tigris-python-sdk

The code implements ordinary Django and S3-compatible file-upload functionality and contains no clear malicious behavior. The primary risks are incomplete access control and validation around presigned uploads and downloads: client-controlled object keys can cause unintended prefixes or overwrites, and the shown endpoints do not demonstrate authentication, authorization, size/type restrictions, or rate limiting. These omissions require review before production use, but they are not evidence of supply-chain malware.