PyPI · pypi.org

stee-nino

Py Install Time Subprocess: subprocess call — process spawning.

Why PkgRadar flagged 0.1.6

Severity	Signal	Evidence
medium	Py Install Time Subprocess	subprocess call — process spawning. · stee_nino-0.1.6/hermes_cli/setup.py
medium	Py Install Time Subprocess	subprocess call — process spawning. · stee_nino-0.1.6/skills/productivity/google-workspace/scripts/setup.py
high	Py Install Time Network Call	Network call (urllib/requests/httpx/http.client) at install or import time. · stee_nino-0.1.6/skills/productivity/google-workspace/scripts/setup.py
medium	Py Import Time Subprocess	subprocess call — process spawning. · stee_nino-0.1.6/plugins/memory/byterover/__init__.py
medium	Py Import Time Subprocess	subprocess call — process spawning. · stee_nino-0.1.6/plugins/memory/hindsight/__init__.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · stee_nino-0.1.6/gateway/platforms/webhook.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · stee_nino-0.1.6/hermes_cli/clipboard.py
high	Credential file access	matched ".npmrc" · stee_nino-0.1.6/hermes_cli/security_advisories.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · stee_nino-0.1.6/hermes_cli/web_server.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · stee_nino-0.1.6/skills/productivity/google-workspace/scripts/google_api.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · stee_nino-0.1.6/tools/tts_tool.py
high	Py Import Time Network Call	Network call (urllib/requests/httpx/http.client) at install or import time. · stee_nino-0.1.6/plugins/dashboard_auth/nous/__init__.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.1.6`	High risk	365	2026-06-03
`0.1.5`	High risk	365	2026-06-03
`0.1.4`	High risk	365	2026-06-03
`0.1.3`	High risk	365	2026-06-03
`0.1.2`	High risk	365	2026-06-03
`0.1.1`	High risk	365	2026-06-03
`0.1.0`	High risk	365	2026-06-03

Block this in CI

PkgRadar gates stee-nino (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi stee-nino==0.1.6

Start free — 25 scans / mo View full evidence