Summary
neurobrix v0.1.4 was classified as CRITICAL RISK with a risk score of 2837. Sigil detected 206 findings across 1266 files, covering phases including provenance, network exfiltration, code patterns, obfuscation, install hooks. Review the findings below before installing this package.
Package description: Universal Deep Learning Inference Engine — execute any AI model without model-specific code
v0.1.4
28 April 2026, 23:09 UTC
by Sigil Bot
Risk Score
2837
Findings
206
Files Scanned
1266
Provenance
Findings by Phase
Phase Ordering
Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/_distutils/core.py:48
# Some mild magic to control the behaviour of 'setup()' from 'run_setup()'.
_setup_stop_after = NoneWhy was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/_distutils/core.py:234
'stop_after' tells 'setup()' when to stop processing; possible
values:Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/build_meta.py:127
'No distribution was found. Ensure that `setup.py` '
'is not empty and that it calls `setup()`.'
) from NoneWhy was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-setup-py-cmdclass
CRITICALsetup.py overrides cmdclass — may execute code during install
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/config/_validate_pyproject/fastjsonschema_validations.py:35
if not isinstance(data, (dict)):
raise JsonSchemaValueException("" + (name_prefix or "data") + " must be object", value=data, name="" + (name_prefix or "data") + "", definition={'$schema': 'http://json-schema.org/draft-07/schema#', '$id': 'https://packaging.python.org/en/latest/specifications/declaring-build-dependencies/', 'title': 'Data structure for ``pyproject.toml`` files', '$$description': ['File format containing build-time configurations for the Python ecosystem. ', ':pep:`51Why was this flagged?
This package overrides Python's setup.py cmdclass, which allows arbitrary code to execute during pip install. This is the primary attack vector for malicious PyPI packages — attackers use it to steal credentials, install backdoors, or download additional payloads before the developer ever runs the code. Rated CRITICAL because it executes automatically with no user interaction required.
install-setup-py-cmdclass
CRITICALsetup.py overrides cmdclass — may execute code during install
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/config/_validate_pyproject/fastjsonschema_validations.py:90
if not isinstance(data__tool, (dict)):
raise JsonSchemaValueException("" + (name_prefix or "data") + ".tool must be object", value=data__tool, name="" + (name_prefix or "data") + ".tool", definition={'type': 'object', 'properties': {'distutils': {'$schema': 'http://json-schema.org/draft-07/schema#', '$id': 'https://setuptools.pypa.io/en/latest/deprecated/distutils/configfile.html', 'title': '``tool.distutils`` table', '$$description': ['**EXPERIMENTAL** (NOT OFFICIALLWhy was this flagged?
This package overrides Python's setup.py cmdclass, which allows arbitrary code to execute during pip install. This is the primary attack vector for malicious PyPI packages — attackers use it to steal credentials, install backdoors, or download additional payloads before the developer ever runs the code. Rated CRITICAL because it executes automatically with no user interaction required.
install-setup-py-cmdclass
CRITICALsetup.py overrides cmdclass — may execute code during install
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/config/_validate_pyproject/fastjsonschema_validations.py:154
if data_keys:
raise JsonSchemaValueException("" + (name_prefix or "data") + " must not contain "+str(data_keys)+" properties", value=data, name="" + (name_prefix or "data") + "", definition={'$schema': 'http://json-schema.org/draft-07/schema#', '$id': 'https://packaging.python.org/en/latest/specifications/declaring-build-dependencies/', 'title': 'Data structure for ``pyproject.toml`` files', '$$description': ['File format containing build-time configurations for the Python ecWhy was this flagged?
This package overrides Python's setup.py cmdclass, which allows arbitrary code to execute during pip install. This is the primary attack vector for malicious PyPI packages — attackers use it to steal credentials, install backdoors, or download additional payloads before the developer ever runs the code. Rated CRITICAL because it executes automatically with no user interaction required.
install-setup-py-cmdclass
CRITICALsetup.py overrides cmdclass — may execute code during install
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/config/_validate_pyproject/fastjsonschema_validations.py:159
if not isinstance(data, (dict)):
raise JsonSchemaValueException("" + (name_prefix or "data") + " must be object", value=data, name="" + (name_prefix or "data") + "", definition={'$schema': 'http://json-schema.org/draft-07/schema#', '$id': 'https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html', 'title': '``tool.setuptools`` table', '$$description': ['``setuptools``-specific configurations that can be set by users that require', 'customization.', 'These configurations aWhy was this flagged?
This package overrides Python's setup.py cmdclass, which allows arbitrary code to execute during pip install. This is the primary attack vector for malicious PyPI packages — attackers use it to steal credentials, install backdoors, or download additional payloads before the developer ever runs the code. Rated CRITICAL because it executes automatically with no user interaction required.
install-setup-py-cmdclass
CRITICALsetup.py overrides cmdclass — may execute code during install
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/config/_validate_pyproject/fastjsonschema_validations.py:455
if not isinstance(data__cmdclass, (dict)):
raise JsonSchemaValueException("" + (name_prefix or "data") + ".cmdclass must be object", value=data__cmdclass, name="" + (name_prefix or "data") + ".cmdclass", definition={'$$description': ['Mapping of distutils-style command names to ``setuptools.Command`` subclasses', 'which in turn should be represented by strings with a qualified class name', '(i.e., "dotted" form with module), e.g.::\n\n', ' cmdclass = {mycmd = "pkg.Why was this flagged?
This package overrides Python's setup.py cmdclass, which allows arbitrary code to execute during pip install. This is the primary attack vector for malicious PyPI packages — attackers use it to steal credentials, install backdoors, or download additional payloads before the developer ever runs the code. Rated CRITICAL because it executes automatically with no user interaction required.
install-setup-py-cmdclass
CRITICALsetup.py overrides cmdclass — may execute code during install
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/config/_validate_pyproject/fastjsonschema_validations.py:589
if data_keys:
raise JsonSchemaValueException("" + (name_prefix or "data") + " must not contain "+str(data_keys)+" properties", value=data, name="" + (name_prefix or "data") + "", definition={'$schema': 'http://json-schema.org/draft-07/schema#', '$id': 'https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html', 'title': '``tool.setuptools`` table', '$$description': ['``setuptools``-specific configurations that can be set by users that require', 'customization.', 'TWhy was this flagged?
This package overrides Python's setup.py cmdclass, which allows arbitrary code to execute during pip install. This is the primary attack vector for malicious PyPI packages — attackers use it to steal credentials, install backdoors, or download additional payloads before the developer ever runs the code. Rated CRITICAL because it executes automatically with no user interaction required.
install-setup-py-cmdclass
CRITICALsetup.py overrides cmdclass — may execute code during install
neurobrix-0.1.4/.venv-mac/lib/python3.11/site-packages/setuptools/config/setuptools.schema.json:186
"(i.e., \"dotted\" form with module), e.g.::\n\n",
" cmdclass = {mycmd = \"pkg.subpkg.module.CommandClass\"}\n\n",
"The command class should be a directly defined at the top-level of the",Why was this flagged?
This package overrides Python's setup.py cmdclass, which allows arbitrary code to execute during pip install. This is the primary attack vector for malicious PyPI packages — attackers use it to steal credentials, install backdoors, or download additional payloads before the developer ever runs the code. Rated CRITICAL because it executes automatically with no user interaction required.
Badge
Markdown
[](https://sigilsec.ai/scans/1082938A-6D58-4E1C-8A7C-DC4BD35CD412)HTML
<a href="https://sigilsec.ai/scans/1082938A-6D58-4E1C-8A7C-DC4BD35CD412"><img src="https://sigilsec.ai/badge/pypi/neurobrix" alt="Sigil Scan"></a>Run This Scan Yourself
Scan your own packages
Run Sigil locally to audit any package before it touches your codebase.
Early Access
Get cloud scanning, threat intel, and CI/CD integration.
Join 150+ developers on the waitlist.
Get threat intelligence and product updates
Security research, new threat signatures, and product updates. No spam.
Other pypi scans
Believe this result is incorrect? Request a review or see our Terms of Service and Methodology.