coverage 7.16.2

Source: https://github.com/coveragepy/coveragepy
Tag scanned: 7.16.2
Compared with: 7.16.1 (0 signals introduced since)
Files: 261 scanned, 35 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 71 info
Scan time: 31.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 43 of 43 warn and critical signals; 43 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution .github/workflows/python-nightly.yml:74:11

[embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
          curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
```
likely benign LLM, confidence 0.80 CI step that curls the pyenv installer script and pipes it into bash.
Reasoning
A CI workflow step downloads the pyenv installer from its official GitHub repo and pipes it to bash. This is a common, if risky, bootstrap pattern, and the snippet shows no obfuscation or hidden payload. Pinning or checksum verification would be better practice.
info ~~warn~~ → info by review dynamic-execution coverage/bytecode.py:27:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            assert text is not None
            code = compile(text, filename or "<string>", "exec", dont_inherit=True)
        self.code = code
```
likely benign LLM, confidence 0.90 compile() of source text inside coverage's bytecode helper.
Reasoning
compile() here turns source text read by coverage's own bytecode tooling into a code object. That is the expected behaviour of a coverage/analysis library, not a hidden payload.
info ~~warn~~ → info by review frame-introspection coverage/collector.py:289:9

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        # Remove ourselves as the trace function.
        sys.settrace(None)
        # Install the real tracer.
        fn: TTraceFn | None = self._start_tracer()
```
likely benign LLM, confidence 0.95 Coverage collector resetting the Python trace function.
Reasoning
sys.settrace(None) removes coverage's own trace function before installing the real tracer. This is standard tracer management for a coverage tool.
info ~~warn~~ → info by review frame-introspection coverage/debug.py:101:27

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
        if self.should("self"):
            caller_self = inspect.stack()[1][0].f_locals.get("self")
            if caller_self is not None:
                self.output.write(f"self: {caller_self!r}\n")
```
likely benign LLM, confidence 0.95 Debug-trace helper reading the caller's frame to log 'self'.
Reasoning
inspect.stack() is used to report the caller's self object in coverage's debug output. This is diagnostic logging, not malicious introspection.
info ~~warn~~ → info by review frame-introspection coverage/debug.py:276:42

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    stack: Iterable[inspect.FrameInfo] = inspect.stack()[:skip:-1]
    if not full:
        for pat in BORING_PRELUDE:
```
likely benign LLM, confidence 0.95 Debug helper capturing the call stack for logging.
Reasoning
inspect.stack() is used to build a filtered stack for coverage's debug output, with boring prelude frames skipped. This is diagnostic code.
info ~~critical~~ → info by review frame-introspection coverage/execfile.py:115:24

`inspect.stack` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
            # don't know what's going on, and just leave it alone.
            top_file = inspect.stack()[-1][0].f_code.co_filename
            sys_path_0_abs = os.path.abspath(sys.path[0])
            top_file_dir_abs = os.path.abspath(os.path.dirname(top_file))
```
likely benign LLM, confidence 0.90 execfile logic that finds the top-level script file via stack inspection.
Reasoning
The critical severity comes from co-occurrence with exec/sys.exit, but the code is coverage's logic for resolving the top-level script path so it can run user code like `python -m`. The anti-analysis shape is a false positive from a legitimate runner.
info ~~warn~~ → info by review decoder-import-with-exec coverage/execfile.py:222:13

file imports decoder module(s) marshal and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        try:
            exec(code, main_mod.__dict__)
        except SystemExit:  # pylint: disable=try-except-raise
            # The user called sys.exit().  Just pass it along to the upper
```
likely benign LLM, confidence 0.93 Runs the user's target script via exec within a module namespace.
Reasoning
exec of the user's program code in its own __dict__ is the core purpose of coverage's run command. The surrounding code handles SystemExit, which is normal.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:222:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(code, main_mod.__dict__)
        except SystemExit:  # pylint: disable=try-except-raise
            # The user called sys.exit().  Just pass it along to the upper
```
likely benign LLM, confidence 0.90 Same exec of the user's program code, flagged a second time.
Reasoning
This is the same exec call as the previous finding, flagged by the dynamic-execution signal. It runs the user's program, which is expected for coverage's execfile module.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:307:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    code = compile(source, filename, mode="exec", dont_inherit=True)
    return code
```
likely benign LLM, confidence 0.90 compile() of the user's script source before execution.
Reasoning
compile() of the source of a user-run file with dont_inherit is how coverage prepares a script for execution. This matches the expected runner design.
info ~~warn~~ → info by review dynamic-execution coverage/execfile.py:335:16

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        # The rest of the file is the code object we want.
        code = marshal.load(fpyc)
        assert isinstance(code, CodeType)
```
likely benign LLM, confidence 0.85 Loads a cached .pyc code object for the script being run.
Reasoning
marshal.load reads the code object from a .pyc file for the script being run, followed by an isinstance(CodeType) check. This is the standard way to execute a cached bytecode file, and it is only a risk for untrusted .pyc inputs.
info ~~warn~~ → info by review dynamic-execution coverage/parser.py:691:30

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            if node.id in ["True", "False", "None", "__debug__"]:
                return True, eval(node.id)  # pylint: disable=eval-used
        case ast.UnaryOp():
            if isinstance(node.op, ast.Not):
```
likely benign LLM, confidence 0.95 eval restricted to constant names during AST constant evaluation.
Reasoning
eval is applied only to the literal names True, False, None, and __debug__, so it cannot execute arbitrary input. This is a constant-folding helper with a pylint suppression.
info ~~critical~~ → info by review dynamic-import coverage/plugin_support.py:45:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            self.current_module = module
            __import__(module)
            mod = sys.modules[module]
```
likely benign LLM, confidence 0.90 Dynamic import of a configured coverage plugin module by name.
Reasoning
__import__ loads a plugin module whose name comes from coverage's configuration, which is the documented plugin mechanism. The severity is critical only because of the dynamic import shape. Users control what gets loaded.
info ~~warn~~ → info by review frame-introspection coverage/pytracer.py:171:13

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
                    f = f.f_back
            sys.settrace(None)
            try:
                self.cur_file_data, self.cur_file_name, self.last_line, self.started_context = (
```
likely benign LLM, confidence 0.90 Coverage tracer temporarily disabling sys.settrace while walking frames.
Reasoning
sys.settrace(None) is used by coverage.py's tracer to disable tracing while it does internal bookkeeping; frame walking via f_back is standard for coverage tools. Legitimate.
info ~~warn~~ → info by review frame-introspection coverage/pytracer.py:337:9

`sys.settrace` — call-stack frame introspection (ast pass, confidence 0.70)
```
        sys.settrace(self._cached_bound_method_trace)
        return self._cached_bound_method_trace
```
likely benign LLM, confidence 0.90 Coverage tracer installs its cached trace method via sys.settrace.
Reasoning
Installing a cached bound method as the trace function is the normal mechanism of a Python coverage tracer.
info ~~warn~~ → info by review decoder-decompress-payload coverage/sqldata.py:451:18

file imports decoder module(s) base64, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            )
        script = zlib.decompress(data[1:]).decode("utf-8")
        self._dbs[threading.get_ident()] = db = SqliteDb(self._filename, self._debug, self._no_disk)
        with db:
```
likely benign LLM, confidence 0.85 Decompresses an internal SQL script via zlib to initialize the coverage SQLite database.
Reasoning
coverage.py stores SQL scripts zlib-compressed in the package and decompresses them to run schema setup for its SQLite data file. This is a known, documented-in-code design choice for a legitimate project; the payload is an SQL script for local coverage data, not a dropper. Still a compressed-payload pattern worth noting.
info ~~warn~~ → info by review frame-introspection coverage/sysmon.py:339:25

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            if disp is None:
                frame = inspect.currentframe()
                if frame is not None:
                    frame = inspect.currentframe().f_back  # type: ignore[union-attr]
```
likely benign LLM, confidence 0.90 Uses currentframe to locate the caller frame for coverage bookkeeping.
Reasoning
Frame inspection via inspect.currentframe().f_back is a routine debugging/introspection step in coverage's sys.monitoring backend.
info ~~warn~~ → info by review frame-introspection coverage/sysmon.py:341:29

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
                if frame is not None:
                    frame = inspect.currentframe().f_back  # type: ignore[union-attr]
                    if LOG:  # pragma: debugging
                        # @panopticon adds a frame.
```
likely benign LLM, confidence 0.90 Retrieves the parent frame in coverage's sys.monitoring code for logging.
Reasoning
Same benign frame lookup, guarded by debugging logic; no malicious use.
info ~~warn~~ → info by review dynamic-execution coverage/templite.py:70:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        global_namespace: dict[str, Any] = {}
        exec(python_source, global_namespace)
        return global_namespace
```
likely benign LLM, confidence 0.85 Template engine executes generated Python source via exec.
Reasoning
Templite is a template engine that compiles generated Python code with exec; the source is produced from templates within the library, so the non-literal exec is by design rather than hidden payload execution.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:419:61

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
(multi-string) A list of debug options.  See :ref:`the run -⟨U+200D⟩-debug option
<cmd_run_debug>` for details.
```
likely benign LLM, confidence 0.95 Invisible ZWJ character inside a documentation option name.
Reasoning
A zero-width joiner inside '--debug' in RST documentation is a stray invisible character that could affect rendering or search, but it is not a malicious payload. Likely accidental copy-paste from a formatted source.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:428:68

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
(string) A file name to write debug output to.  See :ref:`the run -⟨U+200D⟩-debug
option <cmd_run_debug>` for details.
```
likely benign LLM, confidence 0.95 Invisible ZWJ character in a doc cross-reference to the run debug option.
Reasoning
Same stray ZWJ in a documentation cross-reference; benign in context, a formatting artifact.
info ~~warn~~ → info by review unicode-zero-width doc/config.rst:697:24

U+200D ZERO WIDTH JOINER in source (raw pass, confidence 0.75)
```
The ``--debug=pathmap`` option can be used to log details of the re-mapping of
paths.  See :ref:`the -⟨U+200D⟩-debug option <cmd_run_debug>`.

See :ref:`cmd_combine_remapping` and :ref:`source_glob` for more information.
```
likely benign LLM, confidence 0.95 Invisible ZWJ character in documentation prose.
Reasoning
Same stray ZWJ within '--debug' documentation text; low risk, though it is worth cleaning up.
info ~~warn~~ → info by review dynamic-execution igor.py:335:20

`subprocess.getoutput` called with a literal shell command (ast pass, confidence 0.70)
```
    facts.now = datetime.datetime.now()
    facts.branch = subprocess.getoutput("git rev-parse --abbrev-ref @")
    facts.sha = subprocess.getoutput("git rev-parse @")
    return facts
```
likely benign LLM, confidence 0.90 Runs fixed git commands to record branch name in a dev helper script.
Reasoning
Fixed literal git commands used to gather build facts in a developer script; no external input is involved.
info ~~warn~~ → info by review dynamic-execution igor.py:336:17

`subprocess.getoutput` called with a literal shell command (ast pass, confidence 0.70)
```
    facts.branch = subprocess.getoutput("git rev-parse --abbrev-ref @")
    facts.sha = subprocess.getoutput("git rev-parse @")
    return facts
```
likely benign LLM, confidence 0.90 Runs a fixed git command to record the commit SHA.
Reasoning
Fixed literal git rev-parse command in a developer helper; benign.
info ~~warn~~ → info by review dynamic-attribute igor.py:507:19

reach-by-name through `globals.get` (ast pass, confidence 0.60)
```
        verb = args.pop(0)
        handler = globals().get("do_" + verb)
        if handler is None:
            print(f"*** No handler for {verb!r}")
```
likely benign LLM, confidence 0.90 Looks up a do_ handler function by command-line verb name.
Reasoning
Dispatches a developer CLI subcommand by looking up do_<verb> in globals; the verb comes from the local command line, so this is ordinary command dispatch.
info dynamic-execution lab/compare_times.sh:32:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)
```
$HYPERFINE 'python -m pytest test_file1.py'

echo "Coverage 4.5.4"
```

info dynamic-execution lab/compare_times.sh:36:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install -q coverage==4.5.4
$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:37:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:38:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:39:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Coverage 5.0a8, no contexts"

info dynamic-execution lab/compare_times.sh:43:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

pip install -q coverage==5.0a8
$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:44:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:45:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:46:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Coverage 5.0a8, with test contexts"

info dynamic-execution lab/compare_times.sh:54:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)


$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'

info dynamic-execution lab/compare_times.sh:55:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run -m pytest test_file1.py'
$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:56:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m coverage run --branch -m pytest test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

info dynamic-execution lab/compare_times.sh:57:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch test_file1.py'

echo "Pytest-cov contexts"

info dynamic-execution lab/compare_times.sh:62:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)


$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-context=test test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch --cov-context=test test_file1.py'

info dynamic-execution lab/compare_times.sh:63:1

command name is a variable (`$HYPERFINE`) that this file sets only to plain text (ast pass, confidence 0.40)

$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-context=test test_file1.py'
$HYPERFINE 'python -m pytest --cov=. --cov-report= --cov-branch --cov-context=test test_file1.py'

info ~~warn~~ → info by review dynamic-execution lab/hack_pyc.py:19:21

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        self.modtime = f.read(4)
        self.code = marshal.load(f)

    def write(self, f):
```
likely benign LLM, confidence 0.85 Loads Python bytecode from a pyc file in a lab utility.
Reasoning
marshal.load on a .pyc file is the expected way to read bytecode in a lab tool for editing pyc files. It is a known deserialization risk on untrusted input, but this is a local developer lab script rather than a supply-chain payload.
info ~~warn~~ → info by review dynamic-execution lab/parser.py:173:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    code = compile(text, "", "exec", dont_inherit=True)
    for code_obj in all_code_objects(code):
        if text:
```
likely benign LLM, confidence 0.80 compile() of a source text inside a lab parser helper that walks code objects.
Reasoning
The compile call on a variable string is a plain parser utility in a lab directory of a coverage tool. Nothing in the snippet suggests hidden or hostile execution.
info ~~critical~~ → info by review dynamic-execution lab/run_sysmon.py:12:8

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
code = compile(open(the_program, encoding="utf-8").read(), filename=the_program, mode="exec")

my_id = sys.monitoring.COVERAGE_ID
```
likely benign LLM, confidence 0.80 Developer harness compiles a program file named on the command line for sys.monitoring tracing.
Reasoning
Module-level compile of a program file named by a variable is a developer harness that runs a target script for sys.monitoring experiments. The file is a local lab script, not a dropper, though running on import is untidy.
info ~~critical~~ → info by review dynamic-execution lab/run_sysmon.py:119:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
exec(code)
```
likely benign LLM, confidence 0.80 Module-level exec running the compiled target program in the sysmon lab harness.
Reasoning
exec of code compiled from a local program file is the tail of the same lab harness. The source is user-chosen and local, so no remote payload path appears.
info ~~critical~~ → info by review dynamic-execution lab/run_trace.py:42:12

`compile` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
code = open(the_program, encoding="utf-8").read()
code_obj = compile(code, the_program, mode="exec")
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.80 Trace harness reads and compiles a target program file at module scope.
Reasoning
Reads a program file, compiles it and runs it under a trace function. This is a tracing harness for experiments; the input is a local file path.
info ~~critical~~ → info by review frame-introspection lab/run_trace.py:43:1

`sys.settrace` — call-stack frame introspection — file also calls `sys.exit`/`exec`/`eval` (anti-analysis shape) (ast pass, confidence 0.85)
```
code_obj = compile(code, the_program, mode="exec")
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.85 sys.settrace installs a trace function before running the compiled target.
Reasoning
sys.settrace is the standard mechanism for coverage-style tracing. Co-occurrence with exec is expected in a harness that runs a target under tracing, so the anti-analysis label is a false match here.
info ~~critical~~ → info by review dynamic-execution lab/run_trace.py:44:1

`exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)
```
sys.settrace(trace)
exec(code_obj)
```
likely benign LLM, confidence 0.80 exec of the compiled target program under the trace harness.
Reasoning
exec runs code compiled from a local file path, as part of the same tracing harness. No network source or decoding is involved.
info ~~warn~~ → info by review dynamic-execution lab/show_pyc.py:42:12

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        print("pysize %s (%d)" % (binascii.hexlify(size), struct.unpack("<L", size)[0]))
    code = marshal.load(f)
    show_code(code)
```
likely benign LLM, confidence 0.85 Bytecode viewer deserializes a .pyc file to display its code object.
Reasoning
marshal.load on a .pyc file being disassembled is the normal way a bytecode-inspection tool reads its input. The data comes from a user-supplied file, which is what the tool is for.
info ~~warn~~ → info by review decoder-import-with-exec lab/show_pyc.py:52:12

file imports decoder module(s) binascii, marshal and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
def show_py_text(text, fname="<string>"):
    code = compile(text, fname, "exec", dont_inherit=True)
    show_code(code)
```
likely benign LLM, confidence 0.85 Bytecode display tool that imports decoders and compiles source text to show its code.
Reasoning
The module imports binascii and marshal because it parses .pyc headers, and compile is used to show source text. The multi-stage label matches a legitimate disassembly tool.
info ~~warn~~ → info by review dynamic-execution lab/show_pyc.py:52:12

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
def show_py_text(text, fname="<string>"):
    code = compile(text, fname, "exec", dont_inherit=True)
    show_code(code)
```
likely benign LLM, confidence 0.85 compile() of user-supplied source text inside the pyc display tool.
Reasoning
compile of source text with a filename so it can be shown as a code object is a routine operation in a disassembly tool. The input is supplied by the user, not fetched from anywhere hidden.
info ~~warn~~ → info by review dynamic-execution setup.py:31:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        # Execute the code in version.py.
        exec(compile(version_file.read(), cov_ver_py, "exec", dont_inherit=True), module_globals)
    return module_globals
```
likely benign LLM, confidence 0.90 setup.py execs the compiled contents of version.py to read the package version.
Reasoning
This is the standard coverage.py pattern for executing version.py to read __version__ into module globals. It is local, known, and expected in setup.py.
info ~~warn~~ → info by review dynamic-execution setup.py:31:14

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        # Execute the code in version.py.
        exec(compile(version_file.read(), cov_ver_py, "exec", dont_inherit=True), module_globals)
    return module_globals
```
likely benign LLM, confidence 0.90 compile() of the local version.py source in setup.py.
Reasoning
The compile call is the inner half of the same version-reading idiom, applied to a file in the repository. This is normal packaging code.
info ~~critical~~ → info by review dynamic-execution tests/helpers.py:63:12

`subprocess.Popen` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
    proc = subprocess.Popen(
        cmd,
        shell=True,
```
likely benign LLM, confidence 0.75 Test helper runs a runtime-built command through a shell via subprocess.Popen.
Reasoning
A test helper runs a command string through the shell, which is a common test-utility pattern. The command is supplied by test code, not from untrusted input, but shell=True with a variable command deserves a look to confirm no external input reaches it.
info ~~warn~~ → info by review dynamic-execution tests/test_arcs.py:2456:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
            """)
        code_obj = compile(code, filename="hello.html", mode="exec")
        cov = coverage.Coverage(branch=True, debug=["trace"])
        with cov.collect():
```
likely benign LLM, confidence 0.90 Test compiles a small snippet so coverage can be measured on it.
Reasoning
Compiling an HTML-template snippet inside a branch-coverage test is ordinary test setup. It is part of the code under test, not a hidden payload.
info ~~warn~~ → info by review dynamic-execution tests/test_arcs.py:2459:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        with cov.collect():
            exec(code_obj)
```
likely benign LLM, confidence 0.90 Test executes its compiled snippet under coverage collection.
Reasoning
The exec runs the compiled test snippet inside cov.collect(), which is how coverage tests drive code. The code is fixed in the test file.
info ~~warn~~ → info by review dynamic-execution tests/test_cmdline.py:195:20

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        globs = {n: getattr(expected, n) for n in self.MOCK_GLOBALS}
        code_obj = compile(code, "<code>", "exec", dont_inherit=True)
        eval(code_obj, globs, {})  # pylint: disable=eval-used
```
likely benign LLM, confidence 0.90 Test helper compiles a code string to execute it with mocked globals.
Reasoning
compile of a test-supplied code string with pylint disable comment, in a test harness for command-line execution; the code is test fixture content, not obfuscated payload.
info ~~warn~~ → info by review dynamic-execution tests/test_cmdline.py:196:9

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        code_obj = compile(code, "<code>", "exec", dont_inherit=True)
        eval(code_obj, globs, {})  # pylint: disable=eval-used

        # Many of our functions take a lot of arguments, and cmdline.py
```
likely benign LLM, confidence 0.90 Test helper evals compiled code under mocked globals.
Reasoning
eval of the compiled test code object in a controlled namespace within a test file, explicitly annotated with pylint disable; a standard pattern for testing a command-line runner.

info unicode-mixed-script tests/test_config.py:95:33

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

            [tool.coverage.html]
            title = "tabblo & «ταБЬℓσ»"
            [tool.coverage.plugins.a_plugin]
            hello = "world"

info unicode-mixed-script tests/test_config.py:107:53

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        assert cov.config.precision == 3
        assert cov.config.html_title == "tabblo & «ταБЬℓσ»"
        assert cov.config.fail_under == 90.5
        assert cov.config.get_plugin_options("plugins.a_plugin") == {"hello": "world"}

info unicode-mixed-script tests/test_config.py:948:32

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)
```
            [html]
            title = tabblo & «ταБЬℓσ» # numbers
            """,
        )
```

info unicode-mixed-script tests/test_config.py:955:53

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        assert cov.config.exclude_list == ["first", "✘weirdo", "third"]
        assert cov.config.html_title == "tabblo & «ταБЬℓσ» # numbers"

    @pytest.mark.parametrize("bad_file", ["nosuchfile.txt", "."])

info ~~warn~~ → info by review frame-introspection tests/test_context.py:243:13

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """Helper to return qualname_from_frame for the caller."""
    stack = inspect.stack()[1:]
    if any(sinfo[0].f_code.co_name == "get_qualname" for sinfo in stack):
        # We're calling ourselves recursively, maybe because we're testing
```
likely benign LLM, confidence 0.90 Test helper inspects the call stack to detect recursion when computing qualnames.
Reasoning
inspect.stack used to detect recursive calls in a test helper for qualname resolution; frame introspection is legitimate for this purpose and the snippet shows no malicious use.

info unicode-mixed-script tests/test_html.py:450:58

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        self.create_initial_files()
        self.make_file(".coveragerc", "[html]\ntitle = «ταБЬℓσ» numbers")
        self.run_coverage()
        index = self.get_html_index_content()

info unicode-mixed-script tests/test_html.py:459:50

identifier `ταБЬℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

        self.make_file(".coveragerc", "[html]\ntitle = Good title\n")
        self.run_coverage(htmlargs=dict(title="«ταБЬℓσ» & stüff!"))
        index = self.get_html_index_content()
        expected = (

info unicode-mixed-script tests/test_html.py:1402:28

identifier `ʎd` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)


            upside_down = "ʎd˙ǝbɐɹǝʌoɔ"
            surrogate = "db40,dd00: x@"
            """.replace("@", surrogate),

info unicode-mixed-script tests/test_html.py:1402:33

identifier `ǝbɐɹǝʌoɔ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)


            upside_down = "ʎd˙ǝbɐɹǝʌoɔ"
            surrogate = "db40,dd00: x@"
            """.replace("@", surrogate),

info unicode-mixed-script tests/test_mixins.py:54:49

identifier `ταБℓσ` mixes scripts: Greek + Cyrillic + Other (in string/comment) (raw pass, confidence 0.40)

    def test_make_file_non_ascii(self) -> None:
        self.make_file("unicode.txt", "tablo: «ταБℓσ»")
        with open("unicode.txt", "rb") as f:
            text = f.read()

info ~~critical~~ → info by review dynamic-import tests/test_python.py:40:15

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
        # Run the code to see that we really got it encoded properly.
        mod = __import__("encoded_" + encoding)
        assert mod.encoding == encoding
```
likely benign LLM, confidence 0.85 Test imports an encoded test module by constructed name to verify encoding handling.
Reasoning
Dynamic import of a module named by a fixed prefix plus encoding name, used to verify encoded source files in a test. Critical severity is overstated; the import target is a test-controlled name in a test suite.

info unicode-mixed-script tests/test_templite.py:325:24

identifier `ollǝɥ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

        self.try_render(
            "{{where}} ollǝɥ",
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",

info unicode-mixed-script tests/test_templite.py:326:24

identifier `ǝɹǝɥʇ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)

            "{{where}} ollǝɥ",
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )

info unicode-mixed-script tests/test_templite.py:327:14

identifier `ǝɹǝɥʇ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )
```
info unicode-mixed-script tests/test_templite.py:327:25

identifier `ollǝɥ` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
            {"where": "ǝɹǝɥʇ"},
            "ǝɹǝɥʇ ollǝɥ",
        )
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/coveragepy/coveragepy coveragepy && cd coveragepy
git checkout 7.16.2
disclude scan --severity info --diff 7.16.1 .