astrapi-core

v26.6.1 suspicious
6.0
Medium Risk

(No description)

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits behaviors that could be legitimate but also raise concerns, particularly the shell risk and obfuscation techniques used.

  • High shell risk due to command execution capabilities
  • Unconventional coding practices suggesting potential obfuscation
Per-check LLM notes
  • Network: The network calls seem to be part of package version checking or similar functionality, which is not inherently suspicious.
  • Shell: Executing commands like ssh-keygen can indicate legitimate key management activities but also raises concerns about unauthorized system modifications or access control bypasses.
  • Obfuscation: The code uses unconventional syntax to return a JSON response, which could be an attempt at obfuscation but may also serve legitimate purposes like avoiding simple static analysis.
  • Credentials: No clear signs of credential harvesting detected.
  • Metadata: The package shows low effort in metadata and maintainer history, raising some suspicion but not conclusive evidence of malice.

📦 Package Quality Overall: Low (3.0/10)

◈ Medium Test Suite 6.0

Partial test coverage signals detected

  • Test runner config found: pyproject.toml
○ Low Documentation 1.0

No documentation detected

  • No documentation URL, doc files, or meaningful description found
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 304 type-annotated function signatures detected in source
○ Low Multiple Contributors 1.0

Unable to verify contributor count: no GitHub repository found

  • No GitHub repository linked — contributor count unavailable

🔬 Heuristic Checks

⚠ Outbound Network Calls score 7.5

Found 5 network call pattern(s)

  • try: req = urllib.request.Request( url = endpoint,
  • ) with urllib.request.urlopen(req, timeout=10, context=ssl_ctx) as resp:
  • p('/')}/{package}/" req = urllib.request.Request(pkg_url) _upd_log.debug("updater: GET %s", pkg_u
  • g_url) try: with urllib.request.urlopen(req, timeout=15) as resp: html = resp.re
  • else: with smtplib.SMTP(self.smtp_host, self.smtp_port, timeout=15) as s:
⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

  • eturn JSONResponse({"widths": __import__("json").loads(settings_get(key, "{}"))}) """ core/ui/controls.py
⚠ Shell / Subprocess Execution score 10.0

Found 5 shell execution pattern(s)

  • "id_ed25519" try: subprocess.run( ["ssh-keygen", "-t", "ed25519", "-N", "", "-f",
  • -> str: try: r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
  • md] try: result = subprocess.run( final_cmd, check=True, env=env, std
  • md] try: result = subprocess.run( final_cmd, check=True, stdout=subpr
  • nt = 5) -> bool: result = subprocess.run( ["ssh", "-o", "BatchMode=yes", "-
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

No GitHub repository linked

  • No GitHub repository link found
⚠ Maintainer History score 6.0

3 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
  • Package has no PyPI classifiers (low effort / metadata quality)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with astrapi-core 
Create a weather forecasting mini-app using the Python package 'astrapi-core'. This app will allow users to input their location and receive a forecast of weather conditions for the next 7 days. Here's a step-by-step guide on how to develop this application:

1. **Setup Project Environment**: Start by setting up your development environment. Ensure you have Python installed along with pip for package management. Install 'astrapi-core' via pip.

2. **Understanding astrapi-core**: Research the capabilities of 'astrapi-core', focusing on its core functionalities that could be relevant for fetching and processing data related to weather forecasting. Note down any API endpoints, methods, or classes that could be useful.

3. **Designing the Application**: Design the structure of your application. Consider dividing it into modules such as data retrieval, data processing, and user interface. Decide on a suitable framework for building the UI, such as Flask or Django for web-based applications, or Tkinter for desktop applications.

4. **Data Retrieval Module**: Utilize 'astrapi-core' to retrieve weather data. Write functions that call the appropriate methods from 'astrapi-core' to fetch current and forecasted weather conditions based on user input (location).

5. **Data Processing Module**: Develop algorithms or use built-in functions from 'astrapi-core' to process the raw data into meaningful insights. This could include calculating average temperatures, identifying trends, or predicting specific weather events like rain or snow.

6. **User Interface Module**: Build a simple yet effective user interface where users can enter their location and view the weather forecast. The interface should display key information such as temperature, humidity, wind speed, and weather conditions for each day.

7. **Testing and Debugging**: Thoroughly test your application to ensure all modules work seamlessly together. Pay special attention to error handling, especially when dealing with network requests or invalid user inputs.

8. **Deployment**: Once testing is complete, prepare your application for deployment. If deploying a web app, consider hosting options like Heroku or AWS. For desktop apps, create installers or executable files.

Suggested Features:
- User-friendly interface for easy location input and data viewing.
- Interactive charts or graphs to visually represent weather trends.
- Notifications or alerts for significant changes in weather conditions.
- A feature to save and compare multiple locations' forecasts.
- An offline mode that displays previously fetched data if no internet connection is available.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!