Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"base64",
"MIIDXTCCAkWgAwIBAgIJAL+n2xQ3vBcZMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV\n",
"ascii",
),
likely benign
LLM, confidence 0.90
A base64-encoded certificate fragment used as benchmark input.
Reasoning
The raw base64 match is a PEM certificate fragment in a benchmark script that feeds encoded test input to the detector. It is test data, not a hidden payload, and raw-pass findings have a high false-positive rate.
-
file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
expected_size = num_models * 65536
decomp = zlib.decompressobj()
models: dict[str, bytes] = {}
table = bytearray()
likely benign
LLM, confidence 0.80
Loads bundled zlib-compressed language model tables for the chardet detector.
Reasoning
chardet is an encoding-detection library that ships compressed language models. Decompressing zlib data bundled with the package to load those models is the expected design. The payload is data loaded into a bytes/dict structure, not executed, so this is not a dropper. The residual doubt is that the model data itself is opaque and was not inspected.
-
identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
-
identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
-
identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
-
identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
-
identifier `δοκιμή` contains homoglyph candidates: ο (03BF)→o, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
-
identifier `δοκιμή` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
-
concatenated bytes literal contains 35 `\xNN` escapes (96% of content) — binary payload shape (ast pass, confidence 0.85)
detect(
b"\xc2\xf1\xe5 \xf1\xf7\xe0\xf1\xf2\xeb\xe8\xe2\xfb\xe5 \xf1\xe5\xec"
b"\xfc\xe8 \xef\xee\xf5\xee\xe6\xe8 \xe4\xf0\xf3\xe3 \xed\xe0 \xe4"
b"\xf0\xf3\xe3\xe0"
likely benign
LLM, confidence 0.90
Cyrillic cp1251 sample text written as escaped bytes for detector input.
Reasoning
The byte literal is Windows-1251 encoded Russian text, the sample input for an encoding detector. The escapes are expected for non-ASCII test strings in a character-detection library, and nothing executes or decodes into code.
-
identifier `і` contains homoglyph candidates: і (0456)→i (in string/comment) (raw pass, confidence 0.35)
"\u0456": "\u0438", "\u0406": "\u0418", "\u0491": "\u0433",
-
identifier `Н` contains homoglyph candidates: Н (041D)→H (in string/comment) (raw pass, confidence 0.35)
"\u045a": "\u043d", "\u040a": "\u041d", "\u045b": "\u0442", "\u040b": "\u0422",
-
identifier `Т` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)
"\u045b": "\u0442", "\u040b": "\u0422", "\u045f": "\u0446", "\u040f": "\u0426",
-
identifier `К` contains homoglyph candidates: К (041A)→K (in string/comment) (raw pass, confidence 0.35)
"\u045c": "\u043a", "\u040c": "\u041a", "\u0455": "\u0437", "\u0405": "\u0417",
-
identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)
_SERBIAN_CYRILLIC_TO_GAJ: dict[str, str] = {
"\u0430": "a", "\u0431": "b", "\u0432": "v",
-
identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)
"\u0452": "đ", "\u0435": "e", "\u0436": "ž", "\u0437": "z",
-
identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)
"\u043d": "n", "\u043e": "o", "\u043f": "p", "\u0440": "r",
-
identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)
"\u043f": "p", "\u0440": "r", "\u0441": "s", "\u0442": "t",
-
identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)
"\u0440": "r", "\u0441": "s", "\u0442": "t", "\u045b": "ć",
-
identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)
"\u045b": "ć", "\u0443": "u", "\u0444": "f", "\u0445": "h",
-
identifier `х` contains homoglyph candidates: х (0445)→x (in string/comment) (raw pass, confidence 0.35)
"\u0444": "f", "\u0445": "h", "\u0446": "c", "\u0447": "č",
-
identifier `А` contains homoglyph candidates: А (0410)→A (in string/comment) (raw pass, confidence 0.35)
"\u0448": "š", "\u0410": "A", "\u0411": "B", "\u0412": "V",
-
identifier `В` contains homoglyph candidates: В (0412)→B (in string/comment) (raw pass, confidence 0.35)
"\u0411": "B", "\u0412": "V", "\u0413": "G", "\u0414": "D",
-
identifier `Е` contains homoglyph candidates: Е (0415)→E (in string/comment) (raw pass, confidence 0.35)
"\u0402": "Đ", "\u0415": "E", "\u0416": "Ž", "\u0417": "Z",
-
identifier `К` contains homoglyph candidates: К (041A)→K (in string/comment) (raw pass, confidence 0.35)
"\u0408": "J", "\u041a": "K", "\u041b": "L", "\u041c": "M",
-
identifier `М` contains homoglyph candidates: М (041C)→M (in string/comment) (raw pass, confidence 0.35)
"\u041b": "L", "\u041c": "M", "\u041d": "N", "\u041e": "O",
-
identifier `Н` contains homoglyph candidates: Н (041D)→H (in string/comment) (raw pass, confidence 0.35)
"\u041c": "M", "\u041d": "N", "\u041e": "O", "\u041f": "P",
-
identifier `О` contains homoglyph candidates: О (041E)→O (in string/comment) (raw pass, confidence 0.35)
"\u041d": "N", "\u041e": "O", "\u041f": "P", "\u0420": "R",
-
identifier `Р` contains homoglyph candidates: Р (0420)→P (in string/comment) (raw pass, confidence 0.35)
"\u041f": "P", "\u0420": "R", "\u0421": "S", "\u0422": "T",
-
identifier `С` contains homoglyph candidates: С (0421)→C (in string/comment) (raw pass, confidence 0.35)
"\u0420": "R", "\u0421": "S", "\u0422": "T", "\u040b": "Ć",
-
identifier `Т` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)
"\u0421": "S", "\u0422": "T", "\u040b": "Ć", "\u0423": "U",
-
identifier `Х` contains homoglyph candidates: Х (0425)→X (in string/comment) (raw pass, confidence 0.35)
"\u0424": "F", "\u0425": "H", "\u0426": "C", "\u0427": "Č",
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `η` contains homoglyph candidates: η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `μεγαλύτερη` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `μεγαλύτερη` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
modern = chardet.detect(
-
identifier `μακρά` contains homoglyph candidates: α (03B1)→a, κ (03BA)→k, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
modern = chardet.detect(
-
identifier `μακρά` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
modern = chardet.detect(
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `η` contains homoglyph candidates: η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μεγαλύτερη` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μεγαλύτερη` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μακρά` contains homoglyph candidates: α (03B1)→a, κ (03BA)→k, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μακρά` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
concatenated bytes literal contains 435 `\xNN` escapes (95% of content) — binary payload shape (ast pass, confidence 0.85)
CYRILLIC_WIN1251 = (
b"\xc2\xf1\xe5 \xf1\xf7\xe0\xf1\xf2\xeb\xe8\xe2\xfb\xe5 \xf1\xe5\xec"
b"\xfc\xe8 \xef\xee\xf5\xee\xe6\xe8 \xe4\xf0\xf3\xe3 \xed\xe0 \xe4\xf0"
b"\xf3\xe3\xe0, \xea\xe0\xe6\xe4\xe0\xff \xed\xe5\xf1\xf7\xe0\xf1\xf2"
likely benign
LLM, confidence 0.90
Test fixture of Cyrillic cp1251 prose as escaped bytes.
Reasoning
This is a Cyrillic Windows-1251 text sample in a test file for a character encoding detector. The escaped bytes encode ordinary prose and are used only as test input.
-
base64-like blob (64 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
b"MIICpDCCAYwCCQDU+pQ4pHgSpDANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls\n"
b"b2NhbGhvc3QwHhcNMjMwNTI5MTI0ODQ3WhcNMjQwNTI4MTI0ODQ3WjAUMRIwEAYD\n"
b"VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+\n"
b"7e1RRz+BI/kHMBbOz+FN5bEwMmJ2KKQGXN+yTDaj8bKRMqgJ7MJifi3eFmFnqYg\n"
likely benign
LLM, confidence 0.92
Base64 X.509 certificate body in a test fixture.
Reasoning
The base64 lines are a PEM-style X.509 certificate used as test input for escape or encoding handling. The snippet is a standard certificate with a recognizable END marker, so it is a fixture, not an obfuscated payload.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
b"b2NhbGhvc3QwHhcNMjMwNTI5MTI0ODQ3WhcNMjQwNTI4MTI0ODQ3WjAUMRIwEAYD\n"
b"VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+\n"
b"7e1RRz+BI/kHMBbOz+FN5bEwMmJ2KKQGXN+yTDaj8bKRMqgJ7MJifi3eFmFnqYg\n"
b"-----END CERTIFICATE-----\n"
likely benign
LLM, confidence 0.92
Continuation of a base64 certificate fixture in a test file.
Reasoning
This is a continuation of the same PEM certificate fixture, ending in the END CERTIFICATE line. It is test data for an encoding-related test.
-
concatenated bytes literal contains 34 `\xNN` escapes (99% of content) — binary payload shape (ast pass, confidence 0.85)
_assert_detection(
b"\x841\x953" b"\xce\xd2\xc3\xbb\xd3\xd0\xc2\xf1\xd4\xb9\xa3\xac"
b"\xb4\xe8\xc5\xe8\xb5\xc4\xd6\xbb\xca\xc7\xd2\xbb"
likely benign
LLM, confidence 0.90
Regression-test bytes of GB18030 Chinese text, with a BOM case.
Reasoning
The bytes are GB18030 and GBK-encoded Chinese text, including a comment about the GB18030 encoding of U+FEFF. They are regression-test inputs for issue reproductions in an encoding detector.
-
identifier `καλημέρα` contains homoglyph candidates: κ (03BA)→k, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
("cp866", "вода"),
("iso-8859-7", "καλημέρα"),
("windows-1253", "ευχαριστώ πολύ"),
("windows-1255", "תודה רבה"),
-
identifier `καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
("cp866", "вода"),
("iso-8859-7", "καλημέρα"),
("windows-1253", "ευχαριστώ πολύ"),
("windows-1255", "תודה רבה"),
-
identifier `Все` contains homoglyph candidates: В (0412)→B, с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)
_PRUNING_SAMPLES = [
"Все счастливые семьи похожи друг на друга, каждая несчастливая семья "
"несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
-
identifier `Все` contains homoglyph candidates: В (0412)→B, с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)
"несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
"что муж был в связи с бывшею в их доме француженкою-гувернанткой.".encode(
"windows-1251"
-
identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)
"несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
"что муж был в связи с бывшею в их доме француженкою-гувернанткой.".encode(
"windows-1251"
),
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.