Chaintrap · PyPI supply chain
Registry metadata, verified artifact, OSV for this release, requires_dist dependency OSV pass, line-level rules (pypi_malware_rules), optional pip-audit/Bandit — same report shell as npm-mal-scan.
PyPI greenfield scan rated this release PASS (heuristic score 0.0 / 10). OSV reported 0 advisory ID(s); static analysis emitted 0 pattern hit(s).
Scanners prioritize signal over certainty: expect both false positives and blind spots. Combine OSV data with static findings and your own policy — this report does not replace manual review.
Heuristic score combines static rules, OSV hits for this exact version, and optional pip-audit / Bandit output. It is not a malware conviction.
Raw sum before 10.0 cap: 0.0 · Capped total: 0.0
| Static pattern rules (line-level) | 0 match(es); weights sum to this bucket before global cap. | |
| OSV advisories (exact name@version) | 0 record(s); capped at 4.0 points. | |
| pip-audit (optional) | 0 vuln row(s); capped at 3.0; enable PYPI_PIP_AUDIT. | |
| Bandit high/critical (optional) | 0 finding(s); capped at 3.0; enable PYPI_BANDIT. |
Ruleset: 2026-04-17
Use Source Code / Homepage for manual review of the upstream repo. This scan does not clone those URLs.
| Homepage | https://github.com/user/reponame |
| Download | https://github.com/Moneypulation/f34f34wef4ew3r/archive/refs/tags/v_17.tar.gz |
Author YOUR NAME
Author email your.email@domain.com
Trove classifiers
TYPE YOUR DESCRIPTION HERE
License MIT
Line-level rules ran over text-like files under the extracted artifact (max 400000 bytes per file).
Files by suffix (top 24):
.py | 3 |
.txt | 3 |
.md | 1 |
.cfg | 1 |
Chaintrap pairs static behavior signals above with OSV data for this exact version — cross-check CVEs and malware listings with install scripts, execution paths, and scanner findings.
Source: osv.dev — queried at scan time.
0 advisory ID(s) returned by OSV query.
No known vulnerabilities reported for this exact version.
Declared requires_dist strings from package metadata. Each dependency is resolved to the highest PyPI version matching the version specifier, then checked against OSV for that exact name@version. Does not affect the headline verdict score.
No requires_dist entries in PyPI metadata for this release.
Detection library pypi_malware_rules (2026-04-17) — 75 line-level rules over .py and other text artifacts. Matches are triage signals, not proof of malice.
No static pattern matches in extracted source files.
MAL-* OSV IDs appear, review OpenSSF malicious-packages context and isolate affected hosts.