dbt-tree

v0.1.0 suspicious
4.0
Medium Risk

Pretty terminal lineage tree for dbt selectors (dbt-tree "model+").

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows minimal risk in terms of network calls, shell execution, obfuscation, and credential harvesting. However, its novelty and limited activity make it suspicious, especially concerning potential supply-chain attacks.

  • Newly created package with limited activity
  • Potential for command injection due to shell execution
Per-check LLM notes
  • Network: No network calls were detected, which is typical and not suspicious.
  • Shell: Shell execution attempts to run dbt commands, likely for version checks or similar benign purposes, but could indicate potential for command injection if not properly sanitized.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The package is newly created with limited activity and a single release, raising suspicion but lacking clear malicious indicators.

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 6.0

Found 3 shell execution pattern(s)

  • it.""" try: out = subprocess.run( [dbt_path, "--version"], capture_output=True, t
  • args try: proc = subprocess.run(cmd, capture_output=True, text=True) except FileNotFound
  • "*"] try: proc = subprocess.run(cmd, capture_output=True, text=True) except Exception:
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 3.0

GitHub API error: 403

  • GitHub API error: 403
⚠ Maintainer History score 6.0

3 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Package uploaded less than 24 hours ago (2026-06-04T22:00:14.000Z)
  • Author "Karthik Rajashekaran" appears to have only 1 package on PyPI (new or inactive account)

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!