AI Analysis
Final verdict: SUSPICIOUS
The package exhibits potential misuse of shell execution and has low maintainer activity, which raises some concerns about its legitimacy and maintenance.
- Shell risk due to potential unintended shell executions
- Low maintainer activity and poor metadata quality
Per-check LLM notes
- Network: No network calls detected, indicating no immediate risk from network activities.
- Shell: Shell execution is present but seems to be used for running commands within the package's environment, which could be legitimate but requires further review to ensure it does not lead to unintended shell executions.
- Obfuscation: No obfuscation patterns detected, indicating low risk.
- Credentials: No credential harvesting patterns detected, indicating low risk.
- Metadata: The package shows signs of low maintainer activity and poor metadata quality, raising suspicion but not definitive evidence of malice.
Package Quality Overall: Medium (5.2/10)
✦ High
Test Suite
9.0
Test suite present — 6 test file(s) found
6 test file(s) detected (e.g. test_algo_modules.py)
◈ Medium
Documentation
5.0
Some documentation present
Detailed PyPI description (2973 chars)
○ Low
Contributing Guide
2.0
No contributing guide or governance files found
No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium
Type Annotations
5.0
Partial type annotation coverage
108 type-annotated function signatures detected in source
◈ Medium
Multiple Contributors
5.0
Limited contributor diversity
1 unique contributor(s) across 52 commits in ranaumarnadeem/autoMBISTSingle author but highly active (52 commits)
Heuristic Checks
Outbound Network Calls
No suspicious network call patterns found
Code Obfuscation
No obfuscation patterns detected
Shell / Subprocess Execution
score 6.0
Found 3 shell execution pattern(s)
print("$", " ".join(cmd)) subprocess.run(cmd, cwd=str(cwd), env=env, check=True) def run_cmd_with_rolve().parents[2] return subprocess.run( cmd, cwd=repo_root, text=True,) completed = subprocess.run( command, cwd=project_root, env=o
Credential Harvesting
No credential harvesting patterns detected
Typosquatting
No typosquatting candidates detected
Registered Email Domain
No author email provided
Suspicious Page Links
All external links appear legitimate
Git Repository History
score 2.5
Git history flags: Repository has zero stars and zero forks
Repository has zero stars and zero forks
Maintainer History
score 6.0
3 maintainer concern(s) found
Author name is missing or very shortAuthor "" appears to have only 1 package on PyPI (new or inactive account)Package has no PyPI classifiers (low effort / metadata quality)
Known CVE Vulnerabilities
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Use this prompt to build a project with autombist
Build a simple Python application using the autombist package to demonstrate its core features.
💬 Discussion Feed
No discussion yet. Be the first to share your thoughts!
Report Abuse / Security Issue