asyncssh

v2.23.1 suspicious
5.0
Medium Risk

AsyncSSH: Asynchronous SSHv2 client and server library

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows medium suspicion due to high risks in shell execution and obfuscation, with minimal risk in network calls, credentials, and metadata. The combination of these factors does not conclusively indicate a supply-chain attack but warrants further investigation.

  • High shell risk
  • High obfuscation risk
  • Sparse author information
Per-check LLM notes
  • Network: No network calls detected.
  • Shell: Detection of shell execution suggests potential risk as it can be used to execute arbitrary commands.
  • Obfuscation: The byte sequences resemble encoded or encrypted data, potentially indicating obfuscation to hide code logic or sensitive information.
  • Credentials: No clear patterns indicative of credential harvesting were detected.
  • Metadata: The author's information is sparse and the use of non-HTTPS links is concerning, but no other significant red flags are present.

📦 Package Quality Overall: Medium (5.8/10)

○ Low Test Suite 1.0

No test suite detected

  • No test files or test-runner configuration detected
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://asyncssh.readthedocs.io
  • Detailed PyPI description (7806 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 7.0

Partial type annotation coverage

  • Type checker (mypy / pyright / pytype) referenced in project
  • 1029 type-annotated function signatures detected in source
✦ High Multiple Contributors 10.0

Active multi-contributor project

  • 9 unique contributor(s) across 100 commits in ronf/asyncssh
  • Active community — 5 or more distinct contributors

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

⚠ Code Obfuscation score 6.0

Found 3 obfuscation pattern(s)

  • 85984, b'\x04\x00\xc6\x85\x8e\x06\xb7\x04\x04\xe9\xcd\x9e>\xcbf#\x95\xb4B\x9cd\x819\x05?\xb5!\xf8(\xaf`kM=\xba\xa1K^w
  • 4y\xbef~\xf9\xdc\xbb\xacU\xa0b\x95\xce\x87\x0b\x07\x02\x9b\xfc\xdb-\xce(\xd9Y\xf2\x81[\x16\xf8\x17\x98H:\xdaw&\xa3\xc4e]\xa4\x
  • \xf8\x17\x98H:\xdaw&\xa3\xc4e]\xa4\xfb\xfc\x0e\x11\x08\xa8\xfd\x17\xb4H\xa6\x85T\x19\x9cG\xd0\x8f\xfb\x10\xd4\xb8',
⚠ Shell / Subprocess Execution score 4.0

Found 2 shell execution pattern(s)

  • it status is 0""" return subprocess.run(cmd, check=False, shell=True, stdin=DEVNULL,
  • process.run(cmd, check=False, shell=True, stdin=DEVNULL, stdout=DEVNULL, s
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: timeheart.net>

⚠ Suspicious Page Links score 10.0

Found 6 suspicious link(s) on the package page

  • Non-HTTPS external link: http://www.eclipse.org/legal/epl-2.0/
  • Non-HTTPS external link: http://www.lysator.liu.se/~nisse/nettle/
  • Non-HTTPS external link: http://groups.google.com/d/forum/asyncssh-announce
  • Non-HTTPS external link: http://groups.google.com/d/forum/asyncssh-dev
  • Non-HTTPS external link: http://groups.google.com/d/forum/asyncssh-users
  • Non-HTTPS external link: http://asyncssh.timeheart.net
✓ Git Repository History

Repository ronf/asyncssh appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with asyncssh 
Create a versatile SSH terminal emulator using Python's AsyncSSH library. This application will allow users to connect to remote servers via SSH and execute commands on them. The goal is to create a user-friendly interface where users can input their SSH credentials (host, username, password), select a command to run, and view the output of that command. Additionally, the application should support multiple simultaneous connections and provide basic logging functionality for auditing purposes.

Key Features:
- User Interface: Develop a simple text-based or GUI interface allowing users to input SSH credentials and commands.
- Command Execution: Implement the ability to send and receive commands from the remote server, displaying the results back to the user.
- Multiple Sessions: Allow users to manage and switch between multiple active SSH sessions.
- Logging: Create a feature that logs all interactions (commands sent and received) for each session.
- Error Handling: Implement robust error handling to gracefully manage connection issues, authentication failures, and other common errors.

How AsyncSSH is Utilized:
- Use AsyncSSH's client API to establish secure SSH connections to remote servers.
- Leverage the library's asynchronous capabilities to handle multiple connections concurrently.
- Employ AsyncSSH's methods for executing commands on the remote server and retrieving their outputs.
- Integrate AsyncSSH's logging mechanisms to capture all relevant data for auditing purposes.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!