feat(heuristics): add Fake Email analyzer to validate maintainer email domain #1106
+259
−8
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
oracle-contributor-agreement
bot
added
the
OCA Verified
AmineRaouane
force-pushed
the
fake-emails-heuristic
branch
from
c6f35f7 to
8d29103
Compare
AmineRaouane
force-pushed
the
fake-emails-heuristic
branch
5 times, most recently
from
f945882 to
a7103e4
Compare
benmss
reviewed
Jul 9, 2025
benmss
reviewed
Jul 9, 2025
benmss
reviewed
Jul 9, 2025
src/macaron/malware_analyzer/pypi_heuristics/metadata/fake_email.py
Outdated
Show resolved
Hide resolved
…l domains Signed-off-by: Amine <amine.raouane@enim.ac.ma>
Signed-off-by: Amine <amine.raouane@enim.ac.ma>
Signed-off-by: Amine <amine.raouane@enim.ac.ma>
AmineRaouane
force-pushed
the
fake-emails-heuristic
branch
from
759ab97 to
d99495c
Compare
benmss
reviewed
Jul 14, 2025
benmss
reviewed
Jul 14, 2025
…mail domain validation Signed-off-by: Amine <amine.raouane@enim.ac.ma>
AmineRaouane
force-pushed
the
fake-emails-heuristic
branch
from
d99495c to
a8d373b
Compare
benmss
approved these changes
Jul 15, 2025
behnazh-w
requested changes
Jul 18, 2025
| """ | ||
| emailinfo = None | ||
| try: | ||
| emailinfo = validate_email(email, check_deliverability=True) |
There was a problem hiding this comment.
Can you please make check_deliverability configurable via defaults.ini so that you can turn it off in unit tests? We try to avoid network calls in our unit tests.
| analyzer: FakeEmailAnalyzer, pypi_package_json_asset_mock: MagicMock, mock_validate_email: MagicMock | ||
| ) -> None: | ||
| """Test analyzer passes when only maintainer_email is present and valid.""" | ||
| email = "maintainer@example.net" |
There was a problem hiding this comment.
is example.net supposed to be a valid domain?
There was a problem hiding this comment.
Yes and no. The domain is technically valid, but it’s reserved by IANA and not intended for real-world use. So to ensure the email is actually usable by a real user, Should I add a list of reserved domains and TLDs and check against them before proceeding with validation or acceptance, or should I keep it as it is?
| validated_emails = info.get("validated_emails") | ||
| assert isinstance(validated_emails, list) | ||
| assert len(validated_emails) == 2 | ||
| assert {"normalized": "author@example.com", "local_part": "author", "domain": "example.com"} in validated_emails |
There was a problem hiding this comment.
Same question, if example.com is supposed to be a valid domain.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a new heuristic analyzer called
FakeEmailAnalyzer. It verifies the validity of maintainer email addresses listed in a PyPI package by checking both the format and the existence of MX records for their domains. This helps detect packages with fake or throwaway emails, which are often indicative of malicious intent.Description of changes
FakeEmailAnalyzerthat:detect_malicious_metadata_check.pyto include and invoke this new analyzer.Related issues
None
Checklist
verifiedlabel should appear next to all of your commits on GitHub.