agi-node

v2026.6.4 suspicious
6.0
Medium Risk

Distributed worker orchestration and execution support library for AGILAB

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows signs of potential obfuscation and performs system-level operations, which raises concerns about its true intentions. While there is no direct evidence of malicious activities, the lack of historical data and obfuscated code make it suspicious.

  • High obfuscation risk
  • Potential shell execution
Per-check LLM notes
  • Network: No network calls detected, which is normal and expected.
  • Shell: Shell execution patterns may indicate the package performs system-level operations, but without context on its intended use, it's hard to determine if these actions are benign or potentially malicious.
  • Obfuscation: The use of __import__ and getattr suggests potential code obfuscation, possibly to hide functionality or evade detection.
  • Credentials: No clear evidence of credential harvesting detected.
  • Metadata: The package is newly created with no history and a single version, raising some suspicion but not conclusive evidence of malice.

📦 Package Quality Overall: Medium (6.4/10)

◈ Medium Test Suite 6.0

Partial test coverage signals detected

  • Test runner config found: pyproject.toml
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://thalesgroup.github.io/agilab
  • Detailed PyPI description (1380 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 255 type-annotated function signatures detected in source
✦ High Multiple Contributors 10.0

Active multi-contributor project

  • 5 unique contributor(s) across 69 commits in ThalesGroup/agilab
  • Active community — 5 or more distinct contributors

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

  • e_path) logger_obj.error("__import__('%s', fromlist=['%s'])", module, target_class) logger_obj.error("getattr('%s %
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • d), ) subprocess.run(cmd, check=True) except subprocess.CalledProcessErro
  • if os.name != "nt": subprocess.run(["chmod", "-R", "u+rwx", str(path)], check=False, capture_ou
  • to parse output = subprocess.check_output( ["ps", "-A", "-o", "pid=", "-o", "command="
  • ses...") output = subprocess.check_output( ["tasklist", "/fo", "csv", "/nh"], text=Tru
  • IDs...") output = subprocess.check_output( ["ps", "-A", "-o", "pid=", "-o", "ppid="],
  • letedProcess[str]: return subprocess.run( [executable, "-L"], capture_output=True,
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository ThalesGroup/agilab appears legitimate

⚠ Maintainer History score 6.0

3 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Package is very new: uploaded 3 day(s) ago
  • Author "Jean-Pierre Morard" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agi-node 
Build a simple Python application using the agi-node package to demonstrate its core features.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!