aulinx

v0.5.0 suspicious
6.0
Medium Risk

AI-native Linux — desktop to server. 187 tools, semantic compositor, three-tier architecture.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits several suspicious behaviors including high risks related to shell command usage and code obfuscation, along with network and metadata concerns. These factors collectively raise concerns about potential malicious intent.

  • High shell risk due to use of system modification commands
  • Significant obfuscation suggesting attempts to hide code functionality
Per-check LLM notes
  • Network: Network calls to external APIs may be legitimate if documented and used for intended functionality.
  • Shell: Use of shell commands like gsettings and xdg-open could indicate an attempt to modify system settings or open URLs, which might not be expected in a typical application unless explicitly stated in its purpose.
  • Obfuscation: The use of base64 decoding and obfuscated function names suggests potential for hiding malicious code.
  • Credentials: No clear patterns indicating credential harvesting were found.
  • Metadata: Suspicious non-HTTPS link and low maintainer activity suggest potential risk.

📦 Package Quality Overall: Low (4.6/10)

◈ Medium Test Suite 6.0

Partial test coverage signals detected

  • Test runner config found: pyproject.toml
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (13104 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 259 type-annotated function signatures detected in source
◈ Medium Multiple Contributors 5.0

Limited contributor diversity

  • 1 unique contributor(s) across 100 commits in aulinx/aulinx
  • Single author but highly active (100 commits)

🔬 Heuristic Checks

⚠ Outbound Network Calls score 7.5

Found 5 network call pattern(s)

  • x try: resp = httpx.get(f"{base_url}/api/tags", timeout=5) models = [m["nam
  • try: async with httpx.AsyncClient() as client: resp = await client.get(f"{self
  • try: async with httpx.AsyncClient() as client: resp = await client.post(
  • okens = 0 async with httpx.AsyncClient() as client: async with client.stream(
  • try: async with httpx.AsyncClient() as client: resp = await client.get(
⚠ Code Obfuscation score 10.0

Found 5 obfuscation pattern(s)

  • creenshot") png = base64.b64decode(r["data"]) if path: with open(pa
  • e.screenshot") png_data = base64.b64decode(result["data"]) with open(save_path, "wb") as f:
  • import base64 png_data = base64.b64decode(result["data"]) with open(save_path, "wb") as f:
  • rtable.""" try: __import__(module) table.add_row(label, "[green]OK[/green]", f"python
  • ut=30, env={**__import__("os").environ, "DEBIAN_FRONTEND": "noninteractive"},
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • wser try: subprocess.Popen( ["xdg-open", f"http://localhost:{self.port
  • Set the custom keybinding subprocess.run([ "gsettings", "set", schema, "custom-keybindings",
  • ], capture_output=True) subprocess.run([ "gsettings", "set", f"{custom_schema}:{path}", "na
  • ], capture_output=True) subprocess.run([ "gsettings", "set", f"{custom_schema}:{path}", "co
  • lace("shift+", "<Shift>") subprocess.run([ "gsettings", "set", f"{custom_schema}:{path}", "bi
  • layer.Play"] result = subprocess.run(cmd, capture_output=True, text=True, timeout=5) retu
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: 163.com>

⚠ Suspicious Page Links score 2.0

Found 1 suspicious link(s) on the package page

  • Non-HTTPS external link: http://host.docker.internal:11434
⚠ Git Repository History score 2.5

Git history flags: Repository has zero stars and zero forks

  • Repository has zero stars and zero forks
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with aulinx 
Your task is to develop a user-friendly, command-line interface (CLI) tool using the 'aulinx' Python package. This tool will serve as a personal productivity assistant, integrating AI-native functionalities and leveraging the semantic compositor of 'aulinx'. Your CLI tool should allow users to manage their daily tasks efficiently by providing a variety of features such as task creation, deletion, modification, and querying. Additionally, it should support categorization of tasks into different projects or categories, set reminders for upcoming deadlines, and provide suggestions based on past behavior and preferences.

Here are the specific requirements:
- Task Creation: Users should be able to create new tasks with titles, descriptions, due dates, and priority levels.
- Task Deletion: Allow users to delete tasks they no longer need.
- Task Modification: Enable users to update details of existing tasks.
- Task Querying: Implement search functionality to find tasks based on keywords, dates, or priorities.
- Categorization: Tasks should be categorized into different projects or categories for better organization.
- Reminders: Set up reminders for tasks that have upcoming deadlines.
- Suggestions: Use the AI-native capabilities of 'aulinx' to suggest tasks based on historical data and user preferences.

To achieve these goals, you will utilize 'aulinx' to integrate AI functionalities, manage the semantic composition of tasks, and handle the backend operations efficiently. The tool should be designed to be intuitive and easy to use, ensuring that users can quickly adapt to managing their tasks through the CLI interface.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!