almaqso

v1.6.1 suspicious
6.0
Medium Risk

Automation for downloading and processing ALMA calibration target observations.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package almaqso v1.6.1 has moderate risks associated with network and shell command usage, which could indicate potential misuse. However, there is no clear evidence of malicious intent.

  • moderate network risk
  • high shell risk
Per-check LLM notes
  • Network: Network calls can be legitimate if the package is designed to fetch updates or data from a server, but unsecured requests may pose risks.
  • Shell: Executing shell commands, especially those involving file extraction, could indicate risky behavior unless explicitly documented and necessary for package functionality.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The package shows signs of low maintainer activity and poor metadata quality, raising some suspicion but not definitive evidence of malice.

📦 Package Quality Overall: Low (4.8/10)

✦ High Test Suite 9.0

Test suite present — 2 test file(s) found

  • Test runner config found: pyproject.toml
  • 2 test file(s) detected (e.g. test_query.py)
◈ Medium Documentation 7.0

Some documentation present

  • 1 documentation file(s) (e.g. conf.py)
  • Detailed PyPI description (4762 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 33 type-annotated function signatures detected in source
○ Low Multiple Contributors 1.0

Unable to verify contributor count: no GitHub repository found

  • No GitHub repository linked — contributor count unavailable

🔬 Heuristic Checks

⚠ Outbound Network Calls score 1.5

Found 1 network call pattern(s)

  • ) try: response = requests.get(url, stream=True, verify=True, timeout=(3, 60)) resp
✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 4.0

Found 2 shell execution pattern(s)

  • tr(script_name)] result = subprocess.run( cmd, stdout=subprocess.PIPE, stderr
  • e}") try: subprocess.run(["tar", "-xf", f"../{filename}"], check=True) lo
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

No GitHub repository linked

  • No GitHub repository link found
⚠ Maintainer History score 6.0

3 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
  • Package has no PyPI classifiers (low effort / metadata quality)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with almaqso 
Build a simple Python application using the almaqso package to demonstrate its core features.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!