Skip to content

Draft build screen - #6670

Open
klyusba wants to merge 6 commits into
phase-rs:mainfrom
klyusba:draft-build-screen
Open

Draft build screen#6670
klyusba wants to merge 6 commits into
phase-rs:mainfrom
klyusba:draft-build-screen

rollback manacurve

543b415
Select commit
Loading
Failed to load commit list.
Superagent Security / Contributor trust completed Jul 27, 2026 in 1s

Contributor trust inconclusive

Investigator 2 reviewed 1 of 4 candidate PRs (pytubefix#576). The single hydrated PR is a benign typo fix ('ftm=' -> 'fmt=' in a URL format-parameter check) accompanied by standard version bumps from 10.3.5 to 10.3.6. No malicious execution paths, network calls, dependency changes, obfuscation, or permission modifications were found. However, 3 of 4 candidate PRs were assigned to other investigators and are not visible in this shard. The contributor's public activity metrics show zero events/PRs/pushes, yet 4 cross-repository candidate PRs exist, creating uncertainty about unreviewed contributions. A confident safety verdict cannot be rendered from a single minor typo-fix PR when the majority of candidate contributions remain unexamined. Investigator 3 was assigned 1 of 4 candidate PRs in the evidence shard: klyusba/yandex_cup_2022#1. This PR adds a standard MIT license (LICENSE.md) to the contributor's own repository. The patch contains only boilerplate license text with no code, no execution paths, no dependencies, and no network activity. It is a clean, metadata-only change. However, the contributor's current PR (#6663) is not included in this shard, and although the metadata claims 4 hydrated PRs with 0 omissions, only 1 PR is actually present in the evidence JSON. This severe data truncation means the majority of the contributor's candidate history could not be adversarially reviewed. Without visibility into the remaining PRs, a conclusive safety or danger verdict cannot be rendered.