async-substrate-interface

v2.1.0 suspicious
5.0
Medium Risk

Asyncio library for interacting with substrate. Mostly API-compatible with py-substrate-interface

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows signs of potential code obfuscation and unusual coding practices, raising concerns about its intentions. However, there's no concrete evidence of malicious activity.

  • High obfuscation risk due to use of random seeding and byte manipulation
  • Maintainer has only one package, indicating possible lack of community or history
Per-check LLM notes
  • Network: No network calls detected, which is normal if the package does not require external API interactions.
  • Shell: No shell execution patterns detected, indicating no immediate risk of command execution.
  • Obfuscation: The use of random seeding and byte manipulation with pickle.loads() suggests potential for code obfuscation or hiding functionality, which could be used maliciously.
  • Credentials: No direct evidence of credential harvesting is present, but the unusual code patterns may warrant further investigation.
  • Metadata: The maintainer has only one package, suggesting a new or less active account which may warrant further investigation.

📦 Package Quality Overall: Medium (6.2/10)

◈ Medium Test Suite 6.0

Partial test coverage signals detected

  • Test runner config found: pyproject.toml
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (6679 chars)
◈ Medium Contributing Guide 7.0

Some contribution signals present

  • Separate author ("Opentensor Foundation") and maintainer ("Latent Holdings") listed
  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 161 type-annotated function signatures detected in source
✦ High Multiple Contributors 8.0

Active multi-contributor project

  • 4 unique contributor(s) across 100 commits in opentensor/async-substrate-interface
  • Small but multi-author team (3–4 contributors)

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

⚠ Code Obfuscation score 4.0

Found 2 obfuscation pattern(s)

  • y payloads _rng = __import__("random") _rng.seed(42) _bare_bytes = [
  • es everything else. Why: pickle.loads() on disk-backed data is an arbitrary-code-execution vec
✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: latent.to>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository opentensor/async-substrate-interface appears legitimate

⚠ Maintainer History score 2.0

1 maintainer concern(s) found

  • Author "Opentensor Foundation" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with async-substrate-interface 
Create a decentralized finance (DeFi) portfolio tracker using the 'async-substrate-interface' Python package. This application will allow users to monitor their assets across various Substrate-based blockchain networks. The app should support real-time asset value tracking, balance checking, and transaction history retrieval for any wallet address provided by the user.

**Features to Include:**
1. **User Authentication:** Implement a simple login system where users can create accounts or log in using email/password. Store credentials securely.
2. **Wallet Address Input:** Users should be able to input one or multiple wallet addresses associated with different Substrate-based blockchains.
3. **Real-Time Asset Tracking:** Fetch and display the current value of assets held in each wallet address from the connected blockchain(s). Use the 'async-substrate-interface' package to interact with the blockchain APIs.
4. **Balance Checking:** Provide a feature to check the balance of all supported tokens/coins within the specified wallet addresses.
5. **Transaction History:** Allow users to view recent transactions made from/to their wallet addresses. Display relevant details like timestamp, amount, recipient/sender, etc.
6. **Notifications:** Implement push notifications or alerts when significant changes occur in the value of assets (e.g., price drop by more than 5%).
7. **Graphical Representation:** Offer visual graphs to show the performance of each asset over time.
8. **API Documentation:** Create comprehensive documentation for the API endpoints used within the application.

**Utilizing 'async-substrate-interface':**
- Use the package's asynchronous capabilities to efficiently fetch data from the blockchain without blocking the main thread.
- Leverage its compatibility with 'py-substrate-interface' to ensure seamless integration with existing Substrate-based projects.
- Explore advanced functionalities such as querying specific blocks, decoding extrinsics, and handling custom types if necessary.

This project aims to showcase the versatility and power of 'async-substrate-interface' while providing practical utility for DeFi enthusiasts.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!