://...
No GitHub repository linked
No GitHub repository link found
1 maintainer concern(s) found
Author "Shawn" appears to have only 1 package on PyPI (new or inactive account)
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Build a simple Python application using the api-engine-xin package to demonstrate its core features.