pkgcheck-cli 0.1.0__tar.gz

pkgcheck_cli-0.1.0/PKG-INFO

@@ -0,0 +1,39 @@
+Metadata-Version: 2.4
+Name: pkgcheck-cli
+Version: 0.1.0
+Summary: Check a Python package name for risk before you pip install it
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# pkgcheck-cli
+
+A learning project: a command that checks a Python package **name** for risk before you install it.
+
+    pip install pkgcheck-cli
+    pkgcheck requests
+
+Example output:
+
+    requests   SAFE
+    reqeusts   RISKY - name is very similar to popular package 'requests'
+
+## How it works
+
+The command sends the package name to a small web server (FastAPI). The server runs a Random Forest model and answers SAFE or RISKY, with a plain-English reason.
+
+## Important limits (please read)
+
+- **This is a learning project, not a security tool.** Do not rely on it to decide what is safe to install.
+- The model uses **name-only clues**: name length, digits, dashes, and similarity to popular package names.
+- On held-out test data it finds about **63%** of bad packages, and when it says RISKY it is right about **51%** of the time. The test data had far more bad packages than real PyPI has, so real-world precision would be lower.
+- The 500 most popular packages are always answered SAFE.
+- Bad examples come from the DataDog malicious-software-packages dataset. Safe examples are popular PyPI packages, which is not a perfect picture of the real world.
+- The server runs on a free plan. The first request after a quiet period can take up to a minute, and the server may go offline.
+
+## Privacy
+
+Only the package name you type is sent to the server. The server stores the name and its answer in a database.
+
+## Source code
+
+https://github.com/meenakshitha2008-hue/pkgcheck

pkgcheck_cli-0.1.0/README.md

@@ -0,0 +1,32 @@
+# pkgcheck-cli
+
+A learning project: a command that checks a Python package **name** for risk before you install it.
+
+    pip install pkgcheck-cli
+    pkgcheck requests
+
+Example output:
+
+    requests   SAFE
+    reqeusts   RISKY - name is very similar to popular package 'requests'
+
+## How it works
+
+The command sends the package name to a small web server (FastAPI). The server runs a Random Forest model and answers SAFE or RISKY, with a plain-English reason.
+
+## Important limits (please read)
+
+- **This is a learning project, not a security tool.** Do not rely on it to decide what is safe to install.
+- The model uses **name-only clues**: name length, digits, dashes, and similarity to popular package names.
+- On held-out test data it finds about **63%** of bad packages, and when it says RISKY it is right about **51%** of the time. The test data had far more bad packages than real PyPI has, so real-world precision would be lower.
+- The 500 most popular packages are always answered SAFE.
+- Bad examples come from the DataDog malicious-software-packages dataset. Safe examples are popular PyPI packages, which is not a perfect picture of the real world.
+- The server runs on a free plan. The first request after a quiet period can take up to a minute, and the server may go offline.
+
+## Privacy
+
+Only the package name you type is sent to the server. The server stores the name and its answer in a database.
+
+## Source code
+
+https://github.com/meenakshitha2008-hue/pkgcheck

pkgcheck_cli-0.1.0/pkgcheck_cli/main.py

@@ -0,0 +1,30 @@
+import json
+import os
+import sys
+import urllib.parse
+import urllib.request
+
+BASE_URL = os.getenv("PKGCHECK_URL", "https://pkgcheck.onrender.com")
+
+
+def main():
+    if len(sys.argv) < 2:
+        print("Usage: pkgcheck <package-name>")
+        return
+    name = sys.argv[1]
+    url = BASE_URL + "/check?" + urllib.parse.urlencode({"name": name})
+    try:
+        with urllib.request.urlopen(url, timeout=90) as r:
+            data = json.load(r)
+    except Exception as e:
+        print("Could not reach the pkgcheck server:", e)
+        print("If the server was idle, wait a minute and try again.")
+        return
+    line = f"{data['name']}   {data['verdict']}"
+    if data["verdict"] == "RISKY" and data["reasons"]:
+        line += " - " + "; ".join(data["reasons"])
+    print(line)
+
+
+if __name__ == "__main__":
+    main()

pkgcheck_cli-0.1.0/pkgcheck_cli.egg-info/PKG-INFO

@@ -0,0 +1,39 @@
+Metadata-Version: 2.4
+Name: pkgcheck-cli
+Version: 0.1.0
+Summary: Check a Python package name for risk before you pip install it
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# pkgcheck-cli
+
+A learning project: a command that checks a Python package **name** for risk before you install it.
+
+    pip install pkgcheck-cli
+    pkgcheck requests
+
+Example output:
+
+    requests   SAFE
+    reqeusts   RISKY - name is very similar to popular package 'requests'
+
+## How it works
+
+The command sends the package name to a small web server (FastAPI). The server runs a Random Forest model and answers SAFE or RISKY, with a plain-English reason.
+
+## Important limits (please read)
+
+- **This is a learning project, not a security tool.** Do not rely on it to decide what is safe to install.
+- The model uses **name-only clues**: name length, digits, dashes, and similarity to popular package names.
+- On held-out test data it finds about **63%** of bad packages, and when it says RISKY it is right about **51%** of the time. The test data had far more bad packages than real PyPI has, so real-world precision would be lower.
+- The 500 most popular packages are always answered SAFE.
+- Bad examples come from the DataDog malicious-software-packages dataset. Safe examples are popular PyPI packages, which is not a perfect picture of the real world.
+- The server runs on a free plan. The first request after a quiet period can take up to a minute, and the server may go offline.
+
+## Privacy
+
+Only the package name you type is sent to the server. The server stores the name and its answer in a database.
+
+## Source code
+
+https://github.com/meenakshitha2008-hue/pkgcheck

pkgcheck_cli-0.1.0/pkgcheck_cli.egg-info/SOURCES.txt

@@ -0,0 +1,9 @@
+README.md
+pyproject.toml
+pkgcheck_cli/__init__.py
+pkgcheck_cli/main.py
+pkgcheck_cli.egg-info/PKG-INFO
+pkgcheck_cli.egg-info/SOURCES.txt
+pkgcheck_cli.egg-info/dependency_links.txt
+pkgcheck_cli.egg-info/entry_points.txt
+pkgcheck_cli.egg-info/top_level.txt

pkgcheck_cli-0.1.0/pkgcheck_cli.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

pkgcheck_cli-0.1.0/pkgcheck_cli.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+pkgcheck = pkgcheck_cli.main:main

pkgcheck_cli-0.1.0/pkgcheck_cli.egg-info/top_level.txt

@@ -0,0 +1 @@
+pkgcheck_cli

pkgcheck_cli-0.1.0/pyproject.toml

@@ -0,0 +1,14 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pkgcheck-cli"
+version = "0.1.0"
+description = "Check a Python package name for risk before you pip install it"
+readme = "README.md"
+requires-python = ">=3.9"
+dependencies = []
+
+[project.scripts]
+pkgcheck = "pkgcheck_cli.main:main"

pkgcheck_cli-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+