PyPI / botocore / 1.43.117

botocore 1.43.117

Source

https://github.com/boto/botocore

Artifact scanned

botocore-1.43.117-py3-none-any.whl (wheel · 15.3 MB · SHA-256 5920ef9b3002…)

Compared with

botocore-1.43.116-py3-none-any.whl (0 signals introduced since)

Files

78 scanned, 1937 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

4.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-22 23:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-import botocore/vendored/six.py:87:5

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       """Import module, returning the module after the last dot."""
       __import__(name)
       return sys.modules[name]

   likely benign LLM, confidence 0.97 Vendored six.py helper that imports a module by dotted name and returns it from sys.modules.

   Reasoning

   This is the standard `import_module` helper from the six compatibility library, vendored unchanged into botocore. `__import__(name)` followed by `sys.modules[name]` is the usual way six imports a dotted module name. The name is supplied by library code, not by attacker-controlled input, and the snippet has no decoding, network access or process spawning. The critical severity reflects the dynamic-import pattern alone.

2. info critical → info by review frame-introspection botocore/vendored/six.py:728:21

   `sys._getframe` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)

           if _globs_ is None:
               frame = sys._getframe(1)
               _globs_ = frame.f_globals
               if _locs_ is None:

   likely benign LLM, confidence 0.97 Vendored six.py exec_ shim that reads the caller's globals via sys._getframe for Python 2/3 compatibility.

   Reasoning

   This is six's `exec_` compatibility shim, which uses `sys._getframe(1)` to read the caller's globals when none are passed. It is a well-known, legitimate pattern in six. The 'anti-analysis' note only fires because six also defines `exec_` and `sys.exit` in the same file. Nothing here hides behaviour or reaches the network.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o botocore-1.43.117-py3-none-any.whl https://files.pythonhosted.org/packages/10/94/050e35c9febf6dd2fce4a76be587ae4a323964865700467d9d7b082f7133/botocore-1.43.117-py3-none-any.whl
printf '%s  %s\n' 5920ef9b3002e1361846549078549d9154a6e0004c22853c01ce7b279d05d495 botocore-1.43.117-py3-none-any.whl | shasum -a 256 -c -
unzip -q botocore-1.43.117-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg