AI Analysis
Final verdict: SUSPICIOUS
The package shows signs of obfuscation and has limited maintainer history, raising concerns about its legitimacy and potential risks.
- High obfuscation risk
- Limited maintainer history
Per-check LLM notes
- Network: The detected network call patterns are likely for testing purposes and do not necessarily indicate malicious intent.
- Shell: The presence of shell execution patterns could be for legitimate functionality like CLI commands or hardware checks, but requires further investigation to ensure there is no unauthorized access or command execution.
- Obfuscation: The use of __import__ with fromlist suggests an attempt to obscure the direct import statements, which could indicate an effort to evade detection or analysis.
- Credentials: No clear patterns indicative of credential harvesting were detected in the provided code snippet.
- Metadata: The package is very new with limited maintainer history and no linked GitHub repository, raising concerns about its legitimacy.
Heuristic Checks
Outbound Network Calls
score 1.5
Found 1 network call pattern(s)
r") monkeypatch.setattr("urllib.request.urlopen", forbidden_network, raising=False) monkeypatch.
Code Obfuscation
score 4.0
Found 2 obfuscation pattern(s)
ny: try: tunnel = __import__("cydeai.tunnel", fromlist=["connect_worker", "connect", "TunnelConfig"]) except ImportError as exc: raise ImportError("tne: try: module = __import__(module_name, fromlist=list(names)) except ImportError: return None for name i
Shell / Subprocess Execution
score 8.0
Found 4 shell execution pattern(s)
letedProcess[str]: return subprocess.run(args, text=True, **kwargs) """Command line interface for cyletedProcess[str]: return subprocess.run(list(args), text=True, **kwargs) def collect_hardware_summletedProcess[str]: return subprocess.run(list(args), text=True, **kwargs) def find_vllm_processes(rhen_installed(): result = subprocess.run( ["cydeai", "--help"], text=True, st
Credential Harvesting
No credential harvesting patterns detected
Typosquatting
No typosquatting candidates detected
Registered Email Domain
No author email provided
Suspicious Page Links
All external links appear legitimate
Git Repository History
No GitHub repository linked
No GitHub repository link found
Maintainer History
score 6.0
3 maintainer concern(s) found
Only one version has ever been released — brand new packagePackage uploaded less than 24 hours ago (2026-06-05T08:25:16.000Z)Author "Cysic-Curry" appears to have only 1 package on PyPI (new or inactive account)