registry / @rowstile/cli-linux-x64-musl / 0.1.0-alpha.2

@rowstile/cli-linux-x64-musl@0.1.0-alpha.2

The Python the rowstile command runs on, for linux-x64-musl (python-build-standalone 3.13.15, trimmed)

AI Security Review

scanned 18d ago · by lpm-firewall-ai

The inspected signals reflect a bundled Python runtime, a documentation password example, and ordinary file utilities. No active malicious behavior or unresolved concrete attack surface supports a warning or block.

Static reason

One or more suspicious static signals were detected.

Trigger

Python functionality requires invoking the bundled interpreter; no automatic npm execution trigger was found.

Impact

No credential theft, automatic project mutation, or malicious execution chain was established.

Mechanism

Inspected network authentication and file-copy operations are library functions operating on supplied requests and paths.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The complete package.json has no lifecycle scripts, dependencies, or JavaScript entrypoints; it identifies the bundled Python interpreter.
The flagged password is inside an urllib documentation example. Inspected authentication code retrieves credentials by realm and host.
The flagged shutil code copies caller-selected source and destination files within a function.
The native artifact is an x86-64 musl ELF executable, consistent with the interpreter path in the manifest.

Evidence against

Static inspection does not establish the complete behavior or provenance of the native interpreter.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

6 flagged

python/lib/python3.13/urllib/request.pyView file

Lines 36-76python

37Request -- An object that encapsulates the state of a request. The

38state can be as simple as the URL. It can also include extra HTTP

39headers, e.g. a User-Agent.

41BaseHandler --

43internals:

44BaseHandler and parent

45_call_chain conventions

47Example usage:

49import urllib.request

51# set up authentication info

52authinfo = urllib.request.HTTPBasicAuthHandler()

53authinfo.add_password(realm='PDQ Application',

54 uri='https://mahler:8092/site-updates.py',

55 user='klem',

56 passwd='geheim$parole')

Medium

Secret Pattern

Package contains a possible secret pattern.

python/lib/python3.13/urllib/request.pyView on unpkg · L56

58proxy_support = urllib.request.ProxyHandler({"http" : "http://ahad-haam:3128"})

60# build a new opener that adds authentication and caching FTP handlers

61opener = urllib.request.build_opener(proxy_support, authinfo,

62 urllib.request.CacheFTPHandler)

64# install it

65urllib.request.install_opener(opener)

67f = urllib.request.urlopen('https://www.python.org/')

68"""

70# XXX issues:

71# If an authentication error handler that tries to perform

72# authentication for some reason but fails, how should the error be

73# signalled? The client needs to know the HTTP error code. But if

74# the handler knows that the problem was, e.g., that it didn't know

75# that hash algo that requested in the challenge, it would be good to

76# pass that information along to the client, too.

Lines 963-1003text

963 return

964

965 unsupported = None

966 for header in headers:

967 for scheme, realm in self._parse_realm(header):

968 if scheme.lower() != 'basic':

969 unsupported = scheme

970 continue

971

972 if realm is not None:

973 # Use the first matching Basic challenge.

974 # Ignore following challenges even if they use the Basic

975 # scheme.

976 return self.retry_http_basic_auth(host, req, realm)

python/bin/python3.13View file

•path = python/bin/python3.13 kind = native_binary sizeBytes = 20904984 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

python/bin/python3.13View on unpkg

python/lib/python3.13/shutil.pyView file

Lines 240-280text

240 raise SameFileError("{!r} and {!r} are the same file".format(src, dst))

241

242 file_size = 0

243 for i, fn in enumerate([src, dst]):

244 try:

245 st = _stat(fn)

246 except OSError:

247 # File most likely does not exist

248 pass

249 else:

250 # XXX What about other special files? (sockets, devices...)

251 if stat.S_ISFIFO(st.st_mode):

package.jsonView file

Lines 1-27json

2 "name": "@rowstile/cli-linux-x64-musl",

3 "version": "0.1.0-alpha.2",

4 "description": "The Python the rowstile command runs on, for linux-x64-musl (python-build-standalone 3.13.15, trimmed)",

5 "license": "Apache-2.0 AND PSF-2.0",

Source & flagged code

6 flagged · loading source

python/lib/python3.13/urllib/request.pyView file

56patternName = generic_password severity = medium line = 56

Medium

Secret Pattern

Package contains a possible secret pattern.

python/lib/python3.13/urllib/request.pyView on unpkg · L56

983def retry_http_basic_auth(self, host, req, realm): user, pw = self.passwd.find_user_password(realm, host) if pw is not None: raw = "%s

Low

Ai Review Evidence

The flagged password is inside an urllib documentation example. Inspected authentication code retrieves credentials by realm and host.

python/lib/python3.13/urllib/request.pyView on unpkg · L983

python/bin/python3.13View file

•path = python/bin/python3.13 kind = native_binary sizeBytes = 20904984 magicHex = [redacted]

Findings

3 Medium3 Low

MediumSecret Patternpython/lib/python3.13/urllib/request.py

MediumShips Native Binarypython/bin/python3.13

MediumShips Build Helperpython/lib/python3.13/shutil.py

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencepython/lib/python3.13/urllib/request.py

LowAi Review Evidencepython/lib/python3.13/shutil.py

Affected versions and remediation

This report applies to @rowstile/cli-linux-x64-musl@0.1.0-alpha.2.

See all versions of @rowstile/cli-linux-x64-musl for other recorded verdicts.

Review the evidence and your use of @rowstile/cli-linux-x64-musl@0.1.0-alpha.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-04 23:21:41.242Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.