rithik 0.1.1__tar.gz

rithik-0.1.1/.gitattributes

@@ -0,0 +1,4 @@
+# The npm launcher starts with a shebang; a CRLF checkout would make it "node
+js/bin/* text eol=lf
+# Golden files are compared byte for byte, so git must not rewrite their line endings.
+js/test/golden/* text eol=lf

rithik-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,68 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (${{ matrix.os }}, Python ${{ matrix.python }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      # One failing cell should not hide whether the others pass.
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        # The oldest supported Python and the newest one.
+        python: ["3.9", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+
+      # setup-uv stopped publishing floating major tags at v8, so this has to name a full
+      # release.
+      - uses: astral-sh/setup-uv@v10.1.0
+
+      - name: Test
+        run: uv run --python ${{ matrix.python }} pytest -q
+
+      - name: Lint
+        if: matrix.os == 'ubuntu-latest' && matrix.python == '3.13'
+        run: |
+          uv run ruff check
+          uv run ruff format --check
+
+      # The npm package is a port of the Python one and is tested against files generated
+      # from it. A Python change that forgets to regenerate them fails here, not in the port.
+      - name: Golden files are current
+        if: matrix.os == 'ubuntu-latest' && matrix.python == '3.13'
+        run: uv run python scripts/export_golden.py --check
+
+  node:
+    name: node (${{ matrix.os }}, Node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        # The oldest Node that package.json promises, and the current LTS.
+        node: ["18", "24"]
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Parity tests against the Python reference
+        run: npm test
+
+      - name: The packed tarball runs
+        shell: bash
+        run: |
+          npm pack --pack-destination "$RUNNER_TEMP"
+          cd "$RUNNER_TEMP"
+          npx --yes ./rithik-*.tgz --version
+          npx --yes ./rithik-*.tgz scam "Your SBI KYC expires today, update at sbi-kyc.top"

rithik-0.1.1/.github/workflows/publish.yml

@@ -0,0 +1,80 @@
+name: publish
+
+# Trusted publishing to both registries: PyPI and npm each accept uploads from this workflow,
+# so no API token is stored anywhere. See docs/RELEASING.md.
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      # setup-uv stopped publishing floating major tags at v8, so this has to name a full
+      # release.
+      - uses: astral-sh/setup-uv@v10.1.0
+
+      # Neither registry ever accepts a version twice, so a tag that disagrees with the code
+      # should stop here rather than upload something under the wrong number.
+      - name: Check that the tag matches every version string
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          test "$version" = "$(uv version --short)"
+          grep -qx "__version__ = \"$version\"" src/rithik/__init__.py
+          test "$version" = "$(node -p 'require("./package.json").version')"
+
+      - name: Build
+        run: uv build
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/rithik/
+    # Only the upload job can mint the OIDC token that PyPI exchanges for upload rights.
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  npm:
+    # Gated on the same checks as PyPI, so the two registries never disagree about a version.
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          # A release build should never restore anything from a cache.
+          package-manager-cache: false
+
+      # Trusted publishing needs npm 11.5.1 or later, which not every Node 24 build bundles.
+      - run: npm install -g npm@latest
+
+      - run: npm test
+
+      # With trusted publishing, npm exchanges the OIDC token itself and attaches a
+      # provenance attestation; there is no NODE_AUTH_TOKEN.
+      - run: npm publish

rithik-0.1.1/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.py[cod]
+.venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.env
+.env.*

rithik-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rithik Krishna T
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

rithik-0.1.1/PKG-INFO

@@ -0,0 +1,253 @@
+Metadata-Version: 2.5
+Name: rithik
+Version: 0.1.1
+Summary: Rithik Krishna T's command-line card, plus an offline checker for Indian scam messages and links.
+Project-URL: Homepage, https://github.com/Daemon-VI/rithik
+Project-URL: Issues, https://github.com/Daemon-VI/rithik/issues
+Author-email: Rithik Krishna T <trithikkrishna@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: cli,india,phishing,scam,security,sms,upi
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Communications
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# rithik
+
+[![ci](https://github.com/Daemon-VI/rithik/actions/workflows/ci.yml/badge.svg)](https://github.com/Daemon-VI/rithik/actions/workflows/ci.yml)
+
+`rithik` prints my card in your terminal, and it checks suspicious messages and links for the
+scam patterns common in India, entirely offline. Paste in an SMS, a WhatsApp forward or a link,
+and it tells you which known patterns matched, why they matter, and what to do next.
+
+## Install
+
+With Node.js 18 or newer, you can run it without installing anything:
+
+```sh
+npx rithik                          # once it is published to npm
+npx github:Daemon-VI/rithik         # works now, straight from GitHub
+npm install -g rithik               # or keep the `rithik` command around
+```
+
+npm 12 refuses packages fetched from git unless you allow it, so on npm 12 the GitHub form is
+`npx --allow-git=root github:Daemon-VI/rithik`. The npm 10 and 11 releases that ship with
+Node 18 to 24 need no flag.
+
+With Python 3.9 or newer:
+
+```sh
+pipx install git+https://github.com/Daemon-VI/rithik   # works now
+pipx install rithik                                    # once it is published to PyPI
+uvx rithik                                             # run once without installing
+```
+
+Neither version has any dependencies. If the `rithik` script is not on your `PATH`,
+`python -m rithik` does the same thing.
+
+### One engine, two runtimes
+
+The Python package is the reference implementation, and the npm package is a JavaScript port
+of it. The port is tested against golden files generated from the Python code: every corpus
+message and edge case must produce the same verdict, reasons and score, and the terminal output
+must match byte for byte. CI fails if the Python code changes and the golden files are not
+regenerated.
+
+## Usage
+
+```sh
+rithik                     # the card
+rithik card --json         # the card as JSON
+rithik scam "<message or link>"
+rithik scam -              # read the message from standard input
+rithik --version
+```
+
+`--no-color` turns colour off, and so does the `NO_COLOR` environment variable. Colour is also
+off whenever the output is not a terminal. `--json` prints only JSON, so scripts can use it.
+
+### Checking a message
+
+The quotes matter, because they keep your shell from interpreting the message.
+
+```sh
+rithik scam "Dear customer, your SBI account will be blocked today. Update KYC now: https://sbi-kyc-help-desk.top/update"
+```
+
+The output (real, from v0.1.0):
+
+```text
+LIKELY SCAM  (score 0.96 of 1.00)
+
+Why
+  - Link uses a bank or brand name on a domain that brand does not own:
+    "hxxps://sbi-kyc-help-desk[.]top/update"
+  - Asks you to update or verify KYC, PAN or Aadhaar through a message: "KYC
+    now: hxxps://sbi-kyc-help-desk[.]top/update"
+  - Claims your bank account, card or UPI will be blocked unless you act:
+    "account will be blocked"
+  - Link uses a cheap domain ending that is common in phishing:
+    "hxxps://sbi-kyc-help-desk[.]top/update"
+  - Threatens a loss or penalty to rush you: "will be blocked"
+  - Asks for something and gives a link that is not an official site:
+    "hxxps://sbi-kyc-help-desk[.]top/update"
+
+Links in the message
+  - hxxps://sbi-kyc-help-desk[.]top/update
+  (dots shown as [.] so the links cannot be opened by accident)
+
+What to do
+  - Do not click the links, call the numbers or install anything the message
+    asks for.
+  - Never share an OTP, UPI PIN or card details, and remember that you never
+    need your UPI PIN to receive money.
+  - Verify through your bank's official app, or the number printed on your
+    card, not a number from the message.
+  - If money was taken, call 1930 at once or report it at
+    https://cybercrime.gov.in
+  - Report the fraud SMS or call through Chakshu at
+    https://sancharsaathi.gov.in
+```
+
+The verdict is one of `LIKELY SCAM`, `SUSPICIOUS` or `NO KNOWN SCAM SIGNALS`. The last one is
+worded that way on purpose, because it only means that none of the known patterns matched:
+
+```text
+NO KNOWN SCAM SIGNALS  (score 0.00 of 1.00)
+
+None of the scam patterns this checker knows matched. That is not a guarantee
+that the message is genuine: new scams appear all the time. Before you pay, or
+share an OTP or PIN, verify through the official app or website.
+```
+
+A long message is easier to pipe in:
+
+```sh
+pbpaste | rithik scam -                      # macOS
+Get-Clipboard | rithik scam -                # PowerShell
+rithik scam - < message.txt
+```
+
+With `--json`, the report is printed as JSON, and links appear as the message wrote them.
+This is the same check, trimmed to its first reason:
+
+```json
+{
+  "verdict": "scam",
+  "score": 0.964,
+  "reasons": [
+    {
+      "code": "url_brand_impersonation",
+      "label": "Link uses a bank or brand name on a domain that brand does not own.",
+      "evidence": "https://sbi-kyc-help-desk.top/update",
+      "weight": 2.5
+    }
+  ],
+  "urls": [
+    "https://sbi-kyc-help-desk.top/update"
+  ]
+}
+```
+
+The exit code is 0 whenever a check ran, whatever the verdict. It is 2 for a usage error, such
+as a missing or empty message.
+
+## What the checker looks for
+
+The message text is checked for these families of signals:
+
+- urgency and threats
+- KYC, PAN and Aadhaar update requests
+- blocked or suspended accounts
+- electricity disconnection notices
+- UPI PIN requests and UPI collect requests
+- requests for an OTP
+- prize and lottery wins
+- task-based job offers
+- parcels held by a courier or at customs
+- "digital arrest" threats and impersonation of officials
+- remote-access apps and APK files to install
+- loan and investment offers
+- reward points, tax refunds and traffic e-challans
+
+Every link is checked for:
+
+- URL shorteners, which hide where a link goes
+- bare IP addresses used in place of a domain name
+- punycode (`xn--`) domains, which can imitate other scripts
+- lookalike domains that use a bank's or brand's name but are not on its list of official domains
+- domain endings (TLDs) that are common in scam campaigns
+
+Each signal carries a weight, and together they make the score that decides the verdict. Each
+reason in the output names the words or the link that triggered it, so you can judge it for
+yourself.
+
+## Accuracy
+
+Measured results, and how the evaluation set was built, are in
+[docs/EVAL.md](https://github.com/Daemon-VI/rithik/blob/main/docs/EVAL.md).
+This README gives no figures, so that it cannot drift out of step with that file.
+
+## Limitations
+
+- It is a heuristic. It recognises patterns that someone wrote down, and it will miss new or
+  unusual scams.
+- It understands English and Hinglish (Hindi written in the Latin alphabet) only.
+- A result of `NO KNOWN SCAM SIGNALS` is not a guarantee that a message is safe.
+- It never opens links, so it judges a link by its address alone, not by the page behind it.
+- The evaluation set is synthetic: messages written from public fraud advisories rather than
+  collected from real people. Its scores describe that set, not real-world accuracy.
+
+## Privacy
+
+Everything runs on your machine. `rithik` makes no network requests, stores nothing, and
+collects no telemetry. The message you check exists only in the running process.
+
+## Where to report fraud in India
+
+- **Lost money?** Call the National Cyber Crime Helpline, **1930**, as soon as possible, or
+  file a complaint at <https://cybercrime.gov.in>.
+- **Fraud calls, SMS or WhatsApp messages:** report them through Chakshu at
+  <https://sancharsaathi.gov.in>.
+- Contact your bank directly, using the number printed on your card or the bank's official
+  app.
+
+## Contributing
+
+To catch a new pattern, add a rule together with a unit test that shows it firing on a
+message it should catch and staying quiet on a similar genuine one.
+
+```sh
+uv sync
+uv run pytest -q
+uv run ruff check
+uv run ruff format
+uv run python scripts/export_golden.py   # after any behaviour change
+npm test                                 # the JavaScript port must still match
+```
+
+A rule change goes into both `src/rithik/scam/` and its mirror in `js/lib/scam/`. Change the
+Python first, regenerate the golden files, then bring the port level until `npm test` passes.
+
+Some constraints apply:
+
+- The code must run on Python 3.9 and Node 18, and use only the standard library.
+- It must never touch the network.
+- Test messages must be invented. Never use a real person's message, number or account.
+- Scam links in tests must use invented domains.
+
+Releases are covered in [docs/RELEASING.md](https://github.com/Daemon-VI/rithik/blob/main/docs/RELEASING.md).
+
+## License
+
+MIT. See [LICENSE](https://github.com/Daemon-VI/rithik/blob/main/LICENSE).
+
+---
+
+Made by [Rithik Krishna T](https://github.com/Daemon-VI).

rithik-0.1.1/README.md

@@ -0,0 +1,233 @@
+# rithik
+
+[![ci](https://github.com/Daemon-VI/rithik/actions/workflows/ci.yml/badge.svg)](https://github.com/Daemon-VI/rithik/actions/workflows/ci.yml)
+
+`rithik` prints my card in your terminal, and it checks suspicious messages and links for the
+scam patterns common in India, entirely offline. Paste in an SMS, a WhatsApp forward or a link,
+and it tells you which known patterns matched, why they matter, and what to do next.
+
+## Install
+
+With Node.js 18 or newer, you can run it without installing anything:
+
+```sh
+npx rithik                          # once it is published to npm
+npx github:Daemon-VI/rithik         # works now, straight from GitHub
+npm install -g rithik               # or keep the `rithik` command around
+```
+
+npm 12 refuses packages fetched from git unless you allow it, so on npm 12 the GitHub form is
+`npx --allow-git=root github:Daemon-VI/rithik`. The npm 10 and 11 releases that ship with
+Node 18 to 24 need no flag.
+
+With Python 3.9 or newer:
+
+```sh
+pipx install git+https://github.com/Daemon-VI/rithik   # works now
+pipx install rithik                                    # once it is published to PyPI
+uvx rithik                                             # run once without installing
+```
+
+Neither version has any dependencies. If the `rithik` script is not on your `PATH`,
+`python -m rithik` does the same thing.
+
+### One engine, two runtimes
+
+The Python package is the reference implementation, and the npm package is a JavaScript port
+of it. The port is tested against golden files generated from the Python code: every corpus
+message and edge case must produce the same verdict, reasons and score, and the terminal output
+must match byte for byte. CI fails if the Python code changes and the golden files are not
+regenerated.
+
+## Usage
+
+```sh
+rithik                     # the card
+rithik card --json         # the card as JSON
+rithik scam "<message or link>"
+rithik scam -              # read the message from standard input
+rithik --version
+```
+
+`--no-color` turns colour off, and so does the `NO_COLOR` environment variable. Colour is also
+off whenever the output is not a terminal. `--json` prints only JSON, so scripts can use it.
+
+### Checking a message
+
+The quotes matter, because they keep your shell from interpreting the message.
+
+```sh
+rithik scam "Dear customer, your SBI account will be blocked today. Update KYC now: https://sbi-kyc-help-desk.top/update"
+```
+
+The output (real, from v0.1.0):
+
+```text
+LIKELY SCAM  (score 0.96 of 1.00)
+
+Why
+  - Link uses a bank or brand name on a domain that brand does not own:
+    "hxxps://sbi-kyc-help-desk[.]top/update"
+  - Asks you to update or verify KYC, PAN or Aadhaar through a message: "KYC
+    now: hxxps://sbi-kyc-help-desk[.]top/update"
+  - Claims your bank account, card or UPI will be blocked unless you act:
+    "account will be blocked"
+  - Link uses a cheap domain ending that is common in phishing:
+    "hxxps://sbi-kyc-help-desk[.]top/update"
+  - Threatens a loss or penalty to rush you: "will be blocked"
+  - Asks for something and gives a link that is not an official site:
+    "hxxps://sbi-kyc-help-desk[.]top/update"
+
+Links in the message
+  - hxxps://sbi-kyc-help-desk[.]top/update
+  (dots shown as [.] so the links cannot be opened by accident)
+
+What to do
+  - Do not click the links, call the numbers or install anything the message
+    asks for.
+  - Never share an OTP, UPI PIN or card details, and remember that you never
+    need your UPI PIN to receive money.
+  - Verify through your bank's official app, or the number printed on your
+    card, not a number from the message.
+  - If money was taken, call 1930 at once or report it at
+    https://cybercrime.gov.in
+  - Report the fraud SMS or call through Chakshu at
+    https://sancharsaathi.gov.in
+```
+
+The verdict is one of `LIKELY SCAM`, `SUSPICIOUS` or `NO KNOWN SCAM SIGNALS`. The last one is
+worded that way on purpose, because it only means that none of the known patterns matched:
+
+```text
+NO KNOWN SCAM SIGNALS  (score 0.00 of 1.00)
+
+None of the scam patterns this checker knows matched. That is not a guarantee
+that the message is genuine: new scams appear all the time. Before you pay, or
+share an OTP or PIN, verify through the official app or website.
+```
+
+A long message is easier to pipe in:
+
+```sh
+pbpaste | rithik scam -                      # macOS
+Get-Clipboard | rithik scam -                # PowerShell
+rithik scam - < message.txt
+```
+
+With `--json`, the report is printed as JSON, and links appear as the message wrote them.
+This is the same check, trimmed to its first reason:
+
+```json
+{
+  "verdict": "scam",
+  "score": 0.964,
+  "reasons": [
+    {
+      "code": "url_brand_impersonation",
+      "label": "Link uses a bank or brand name on a domain that brand does not own.",
+      "evidence": "https://sbi-kyc-help-desk.top/update",
+      "weight": 2.5
+    }
+  ],
+  "urls": [
+    "https://sbi-kyc-help-desk.top/update"
+  ]
+}
+```
+
+The exit code is 0 whenever a check ran, whatever the verdict. It is 2 for a usage error, such
+as a missing or empty message.
+
+## What the checker looks for
+
+The message text is checked for these families of signals:
+
+- urgency and threats
+- KYC, PAN and Aadhaar update requests
+- blocked or suspended accounts
+- electricity disconnection notices
+- UPI PIN requests and UPI collect requests
+- requests for an OTP
+- prize and lottery wins
+- task-based job offers
+- parcels held by a courier or at customs
+- "digital arrest" threats and impersonation of officials
+- remote-access apps and APK files to install
+- loan and investment offers
+- reward points, tax refunds and traffic e-challans
+
+Every link is checked for:
+
+- URL shorteners, which hide where a link goes
+- bare IP addresses used in place of a domain name
+- punycode (`xn--`) domains, which can imitate other scripts
+- lookalike domains that use a bank's or brand's name but are not on its list of official domains
+- domain endings (TLDs) that are common in scam campaigns
+
+Each signal carries a weight, and together they make the score that decides the verdict. Each
+reason in the output names the words or the link that triggered it, so you can judge it for
+yourself.
+
+## Accuracy
+
+Measured results, and how the evaluation set was built, are in
+[docs/EVAL.md](https://github.com/Daemon-VI/rithik/blob/main/docs/EVAL.md).
+This README gives no figures, so that it cannot drift out of step with that file.
+
+## Limitations
+
+- It is a heuristic. It recognises patterns that someone wrote down, and it will miss new or
+  unusual scams.
+- It understands English and Hinglish (Hindi written in the Latin alphabet) only.
+- A result of `NO KNOWN SCAM SIGNALS` is not a guarantee that a message is safe.
+- It never opens links, so it judges a link by its address alone, not by the page behind it.
+- The evaluation set is synthetic: messages written from public fraud advisories rather than
+  collected from real people. Its scores describe that set, not real-world accuracy.
+
+## Privacy
+
+Everything runs on your machine. `rithik` makes no network requests, stores nothing, and
+collects no telemetry. The message you check exists only in the running process.
+
+## Where to report fraud in India
+
+- **Lost money?** Call the National Cyber Crime Helpline, **1930**, as soon as possible, or
+  file a complaint at <https://cybercrime.gov.in>.
+- **Fraud calls, SMS or WhatsApp messages:** report them through Chakshu at
+  <https://sancharsaathi.gov.in>.
+- Contact your bank directly, using the number printed on your card or the bank's official
+  app.
+
+## Contributing
+
+To catch a new pattern, add a rule together with a unit test that shows it firing on a
+message it should catch and staying quiet on a similar genuine one.
+
+```sh
+uv sync
+uv run pytest -q
+uv run ruff check
+uv run ruff format
+uv run python scripts/export_golden.py   # after any behaviour change
+npm test                                 # the JavaScript port must still match
+```
+
+A rule change goes into both `src/rithik/scam/` and its mirror in `js/lib/scam/`. Change the
+Python first, regenerate the golden files, then bring the port level until `npm test` passes.
+
+Some constraints apply:
+
+- The code must run on Python 3.9 and Node 18, and use only the standard library.
+- It must never touch the network.
+- Test messages must be invented. Never use a real person's message, number or account.
+- Scam links in tests must use invented domains.
+
+Releases are covered in [docs/RELEASING.md](https://github.com/Daemon-VI/rithik/blob/main/docs/RELEASING.md).
+
+## License
+
+MIT. See [LICENSE](https://github.com/Daemon-VI/rithik/blob/main/LICENSE).
+
+---
+
+Made by [Rithik Krishna T](https://github.com/Daemon-VI).