registry / @rowstile/cli-linux-x64-musl / 0.1.0-alpha.7

@rowstile/cli-linux-x64-musl@0.1.0-alpha.7

⚠ Under review

The Python the rowstile command runs on, for linux-x64-musl (python-build-standalone 3.13.15, trimmed)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The inspected Python source and metadata do not establish an attack. Because the bundled native runtime could not be inspected, its behavior remains materially unresolved and requires manual review.

Static reason

One or more suspicious static signals were detected.

Trigger

The runtime may be activated when rowstile invokes the bundled Python executable.

Impact

No specific harmful effect is established; runtime behavior remains uncertain.

Mechanism

The package includes a native Python runtime and libpython; available offline analysis could not inspect the library’s behavior.

AI rationale

The inspected Python source and metadata do not establish an attack. Because the bundled native runtime could not be inspected, its behavior remains materially unresolved and requires manual review.

Evidence

python/bin/python3.13python/lib/libpython3.so.lpm-inspection-H2XcCy/0-b3f76aa07b72.txt

Decision evidence

public snapshot

AI called this Manual Review at 75.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest packages Python and names python/bin/python3.13 as rowstile’s runtime; it declares no JavaScript entrypoint or lifecycle hook.
The offline analysis identifies libpython3.so as an ELF artifact but could not inspect its executable behavior.
The password-like string in urllib.request.py appears in a documentation example, not an active credential transfer.
The README describes the package as a standalone CPython runtime for rowstile.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

8 flagged

python/lib/python3.13/urllib/request.pyView file

Lines 36-76python

37Request -- An object that encapsulates the state of a request. The

38state can be as simple as the URL. It can also include extra HTTP

39headers, e.g. a User-Agent.

41BaseHandler --

43internals:

44BaseHandler and parent

45_call_chain conventions

47Example usage:

49import urllib.request

51# set up authentication info

52authinfo = urllib.request.HTTPBasicAuthHandler()

53authinfo.add_password(realm='PDQ Application',

54 uri='https://mahler:8092/site-updates.py',

55 user='klem',

56 passwd='geheim$parole')

Medium

Secret Pattern

Package contains a possible secret pattern.

python/lib/python3.13/urllib/request.pyView on unpkg · L56

58proxy_support = urllib.request.ProxyHandler({"http" : "http://ahad-haam:3128"})

60# build a new opener that adds authentication and caching FTP handlers

Low

Ai Review Evidence

The password-like string in urllib.request.py appears in a documentation example, not an active credential transfer.

python/lib/python3.13/urllib/request.pyView on unpkg · L56

61opener = urllib.request.build_opener(proxy_support, authinfo,

62 urllib.request.CacheFTPHandler)

64# install it

65urllib.request.install_opener(opener)

67f = urllib.request.urlopen('https://www.python.org/')

68"""

70# XXX issues:

71# If an authentication error handler that tries to perform

72# authentication for some reason but fails, how should the error be

73# signalled? The client needs to know the HTTP error code. But if

74# the handler knows that the problem was, e.g., that it didn't know

75# that hash algo that requested in the challenge, it would be good to

76# pass that information along to the client, too.

python/bin/python3.13View file

•path = python/bin/python3.13 kind = native_binary sizeBytes = 20904984 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

python/bin/python3.13View on unpkg

python/lib/python3.13/shutil.pyView file

•path = python/lib/python3.13/shutil.py kind = build_helper sizeBytes = 57130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/lib/python3.13/shutil.pyView on unpkg

package.jsonView file

Lines 1-31json

2 "name": "@rowstile/cli-linux-x64-musl",

3 "version": "0.1.0-alpha.7",

4 "description": "The Python the rowstile command runs on, for linux-x64-musl (python-build-standalone 3.13.15, trimmed)",

5 "license": "Apache-2.0 AND PSF-2.0",

.lpm-inspection-H2XcCy/0-b3f76aa07b72.txtView file

5format=unrecognized artifact Package execution and network access were disabled. Analysis describes bytes, not a verdict. Trace source callers. limitations=["No supported structural or executable analysis; behavior remai

Low

Ai Review Evidence

The offline analysis identifies libpython3.so as an ELF artifact but could not inspect its executable behavior.

.lpm-inspection-H2XcCy/0-b3f76aa07b72.txtView on unpkg · L5

README.mdView file

Lines 1-6markdown

1# @rowstile/cli-linux-x64-musl

3The Python that the `rowstile` command runs on, for linux-x64-musl: CPython 3.13.15 from python-build-standalone (20260924), without the parts the command never uses. Installed by `rowstile` as an optional dependency; not for use on its own.

Low

Ai Review Evidence

The README describes the package as a standalone CPython runtime for rowstile.

README.mdView on unpkg · L3

5Python's licence is `python/lib/python3.13/LICENSE.txt` (`python/LICENSE.txt` on Windows); the licences of the libraries built into it (OpenSSL, SQLite, zlib, bzip2, xz, libffi and others) are in `python/licenses/`

Source & flagged code

8 flagged · loading source

python/lib/python3.13/urllib/request.pyView file

56patternName = generic_password severity = medium line = 56

Medium

Secret Pattern

Package contains a possible secret pattern.

python/lib/python3.13/urllib/request.pyView on unpkg · L56

56passwd='geheim$parole') proxy_support = urllib.request.ProxyHandler({"http" : "http://ahad-haam:3128"}) # build a new opener that adds authentication and caching FTP ha

Low

Ai Review Evidence

The password-like string in urllib.request.py appears in a documentation example, not an active credential transfer.

python/lib/python3.13/urllib/request.pyView on unpkg · L56

python/bin/python3.13View file

•path = python/bin/python3.13 kind = native_binary sizeBytes = 20904984 magicHex = [redacted]

Findings

3 Medium5 Low

MediumSecret Patternpython/lib/python3.13/urllib/request.py

MediumShips Native Binarypython/bin/python3.13

MediumShips Build Helperpython/lib/python3.13/shutil.py

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidence.lpm-inspection-H2XcCy/0-b3f76aa07b72.txt

LowAi Review Evidencepython/lib/python3.13/urllib/request.py

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to @rowstile/cli-linux-x64-musl@0.1.0-alpha.7.

See all versions of @rowstile/cli-linux-x64-musl for other recorded verdicts.

Review the evidence and your use of @rowstile/cli-linux-x64-musl@0.1.0-alpha.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 11:58:04.095Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.