chardet 7.7.0

Source: https://github.com/chardet/chardet
Artifact scanned: chardet-7.7.0-py3-none-any.whl (wheel · 690.1 KB · SHA-256 11cf9b719ea3…)
Compared with: chardet-7.6.0-py3-none-any.whl (1 signals introduced since)
Files: 33 scanned, 10 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 3.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 08:09

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload chardet/models/_format.py:63:14 new in this release

file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    expected_size = num_models * 65536
    decomp = zlib.decompressobj()
    models: dict[str, bytes] = {}
    table = bytearray()
```
likely benign LLM, confidence 0.85 chardet's model-format loader decompresses bundled encoding-model data with zlib into a bytes table.
Reasoning
The snippet shows a model-loading routine: it computes an expected size from num_models times 65536, creates a zlib decompressobj, and fills a dict of model bytes and a table. chardet ships compressed language-model data and must decompress it to detect encodings, so this is a plausible legitimate pattern. The snippet does not show the payload being executed, only decompressed into data, and the finding is an ast-pass signal that only flags the decompress call itself. Some doubt remains because the surrounding code isn't visible.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o chardet-7.7.0-py3-none-any.whl https://files.pythonhosted.org/packages/cc/75/88a3eb36264375ff951bd2f9397c409727ab6aa6a18e1bd933851571d421/chardet-7.7.0-py3-none-any.whl
printf '%s  %s\n' 11cf9b719ea3675a2a7d8a3071bbe4d7ea24b26bfe39a51588d515ddd05cacad chardet-7.7.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q chardet-7.7.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg