@rowstile/cli-linux-x64-musl@0.1.0-alpha.9
The Python the rowstile command runs on, for linux-x64-musl (python-build-standalone 3.13.15, trimmed)
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe proxy setup is executable module-level code, not merely a documentation example, and it changes the default opener for later HTTP requests. This is concrete runtime traffic redirection, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
A program using the bundled interpreter imports urllib.request and then makes an HTTP request through urllib.
Impact
The proxy can receive or interfere with HTTP traffic from the process.
Mechanism
The module builds an opener with a fixed HTTP proxy and installs it globally.
Attack narrative
When urllib.request is imported, it installs an opener configured with a fixed HTTP proxy. Subsequent urllib HTTP requests in that process may pass through the configured proxy, exposing traffic to that endpoint.
AI rationale
The proxy setup is executable module-level code, not merely a documentation example, and it changes the default opener for later HTTP requests. This is concrete runtime traffic redirection, so the package should be blocked.
Evidence
python/lib/python3.13/urllib/request.py
Network endpoints1
ahad-haam:3128
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest bundles a Python runtime and identifies its interpreter.
- Importing urllib.request installs a process-wide opener that routes HTTP traffic through a hardcoded proxy.
Evidence against
- The manifest contains no lifecycle hook, so the proxy behavior is conditional on runtime use of urllib.request.
Behavioral surface
Source & flagged code
5 flagged · loading sourcepython/lib/python3.13/urllib/request.pyView file
58proxy_support = urllib.request.ProxyHandler({"http" : "http://ahad-haam:3128"})
# build a new opener that adds authentication and caching FTP handlers
opener = urllib.request.build_opener(proxy_support, authinfo,
urllib.request.CacheFTPHandler)
# install it
urllib.request.install_opener(opener)
f = urll
High
Ai Review Evidence
Importing urllib.request installs a process-wide opener that routes HTTP traffic through a hardcoded proxy.
python/lib/python3.13/urllib/request.pyView on unpkg · L5856patternName = generic_password
severity = medium
line = 56
Medium
Secret Pattern
Package contains a possible secret pattern.
python/lib/python3.13/urllib/request.pyView on unpkg · L56python/bin/python3.13View file
•path = python/bin/python3.13
kind = native_binary
sizeBytes = 20904984
magicHex = [redacted]
Findings
2 High3 Medium
HighAi Review Evidencepackage.json
HighAi Review Evidencepython/lib/python3.13/urllib/request.py
MediumSecret Patternpython/lib/python3.13/urllib/request.py
MediumShips Native Binarypython/bin/python3.13
MediumShips Build Helperpython/lib/python3.13/shutil.py
Affected versions and remediation
This report applies to @rowstile/cli-linux-x64-musl@0.1.0-alpha.9.
See all versions of @rowstile/cli-linux-x64-musl for other recorded verdicts.
- Avoid installing @rowstile/cli-linux-x64-musl@0.1.0-alpha.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.