🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows some unusual characteristics that warrant further investigation, particularly the use of shell commands for version control and the lack of detailed author information.

Shell risk due to git commands
Metadata risk due to newness and sparse author details

Per-check LLM notes

Network: No network calls detected.
Shell: Git commands suggest version control operations which may be part of development practices but could potentially be misused.
Obfuscation: No obfuscation patterns detected, indicating low risk.
Credentials: No credential harvesting patterns detected, indicating low risk.
Metadata: The repository and package are very new, the maintainer has limited history, and author details are sparse, indicating potential risks.

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 8.0

Found 4 shell execution pattern(s)

al[str]: try: r = subprocess.run( ["git", *args], capture_output=True
""" try: r = subprocess.run( ["git", "status", "--porcelain"], c
sistent. """ result = subprocess.run( ["git", "status", "--porcelain"], capture_o
it_paths = set() result = subprocess.run(["git", "status", "--porcelain"], capture_output=True, text=

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 2.5

Git history flags: Repository created very recently: 5 day(s) ago (2026-05-31T11:37:57Z)

Repository created very recently: 5 day(s) ago (2026-05-31T11:37:57Z)

⚠ Maintainer History score 8.0

4 maintainer concern(s) found

Only one version has ever been released — brand new package
Package uploaded less than 24 hours ago (2026-06-05T04:49:35.000Z)
Author name is missing or very short
Author "" appears to have only 1 package on PyPI (new or inactive account)