Sentinel AI

Runtime watchdog for Python package installations

Detects malicious .pth files and suspicious behaviors during Python package installations — inspired by the LiteLLM PyPI attack.

Features

• Detects .pth files that execute code automatically
• Monitors access to sensitive files (SSH keys, .env)
• CLI with instant feedback and color-coded alerts
• Demonstration script to simulate a malicious package

Installation

```bash pip install -r requirements.txt ```

Usage

Simulate a malicious package

```bash python simulate_attack.py ```

Scan a package

```bash python cli.py scan-install requests ```

Example output: ``` 🚨 HIGH RISK DETECTED

• /path/to/malicious_test.pth → Contains executable import statement Recommendation: DO NOT TRUST this package ```

License

MIT