msra-codegen

v0.1.0 suspicious
4.0
Medium Risk

MSRA to async Python client generator

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows subprocess execution which may be legitimate but requires further investigation. Additionally, the package is new with incomplete metadata, raising concerns about its legitimacy.

  • Subprocess execution observed, potential for misuse exists.
  • Minimal maintainer history and incomplete author information.
Per-check LLM notes
  • Network: No network calls detected, which is normal and does not indicate any risk.
  • Shell: Subprocess execution is observed, which could be legitimate if the package requires executing external tools like 'node'. However, it's worth investigating the purpose of these calls to ensure they are not being used for malicious activities.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The package is brand new with minimal maintainer history and incomplete author information, raising suspicion.

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 6.0

Found 3 shell execution pattern(s)

  • ror(msra_path) process = subprocess.run( ["node", str(NODE_EXPORT), str(msra_path)],
  • [str]) -> None: process = subprocess.run( [sys.executable, *arguments], capture_outpu
  • argv, *targets] process = subprocess.run( command, cwd=output_root, capture_o
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 3.0

GitHub API error: 403

  • GitHub API error: 403
⚠ Maintainer History score 8.0

4 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Package uploaded less than 24 hours ago (2026-06-05T05:55:08.000Z)
  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!