Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
"base64",
"MIIDXTCCAkWgAwIBAgIJAL+n2xQ3vBcZMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV\n",
"ascii",
),
likely benign
LLM, confidence 0.90
A base64-encoded certificate fragment used as benchmark input.
Reasoning
The raw pass flagged a base64 string that is a PEM certificate fragment ('MIIDXTCC...' begins a standard X.509 DER encoding) used as benchmark input. Certificate text in a test or benchmark script is ordinary, and the raw pass has a high false-positive rate on base64.
-
file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
expected_size = num_models * 65536
decomp = zlib.decompressobj()
models: dict[str, bytes] = {}
table = bytearray()
likely benign
LLM, confidence 0.80
zlib decompression of bundled model tables in chardet's format loader.
Reasoning
chardet ships compressed language and encoding probability models, and this code decompresses them with zlib to build its lookup tables, checking an expected size first. The pattern matches a dropper, but here it is a bounded, documented model-loading routine inside an encoding detection library with no execution of the decompressed data.
-
identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
-
identifier `Καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
-
identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
-
identifier `κόσμε` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
-
identifier `δοκιμή` contains homoglyph candidates: ο (03BF)→o, κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)
-
identifier `δοκιμή` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
-
concatenated bytes literal contains 35 `\xNN` escapes (96% of content) — binary payload shape (ast pass, confidence 0.85)
detect(
b"\xc2\xf1\xe5 \xf1\xf7\xe0\xf1\xf2\xeb\xe8\xe2\xfb\xe5 \xf1\xe5\xec"
b"\xfc\xe8 \xef\xee\xf5\xee\xe6\xe8 \xe4\xf0\xf3\xe3 \xed\xe0 \xe4"
b"\xf0\xf3\xe3\xe0"
likely benign
LLM, confidence 0.93
A Windows-1251 Cyrillic text sample passed to the detector in a benchmark.
Reasoning
The bytes literal is Russian text encoded in Windows-1251 (Cyrillic characters such as 'Счастливые' escaped as \xNN). This is a legitimate encoding-detection sample for a chardet benchmark, not a binary payload or obfuscated code.
-
identifier `і` contains homoglyph candidates: і (0456)→i (in string/comment) (raw pass, confidence 0.35)
"\u0456": "\u0438", "\u0406": "\u0418", "\u0491": "\u0433",
-
identifier `Н` contains homoglyph candidates: Н (041D)→H (in string/comment) (raw pass, confidence 0.35)
"\u045a": "\u043d", "\u040a": "\u041d", "\u045b": "\u0442", "\u040b": "\u0422",
-
identifier `Т` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)
"\u045b": "\u0442", "\u040b": "\u0422", "\u045f": "\u0446", "\u040f": "\u0426",
-
identifier `К` contains homoglyph candidates: К (041A)→K (in string/comment) (raw pass, confidence 0.35)
"\u045c": "\u043a", "\u040c": "\u041a", "\u0455": "\u0437", "\u0405": "\u0417",
-
identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)
_SERBIAN_CYRILLIC_TO_GAJ: dict[str, str] = {
"\u0430": "a", "\u0431": "b", "\u0432": "v",
-
identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)
"\u0452": "đ", "\u0435": "e", "\u0436": "ž", "\u0437": "z",
-
identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)
"\u043d": "n", "\u043e": "o", "\u043f": "p", "\u0440": "r",
-
identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)
"\u043f": "p", "\u0440": "r", "\u0441": "s", "\u0442": "t",
-
identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)
"\u0440": "r", "\u0441": "s", "\u0442": "t", "\u045b": "ć",
-
identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)
"\u045b": "ć", "\u0443": "u", "\u0444": "f", "\u0445": "h",
-
identifier `х` contains homoglyph candidates: х (0445)→x (in string/comment) (raw pass, confidence 0.35)
"\u0444": "f", "\u0445": "h", "\u0446": "c", "\u0447": "č",
-
identifier `А` contains homoglyph candidates: А (0410)→A (in string/comment) (raw pass, confidence 0.35)
"\u0448": "š", "\u0410": "A", "\u0411": "B", "\u0412": "V",
-
identifier `В` contains homoglyph candidates: В (0412)→B (in string/comment) (raw pass, confidence 0.35)
"\u0411": "B", "\u0412": "V", "\u0413": "G", "\u0414": "D",
-
identifier `Е` contains homoglyph candidates: Е (0415)→E (in string/comment) (raw pass, confidence 0.35)
"\u0402": "Đ", "\u0415": "E", "\u0416": "Ž", "\u0417": "Z",
-
identifier `К` contains homoglyph candidates: К (041A)→K (in string/comment) (raw pass, confidence 0.35)
"\u0408": "J", "\u041a": "K", "\u041b": "L", "\u041c": "M",
-
identifier `М` contains homoglyph candidates: М (041C)→M (in string/comment) (raw pass, confidence 0.35)
"\u041b": "L", "\u041c": "M", "\u041d": "N", "\u041e": "O",
-
identifier `Н` contains homoglyph candidates: Н (041D)→H (in string/comment) (raw pass, confidence 0.35)
"\u041c": "M", "\u041d": "N", "\u041e": "O", "\u041f": "P",
-
identifier `О` contains homoglyph candidates: О (041E)→O (in string/comment) (raw pass, confidence 0.35)
"\u041d": "N", "\u041e": "O", "\u041f": "P", "\u0420": "R",
-
identifier `Р` contains homoglyph candidates: Р (0420)→P (in string/comment) (raw pass, confidence 0.35)
"\u041f": "P", "\u0420": "R", "\u0421": "S", "\u0422": "T",
-
identifier `С` contains homoglyph candidates: С (0421)→C (in string/comment) (raw pass, confidence 0.35)
"\u0420": "R", "\u0421": "S", "\u0422": "T", "\u040b": "Ć",
-
identifier `Т` contains homoglyph candidates: Т (0422)→T (in string/comment) (raw pass, confidence 0.35)
"\u0421": "S", "\u0422": "T", "\u040b": "Ć", "\u0423": "U",
-
identifier `Х` contains homoglyph candidates: Х (0425)→X (in string/comment) (raw pass, confidence 0.35)
"\u0424": "F", "\u0425": "H", "\u0426": "C", "\u0427": "Č",
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `η` contains homoglyph candidates: η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `μεγαλύτερη` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `μεγαλύτερη` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
data = (
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
modern = chardet.detect(
-
identifier `μακρά` contains homoglyph candidates: α (03B1)→a, κ (03BA)→k, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
modern = chardet.detect(
-
identifier `μακρά` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7")
modern = chardet.detect(
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `η` contains homoglyph candidates: η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μεγαλύτερη` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, η (03B7)→n (in string/comment) (raw pass, confidence 0.35)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μεγαλύτερη` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
(
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `Η` contains homoglyph candidates: Η (0397)→H (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μακρά` contains homoglyph candidates: α (03B1)→a, κ (03BA)→k, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
identifier `μακρά` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
"Η Αθήνα είναι η πρωτεύουσα και μεγαλύτερη πόλη της Ελλάδας. "
"Η πόλη έχει μακρά ιστορία που εκτείνεται πάνω από τρεις χιλιετίες."
).encode("iso-8859-7"),
-
concatenated bytes literal contains 435 `\xNN` escapes (95% of content) — binary payload shape (ast pass, confidence 0.85)
CYRILLIC_WIN1251 = (
b"\xc2\xf1\xe5 \xf1\xf7\xe0\xf1\xf2\xeb\xe8\xe2\xfb\xe5 \xf1\xe5\xec"
b"\xfc\xe8 \xef\xee\xf5\xee\xe6\xe8 \xe4\xf0\xf3\xe3 \xed\xe0 \xe4\xf0"
b"\xf3\xe3\xe0, \xea\xe0\xe6\xe4\xe0\xff \xed\xe5\xf1\xf7\xe0\xf1\xf2"
likely benign
LLM, confidence 0.93
A Windows-1251 Cyrillic text fixture in a benchmark test.
Reasoning
This is a bytes constant holding Windows-1251 Cyrillic text split across concatenated literals, the normal way to write encoded test fixtures for an encoding detector. The high escape ratio reflects non-ASCII text, not a payload.
-
base64-like blob (64 bytes, compression ratio 1.06) (raw pass, confidence 0.60)
b"MIICpDCCAYwCCQDU+pQ4pHgSpDANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls\n"
b"b2NhbGhvc3QwHhcNMjMwNTI5MTI0ODQ3WhcNMjQwNTI4MTI0ODQ3WjAUMRIwEAYD\n"
b"VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+\n"
b"7e1RRz+BI/kHMBbOz+FN5bEwMmJ2KKQGXN+yTDaj8bKRMqgJ7MJifi3eFmFnqYg\n"
likely benign
LLM, confidence 0.93
A base64-encoded localhost PEM certificate in a test fixture.
Reasoning
The base64 lines form a PEM certificate for localhost in a test of escape handling. Test certificate data is an expected artifact, and the raw pass flagged it only because it looks like base64.
-
base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
b"b2NhbGhvc3QwHhcNMjMwNTI5MTI0ODQ3WhcNMjQwNTI4MTI0ODQ3WjAUMRIwEAYD\n"
b"VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+\n"
b"7e1RRz+BI/kHMBbOz+FN5bEwMmJ2KKQGXN+yTDaj8bKRMqgJ7MJifi3eFmFnqYg\n"
b"-----END CERTIFICATE-----\n"
likely benign
LLM, confidence 0.93
Continuation of a base64 PEM certificate test fixture.
Reasoning
This is a continuation of the same PEM certificate test fixture, ending in its END CERTIFICATE line. It is ordinary test data with no execution or hiding behavior.
-
concatenated bytes literal contains 34 `\xNN` escapes (99% of content) — binary payload shape (ast pass, confidence 0.85)
_assert_detection(
b"\x841\x953" b"\xce\xd2\xc3\xbb\xd3\xd0\xc2\xf1\xd4\xb9\xa3\xac"
b"\xb4\xe8\xc5\xe8\xb5\xc4\xd6\xbb\xca\xc7\xd2\xbb"
likely benign
LLM, confidence 0.94
A GB18030-encoded Chinese text fixture in a regression test.
Reasoning
The bytes literal is GB18030 and Chinese text, explicitly commented as the GB18030 encoding of U+FEFF, passed to a detection assertion. It is a regression test for a reported encoding issue and not a hidden payload.
-
identifier `καλημέρα` contains homoglyph candidates: κ (03BA)→k, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)
("cp866", "вода"),
("iso-8859-7", "καλημέρα"),
("windows-1253", "ευχαριστώ πολύ"),
("windows-1255", "תודה רבה"),
-
identifier `καλημέρα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
("cp866", "вода"),
("iso-8859-7", "καλημέρα"),
("windows-1253", "ευχαριστώ πολύ"),
("windows-1255", "תודה רבה"),
-
identifier `Все` contains homoglyph candidates: В (0412)→B, с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)
_PRUNING_SAMPLES = [
"Все счастливые семьи похожи друг на друга, каждая несчастливая семья "
"несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
-
identifier `Все` contains homoglyph candidates: В (0412)→B, с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)
"несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
"что муж был в связи с бывшею в их доме француженкою-гувернанткой.".encode(
"windows-1251"
-
identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)
"несчастлива по-своему. Все смешалось в доме Облонских. Жена узнала, "
"что муж был в связи с бывшею в их доме француженкою-гувернанткой.".encode(
"windows-1251"
),
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.