atbash-sdk

v0.1.2 suspicious
4.0
Medium Risk

Atbash SDK — agent safety / judge HTTP client + Rust core (secp256k1 signing, GTV/GTX, redaction, memory diff).

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package has minimal risks in terms of network, shell, and obfuscation activities but raises concerns due to missing repository and inactive maintainer.

  • Metadata risk is high with missing repository and inactive maintainer
  • No significant direct security threats detected
Per-check LLM notes
  • Network: No network calls detected, which is normal if the package does not require external communication.
  • Shell: No shell execution patterns detected, indicating no immediate signs of executing system commands.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The repository is not found, the maintainer seems new and inactive, raising concerns.

📦 Package Quality Overall: Low (3.2/10)

○ Low Test Suite 1.0

No test suite detected

  • No test files or test-runner configuration detected
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (16795 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • Classifier: Typing :: Typed
○ Low Multiple Contributors 1.0

Could not retrieve contributor data from GitHub

  • GitHub API error: 404

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

✓ Code Obfuscation

No obfuscation patterns detected

✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: chromaway.com>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 3.0

Repository not found (deleted or private)

  • Repository not found (deleted or private)
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Author "Atbash" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with atbash-sdk 
Develop a secure financial transaction app using the Atbash SDK in Python. This application will simulate the process of securely sending and receiving payments, focusing on the security aspects provided by the Atbash SDK. The app should include the following features:

1. User Registration: Users should be able to register with a unique username and password. Passwords must be hashed and stored securely.
2. Transaction Creation: Users can create transactions specifying the recipient, amount, and optional message. Each transaction must be signed using the secp256k1 algorithm from the Atbash SDK's Rust core.
3. Transaction Verification: Implement a feature where transactions can be verified by checking the signature against the sender's public key. Utilize the Atbash SDK for this verification process.
4. Secure Communication: All communication between the server and clients should be done over HTTPS, utilizing the judge HTTP client functionality from the Atbash SDK.
5. Data Redaction: To ensure sensitive data is not leaked, implement data redaction capabilities for logs and other outputs using the redaction feature from the Atbash SDK.
6. Memory Safety: Use the memory diff feature from the Atbash SDK to monitor for any potential memory leaks or unsafe memory access patterns during runtime.
7. Transaction History: Provide users with a history of their transactions, ensuring that personal information is handled securely according to the GTV/GTX functionalities within the Atbash SDK.
8. Account Balance Update: After a transaction is successfully processed, the sender’s account balance should decrease and the recipient’s account balance should increase accordingly.

The Atbash SDK will be central to ensuring the security and integrity of the transactions, from signing and verifying signatures to securing communications and managing sensitive data. Your task is to design and implement this application, paying special attention to how each of these features integrates with the Atbash SDK to enhance security.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!