PyPI / cbor2 / 6.2.0.post1

cbor2 6.2.0.post1

Source

https://github.com/agronholm/cbor2

Artifact scanned

cbor2-6.2.0.post1.tar.gz (sdist · 98.7 KB · SHA-256 2465ecef686b…)

Compared with

cbor2-6.2.0.tar.gz (0 signals introduced since)

Files

47 scanned, 12 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-11-01 15:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review dynamic-execution .github/workflows/test.yml:41:9

   [embedded bash] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

           eval "$(cargo llvm-cov show-env --manifest-path rust/Cargo.toml --sh)"
           pip install --group test -e .
           coverage run -m pytest -v

   likely benign LLM, confidence 0.90 CI workflow evals the shell environment exports printed by cargo-llvm-cov before running coverage tests.

   Reasoning

   The eval runs the output of `cargo llvm-cov show-env --sh`, a documented cargo-llvm-cov command that prints shell exports for coverage instrumentation. It is a common CI idiom. The command is fixed and runs in a test workflow with no network input or encoded payload, so it is not a dropper. The critical severity overstates the risk here.

2. info warn → info by review dynamic-execution tests/test_sequence_docs.py:26:5

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       # Execute the checked-in documentation, not a separate copy of the recipe.
       exec(compile(dedent(match[1]), str(usage), "exec"), namespace)

   likely benign LLM, confidence 0.85 Test executes Python code blocks extracted from the repository's own documentation to verify the examples work.

   Reasoning

   The test extracts a code block from the checked-in usage documentation and executes it, as the comment states, so that the docs themselves are tested. The source is a repository file, not remote or encoded data, so the exec is a deliberate doc-testing technique rather than hidden malicious behavior.

3. info warn → info by review dynamic-execution tests/test_sequence_docs.py:26:10

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

       # Execute the checked-in documentation, not a separate copy of the recipe.
       exec(compile(dedent(match[1]), str(usage), "exec"), namespace)

   likely benign LLM, confidence 0.85 compile call that prepares the extracted documentation snippet for the test's exec.

   Reasoning

   This compile call is the input to the exec on the previous line and compiles documentation text from a checked-in file with a named filename. It is part of the same benign doc-testing mechanism and has no independent malicious indicator.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o cbor2-6.2.0.post1.tar.gz https://files.pythonhosted.org/packages/e6/06/c4f5a74784e5e040b2fac0efa440691f37d775bd8b32fbfb3251124155a4/cbor2-6.2.0.post1.tar.gz
printf '%s  %s\n' 2465ecef686b61e9feee840f506ef1cc15fa568825344c7b0af504b8230b698c cbor2-6.2.0.post1.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf cbor2-6.2.0.post1.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg