🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits multiple indicators of potential misuse, including obfuscated code, retrieval of sensitive credentials, and signs of low-effort creation, suggesting it may be newly minted for malicious activities.

High obfuscation risk
Potential credential harvesting

Per-check LLM notes

Network: The network calls appear to be checking the availability of an S3 index URL, which is not inherently suspicious but should be verified against known good behavior.
Shell: The shell executions seem related to GitHub CLI operations, possibly for authentication and API interactions, which could be legitimate but warrant further investigation into the package's intended use.
Obfuscation: The code uses base64 decoding which could be used for obfuscating strings or data, raising suspicion of potential malicious intent.
Credentials: The code attempts to retrieve a GITHUB_TOKEN from environment variables, which is a common practice but also a red flag for unauthorized access or credential harvesting.
Metadata: The package shows signs of low effort and could be newly created for malicious purposes.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 3.0

Found 2 network call pattern(s)

"" try: request = urllib.request.Request(info.s3_index_url, method="HEAD") with urlli
, method="HEAD") with urllib.request.urlopen(request, timeout=10) as response: return

⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

) try: return base64.b64decode(content) except binascii.Error as e: raise GitHu

⚠ Shell / Subprocess Execution score 4.0

Found 2 shell execution pattern(s)

try: result = subprocess.run( [gh_path, "auth", "status"],
try: result = subprocess.run( [self._gh_cli_path, "api", api_path],

⚠ Credential Harvesting score 2.5

Found 1 credential access pattern(s)

> AuthMethod: token = os.getenv("GITHUB_TOKEN", "") if token: self._github_token = to

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

No GitHub repository linked

No GitHub repository link found

⚠ Maintainer History score 8.0

4 maintainer concern(s) found

Only one version has ever been released — brand new package
Package uploaded less than 24 hours ago (2026-06-05T01:03:14.000Z)
Author "Advanced Micro Devices, Inc." appears to have only 1 package on PyPI (new or inactive account)
Package has no PyPI classifiers (low effort / metadata quality)