Package evidence

sitellm==0.5.6

Py Runtime Dynamic Dangerous Import: Dynamic __import__('os') — reflection bypass for static checks.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 35
First published: Apr 2026
Publisher: maple5218

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["sitellm==0.5.6"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["sitellm==0.5.6"],"fail_on":"high"}'

Publishermaple5218

Artifact bytes14,829,493

Previous versionnone

Published2026-06-12T09:34:58

SHA-2560f4922f3f20a151c207553f473510e2d6f1fccd73e9151d2b46fbf47e3256943

Why flagged

What the scanner saw

Py Runtime Dynamic Dangerous Import: Dynamic __import__('os') — reflection bypass for static checks.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

28h agoLast checked

highRisk

130Score

0.5.6Version

Status history (1 event)

new → available28h ago · risk high · score 130 · status changed

Evidence

Static findings

51 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Py Runtime Dynamic Dangerous Import	sitellm-0.5.6/sitellm/integrations/gcs_bucket/gcs_bucket_mock_client.py	Dynamic __import__('os') — reflection bypass for static checks.	30
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_edit/vertex_gemini_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_edit/vertex_imagen_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_generation/vertex_gemini_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_generation/vertex_imagen_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/utils.py	matched "AWS_ACCESS_KEY"	10

Show all 51 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Py Runtime Dynamic Dangerous Import	sitellm-0.5.6/sitellm/integrations/gcs_bucket/gcs_bucket_mock_client.py	Dynamic __import__('os') — reflection bypass for static checks.	30
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_edit/vertex_gemini_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_edit/vertex_imagen_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_generation/vertex_gemini_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/image_generation/vertex_imagen_transformation.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	10
medium	Credential file access	sitellm-0.5.6/sitellm/utils.py	matched "AWS_ACCESS_KEY"	10
low	Credential file access	sitellm-0.5.6/sitellm/_logging.py	matched "aws_secret_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/caching/caching.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/caching/s3_cache.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/experimental_mcp_client/client.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/integrations/focus/destinations/factory.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/integrations/focus/destinations/s3_destination.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/integrations/s3.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/integrations/s3_v2.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/integrations/sqs.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/litellm_core_utils/get_litellm_params.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/llms/bedrock/base_aws_llm.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/llms/bedrock/common_utils.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/llms/bedrock/files/handler.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/llms/bedrock/files/transformation.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/llms/bedrock/realtime/handler.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/vertex_ai_aws_wif.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/llms/vertex_ai/vertex_ai_non_gemini.py	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	sitellm-0.5.6/sitellm/main.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/_experimental/mcp_server/db.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/_experimental/mcp_server/mcp_server_manager.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/_experimental/out/_next/static/chunks/0.k4r11oejdvm.js	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/_experimental/out/_next/static/chunks/0ztrvt.xib55a.js	matched ".ssh/"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/auth/rds_iam_token.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/common_utils/load_config_utils.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/common_utils/openai_endpoint_utils.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/db/dynamo_db.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py	matched "aws_secret_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/guardrails/guardrail_initializers.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/health_check.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/proxy/management_endpoints/mcp_management_endpoints.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/rag/ingestion/s3_vectors_ingestion.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/realtime_api/main.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/secret_managers/aws_secret_manager_v2.py	matched "AWS_ACCESS_KEY"	5
low	Credential file access	sitellm-0.5.6/sitellm/setup_wizard.py	matched "AWS_ACCESS_KEY"	5
low	Credential file access	sitellm-0.5.6/sitellm/types/guardrails.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/types/mcp.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/types/mcp_server/mcp_server_manager.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/types/rag.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/types/router.py	matched "aws_access_key"	5
low	Credential file access	sitellm-0.5.6/sitellm/integrations/callback_configs.json	matched "aws_access_key"	3
low	Credential file access	sitellm-0.5.6/sitellm/policy_templates_backup.json	matched "aws_access_key"	3
low	Credential file access	sitellm-0.5.6/sitellm/proxy/_new_new_secret_config.yaml	matched "aws_access_key"	3
low	Credential file access	sitellm-0.5.6/sitellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/patterns.json	matched "aws_access_key"	3
low	Credential file access	sitellm-0.5.6/sitellm/proxy/mcp_registry.json	matched "AWS_ACCESS_KEY"	3
low	Credential file access	sitellm-0.5.6/sitellm/proxy/public_endpoints/provider_create_fields.json	matched "aws_access_key"	3