avrotize

v3.5.11 suspicious
5.0
Medium Risk

Tools to convert from and to Avro Schema from various other schema languages.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits moderate risk due to obfuscation techniques and metadata concerns, though direct threats like shell execution or credential harvesting are not evident.

  • High obfuscation risk due to eval() and dynamic imports.
  • Suspicious metadata with non-HTTPS links and missing maintainer information.
Per-check LLM notes
  • Network: The network calls seem to be part of fetching resources or making API requests, which is common for many packages, but the exact purpose should be verified.
  • Shell: No shell execution patterns detected, indicating no immediate risk from this aspect.
  • Obfuscation: The use of eval() and dynamic import patterns suggest potential for code injection or hiding malicious functionality.
  • Credentials: No clear evidence of credential harvesting or secret handling is present.
  • Metadata: Suspicious non-HTTPS external link and lack of maintainer information suggest potential risks.

📦 Package Quality Overall: Low (3.8/10)

◈ Medium Test Suite 6.0

Partial test coverage signals detected

  • Test runner config found: pyproject.toml
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (95257 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 835 type-annotated function signatures detected in source
○ Low Multiple Contributors 1.0

Unable to verify contributor count: no GitHub repository found

  • No GitHub repository linked — contributor count unavailable

🔬 Heuristic Checks

⚠ Outbound Network Calls score 3.0

Found 2 network call pattern(s)

  • tps']: response = requests.get(url if isinstance( url, str) else parsed_url
  • tps']: response = requests.get(url, timeout=30) response.raise_for_status()
⚠ Code Obfuscation score 4.0

Found 2 obfuscation pattern(s)

  • s = { 'type': eval(arg['type']), 'help': arg['help'],
  • le and function.""" mod = __import__(module, fromlist=[func]) return getattr(mod, func) def main(): """Main func
✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: microsoft.com>

⚠ Suspicious Page Links score 2.0

Found 1 suspicious link(s) on the package page

  • Non-HTTPS external link: http://xregistry.io
✓ Git Repository History

No GitHub repository linked

  • No GitHub repository link found
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with avrotize 
Create a Python-based utility named 'SchemaTranslator' that leverages the 'avrotize' package to convert between Avro schemas and other schema formats such as JSON Schema and Protocol Buffers. The utility should allow users to input a schema in one format and output it in another. Here’s a detailed breakdown of the requirements:

1. **User Interface**: Design a simple command-line interface (CLI) that accepts user inputs for the source schema file path, the target schema format, and any necessary conversion options.
2. **Conversion Engine**: Implement the core functionality using the 'avrotize' package to perform the conversions. Ensure that the utility supports bidirectional conversions between Avro and both JSON Schema and Protocol Buffers.
3. **Error Handling**: Incorporate robust error handling to manage cases where the input schema is malformed or the specified conversion is not supported.
4. **Documentation**: Provide clear documentation on how to install and use the utility, including examples of valid input/output pairs.
5. **Testing**: Write unit tests to verify that the conversion functions work correctly under different scenarios, including edge cases.
6. **Optional Features**:
   - Support for additional schema formats like XML Schema if time permits.
   - Integration with a web service API that allows uploading/downloading schema files for conversion.
7. **Deployment**: Prepare a Dockerfile to containerize the application, making it easy to deploy and run in various environments.

By completing this project, you will gain experience working with schema conversion tools, handling complex data formats, and building practical command-line applications.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!