PyPI / charset-normalizer / 3.5.2

charset-normalizer 3.5.2

Source
https://github.com/jawah/charset_normalizer
Tag scanned
3.5.2
Compared with
3.5.1 (0 signals introduced since)
Files
74 scanned, 11 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 99 info
Scan time
32.9 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 36 of 36 warn and critical signals; 36 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-21 20:20

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line README.md:58:1

    line length 2368 characters (raw pass, confidence 0.65)

    [^2]: Chardet 7 replaced the historical LGPL-licensed implementation with an AI-assisted rewrite, initially distributed under MIT and later under 0BSD. The original author [contests](https://github.com/chardet/chardet/issues/327) that the rewrite was sufficiently independent to permit relicensing, while Chardet's maint
    likely benign LLM, confidence 0.95 A long footnote paragraph in a README about the Chardet library's relicensing history.
    Reasoning

    A long markdown footnote line about the Chardet licensing dispute is prose, not code. Long lines in documentation are a weak raw-pass signal with no obfuscation or malicious content.

  2. info unicode-invisible bin/bc.py:91:19

    U+FE0F VARIATION SELECTOR-16 (invisible payload carrier) in source (in string/comment) (raw pass, confidence 0.54)

                print(
                    f"⟨U+FE0F⟩✅ ⟨U+FE0F⟩'{tbt_path}' (got '{charset_normalizer_encoding}' but "
                    f"eq {chardet_encoding} WITH {round(calc_eq * 100.0, 3)} %)"
                )
  3. info unicode-invisible bin/bc.py:91:26

    U+FE0F VARIATION SELECTOR-16 (invisible payload carrier) in source (in string/comment) (raw pass, confidence 0.54)

                print(
                    f"⟨U+FE0F⟩✅ ⟨U+FE0F⟩'{tbt_path}' (got '{charset_normalizer_encoding}' but "
                    f"eq {chardet_encoding} WITH {round(calc_eq * 100.0, 3)} %)"
                )
  4. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:2:4

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (raw pass, confidence 0.70)

    1. Bсеки човек има право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование. Hачалното образование трябва да бъде зад
    likely benign LLM, confidence 0.70 A Bulgarian sample text containing a Latin 'B' and a Cyrillic 'с' in one word.
    Reasoning

    The file is a Bulgarian prose sample. The Latin lookalike letter in 'Bсеки' appears in running text, not in code or an identifier. The pattern looks like a deliberately seeded homoglyph test fixture, which is more plausibly a scanner test corpus than an attack.

  5. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:2:4

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    1. Bсеки човек има право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование. Hачалното образование трябва да бъде зад
    likely benign LLM, confidence 0.70 Same word as the prior finding, flagged for mixing Latin and Cyrillic scripts.
    Reasoning

    This is the mixed-script companion to the same word in a Bulgarian prose sample. The mixing is real, but it sits in running text in a data file, which weakens any attack reading.

  6. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:2:72

    identifier `Oбразованието` contains homoglyph candidates: р (0440)→p, а (0430)→a, о (043E)→o, а (0430)→a (raw pass, confidence 0.70)

    право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование. Hачалното образование трябва да бъде задължително. Tехнич
    likely benign LLM, confidence 0.70 A Bulgarian sample sentence with a Latin 'O' substituted into a Cyrillic word.
    Reasoning

    'Oбразованието' is a sentence-initial word in Bulgarian prose with a Latin 'O' in place of Cyrillic. This looks like a seeded homoglyph test fixture in a sample data file, not executable code.

  7. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:2:72

    identifier `Oбразованието` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование. Hачалното образование трябва да бъде задължително. Tехнич
    likely benign LLM, confidence 0.70 Same word as the prior finding, flagged for mixing Latin and Cyrillic scripts.
    Reasoning

    This is the mixed-script companion to the 'Oбразованието' prose finding. It is a text sample, not an identifier in code, so the risk is low.

  8. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:2:247

    identifier `Hачалното` contains homoglyph candidates: а (0430)→a, а (0430)→a, о (043E)→o, о (043E)→o (raw pass, confidence 0.70)

    �новното образование. Hачалното образование трябва да бъде задължително. Tехническото и професионалното образование трябва да бъдат общодостъпни, а висшето образование тря… (340 bytes total)
    likely benign LLM, confidence 0.70 A Bulgarian sample sentence with multiple Latin lookalike letters in a Cyrillic word.
    Reasoning

    'Hачалното' is a Bulgarian prose word with a Latin 'H' substituted, repeated across several letters. This looks like a deliberately seeded homoglyph test sample rather than an attack payload.

  9. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:2:247

    identifier `Hачалното` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    �новното образование. Hачалното образование трябва да бъде задължително. Tехническото и професионалното образование трябва да бъдат общодостъпни, а висшето образование тря… (340 bytes total)
    likely benign LLM, confidence 0.70 Same word as the prior finding, flagged for mixing Latin and Cyrillic scripts.
    Reasoning

    This is the mixed-script companion to the 'Hачалното' prose finding, in a text sample with no code execution context.

  10. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:2:341

    identifier `Tехническото` contains homoglyph candidates: е (0435)→e, х (0445)→x, е (0435)→e, с (0441)→c (raw pass, confidence 0.70)

    да бъде задължително. Tехническото и професионалното образование трябва да бъдат общодостъпни, а висшето образование трябва да бъде еднакво достъпно за всички на основата на
    likely benign LLM, confidence 0.70 A Bulgarian sample sentence with several Latin lookalike letters in a Cyrillic word.
    Reasoning

    'Tехническото' is Bulgarian prose with a Latin 'T' and Latin 'e', 'x', 'c' letters mixed in. The pattern is consistent with a seeded test fixture in a sample text file, not a code-level deception.

  11. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:2:341

    identifier `Tехническото` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    да бъде задължително. Tехническото и професионалното образование трябва да бъдат общодостъпни, а висшето образование трябва да бъде еднакво достъпно за всички на основата на
    likely benign LLM, confidence 0.70 Same word as the prior finding, flagged for mixing Latin and Cyrillic scripts.
    Reasoning

    This is the mixed-script companion to the 'Tехническото' prose finding, in a text sample with no executable context.

  12. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:3:4

    identifier `Oбразованието` contains homoglyph candidates: р (0440)→p, а (0430)→a, о (043E)→o, а (0430)→a (raw pass, confidence 0.70)

    2. Oбразованието трябва да бъде насочено към цялостно развитие на човешката личност и заcилване на уважението към правата на човека и основните свободи. Tо трябва да съдейства … (340 bytes total)
    likely benign LLM, confidence 0.70 A second Bulgarian sample line with a Latin 'O' in a Cyrillic word.
    Reasoning

    'Oбразованието' on line 3 is a repeat of the homoglyph pattern in the same Bulgarian sample text. It is prose in a data file, consistent with a seeded test fixture.

  13. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:3:4

    identifier `Oбразованието` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    2. Oбразованието трябва да бъде насочено към цялостно развитие на човешката личност и заcилване на уважението към правата на човека и основните свободи. Tо трябва да съдейства … (340 bytes total)
    likely benign LLM, confidence 0.80 Bulgarian prose sentence in a data text file where the word 'Oбразованието' has a Latin O in place of a Cyrillic letter.
    Reasoning

    A raw-pass mixed-script flag on a Latin 'O' inside a Bulgarian word in a plain-text data file. This is natural-language prose, not code, so nothing executes and no identifier is being hidden. Such stray Latin lookalikes are typical of copy-paste or typing artifacts, and the raw pass has a high false-positive rate.

  14. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:3:157

    identifier `заcилване` contains homoglyph candidates: а (0430)→a, а (0430)→a, е (0435)→e (raw pass, confidence 0.70)

    а човешката личност и заcилване на уважението към правата на човека и основните свободи. Tо трябва да съдейства за разбирателството, тъпримостта и приятелството между всички … (340 bytes total)
    likely benign LLM, confidence 0.80 Bulgarian text in which the word 'заcилване' contains Latin lookalike letters.
    Reasoning

    Raw homoglyph flag on Latin 'a' and 'c' mixed into a Bulgarian word in running text. There is no code, identifier binding or execution path here, so the lookalike characters have no way to hide behaviour. The pattern fits a typo or a test fixture.

  15. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:3:157

    identifier `заcилване` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)

    а човешката личност и заcилване на уважението към правата на човека и основните свободи. Tо трябва да съдейства за разбирателството, тъпримостта и приятелството между всички … (340 bytes total)
    likely benign LLM, confidence 0.80 Second signal for the same mixed Cyrillic/Latin word 'заcилване' in the Bulgarian text.
    Reasoning

    Same word and same underlying lookalike characters as the homoglyph finding at this position, reported again as a mixed-script signal. It is a duplicate with no separate evidence.

  16. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:3:279

    identifier `Tо` contains homoglyph candidates: о (043E)→o (raw pass, confidence 0.70)

    � и основните свободи. Tо трябва да съдейства за разбирателството, тъпримостта и приятелството между всички народи, расови или религиозни групи, както и за осъществяване дейн… (341 bytes total)
    likely benign LLM, confidence 0.80 Bulgarian sentence where 'Tо' contains a Cyrillic о mixed with a Latin T.
    Reasoning

    A Latin 'o' in the Bulgarian word 'Tо' in plain prose. The text is a human-rights article in a .txt data file with no executable context, so this is a lookalike typo rather than an obfuscated identifier.

  17. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:3:279

    identifier `Tо` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    � и основните свободи. Tо трябва да съдейства за разбирателството, тъпримостта и приятелството между всички народи, расови или религиозни групи, както и за осъществяване дейн… (341 bytes total)
    likely benign LLM, confidence 0.80 Second mixed-script signal for the 'Tо' token in the Bulgarian text.
    Reasoning

    Duplicate mixed-script signal for the same 'Tо' token. It adds no independent evidence.

  18. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:3:573

    identifier `Oрганизацията` contains homoglyph candidates: р (0440)→p, а (0430)→a, а (0430)→a, а (0430)→a (raw pass, confidence 0.70)

    �твяване дейността на Oрганизацията на Oбединените нации за поддържане на мира.⟨U+000D⟩
    likely benign LLM, confidence 0.80 Bulgarian text where 'Oрганизацията' mixes a Latin O with Cyrillic letters, as in the phrase about the United Nations.
    Reasoning

    Several lookalike letters inside 'Oрганизацията' and related words, in running prose. The file is non-code text, so there is no identifier to exploit. The pattern matches a document typed or pasted with mixed keyboard layouts.

  19. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:3:573

    identifier `Oрганизацията` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    �твяване дейността на Oрганизацията на Oбединените нации за поддържане на мира.⟨U+000D⟩
    likely benign LLM, confidence 0.80 Second mixed-script signal for 'Oрганизацията' in the Bulgarian text.
    Reasoning

    Duplicate mixed-script signal for the same 'Oрганизацията' token, with no new evidence.

  20. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:3:604

    identifier `Oбединените` contains homoglyph candidates: е (0435)→e, е (0435)→e, е (0435)→e (raw pass, confidence 0.70)

    �а на Oрганизацията на Oбединените нации за поддържане на мира.⟨U+000D⟩
    likely benign LLM, confidence 0.80 Bulgarian text where 'Oбединените' contains a Latin O and Cyrillic е characters.
    Reasoning

    Lookalike Cyrillic 'е' characters mixed with a Latin 'O' in 'Oбединените', within a plain-text Bulgarian sentence. Nothing here is code or an identifier that could be bound or executed.

  21. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:3:604

    identifier `Oбединените` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    �а на Oрганизацията на Oбединените нации за поддържане на мира.⟨U+000D⟩
    likely benign LLM, confidence 0.80 Second mixed-script signal for 'Oбединените' in the Bulgarian text.
    Reasoning

    Duplicate mixed-script signal for the same 'Oбединените' token.

  22. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:4:4

    identifier `Pодителите` contains homoglyph candidates: о (043E)→o, е (0435)→e, е (0435)→e (raw pass, confidence 0.70)

    3. Pодителите имат право, с приоритет, да избират вида образование, което да получат техните деца.⟨U+000D⟩
    Член 27
    likely benign LLM, confidence 0.80 Bulgarian text where 'Pодителите' starts with a Latin P before Cyrillic letters.
    Reasoning

    A Latin 'P' mixed with Cyrillic letters in 'Pодителите' at the start of an article in a plain-text data file. The lookalike characters are harmless here and match a typing or copy artifact.

  23. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:4:4

    identifier `Pодителите` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    3. Pодителите имат право, с приоритет, да избират вида образование, което да получат техните деца.⟨U+000D⟩
    Член 27
    likely benign LLM, confidence 0.80 Second mixed-script signal for 'Pодителите' in the Bulgarian text.
    Reasoning

    Duplicate mixed-script signal for the same 'Pодителите' token.

  24. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:6:4

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (raw pass, confidence 0.70)

    1. Bсеки човек има право свободно да участва в културния живот на обществото, да се наслаждава на изкуствата, да участва в научния напредък и да се ползва от неговите достижения
    likely benign LLM, confidence 0.85 A Bulgarian sample sentence in a text data file has a Latin B mixed with Cyrillic letters.
    Reasoning

    Raw-pass homoglyph flag on a Latin 'B' fused with Cyrillic 'еки' inside a Bulgarian sample sentence in a data file. The token is prose inside a text sample, not an identifier that runs code, and the mix looks like a typo or test-fixture artifact. No execution or concealment purpose is visible.

  25. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:6:4

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    1. Bсеки човек има право свободно да участва в културния живот на обществото, да се наслаждава на изкуствата, да участва в научния напредък и да се ползва от неговите достижения
    likely benign LLM, confidence 0.85 The same Latin-plus-Cyrillic token in the Bulgarian sample sentence.
    Reasoning

    Same mixed-script observation as the homoglyph finding on the same token. It is a prose sample in a data file, so the script mix is most likely an authoring or fixture artifact rather than obfuscation.

  26. info warn → info by review unicode-homoglyph data/sample-bulgarian.txt:7:4

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (raw pass, confidence 0.70)

    2. Bсеки човек има право на закрила на моралните и материалните си интереси, които са резултат от каквото и да е научно, литературно или художествено произведение, на което той … (340 bytes total)
    likely benign LLM, confidence 0.85 A second Bulgarian sample sentence with the same Latin B mixed into a Cyrillic word.
    Reasoning

    Repeat of the same Latin B / Cyrillic mix in the second sentence of a Bulgarian text sample. It appears in running prose, so it reads as a sample-data quirk, not a code identifier.

  27. info warn → info by review unicode-mixed-script data/sample-bulgarian.txt:7:4

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    2. Bсеки човек има право на закрила на моралните и материалните си интереси, които са резултат от каквото и да е научно, литературно или художествено произведение, на което той … (340 bytes total)
    likely benign LLM, confidence 0.85 The same Latin-plus-Cyrillic token in the second Bulgarian sample sentence.
    Reasoning

    Mixed-script flag on the same token as the homoglyph finding. Prose in a text sample, not a sensitive identifier.

  28. line length 569 characters (raw pass, confidence 0.50)

    � �������� �������� �� ������� ������ ������� 12 ������������ ��������, ������ ���� ������ ��� ���� �����. �������� ����… (339 bytes total)
  29. info long-line data/sample-greek.txt:1:1

    line length 569 characters (raw pass, confidence 0.50)

    � �������� �������� �� ������� ������ ������� 12 ������������ ��������, ������ ���� ������ ��� ���� �����. �������� ����… (339 bytes total)
  30. info warn → info by review unicode-zero-width data/sample-polish.txt:2:2

    U+FEFF ZERO WIDTH NO-BREAK SPACE (BOM) in source (raw pass, confidence 0.75)

    "source";"target"⟨U+000D⟩
    "⟨U+FEFF⟩REF.-2";"POLISH"⟨U+000D⟩
    "KW-P00-01";"SYSTEM VIDEODOMOFONOWY MEET"⟨U+000D⟩
    "KW-P00-02";"URZĄDZENIE"
    dismissed LLM, confidence 0.93 A BOM precedes the first field of a Polish CSV data file.
    Reasoning

    A UTF-8 byte order mark at the start of a semicolon-separated CSV is a common Excel/export artifact. It is harmless and does not conceal logic or code.

  31. line length 503 characters (raw pass, confidence 0.50)

    ������ 1895 �. ������� �������� ������ � ���������, ����� ����� ������������� �������� � ������ ����������� ������� (�����… (341 bytes total)
  32. info warn → info by review unicode-homoglyph docs/user/advanced_search.rst:11:20

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (raw pass, confidence 0.70)

    
        my_byte_str = 'Bсеки човек има право на образование.'.encode('cp1251')
    
        results = from_bytes(
    likely benign LLM, confidence 0.85 A docs example encodes a Bulgarian string literal containing a mixed Latin/Cyrillic word.
    Reasoning

    In reStructuredText docs, a Python example encodes a Bulgarian sentence with cp1251. The homoglyph sits inside a string literal used to demonstrate encoding detection, not in an identifier. The Latin/Cyrillic mix is likely a documentation example artifact.

  33. info warn → info by review unicode-mixed-script docs/user/advanced_search.rst:11:20

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    
        my_byte_str = 'Bсеки човек има право на образование.'.encode('cp1251')
    
        results = from_bytes(
    likely benign LLM, confidence 0.85 The same mixed-script token in the docs example string.
    Reasoning

    Mixed-script observation on the same docs string literal. It is a demonstration string in a charset-detection example, so this is not evidence of obfuscation.

  34. info warn → info by review unicode-homoglyph docs/user/handling_result.rst:9:20

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (raw pass, confidence 0.70)

    
        my_byte_str = 'Bсеки човек има право на образование.'.encode('cp1251')
    
        # Assign return value so we can fully exploit result
    likely benign LLM, confidence 0.85 A tutorial example repeats the mixed Latin/Cyrillic Bulgarian string literal.
    Reasoning

    The same docs example string appears in a result-handling tutorial. The mixed script sits inside a demonstration literal, so it reads as a sample-text artifact.

  35. info warn → info by review unicode-mixed-script docs/user/handling_result.rst:9:20

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    
        my_byte_str = 'Bсеки човек има право на образование.'.encode('cp1251')
    
        # Assign return value so we can fully exploit result
    likely benign LLM, confidence 0.85 The same mixed-script token in the tutorial example string.
    Reasoning

    Mixed-script flag on the same tutorial string literal. It is an example value with no execution or concealment role.

  36. info warn → info by review unicode-homoglyph docs/user/miscellaneous.rst:12:20

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (raw pass, confidence 0.70)

    
        my_byte_str = 'Bсеки човек има право на образование.'.encode('cp1251')
    
        # Assign return value so we can fully exploit result
    likely benign LLM, confidence 0.85 A miscellaneous docs example repeats the mixed-script Bulgarian literal.
    Reasoning

    Another docs example with the same Bulgarian sample literal, used to show encoding behavior. The homoglyph is inside a string and reflects sample-text authoring.

  37. info warn → info by review unicode-mixed-script docs/user/miscellaneous.rst:12:20

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    
        my_byte_str = 'Bсеки човек има право на образование.'.encode('cp1251')
    
        # Assign return value so we can fully exploit result
    likely benign LLM, confidence 0.85 The same mixed-script token in the miscellaneous docs example.
    Reasoning

    Mixed-script flag on the same docs example literal. It is an illustrative string, not an identifier used to hide code.

  38. info warn → info by review unicode-homoglyph docs/user/miscellaneous.rst:19:26

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (raw pass, confidence 0.70)

    
        # This should print 'Bсеки човек има право на образование.'
        print(str(result))
    likely benign LLM, confidence 0.85 A docs comment shows expected printed output containing the mixed-script Bulgarian string.
    Reasoning

    A comment and print call in the docs show the expected printed output. The homoglyph is in a comment-quoted string, so it is documentation text, not executable obfuscation.

  39. info warn → info by review unicode-mixed-script docs/user/miscellaneous.rst:19:26

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

    
        # This should print 'Bсеки човек има право на образование.'
        print(str(result))
    likely benign LLM, confidence 0.85 The same mixed-script token in the docs comment.
    Reasoning

    Mixed-script flag on the same comment text in the docs. It is prose in a comment, not code that conceals intent.

  40. info warn → info by review unicode-homoglyph docs/user/new_encoding.rst:40:40

    identifier `А` contains homoglyph candidates: А (0410)→A (raw pass, confidence 0.70)

        # Example: remap bytes 0x80-0x83 to specific characters
        DECODING_TABLE[0x80] = "\u0410"  # А (Cyrillic)
        DECODING_TABLE[0x81] = "\u0411"  # Б
        DECODING_TABLE[0x82] = "\u0412"  # В
    likely benign LLM, confidence 0.90 Documentation example showing a byte-to-Cyrillic-character mapping in an encoding table.
    Reasoning

    The file is RST documentation explaining an encoding example. The Cyrillic letter appears inside a string literal escape and a comment illustrating a byte-to-character mapping, not as an identifier used to hide code. The homoglyph finding is a raw-pass false positive from documentation prose.

  41. info warn → info by review unicode-homoglyph docs/user/new_encoding.rst:42:40

    identifier `В` contains homoglyph candidates: В (0412)→B (raw pass, confidence 0.70)

        DECODING_TABLE[0x81] = "\u0411"  # Б
        DECODING_TABLE[0x82] = "\u0412"  # В
        DECODING_TABLE[0x83] = "\u0413"  # Г
    likely benign LLM, confidence 0.90 Documentation example mapping another byte to a Cyrillic character in an illustrative decoding table.
    Reasoning

    Same documentation context: the Cyrillic В appears in an illustrative table entry and comment within an RST doc about a new encoding. No executable identifier is being spoofed, so this is a benign example rather than obfuscation.

  42. identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

       >>> from charset_normalizer import from_bytes
       >>> results = from_bytes('Bсеки човек има право на образование. Oбразованието!'.encode('utf_8'))
       >>> best_guess = results.best()
       >>> str(best_guess)
  43. info unicode-mixed-script src/charset_normalizer/__init__.py:11:30

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

       >>> from charset_normalizer import from_bytes
       >>> results = from_bytes('Bсеки човек има право на образование. Oбразованието!'.encode('utf_8'))
       >>> best_guess = results.best()
       >>> str(best_guess)
  44. identifier `Oбразованието` contains homoglyph candidates: р (0440)→p, а (0430)→a, о (043E)→o, а (0430)→a (in string/comment) (raw pass, confidence 0.35)

       >>> from charset_normalizer import from_bytes
       >>> results = from_bytes('Bсеки човек има право на образование. Oбразованието!'.encode('utf_8'))
       >>> best_guess = results.best()
       >>> str(best_guess)
  45. info unicode-mixed-script src/charset_normalizer/__init__.py:11:98

    identifier `Oбразованието` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

       >>> from charset_normalizer import from_bytes
       >>> results = from_bytes('Bсеки човек има право на образование. Oбразованието!'.encode('utf_8'))
       >>> best_guess = results.best()
       >>> str(best_guess)
  46. identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

       >>> str(best_guess)
       'Bсеки човек има право на образование. Oбразованието!'
    
    Others methods and usages are available - see the full documentation
  47. info unicode-mixed-script src/charset_normalizer/__init__.py:14:5

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

       >>> str(best_guess)
       'Bсеки човек има право на образование. Oбразованието!'
    
    Others methods and usages are available - see the full documentation
  48. identifier `Oбразованието` contains homoglyph candidates: р (0440)→p, а (0430)→a, о (043E)→o, а (0430)→a (in string/comment) (raw pass, confidence 0.35)

       >>> str(best_guess)
       'Bсеки човек има право на образование. Oбразованието!'
    
    Others methods and usages are available - see the full documentation
  49. info unicode-mixed-script src/charset_normalizer/__init__.py:14:73

    identifier `Oбразованието` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

       >>> str(best_guess)
       'Bсеки човек има право на образование. Oбразованието!'
    
    Others methods and usages are available - see the full documentation
  50. identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)

        "Russian": [
            "о",
            "е",
            "а",
  51. identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "о",
            "е",
            "а",
            "и",
  52. identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

            "е",
            "а",
            "и",
            "н",
  53. identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

            "т",
            "с",
            "р",
            "в",
  54. identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

            "с",
            "р",
            "в",
            "л",
  55. identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)

            "п",
            "у",
            "г",
            "я",
  56. identifier `х` contains homoglyph candidates: х (0445)→x (in string/comment) (raw pass, confidence 0.35)

            "ч",
            "х",
            "ж",
            "ц",
  57. identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)

        "Ukrainian": [
            "о",
            "а",
            "н",
  58. identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

            "о",
            "а",
            "н",
            "і",
  59. identifier `і` contains homoglyph candidates: і (0456)→i (in string/comment) (raw pass, confidence 0.35)

            "н",
            "і",
            "и",
            "р",
  60. identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

            "и",
            "р",
            "в",
            "т",
  61. identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "т",
            "е",
            "с",
            "к",
  62. identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

            "е",
            "с",
            "к",
            "л",
  63. identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)

            "л",
            "у",
            "д",
            "м",
  64. identifier `х` contains homoglyph candidates: х (0445)→x (in string/comment) (raw pass, confidence 0.35)

            "ч",
            "х",
            "ц",
            "ї",
  65. identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

        "Serbian": [
            "а",
            "и",
            "о",
  66. identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)

            "и",
            "о",
            "е",
            "н",
  67. identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "о",
            "е",
            "н",
            "р",
  68. identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

            "н",
            "р",
            "с",
            "у",
  69. identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

            "р",
            "с",
            "у",
            "т",
  70. identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)

            "с",
            "у",
            "т",
            "к",
  71. identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

        "Bulgarian": [
            "а",
            "и",
            "о",
  72. identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)

            "и",
            "о",
            "е",
            "н",
  73. identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "о",
            "е",
            "н",
            "т",
  74. identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

            "т",
            "р",
            "с",
            "в",
  75. identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

            "р",
            "с",
            "в",
            "л",
  76. identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)

            "ъ",
            "у",
            "б",
            "ч",
  77. identifier `х` contains homoglyph candidates: х (0445)→x (in string/comment) (raw pass, confidence 0.35)

            "щ",
            "х",
        ],
        "Croatian": [
  78. identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

        "Greek": [
            "α",
            "τ",
            "ο",
  79. identifier `ο` contains homoglyph candidates: ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

            "τ",
            "ο",
            "ι",
            "ε",
  80. identifier `ν` contains homoglyph candidates: ν (03BD)→v (in string/comment) (raw pass, confidence 0.35)

            "ε",
            "ν",
            "ρ",
            "σ",
  81. identifier `ρ` contains homoglyph candidates: ρ (03C1)→p (in string/comment) (raw pass, confidence 0.35)

            "ν",
            "ρ",
            "σ",
            "κ",
  82. identifier `κ` contains homoglyph candidates: κ (03BA)→k (in string/comment) (raw pass, confidence 0.35)

            "σ",
            "κ",
            "η",
            "π",
  83. identifier `η` contains homoglyph candidates: η (03B7)→n (in string/comment) (raw pass, confidence 0.35)

            "κ",
            "η",
            "π",
            "ς",
  84. identifier `а` contains homoglyph candidates: а (0430)→a (in string/comment) (raw pass, confidence 0.35)

        "Kazakh": [
            "а",
            "ы",
            "е",
  85. identifier `е` contains homoglyph candidates: е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "ы",
            "е",
            "н",
            "т",
  86. identifier `р` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

            "т",
            "р",
            "л",
            "і",
  87. identifier `і` contains homoglyph candidates: і (0456)→i (in string/comment) (raw pass, confidence 0.35)

            "л",
            "і",
            "д",
            "с",
  88. identifier `с` contains homoglyph candidates: с (0441)→c (in string/comment) (raw pass, confidence 0.35)

            "д",
            "с",
            "м",
            "қ",
  89. identifier `о` contains homoglyph candidates: о (043E)→o (in string/comment) (raw pass, confidence 0.35)

            "к",
            "о",
            "б",
            "и",
  90. identifier `у` contains homoglyph candidates: у (0443)→y (in string/comment) (raw pass, confidence 0.35)

            "и",
            "у",
            "ғ",
            "ж",
  91. info unicode-homoglyph tests/test_base_detection.py:171:10

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "Bсеки човек има право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование.".encode(),
  92. info unicode-mixed-script tests/test_base_detection.py:171:10

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

            "Bсеки човек има право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование.".encode(),
  93. info unicode-homoglyph tests/test_base_detection.py:171:78

    identifier `Oбразованието` contains homoglyph candidates: р (0440)→p, а (0430)→a, о (043E)→o, а (0430)→a (in string/comment) (raw pass, confidence 0.35)

            "Bсеки човек има право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование.".encode(),
  94. info unicode-mixed-script tests/test_base_detection.py:171:78

    identifier `Oбразованието` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

            "Bсеки човек има право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование.".encode(),
  95. info unicode-homoglyph tests/test_base_detection.py:171:165

    identifier `се` contains homoglyph candidates: с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "Bсеки човек има право на образование. Oбразованието трябва да бъде безплатно, поне що се отнася до началното и основното образование.".encode(),
  96. info unicode-homoglyph tests/test_base_detection.py:172:10

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

            "Bсеки човек има право на образование.".encode(),
            "(° ͜ʖ °), creepy face, smiley 😀".encode(),
            """["Financiën", "La France"]""".encode(),
  97. info unicode-mixed-script tests/test_base_detection.py:172:10

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

            "Bсеки човек има право на образование.".encode(),
            "(° ͜ʖ °), creepy face, smiley 😀".encode(),
            """["Financiën", "La France"]""".encode(),
  98. info unicode-homoglyph tests/test_base_detection.py:249:10

    identifier `Bсеки` contains homoglyph candidates: с (0441)→c, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

        best_guess = from_bytes(
            "Bсеки човек има право на образование.".encode("cp1251")
        ).best()
  99. info unicode-mixed-script tests/test_base_detection.py:249:10

    identifier `Bсеки` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

        best_guess = from_bytes(
            "Bсеки човек има право на образование.".encode("cp1251")
        ).best()

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/jawah/charset_normalizer charset_normalizer && cd charset_normalizer
git checkout 3.5.2
disclude scan --severity info --diff 3.5.1 .