PyPI / cbor2 / 6.2.0

cbor2 6.2.0

Source

https://github.com/agronholm/cbor2

Artifact scanned

cbor2-6.2.0.tar.gz (sdist · 98.6 KB · SHA-256 85f87591f85b…)

Compared with

cbor2-6.1.5.tar.gz (2 signals introduced since)

Files

47 scanned, 12 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.9 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-11-01 15:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution tests/test_sequence_docs.py:26:5 new in this release

   `exec` called on a non-literal expression (ast pass, confidence 0.70)

       # Execute the checked-in documentation, not a separate copy of the recipe.
       exec(compile(dedent(match[1]), str(usage), "exec"), namespace)

   likely benign LLM, confidence 0.80 Doc-test harness that compiles and execs a code block extracted from a checked-in documentation file.

   Reasoning

   The test extracts a code block from a checked-in documentation file and executes it, with a comment stating the intent is to run the real documentation rather than a copy. This is a doc-testing pattern. The source is the repository's own docs, so there is no evidence of hidden or remote payload. The exec is still a dynamic execution of text pulled from a file, so it is not fully free of risk.

2. info warn → info by review dynamic-execution tests/test_sequence_docs.py:26:10 new in this release

   `compile` called on a non-literal expression (ast pass, confidence 0.70)

       # Execute the checked-in documentation, not a separate copy of the recipe.
       exec(compile(dedent(match[1]), str(usage), "exec"), namespace)

   likely benign LLM, confidence 0.80 The compile call that feeds the doc-test exec, compiling a documentation code block with its source path as filename.

   Reasoning

   This compile call is the inner part of the same exec(compile(...)) doc-test pattern flagged in the exec finding. It compiles text from the repository's own documentation, with the filename set to the doc path, so it is not an obfuscation or malicious construct.

3. info critical → info by review dynamic-execution .github/workflows/test.yml:41:9

   [embedded bash] `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

           eval "$(cargo llvm-cov show-env --manifest-path rust/Cargo.toml --sh)"
           pip install --group test -e .
           coverage run -m pytest -v

   likely benign LLM, confidence 0.85 CI step that evals cargo-llvm-cov's generated shell environment exports before running coverage tests.

   Reasoning

   The eval runs the stdout of `cargo llvm-cov show-env --sh`, a standard way to export coverage instrumentation environment variables into the shell. The input comes from a trusted local build tool in CI, not from untrusted data or a remote source, and the following lines are ordinary pip and pytest steps. Eval of tool output is a poor practice but is a common, legitimate pattern here.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o cbor2-6.2.0.tar.gz https://files.pythonhosted.org/packages/49/22/4a1d4b8436f46caf4a4b7d841b9c1314226090345bee171de7419ba47b84/cbor2-6.2.0.tar.gz
printf '%s  %s\n' 85f87591f85bd60e35550b2e093630cb036580e6f1d8b7777089dee194a33e42 cbor2-6.2.0.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf cbor2-6.2.0.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg