aplanesdk

v0.20.0 suspicious
6.0
Medium Risk

Python SDK for APlane transaction signing

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits significant risks related to network interaction and obfuscation techniques, suggesting potential malicious intent or hidden functionality.

  • High network risk due to external service interaction
  • Significant obfuscation indicating possible concealment of code logic
Per-check LLM notes
  • Network: The use of an Authorization header suggests the package interacts with an external service, which could be legitimate but requires verification of its purpose and destination.
  • Shell: No direct shell execution patterns were detected, but the presence of SSH client initialization indicates potential remote command execution capabilities that should be reviewed.
  • Obfuscation: The observed patterns suggest intentional obfuscation of data, possibly to hide functionality or code logic.
  • Credentials: No clear evidence of credential harvesting is present.
  • Metadata: Suspicious activity around the git repository and maintainer history suggests potential risk.

📦 Package Quality Overall: Medium (5.4/10)

✦ High Test Suite 9.0

Test suite present — 4 test file(s) found

  • 4 test file(s) detected (e.g. test_algokit.py)
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://github.com/aplane-algo/aplanesdk/tree/main/python
  • Detailed PyPI description (16284 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 53 type-annotated function signatures detected in source
○ Low Multiple Contributors 2.0

Single-author or unverifiable project

  • 1 unique contributor(s) across 3 commits in aplane-algo/aplanesdk
  • Single author with few commits — possibly a personal or throwaway project

🔬 Heuristic Checks

⚠ Outbound Network Calls score 4.5

Found 3 network call pattern(s)

  • e None self.session = requests.Session() self.session.headers["Authorization"] = f"aplane {
  • ation (TOFU) client = paramiko.SSHClient() # Load existing known hosts if available
  • h/known_hosts") client = paramiko.SSHClient() # Load known hosts if file exists if os.path.exis
⚠ Code Obfuscation score 10.0

Found 5 obfuscation pattern(s)

  • (txn) txn_bytes = b"TX" + base64.b64decode(msgpack_b64) return txn_bytes.hex(), txn.sender def _
  • signed_hex = base64.b64decode(passthrough[i], validate=True).hex() except
  • all_bytes = b"".join(base64.b64decode(s) for s in signed_list) return base64.b64encode(all
  • 0]) all_bytes = b"".join(base64.b64decode(s) for s in merged) return base64.b64encode(all_bytes).d
  • e_mock_txn()) assert base64.b64decode(signed) == bytes.fromhex("deadbeef") def test_timeout(s
✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 7.5

Git history flags: Repository has zero stars and zero forks

  • Repository has zero stars and zero forks
  • Single contributor with only 3 commit(s) — possibly throwaway account
  • All 3 commits happened within 24 hours
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Author "APlane Project LLC" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with aplanesdk 
Develop a mini-application called 'APlaneWallet' that leverages the 'aplanesdk' Python package to facilitate secure transactions within the APlane ecosystem. This application will serve as a user-friendly interface for managing digital assets and performing transactions with enhanced security measures. Here’s a step-by-step guide on what your application should include and how it should work:

1. **User Authentication**: Implement a simple login system where users can create an account or log in using their existing credentials. Utilize the 'aplanesdk' package to securely sign up and authenticate users.
2. **Digital Wallet Management**: Users should be able to view and manage their digital wallets, including viewing balances, adding funds, and withdrawing funds. Use 'aplanesdk' to handle the signing of transactions related to these actions.
3. **Transaction History**: Provide a feature that displays the history of all transactions made by the user. Each transaction should include details like the amount, recipient, and timestamp. 'aplanesdk' should be used to verify and display these transactions securely.
4. **Send Funds Feature**: Allow users to send funds to other accounts within the APlane ecosystem. Ensure that each transaction is signed securely using the 'aplanesdk' package before it is processed.
5. **Security Enhancements**: Integrate two-factor authentication (2FA) for added security when performing sensitive operations such as sending funds or withdrawing money. Use 'aplanesdk' to enhance the security protocols during these actions.
6. **Notifications**: Implement real-time notifications for successful transactions and any other important updates related to the user's account. While not directly tied to 'aplanesdk', ensure that these notifications are triggered only after the transaction has been successfully signed and verified through the SDK.
7. **Backup and Restore Functionality**: Enable users to back up their wallet data and restore it if needed. This backup process should involve securely signing the backup file using 'aplanesdk'.

Your task is to design and implement this application from scratch, focusing on usability, security, and integration with the 'aplanesdk' package. Document your implementation process, highlighting how 'aplanesdk' is utilized at various stages to ensure the security and integrity of transactions.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!