netdiag-cli

v0.1.0 suspicious
6.0
Medium Risk

One CLI for network troubleshooting: traceroute with BGP/ASN, DNS, latency, VPN checks, and SRE on-call presets.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits moderate risk due to its reliance on external shell commands and limited metadata, suggesting potential misuse or lack of transparency.

  • Moderate shell risk due to use of external commands
  • High metadata risk due to lack of author information and community engagement
Per-check LLM notes
  • Network: The network calls appear to be part of DNS resolution and connection management, which aligns with the diagnostic functionality of the package.
  • Shell: Use of external commands like 'dig', 'scutil', and 'resolvectl' suggests the package leverages system tools for network diagnostics, but could potentially pose a risk if not properly sanitized or controlled.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The package is newly created with minimal details, no community engagement, and lacks author information, raising concerns about its legitimacy.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 9.0

Found 6 network call pattern(s)

  • ocket.getdefaulttimeout() socket.setdefaulttimeout(timeout) try: host, _, _ = socket.gethostbyaddr(
  • urn None finally: socket.setdefaulttimeout(old_timeout) def _fill_asn_name(asn: AsnRecord | None, bgp
  • ockaddr) == 2: return socket.create_connection(sockaddr, timeout=timeout) sock = socket.socket(family,
  • ntext() try: with socket.create_connection((host, port), timeout=timeout) as raw: with ctx.
  • ocket.getdefaulttimeout() socket.setdefaulttimeout(timeout) try: host, _aliases, _addrs = socket.ge
  • str(exc) finally: socket.setdefaulttimeout(old_timeout) def address_properties(addr: str) -> dict[str
✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • type in types: proc = subprocess.run( ["dig", "+short", name, rtype.upper()],
  • ResolverInfo] = [] proc = subprocess.run( ["scutil", "--dns"], capture_output=True,
  • "resolvectl"): proc = subprocess.run( ["resolvectl", "status"], capture_o
  • _require_dig() proc = subprocess.run( ["dig", "+trace", "+nodnssec", name, record_type.up
  • [f"@{server}"] proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=False
  • None try: proc = subprocess.run( ["dig", "+short", "+time=2", "+tries=1", qname,
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 2.5

Git history flags: Repository has zero stars and zero forks

  • Repository has zero stars and zero forks
⚠ Maintainer History score 8.0

4 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Package uploaded less than 24 hours ago (2026-06-05T00:42:12.000Z)
  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)