Chaintrap · PyPI supply chain
Registry metadata, verified artifact, OSV for this release, requires_dist dependency OSV pass, line-level rules (pypi_malware_rules), optional pip-audit/Bandit — same report shell as npm-mal-scan.
PyPI greenfield scan rated this release PASS (heuristic score 1.0 / 10). OSV reported 0 advisory ID(s); static analysis emitted 1 pattern hit(s).
Scanners prioritize signal over certainty: expect both false positives and blind spots. Combine OSV data with static findings and your own policy — this report does not replace manual review.
Heuristic score combines static rules, OSV hits for this exact version, and optional pip-audit / Bandit output. It is not a malware conviction.
Raw sum before 10.0 cap: 1.0 · Capped total: 1.0
Findings by severity medium: 1
| Static pattern rules (line-level) | 1.0 | 1 match(es); weights sum to this bucket before global cap. |
| OSV advisories (exact name@version) | 0 record(s); capped at 4.0 points. | |
| pip-audit (optional) | 0 vuln row(s); capped at 3.0; enable PYPI_PIP_AUDIT. | |
| Bandit high/critical (optional) | 0 finding(s); capped at 3.0; enable PYPI_BANDIT. |
Ruleset: 2026-04-17
Use Source Code / Homepage for manual review of the upstream repo. This scan does not clone those URLs.
No project URLs in PyPI metadata.
Author f1zzen
Makes HelloWorld("print") actually real.
Line-level rules ran over text-like files under the extracted artifact (max 400000 bytes per file).
Files by suffix (top 24):
.py | 2 |
.txt | 1 |
Chaintrap pairs static behavior signals above with OSV data for this exact version — cross-check CVEs and malware listings with install scripts, execution paths, and scanner findings.
Source: osv.dev — queried at scan time.
0 advisory ID(s) returned by OSV query.
No known vulnerabilities reported for this exact version.
Declared requires_dist strings from package metadata. Each dependency is resolved to the highest PyPI version matching the version specifier, then checked against OSV for that exact name@version. Does not affect the headline verdict score.
No requires_dist entries in PyPI metadata for this release.
Detection library pypi_malware_rules (2026-04-17) — 75 line-level rules over .py and other text artifacts. Matches are triage signals, not proof of malice.
Matches by category dynamic_import (1) · Total hits 1
Category dynamic_import
import_module loads modules by runtime string.
Analyst note Often benign (plugins); suspicious with obfuscated strings or network-sourced names.
helloworld_print/core.py:7
module = importlib.import_module(module_name)
MAL-* OSV IDs appear, review OpenSSF malicious-packages context and isolate affected hosts.