azure-storage-blob 12.31.1

Source: https://github.com/Azure/azure-sdk-for-python
Artifact scanned: azure_storage_blob-12.31.1-py3-none-any.whl (wheel · 445.2 KB · SHA-256 9e012d5f4ab6…)
Compared with: azure_storage_blob-12.31.0-py3-none-any.whl (0 signals introduced since)
Files: 91 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 4.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-30 11:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload azure/storage/blob/_shared/avro/datafile.py:212:28

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            # "raw" (no zlib headers) decompression.  See zlib.h.
            uncompressed = zlib.decompress(data, -15)
            self._datum_decoder = avro_io.BinaryDecoder(io.BytesIO(uncompressed))
        else:
```
likely benign LLM, confidence 0.95 Avro datafile reader that raw-inflates deflate-compressed blocks using zlib.decompress(data, -15).
Reasoning
The snippet is the Avro data file reader's deflate codec path. zlib.decompress with wbits -15 is raw deflate, which the Avro spec uses for the 'deflate' codec. The data being decompressed is the file's own block content, not a hidden embedded payload, and the surrounding comment explicitly references zlib.h raw decompression. This is standard library parsing code.
info ~~warn~~ → info by review encoding-base64 azure/storage/blob/_shared/parser.py:19:25

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)
```
DEVSTORE_ACCOUNT_NAME = "devstoreaccount1"
DEVSTORE_ACCOUNT_KEY = "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw=="
```
likely benign LLM, confidence 0.96 Well-known public Azure Storage emulator (devstoreaccount1) account key constant defined in the SDK's parser module.
Reasoning
The 88-character base64 string is the publicly documented Azurite/Azure Storage emulator account key (devstoreaccount1), which is published in Microsoft's SDK and emulator documentation and is intended for local development only. It is a constant, not an encoded dropper or obfuscated payload. The low compression ratio is typical of random base64 key material. The raw-pass finding is a known false positive for this well-known key.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o azure_storage_blob-12.31.1-py3-none-any.whl https://files.pythonhosted.org/packages/1a/93/b9f0dc477827887aef64012946bdba65e9aad67084ad38044661a72fe47d/azure_storage_blob-12.31.1-py3-none-any.whl
printf '%s  %s\n' 9e012d5f4ab658b7cb8a4581329d7a7aa2bf5f39b4d63baeefaae7f9e90fe6f0 azure_storage_blob-12.31.1-py3-none-any.whl | shasum -a 256 -c -
unzip -q azure_storage_blob-12.31.1-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg