AI Analysis
The package shows low risk in terms of network and shell activities, but the metadata analysis raises concerns due to low repository activity and lack of detailed information from the maintainer.
- Low repository activity
- New maintainer with insufficient details
Per-check LLM notes
- Network: No network calls detected, which is not necessarily suspicious unless the package's functionality requires it.
- Shell: No shell execution patterns detected, indicating that the package does not execute system commands without user interaction.
- Metadata: The repository's low activity, new maintainer, and lack of details raise concerns about potential malicious intent.
Package Quality Overall: Medium (5.8/10)
Test suite present — 1 test file(s) found
Test runner config found: pyproject.toml1 test file(s) detected (e.g. test_scanner.py)
Some documentation present
Detailed PyPI description (8192 chars)
No contributing guide or governance files found
Development Status classifier >= Beta
Partial type annotation coverage
26 type-annotated function signatures detected in source
Limited contributor diversity
2 unique contributor(s) across 2 commits in devxyasir/apikeyscannerTwo distinct contributors found
Heuristic Checks
No suspicious network call patterns found
No obfuscation patterns detected
No shell execution patterns detected
No credential harvesting patterns detected
No typosquatting candidates detected
Email domain looks legitimate: gmail.com>
All external links appear legitimate
Git history flags: Repository has zero stars and zero forks
Repository has zero stars and zero forksVery few commits: 2 total
3 maintainer concern(s) found
Only one version has ever been released — brand new packageAuthor name is missing or very shortAuthor "" appears to have only 1 package on PyPI (new or inactive account)
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Create a Python-based CLI tool named 'SecretGuard' that leverages the 'apikeyscanner' package to help developers and DevOps teams detect potential security leaks within their code repositories. SecretGuard should be able to scan files for common patterns of API keys, tokens, and other sensitive information. The tool should support scanning specific file types (e.g., .py, .json, .yaml), allowing users to specify directories or individual files as inputs. Additionally, SecretGuard should provide an option to exclude certain directories or files from the scan to prevent false positives. After scanning, the tool should output a report detailing any potential leaks found, including the file path and line number where the suspicious string was located. Users should also have the ability to customize the regex patterns used for detecting secrets. The application should be designed with modularity in mind, allowing for easy extension of supported file types and detection patterns.
💬 Discussion Feed
No discussion yet. Be the first to share your thoughts!
Report Abuse / Security Issue